OpenShell/sdk/go/proto/openshellv1/openshell.pb.go

// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.11
// 	protoc        (unknown)
// source: openshell.proto

package openshellv1

import (
	datamodelv1 "github.com/NVIDIA/OpenShell/sdk/go/proto/datamodelv1"
	_ "github.com/NVIDIA/OpenShell/sdk/go/proto/optionsv1"
	sandboxv1 "github.com/NVIDIA/OpenShell/sdk/go/proto/sandboxv1"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	durationpb "google.golang.org/protobuf/types/known/durationpb"
	structpb "google.golang.org/protobuf/types/known/structpb"
	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

type ExtensionKind int32

const (
	ExtensionKind_EXTENSION_KIND_UNSPECIFIED           ExtensionKind = 0
	ExtensionKind_EXTENSION_KIND_COMPUTE_DRIVER        ExtensionKind = 1
	ExtensionKind_EXTENSION_KIND_CREDENTIAL_DRIVER     ExtensionKind = 2
	ExtensionKind_EXTENSION_KIND_GATEWAY_INTERCEPTOR   ExtensionKind = 3
	ExtensionKind_EXTENSION_KIND_SUPERVISOR_MIDDLEWARE ExtensionKind = 4
)

// Enum value maps for ExtensionKind.
var (
	ExtensionKind_name = map[int32]string{
		0: "EXTENSION_KIND_UNSPECIFIED",
		1: "EXTENSION_KIND_COMPUTE_DRIVER",
		2: "EXTENSION_KIND_CREDENTIAL_DRIVER",
		3: "EXTENSION_KIND_GATEWAY_INTERCEPTOR",
		4: "EXTENSION_KIND_SUPERVISOR_MIDDLEWARE",
	}
	ExtensionKind_value = map[string]int32{
		"EXTENSION_KIND_UNSPECIFIED":           0,
		"EXTENSION_KIND_COMPUTE_DRIVER":        1,
		"EXTENSION_KIND_CREDENTIAL_DRIVER":     2,
		"EXTENSION_KIND_GATEWAY_INTERCEPTOR":   3,
		"EXTENSION_KIND_SUPERVISOR_MIDDLEWARE": 4,
	}
)

func (x ExtensionKind) Enum() *ExtensionKind {
	p := new(ExtensionKind)
	*p = x
	return p
}

func (x ExtensionKind) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ExtensionKind) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[0].Descriptor()
}

func (ExtensionKind) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[0]
}

func (x ExtensionKind) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ExtensionKind.Descriptor instead.
func (ExtensionKind) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{0}
}

// High-level sandbox lifecycle phase derived by the gateway.
//
// Clients should rely on this normalized lifecycle summary for readiness and
// deletion decisions instead of interpreting raw conditions.
type SandboxPhase int32

const (
	SandboxPhase_SANDBOX_PHASE_UNSPECIFIED  SandboxPhase = 0
	SandboxPhase_SANDBOX_PHASE_PROVISIONING SandboxPhase = 1
	SandboxPhase_SANDBOX_PHASE_READY        SandboxPhase = 2
	SandboxPhase_SANDBOX_PHASE_ERROR        SandboxPhase = 3
	SandboxPhase_SANDBOX_PHASE_DELETING     SandboxPhase = 4
	SandboxPhase_SANDBOX_PHASE_UNKNOWN      SandboxPhase = 5
	SandboxPhase_SANDBOX_PHASE_STOPPING     SandboxPhase = 6
	SandboxPhase_SANDBOX_PHASE_STOPPED      SandboxPhase = 7
	SandboxPhase_SANDBOX_PHASE_STARTING     SandboxPhase = 8
	// The canonical main process exited successfully and its result is final.
	SandboxPhase_SANDBOX_PHASE_COMPLETED SandboxPhase = 9
)

// Enum value maps for SandboxPhase.
var (
	SandboxPhase_name = map[int32]string{
		0: "SANDBOX_PHASE_UNSPECIFIED",
		1: "SANDBOX_PHASE_PROVISIONING",
		2: "SANDBOX_PHASE_READY",
		3: "SANDBOX_PHASE_ERROR",
		4: "SANDBOX_PHASE_DELETING",
		5: "SANDBOX_PHASE_UNKNOWN",
		6: "SANDBOX_PHASE_STOPPING",
		7: "SANDBOX_PHASE_STOPPED",
		8: "SANDBOX_PHASE_STARTING",
		9: "SANDBOX_PHASE_COMPLETED",
	}
	SandboxPhase_value = map[string]int32{
		"SANDBOX_PHASE_UNSPECIFIED":  0,
		"SANDBOX_PHASE_PROVISIONING": 1,
		"SANDBOX_PHASE_READY":        2,
		"SANDBOX_PHASE_ERROR":        3,
		"SANDBOX_PHASE_DELETING":     4,
		"SANDBOX_PHASE_UNKNOWN":      5,
		"SANDBOX_PHASE_STOPPING":     6,
		"SANDBOX_PHASE_STOPPED":      7,
		"SANDBOX_PHASE_STARTING":     8,
		"SANDBOX_PHASE_COMPLETED":    9,
	}
)

func (x SandboxPhase) Enum() *SandboxPhase {
	p := new(SandboxPhase)
	*p = x
	return p
}

func (x SandboxPhase) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (SandboxPhase) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[1].Descriptor()
}

func (SandboxPhase) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[1]
}

func (x SandboxPhase) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use SandboxPhase.Descriptor instead.
func (SandboxPhase) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{1}
}

// Operation whose installed authority is tracked by a receipt.
type ProviderMutationKind int32

const (
	ProviderMutationKind_PROVIDER_MUTATION_KIND_UNSPECIFIED ProviderMutationKind = 0
	ProviderMutationKind_PROVIDER_MUTATION_KIND_ATTACH      ProviderMutationKind = 1
	ProviderMutationKind_PROVIDER_MUTATION_KIND_DETACH      ProviderMutationKind = 2
	ProviderMutationKind_PROVIDER_MUTATION_KIND_UPDATE      ProviderMutationKind = 3
	// Reconstructed status for existing desired state without a mutation receipt.
	ProviderMutationKind_PROVIDER_MUTATION_KIND_OBSERVE ProviderMutationKind = 4
)

// Enum value maps for ProviderMutationKind.
var (
	ProviderMutationKind_name = map[int32]string{
		0: "PROVIDER_MUTATION_KIND_UNSPECIFIED",
		1: "PROVIDER_MUTATION_KIND_ATTACH",
		2: "PROVIDER_MUTATION_KIND_DETACH",
		3: "PROVIDER_MUTATION_KIND_UPDATE",
		4: "PROVIDER_MUTATION_KIND_OBSERVE",
	}
	ProviderMutationKind_value = map[string]int32{
		"PROVIDER_MUTATION_KIND_UNSPECIFIED": 0,
		"PROVIDER_MUTATION_KIND_ATTACH":      1,
		"PROVIDER_MUTATION_KIND_DETACH":      2,
		"PROVIDER_MUTATION_KIND_UPDATE":      3,
		"PROVIDER_MUTATION_KIND_OBSERVE":     4,
	}
)

func (x ProviderMutationKind) Enum() *ProviderMutationKind {
	p := new(ProviderMutationKind)
	*p = x
	return p
}

func (x ProviderMutationKind) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ProviderMutationKind) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[2].Descriptor()
}

func (ProviderMutationKind) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[2]
}

func (x ProviderMutationKind) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ProviderMutationKind.Descriptor instead.
func (ProviderMutationKind) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{2}
}

// Readiness states describe persisted intent separately from installed state.
type ProviderReadinessState int32

const (
	ProviderReadinessState_PROVIDER_READINESS_STATE_UNSPECIFIED ProviderReadinessState = 0
	ProviderReadinessState_PROVIDER_READINESS_STATE_PERSISTED   ProviderReadinessState = 1
	ProviderReadinessState_PROVIDER_READINESS_STATE_PENDING     ProviderReadinessState = 2
	ProviderReadinessState_PROVIDER_READINESS_STATE_READY       ProviderReadinessState = 3
	ProviderReadinessState_PROVIDER_READINESS_STATE_WITHHELD    ProviderReadinessState = 4
	ProviderReadinessState_PROVIDER_READINESS_STATE_REVOKED     ProviderReadinessState = 5
	ProviderReadinessState_PROVIDER_READINESS_STATE_FAILED      ProviderReadinessState = 6
	ProviderReadinessState_PROVIDER_READINESS_STATE_SUPERSEDED  ProviderReadinessState = 7
)

// Enum value maps for ProviderReadinessState.
var (
	ProviderReadinessState_name = map[int32]string{
		0: "PROVIDER_READINESS_STATE_UNSPECIFIED",
		1: "PROVIDER_READINESS_STATE_PERSISTED",
		2: "PROVIDER_READINESS_STATE_PENDING",
		3: "PROVIDER_READINESS_STATE_READY",
		4: "PROVIDER_READINESS_STATE_WITHHELD",
		5: "PROVIDER_READINESS_STATE_REVOKED",
		6: "PROVIDER_READINESS_STATE_FAILED",
		7: "PROVIDER_READINESS_STATE_SUPERSEDED",
	}
	ProviderReadinessState_value = map[string]int32{
		"PROVIDER_READINESS_STATE_UNSPECIFIED": 0,
		"PROVIDER_READINESS_STATE_PERSISTED":   1,
		"PROVIDER_READINESS_STATE_PENDING":     2,
		"PROVIDER_READINESS_STATE_READY":       3,
		"PROVIDER_READINESS_STATE_WITHHELD":    4,
		"PROVIDER_READINESS_STATE_REVOKED":     5,
		"PROVIDER_READINESS_STATE_FAILED":      6,
		"PROVIDER_READINESS_STATE_SUPERSEDED":  7,
	}
)

func (x ProviderReadinessState) Enum() *ProviderReadinessState {
	p := new(ProviderReadinessState)
	*p = x
	return p
}

func (x ProviderReadinessState) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ProviderReadinessState) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[3].Descriptor()
}

func (ProviderReadinessState) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[3]
}

func (x ProviderReadinessState) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ProviderReadinessState.Descriptor instead.
func (ProviderReadinessState) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{3}
}

// Closed reason categories are safe to display. Raw installation errors are
// never part of the readiness protocol.
type ProviderReadinessReason int32

const (
	ProviderReadinessReason_PROVIDER_READINESS_REASON_UNSPECIFIED               ProviderReadinessReason = 0
	ProviderReadinessReason_PROVIDER_READINESS_REASON_WAITING_FOR_SUPERVISOR    ProviderReadinessReason = 1
	ProviderReadinessReason_PROVIDER_READINESS_REASON_WAITING_FOR_CREDENTIALS   ProviderReadinessReason = 2
	ProviderReadinessReason_PROVIDER_READINESS_REASON_WAITING_FOR_POLICY        ProviderReadinessReason = 3
	ProviderReadinessReason_PROVIDER_READINESS_REASON_WAITING_FOR_PROCESS       ProviderReadinessReason = 4
	ProviderReadinessReason_PROVIDER_READINESS_REASON_UNSUPPORTED_SUPERVISOR    ProviderReadinessReason = 5
	ProviderReadinessReason_PROVIDER_READINESS_REASON_CREDENTIALS_WITHHELD      ProviderReadinessReason = 6
	ProviderReadinessReason_PROVIDER_READINESS_REASON_CREDENTIAL_INSTALL_FAILED ProviderReadinessReason = 7
	ProviderReadinessReason_PROVIDER_READINESS_REASON_POLICY_ACTIVATION_FAILED  ProviderReadinessReason = 8
	ProviderReadinessReason_PROVIDER_READINESS_REASON_PROCESS_INSTALL_FAILED    ProviderReadinessReason = 9
	ProviderReadinessReason_PROVIDER_READINESS_REASON_SUPERVISOR_DISCONNECTED   ProviderReadinessReason = 10
	ProviderReadinessReason_PROVIDER_READINESS_REASON_SUPERVISOR_LEASE_EXPIRED  ProviderReadinessReason = 11
	ProviderReadinessReason_PROVIDER_READINESS_REASON_DESIRED_STATE_CHANGED     ProviderReadinessReason = 12
	ProviderReadinessReason_PROVIDER_READINESS_REASON_CREDENTIAL_EXPIRED        ProviderReadinessReason = 13
	ProviderReadinessReason_PROVIDER_READINESS_REASON_LOCAL_POLICY              ProviderReadinessReason = 14
	ProviderReadinessReason_PROVIDER_READINESS_REASON_SNAPSHOT_MISMATCH         ProviderReadinessReason = 15
)

// Enum value maps for ProviderReadinessReason.
var (
	ProviderReadinessReason_name = map[int32]string{
		0:  "PROVIDER_READINESS_REASON_UNSPECIFIED",
		1:  "PROVIDER_READINESS_REASON_WAITING_FOR_SUPERVISOR",
		2:  "PROVIDER_READINESS_REASON_WAITING_FOR_CREDENTIALS",
		3:  "PROVIDER_READINESS_REASON_WAITING_FOR_POLICY",
		4:  "PROVIDER_READINESS_REASON_WAITING_FOR_PROCESS",
		5:  "PROVIDER_READINESS_REASON_UNSUPPORTED_SUPERVISOR",
		6:  "PROVIDER_READINESS_REASON_CREDENTIALS_WITHHELD",
		7:  "PROVIDER_READINESS_REASON_CREDENTIAL_INSTALL_FAILED",
		8:  "PROVIDER_READINESS_REASON_POLICY_ACTIVATION_FAILED",
		9:  "PROVIDER_READINESS_REASON_PROCESS_INSTALL_FAILED",
		10: "PROVIDER_READINESS_REASON_SUPERVISOR_DISCONNECTED",
		11: "PROVIDER_READINESS_REASON_SUPERVISOR_LEASE_EXPIRED",
		12: "PROVIDER_READINESS_REASON_DESIRED_STATE_CHANGED",
		13: "PROVIDER_READINESS_REASON_CREDENTIAL_EXPIRED",
		14: "PROVIDER_READINESS_REASON_LOCAL_POLICY",
		15: "PROVIDER_READINESS_REASON_SNAPSHOT_MISMATCH",
	}
	ProviderReadinessReason_value = map[string]int32{
		"PROVIDER_READINESS_REASON_UNSPECIFIED":               0,
		"PROVIDER_READINESS_REASON_WAITING_FOR_SUPERVISOR":    1,
		"PROVIDER_READINESS_REASON_WAITING_FOR_CREDENTIALS":   2,
		"PROVIDER_READINESS_REASON_WAITING_FOR_POLICY":        3,
		"PROVIDER_READINESS_REASON_WAITING_FOR_PROCESS":       4,
		"PROVIDER_READINESS_REASON_UNSUPPORTED_SUPERVISOR":    5,
		"PROVIDER_READINESS_REASON_CREDENTIALS_WITHHELD":      6,
		"PROVIDER_READINESS_REASON_CREDENTIAL_INSTALL_FAILED": 7,
		"PROVIDER_READINESS_REASON_POLICY_ACTIVATION_FAILED":  8,
		"PROVIDER_READINESS_REASON_PROCESS_INSTALL_FAILED":    9,
		"PROVIDER_READINESS_REASON_SUPERVISOR_DISCONNECTED":   10,
		"PROVIDER_READINESS_REASON_SUPERVISOR_LEASE_EXPIRED":  11,
		"PROVIDER_READINESS_REASON_DESIRED_STATE_CHANGED":     12,
		"PROVIDER_READINESS_REASON_CREDENTIAL_EXPIRED":        13,
		"PROVIDER_READINESS_REASON_LOCAL_POLICY":              14,
		"PROVIDER_READINESS_REASON_SNAPSHOT_MISMATCH":         15,
	}
)

func (x ProviderReadinessReason) Enum() *ProviderReadinessReason {
	p := new(ProviderReadinessReason)
	*p = x
	return p
}

func (x ProviderReadinessReason) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ProviderReadinessReason) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[4].Descriptor()
}

func (ProviderReadinessReason) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[4]
}

func (x ProviderReadinessReason) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ProviderReadinessReason.Descriptor instead.
func (ProviderReadinessReason) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{4}
}

// Component whose desired state is tracked by a durable update operation.
type ConfigComponent int32

const (
	ConfigComponent_CONFIG_COMPONENT_UNSPECIFIED          ConfigComponent = 0
	ConfigComponent_CONFIG_COMPONENT_SANDBOX_CONFIG       ConfigComponent = 1
	ConfigComponent_CONFIG_COMPONENT_PROVIDER_ENVIRONMENT ConfigComponent = 2
)

// Enum value maps for ConfigComponent.
var (
	ConfigComponent_name = map[int32]string{
		0: "CONFIG_COMPONENT_UNSPECIFIED",
		1: "CONFIG_COMPONENT_SANDBOX_CONFIG",
		2: "CONFIG_COMPONENT_PROVIDER_ENVIRONMENT",
	}
	ConfigComponent_value = map[string]int32{
		"CONFIG_COMPONENT_UNSPECIFIED":          0,
		"CONFIG_COMPONENT_SANDBOX_CONFIG":       1,
		"CONFIG_COMPONENT_PROVIDER_ENVIRONMENT": 2,
	}
)

func (x ConfigComponent) Enum() *ConfigComponent {
	p := new(ConfigComponent)
	*p = x
	return p
}

func (x ConfigComponent) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ConfigComponent) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[5].Descriptor()
}

func (ConfigComponent) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[5]
}

func (x ConfigComponent) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ConfigComponent.Descriptor instead.
func (ConfigComponent) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{5}
}

// Result of applying a component revision at its owning runtime boundary.
type ConfigApplyOutcome int32

const (
	ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_UNSPECIFIED                     ConfigApplyOutcome = 0
	ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_APPLIED                         ConfigApplyOutcome = 1
	ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_IGNORED_DUPLICATE               ConfigApplyOutcome = 2
	ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_IGNORED_STALE                   ConfigApplyOutcome = 3
	ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_RETAINED_LOCAL_OVERRIDE         ConfigApplyOutcome = 4
	ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_DEGRADED                        ConfigApplyOutcome = 5
	ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_FAILED_RETAINED_LAST_KNOWN_GOOD ConfigApplyOutcome = 6
	ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_FAILED_CLOSED                   ConfigApplyOutcome = 7
	ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_UNSUPPORTED                     ConfigApplyOutcome = 8
)

// Enum value maps for ConfigApplyOutcome.
var (
	ConfigApplyOutcome_name = map[int32]string{
		0: "CONFIG_APPLY_OUTCOME_UNSPECIFIED",
		1: "CONFIG_APPLY_OUTCOME_APPLIED",
		2: "CONFIG_APPLY_OUTCOME_IGNORED_DUPLICATE",
		3: "CONFIG_APPLY_OUTCOME_IGNORED_STALE",
		4: "CONFIG_APPLY_OUTCOME_RETAINED_LOCAL_OVERRIDE",
		5: "CONFIG_APPLY_OUTCOME_DEGRADED",
		6: "CONFIG_APPLY_OUTCOME_FAILED_RETAINED_LAST_KNOWN_GOOD",
		7: "CONFIG_APPLY_OUTCOME_FAILED_CLOSED",
		8: "CONFIG_APPLY_OUTCOME_UNSUPPORTED",
	}
	ConfigApplyOutcome_value = map[string]int32{
		"CONFIG_APPLY_OUTCOME_UNSPECIFIED":                     0,
		"CONFIG_APPLY_OUTCOME_APPLIED":                         1,
		"CONFIG_APPLY_OUTCOME_IGNORED_DUPLICATE":               2,
		"CONFIG_APPLY_OUTCOME_IGNORED_STALE":                   3,
		"CONFIG_APPLY_OUTCOME_RETAINED_LOCAL_OVERRIDE":         4,
		"CONFIG_APPLY_OUTCOME_DEGRADED":                        5,
		"CONFIG_APPLY_OUTCOME_FAILED_RETAINED_LAST_KNOWN_GOOD": 6,
		"CONFIG_APPLY_OUTCOME_FAILED_CLOSED":                   7,
		"CONFIG_APPLY_OUTCOME_UNSUPPORTED":                     8,
	}
)

func (x ConfigApplyOutcome) Enum() *ConfigApplyOutcome {
	p := new(ConfigApplyOutcome)
	*p = x
	return p
}

func (x ConfigApplyOutcome) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ConfigApplyOutcome) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[6].Descriptor()
}

func (ConfigApplyOutcome) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[6]
}

func (x ConfigApplyOutcome) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ConfigApplyOutcome.Descriptor instead.
func (ConfigApplyOutcome) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{6}
}

// Durable lifecycle of one desired-state update operation.
type ConfigUpdateOperationState int32

const (
	ConfigUpdateOperationState_CONFIG_UPDATE_OPERATION_STATE_UNSPECIFIED ConfigUpdateOperationState = 0
	ConfigUpdateOperationState_CONFIG_UPDATE_OPERATION_STATE_PENDING     ConfigUpdateOperationState = 1
	ConfigUpdateOperationState_CONFIG_UPDATE_OPERATION_STATE_APPLIED     ConfigUpdateOperationState = 2
	ConfigUpdateOperationState_CONFIG_UPDATE_OPERATION_STATE_INACTIVE    ConfigUpdateOperationState = 3
	ConfigUpdateOperationState_CONFIG_UPDATE_OPERATION_STATE_FAILED      ConfigUpdateOperationState = 4
	ConfigUpdateOperationState_CONFIG_UPDATE_OPERATION_STATE_SUPERSEDED  ConfigUpdateOperationState = 5
	ConfigUpdateOperationState_CONFIG_UPDATE_OPERATION_STATE_CANCELLED   ConfigUpdateOperationState = 6
)

// Enum value maps for ConfigUpdateOperationState.
var (
	ConfigUpdateOperationState_name = map[int32]string{
		0: "CONFIG_UPDATE_OPERATION_STATE_UNSPECIFIED",
		1: "CONFIG_UPDATE_OPERATION_STATE_PENDING",
		2: "CONFIG_UPDATE_OPERATION_STATE_APPLIED",
		3: "CONFIG_UPDATE_OPERATION_STATE_INACTIVE",
		4: "CONFIG_UPDATE_OPERATION_STATE_FAILED",
		5: "CONFIG_UPDATE_OPERATION_STATE_SUPERSEDED",
		6: "CONFIG_UPDATE_OPERATION_STATE_CANCELLED",
	}
	ConfigUpdateOperationState_value = map[string]int32{
		"CONFIG_UPDATE_OPERATION_STATE_UNSPECIFIED": 0,
		"CONFIG_UPDATE_OPERATION_STATE_PENDING":     1,
		"CONFIG_UPDATE_OPERATION_STATE_APPLIED":     2,
		"CONFIG_UPDATE_OPERATION_STATE_INACTIVE":    3,
		"CONFIG_UPDATE_OPERATION_STATE_FAILED":      4,
		"CONFIG_UPDATE_OPERATION_STATE_SUPERSEDED":  5,
		"CONFIG_UPDATE_OPERATION_STATE_CANCELLED":   6,
	}
)

func (x ConfigUpdateOperationState) Enum() *ConfigUpdateOperationState {
	p := new(ConfigUpdateOperationState)
	*p = x
	return p
}

func (x ConfigUpdateOperationState) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ConfigUpdateOperationState) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[7].Descriptor()
}

func (ConfigUpdateOperationState) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[7]
}

func (x ConfigUpdateOperationState) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ConfigUpdateOperationState.Descriptor instead.
func (ConfigUpdateOperationState) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{7}
}

// Provider credential token grant configuration.
// When present, the credential is obtained dynamically via OAuth2 grant when needed.
type ProviderCredentialTokenGrantType int32

const (
	ProviderCredentialTokenGrantType_PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_UNSPECIFIED        ProviderCredentialTokenGrantType = 0
	ProviderCredentialTokenGrantType_PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_CLIENT_CREDENTIALS ProviderCredentialTokenGrantType = 1
	ProviderCredentialTokenGrantType_PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_TOKEN_EXCHANGE     ProviderCredentialTokenGrantType = 2
)

// Enum value maps for ProviderCredentialTokenGrantType.
var (
	ProviderCredentialTokenGrantType_name = map[int32]string{
		0: "PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_UNSPECIFIED",
		1: "PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_CLIENT_CREDENTIALS",
		2: "PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_TOKEN_EXCHANGE",
	}
	ProviderCredentialTokenGrantType_value = map[string]int32{
		"PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_UNSPECIFIED":        0,
		"PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_CLIENT_CREDENTIALS": 1,
		"PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_TOKEN_EXCHANGE":     2,
	}
)

func (x ProviderCredentialTokenGrantType) Enum() *ProviderCredentialTokenGrantType {
	p := new(ProviderCredentialTokenGrantType)
	*p = x
	return p
}

func (x ProviderCredentialTokenGrantType) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ProviderCredentialTokenGrantType) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[8].Descriptor()
}

func (ProviderCredentialTokenGrantType) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[8]
}

func (x ProviderCredentialTokenGrantType) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ProviderCredentialTokenGrantType.Descriptor instead.
func (ProviderCredentialTokenGrantType) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{8}
}

type ProviderCredentialRefreshStrategy int32

const (
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED                ProviderCredentialRefreshStrategy = 0
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC                     ProviderCredentialRefreshStrategy = 1
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL                   ProviderCredentialRefreshStrategy = 2
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN       ProviderCredentialRefreshStrategy = 3
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS  ProviderCredentialRefreshStrategy = 4
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT ProviderCredentialRefreshStrategy = 5
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE        ProviderCredentialRefreshStrategy = 6
)

// Enum value maps for ProviderCredentialRefreshStrategy.
var (
	ProviderCredentialRefreshStrategy_name = map[int32]string{
		0: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED",
		1: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC",
		2: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL",
		3: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN",
		4: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS",
		5: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT",
		6: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE",
	}
	ProviderCredentialRefreshStrategy_value = map[string]int32{
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED":                0,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC":                     1,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL":                   2,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN":       3,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS":  4,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT": 5,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE":        6,
	}
)

func (x ProviderCredentialRefreshStrategy) Enum() *ProviderCredentialRefreshStrategy {
	p := new(ProviderCredentialRefreshStrategy)
	*p = x
	return p
}

func (x ProviderCredentialRefreshStrategy) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ProviderCredentialRefreshStrategy) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[9].Descriptor()
}

func (ProviderCredentialRefreshStrategy) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[9]
}

func (x ProviderCredentialRefreshStrategy) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ProviderCredentialRefreshStrategy.Descriptor instead.
func (ProviderCredentialRefreshStrategy) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{9}
}

// Stable provider profile categories used by clients for grouping and filtering.
type ProviderProfileCategory int32

const (
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_UNSPECIFIED    ProviderProfileCategory = 0
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_OTHER          ProviderProfileCategory = 1
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE      ProviderProfileCategory = 2
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_AGENT          ProviderProfileCategory = 3
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL ProviderProfileCategory = 4
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_MESSAGING      ProviderProfileCategory = 5
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_DATA           ProviderProfileCategory = 6
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_KNOWLEDGE      ProviderProfileCategory = 7
)

// Enum value maps for ProviderProfileCategory.
var (
	ProviderProfileCategory_name = map[int32]string{
		0: "PROVIDER_PROFILE_CATEGORY_UNSPECIFIED",
		1: "PROVIDER_PROFILE_CATEGORY_OTHER",
		2: "PROVIDER_PROFILE_CATEGORY_INFERENCE",
		3: "PROVIDER_PROFILE_CATEGORY_AGENT",
		4: "PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL",
		5: "PROVIDER_PROFILE_CATEGORY_MESSAGING",
		6: "PROVIDER_PROFILE_CATEGORY_DATA",
		7: "PROVIDER_PROFILE_CATEGORY_KNOWLEDGE",
	}
	ProviderProfileCategory_value = map[string]int32{
		"PROVIDER_PROFILE_CATEGORY_UNSPECIFIED":    0,
		"PROVIDER_PROFILE_CATEGORY_OTHER":          1,
		"PROVIDER_PROFILE_CATEGORY_INFERENCE":      2,
		"PROVIDER_PROFILE_CATEGORY_AGENT":          3,
		"PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL": 4,
		"PROVIDER_PROFILE_CATEGORY_MESSAGING":      5,
		"PROVIDER_PROFILE_CATEGORY_DATA":           6,
		"PROVIDER_PROFILE_CATEGORY_KNOWLEDGE":      7,
	}
)

func (x ProviderProfileCategory) Enum() *ProviderProfileCategory {
	p := new(ProviderProfileCategory)
	*p = x
	return p
}

func (x ProviderProfileCategory) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ProviderProfileCategory) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[10].Descriptor()
}

func (ProviderProfileCategory) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[10]
}

func (x ProviderProfileCategory) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ProviderProfileCategory.Descriptor instead.
func (ProviderProfileCategory) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{10}
}

type ConfigurationAdmissionState int32

const (
	ConfigurationAdmissionState_CONFIGURATION_ADMISSION_STATE_UNSPECIFIED ConfigurationAdmissionState = 0
	ConfigurationAdmissionState_CONFIGURATION_ADMISSION_STATE_PENDING     ConfigurationAdmissionState = 1
	ConfigurationAdmissionState_CONFIGURATION_ADMISSION_STATE_ACCEPTED    ConfigurationAdmissionState = 2
	ConfigurationAdmissionState_CONFIGURATION_ADMISSION_STATE_REJECTED    ConfigurationAdmissionState = 3
)

// Enum value maps for ConfigurationAdmissionState.
var (
	ConfigurationAdmissionState_name = map[int32]string{
		0: "CONFIGURATION_ADMISSION_STATE_UNSPECIFIED",
		1: "CONFIGURATION_ADMISSION_STATE_PENDING",
		2: "CONFIGURATION_ADMISSION_STATE_ACCEPTED",
		3: "CONFIGURATION_ADMISSION_STATE_REJECTED",
	}
	ConfigurationAdmissionState_value = map[string]int32{
		"CONFIGURATION_ADMISSION_STATE_UNSPECIFIED": 0,
		"CONFIGURATION_ADMISSION_STATE_PENDING":     1,
		"CONFIGURATION_ADMISSION_STATE_ACCEPTED":    2,
		"CONFIGURATION_ADMISSION_STATE_REJECTED":    3,
	}
)

func (x ConfigurationAdmissionState) Enum() *ConfigurationAdmissionState {
	p := new(ConfigurationAdmissionState)
	*p = x
	return p
}

func (x ConfigurationAdmissionState) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ConfigurationAdmissionState) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[11].Descriptor()
}

func (ConfigurationAdmissionState) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[11]
}

func (x ConfigurationAdmissionState) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ConfigurationAdmissionState.Descriptor instead.
func (ConfigurationAdmissionState) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{11}
}

// Policy load status.
type PolicyStatus int32

const (
	PolicyStatus_POLICY_STATUS_UNSPECIFIED PolicyStatus = 0
	// Server received the update; sandbox has not yet loaded it.
	PolicyStatus_POLICY_STATUS_PENDING PolicyStatus = 1
	// Sandbox successfully applied this policy version.
	PolicyStatus_POLICY_STATUS_LOADED PolicyStatus = 2
	// Sandbox attempted to apply but failed; LKG policy remains active.
	// ListSandboxPolicies also uses FAILED for historical payloads that are
	// invalid under the current schema; load_error contains the diagnostic.
	PolicyStatus_POLICY_STATUS_FAILED PolicyStatus = 3
	// A newer version was persisted before the sandbox loaded this one.
	PolicyStatus_POLICY_STATUS_SUPERSEDED PolicyStatus = 4
)

// Enum value maps for PolicyStatus.
var (
	PolicyStatus_name = map[int32]string{
		0: "POLICY_STATUS_UNSPECIFIED",
		1: "POLICY_STATUS_PENDING",
		2: "POLICY_STATUS_LOADED",
		3: "POLICY_STATUS_FAILED",
		4: "POLICY_STATUS_SUPERSEDED",
	}
	PolicyStatus_value = map[string]int32{
		"POLICY_STATUS_UNSPECIFIED": 0,
		"POLICY_STATUS_PENDING":     1,
		"POLICY_STATUS_LOADED":      2,
		"POLICY_STATUS_FAILED":      3,
		"POLICY_STATUS_SUPERSEDED":  4,
	}
)

func (x PolicyStatus) Enum() *PolicyStatus {
	p := new(PolicyStatus)
	*p = x
	return p
}

func (x PolicyStatus) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (PolicyStatus) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[12].Descriptor()
}

func (PolicyStatus) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[12]
}

func (x PolicyStatus) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use PolicyStatus.Descriptor instead.
func (PolicyStatus) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{12}
}

// Service status enum.
type ServiceStatus int32

const (
	ServiceStatus_SERVICE_STATUS_UNSPECIFIED ServiceStatus = 0
	ServiceStatus_SERVICE_STATUS_HEALTHY     ServiceStatus = 1
	ServiceStatus_SERVICE_STATUS_DEGRADED    ServiceStatus = 2
	ServiceStatus_SERVICE_STATUS_UNHEALTHY   ServiceStatus = 3
)

// Enum value maps for ServiceStatus.
var (
	ServiceStatus_name = map[int32]string{
		0: "SERVICE_STATUS_UNSPECIFIED",
		1: "SERVICE_STATUS_HEALTHY",
		2: "SERVICE_STATUS_DEGRADED",
		3: "SERVICE_STATUS_UNHEALTHY",
	}
	ServiceStatus_value = map[string]int32{
		"SERVICE_STATUS_UNSPECIFIED": 0,
		"SERVICE_STATUS_HEALTHY":     1,
		"SERVICE_STATUS_DEGRADED":    2,
		"SERVICE_STATUS_UNHEALTHY":   3,
	}
)

func (x ServiceStatus) Enum() *ServiceStatus {
	p := new(ServiceStatus)
	*p = x
	return p
}

func (x ServiceStatus) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ServiceStatus) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[13].Descriptor()
}

func (ServiceStatus) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[13]
}

func (x ServiceStatus) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ServiceStatus.Descriptor instead.
func (ServiceStatus) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{13}
}

// Workspace-scoped role for members.
type WorkspaceRole int32

const (
	WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED WorkspaceRole = 0
	WorkspaceRole_WORKSPACE_ROLE_USER        WorkspaceRole = 1
	WorkspaceRole_WORKSPACE_ROLE_ADMIN       WorkspaceRole = 2
)

// Enum value maps for WorkspaceRole.
var (
	WorkspaceRole_name = map[int32]string{
		0: "WORKSPACE_ROLE_UNSPECIFIED",
		1: "WORKSPACE_ROLE_USER",
		2: "WORKSPACE_ROLE_ADMIN",
	}
	WorkspaceRole_value = map[string]int32{
		"WORKSPACE_ROLE_UNSPECIFIED": 0,
		"WORKSPACE_ROLE_USER":        1,
		"WORKSPACE_ROLE_ADMIN":       2,
	}
)

func (x WorkspaceRole) Enum() *WorkspaceRole {
	p := new(WorkspaceRole)
	*p = x
	return p
}

func (x WorkspaceRole) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (WorkspaceRole) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[14].Descriptor()
}

func (WorkspaceRole) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[14]
}

func (x WorkspaceRole) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use WorkspaceRole.Descriptor instead.
func (WorkspaceRole) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{14}
}

// Stable recovery action for the most recent provider credential refresh
// failure. Kept after the pre-existing enums so adding it does not renumber
// their generated descriptors. Clients should use this field instead of
// parsing last_error.
type ProviderCredentialRefreshRecoveryAction int32

const (
	ProviderCredentialRefreshRecoveryAction_PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_UNSPECIFIED       ProviderCredentialRefreshRecoveryAction = 0
	ProviderCredentialRefreshRecoveryAction_PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_RETRY             ProviderCredentialRefreshRecoveryAction = 1
	ProviderCredentialRefreshRecoveryAction_PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_REAUTHORIZE       ProviderCredentialRefreshRecoveryAction = 2
	ProviderCredentialRefreshRecoveryAction_PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_FIX_CONFIGURATION ProviderCredentialRefreshRecoveryAction = 3
	ProviderCredentialRefreshRecoveryAction_PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_INVESTIGATE       ProviderCredentialRefreshRecoveryAction = 4
)

// Enum value maps for ProviderCredentialRefreshRecoveryAction.
var (
	ProviderCredentialRefreshRecoveryAction_name = map[int32]string{
		0: "PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_UNSPECIFIED",
		1: "PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_RETRY",
		2: "PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_REAUTHORIZE",
		3: "PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_FIX_CONFIGURATION",
		4: "PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_INVESTIGATE",
	}
	ProviderCredentialRefreshRecoveryAction_value = map[string]int32{
		"PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_UNSPECIFIED":       0,
		"PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_RETRY":             1,
		"PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_REAUTHORIZE":       2,
		"PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_FIX_CONFIGURATION": 3,
		"PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_INVESTIGATE":       4,
	}
)

func (x ProviderCredentialRefreshRecoveryAction) Enum() *ProviderCredentialRefreshRecoveryAction {
	p := new(ProviderCredentialRefreshRecoveryAction)
	*p = x
	return p
}

func (x ProviderCredentialRefreshRecoveryAction) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ProviderCredentialRefreshRecoveryAction) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[15].Descriptor()
}

func (ProviderCredentialRefreshRecoveryAction) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[15]
}

func (x ProviderCredentialRefreshRecoveryAction) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ProviderCredentialRefreshRecoveryAction.Descriptor instead.
func (ProviderCredentialRefreshRecoveryAction) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{15}
}

// Result of a public delete, membership removal, or session revocation.
// Default requests return NOT_FOUND for a missing target. With allow_missing,
// only a missing target becomes ALREADY_ABSENT; parent lookup, authorization,
// validation, precondition, and backend errors retain their normal status.
// These results describe the targeted resource, not a same-name replacement.
type DeletionOutcome int32

const (
	// No outcome was supplied. Never infer completion from this value.
	DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED DeletionOutcome = 0
	// The targeted gateway resource is removed (or the SSH session is revoked).
	// Downstream platform garbage collection may still be finishing.
	DeletionOutcome_DELETION_OUTCOME_COMPLETED DeletionOutcome = 1
	// Sandbox deletion is accepted but its gateway record still exists.
	// Observe the targeted sandbox ID until it disappears for completion.
	DeletionOutcome_DELETION_OUTCOME_ACCEPTED DeletionOutcome = 2
	// The target did not exist and allow_missing was true.
	DeletionOutcome_DELETION_OUTCOME_ALREADY_ABSENT DeletionOutcome = 3
)

// Enum value maps for DeletionOutcome.
var (
	DeletionOutcome_name = map[int32]string{
		0: "DELETION_OUTCOME_UNSPECIFIED",
		1: "DELETION_OUTCOME_COMPLETED",
		2: "DELETION_OUTCOME_ACCEPTED",
		3: "DELETION_OUTCOME_ALREADY_ABSENT",
	}
	DeletionOutcome_value = map[string]int32{
		"DELETION_OUTCOME_UNSPECIFIED":    0,
		"DELETION_OUTCOME_COMPLETED":      1,
		"DELETION_OUTCOME_ACCEPTED":       2,
		"DELETION_OUTCOME_ALREADY_ABSENT": 3,
	}
)

func (x DeletionOutcome) Enum() *DeletionOutcome {
	p := new(DeletionOutcome)
	*p = x
	return p
}

func (x DeletionOutcome) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (DeletionOutcome) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[16].Descriptor()
}

func (DeletionOutcome) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[16]
}

func (x DeletionOutcome) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use DeletionOutcome.Descriptor instead.
func (DeletionOutcome) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{16}
}

// Last observed network result for a configured external tool endpoint.
// Results describe accepted traffic observations, not present availability.
type EndpointResult int32

const (
	EndpointResult_ENDPOINT_RESULT_UNSPECIFIED EndpointResult = 0
	// No exchange has been observed under the current configuration and session.
	EndpointResult_ENDPOINT_RESULT_NO_OBSERVED_EXCHANGE EndpointResult = 1
	// An upstream HTTP status below 400 was received. Its body can still contain
	// an MCP error; this result does not establish tool-call success.
	EndpointResult_ENDPOINT_RESULT_HTTP_RESPONSE_RECEIVED EndpointResult = 2
	// OpenShell policy denied the request locally.
	EndpointResult_ENDPOINT_RESULT_POLICY_DENIED EndpointResult = 3
	// An applicable OpenShell-managed credential was unavailable.
	EndpointResult_ENDPOINT_RESULT_CREDENTIAL_UNAVAILABLE EndpointResult = 4
	// TLS setup for the upstream connection failed.
	EndpointResult_ENDPOINT_RESULT_TLS_FAILED EndpointResult = 5
	// The upstream transport failed before an HTTP response arrived.
	EndpointResult_ENDPOINT_RESULT_TRANSPORT_FAILED EndpointResult = 6
	// The upstream service returned an HTTP rejection.
	EndpointResult_ENDPOINT_RESULT_UPSTREAM_REJECTED EndpointResult = 7
)

// Enum value maps for EndpointResult.
var (
	EndpointResult_name = map[int32]string{
		0: "ENDPOINT_RESULT_UNSPECIFIED",
		1: "ENDPOINT_RESULT_NO_OBSERVED_EXCHANGE",
		2: "ENDPOINT_RESULT_HTTP_RESPONSE_RECEIVED",
		3: "ENDPOINT_RESULT_POLICY_DENIED",
		4: "ENDPOINT_RESULT_CREDENTIAL_UNAVAILABLE",
		5: "ENDPOINT_RESULT_TLS_FAILED",
		6: "ENDPOINT_RESULT_TRANSPORT_FAILED",
		7: "ENDPOINT_RESULT_UPSTREAM_REJECTED",
	}
	EndpointResult_value = map[string]int32{
		"ENDPOINT_RESULT_UNSPECIFIED":            0,
		"ENDPOINT_RESULT_NO_OBSERVED_EXCHANGE":   1,
		"ENDPOINT_RESULT_HTTP_RESPONSE_RECEIVED": 2,
		"ENDPOINT_RESULT_POLICY_DENIED":          3,
		"ENDPOINT_RESULT_CREDENTIAL_UNAVAILABLE": 4,
		"ENDPOINT_RESULT_TLS_FAILED":             5,
		"ENDPOINT_RESULT_TRANSPORT_FAILED":       6,
		"ENDPOINT_RESULT_UPSTREAM_REJECTED":      7,
	}
)

func (x EndpointResult) Enum() *EndpointResult {
	p := new(EndpointResult)
	*p = x
	return p
}

func (x EndpointResult) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (EndpointResult) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[17].Descriptor()
}

func (EndpointResult) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[17]
}

func (x EndpointResult) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use EndpointResult.Descriptor instead.
func (EndpointResult) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{17}
}

// IssueSandboxToken request. Empty body; identity is established by the
// authentication credentials carried in the request headers (a projected
// Kubernetes ServiceAccount JWT in the K8s driver path).
type IssueSandboxTokenRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *IssueSandboxTokenRequest) Reset() {
	*x = IssueSandboxTokenRequest{}
	mi := &file_openshell_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *IssueSandboxTokenRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*IssueSandboxTokenRequest) ProtoMessage() {}

func (x *IssueSandboxTokenRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use IssueSandboxTokenRequest.ProtoReflect.Descriptor instead.
func (*IssueSandboxTokenRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{0}
}

// IssueSandboxToken response. The supervisor caches the returned token in
// memory and presents it as `Authorization: Bearer` on every subsequent
// gateway RPC.
type IssueSandboxTokenResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-minted session JWT bound to the calling sandbox's UUID, active
	// runtime generation, authorization epoch, and durable token lineage.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// Absolute expiry of the issued token. Absence means the token is non-expiring.
	ExpirationTime *timestamppb.Timestamp `protobuf:"bytes,102,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *IssueSandboxTokenResponse) Reset() {
	*x = IssueSandboxTokenResponse{}
	mi := &file_openshell_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *IssueSandboxTokenResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*IssueSandboxTokenResponse) ProtoMessage() {}

func (x *IssueSandboxTokenResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use IssueSandboxTokenResponse.ProtoReflect.Descriptor instead.
func (*IssueSandboxTokenResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{1}
}

func (x *IssueSandboxTokenResponse) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *IssueSandboxTokenResponse) GetExpirationTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ExpirationTime
	}
	return nil
}

// RefreshSandboxToken request. The calling principal must already be a
// sandbox principal (i.e. the request carries a still-valid gateway-minted
// JWT in its Authorization header). Extension service names are resolved
// against server-owned registrations and the sandbox's effective policy;
// callers never choose token audiences directly.
type RefreshSandboxTokenRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Operator registration names for extension services selected by the
	// sandbox's effective policy.
	ExtensionServiceNames []string `protobuf:"bytes,1,rep,name=extension_service_names,json=extensionServiceNames,proto3" json:"extension_service_names,omitempty"`
	unknownFields         protoimpl.UnknownFields
	sizeCache             protoimpl.SizeCache
}

func (x *RefreshSandboxTokenRequest) Reset() {
	*x = RefreshSandboxTokenRequest{}
	mi := &file_openshell_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RefreshSandboxTokenRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RefreshSandboxTokenRequest) ProtoMessage() {}

func (x *RefreshSandboxTokenRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RefreshSandboxTokenRequest.ProtoReflect.Descriptor instead.
func (*RefreshSandboxTokenRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{2}
}

func (x *RefreshSandboxTokenRequest) GetExtensionServiceNames() []string {
	if x != nil {
		return x.ExtensionServiceNames
	}
	return nil
}

// RefreshSandboxToken response. The new token replaces the supervisor's
// in-memory bearer credential.
type RefreshSandboxTokenResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Fresh gateway-minted JWT bound to the same sandbox UUID.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// Absolute expiry of the new token. Absence means the token is non-expiring.
	ExpirationTime *timestamppb.Timestamp `protobuf:"bytes,102,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
	// Fresh credentials for the requested, policy-authorized extension
	// services. These remain in supervisor memory and are never persisted.
	ExtensionCredentials []*ExtensionServiceCredential `protobuf:"bytes,3,rep,name=extension_credentials,json=extensionCredentials,proto3" json:"extension_credentials,omitempty"`
	// Fresh Sandbox Protocol bearer token from the same atomic refresh.
	SandboxToken string `protobuf:"bytes,4,opt,name=sandbox_token,json=sandboxToken,proto3" json:"sandbox_token,omitempty"`
	// Absolute Sandbox Protocol token expiry. Required when sandbox_token is set.
	SandboxExpirationTime *timestamppb.Timestamp `protobuf:"bytes,105,opt,name=sandbox_expiration_time,json=sandboxExpirationTime,proto3" json:"sandbox_expiration_time,omitempty"`
	// Launch generation to which both refreshed credentials are bound.
	SessionId string `protobuf:"bytes,6,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// Durable authorization epoch shared by the gateway and Sandbox Runtime.
	CredentialEpoch uint64 `protobuf:"varint,7,opt,name=credential_epoch,json=credentialEpoch,proto3" json:"credential_epoch,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *RefreshSandboxTokenResponse) Reset() {
	*x = RefreshSandboxTokenResponse{}
	mi := &file_openshell_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RefreshSandboxTokenResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RefreshSandboxTokenResponse) ProtoMessage() {}

func (x *RefreshSandboxTokenResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RefreshSandboxTokenResponse.ProtoReflect.Descriptor instead.
func (*RefreshSandboxTokenResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{3}
}

func (x *RefreshSandboxTokenResponse) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *RefreshSandboxTokenResponse) GetExpirationTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ExpirationTime
	}
	return nil
}

func (x *RefreshSandboxTokenResponse) GetExtensionCredentials() []*ExtensionServiceCredential {
	if x != nil {
		return x.ExtensionCredentials
	}
	return nil
}

func (x *RefreshSandboxTokenResponse) GetSandboxToken() string {
	if x != nil {
		return x.SandboxToken
	}
	return ""
}

func (x *RefreshSandboxTokenResponse) GetSandboxExpirationTime() *timestamppb.Timestamp {
	if x != nil {
		return x.SandboxExpirationTime
	}
	return nil
}

func (x *RefreshSandboxTokenResponse) GetSessionId() string {
	if x != nil {
		return x.SessionId
	}
	return ""
}

func (x *RefreshSandboxTokenResponse) GetCredentialEpoch() uint64 {
	if x != nil {
		return x.CredentialEpoch
	}
	return 0
}

// Health check request.
type HealthRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *HealthRequest) Reset() {
	*x = HealthRequest{}
	mi := &file_openshell_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *HealthRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*HealthRequest) ProtoMessage() {}

func (x *HealthRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use HealthRequest.ProtoReflect.Descriptor instead.
func (*HealthRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{4}
}

// Health check response.
type HealthResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Service status.
	Status ServiceStatus `protobuf:"varint,1,opt,name=status,proto3,enum=openshell.v1.ServiceStatus" json:"status,omitempty"`
	// Service version.
	Version       string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *HealthResponse) Reset() {
	*x = HealthResponse{}
	mi := &file_openshell_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *HealthResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*HealthResponse) ProtoMessage() {}

func (x *HealthResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use HealthResponse.ProtoReflect.Descriptor instead.
func (*HealthResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{5}
}

func (x *HealthResponse) GetStatus() ServiceStatus {
	if x != nil {
		return x.Status
	}
	return ServiceStatus_SERVICE_STATUS_UNSPECIFIED
}

func (x *HealthResponse) GetVersion() string {
	if x != nil {
		return x.Version
	}
	return ""
}

// Current-user request. The identity comes from the authenticated request.
type GetCurrentUserRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetCurrentUserRequest) Reset() {
	*x = GetCurrentUserRequest{}
	mi := &file_openshell_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetCurrentUserRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetCurrentUserRequest) ProtoMessage() {}

func (x *GetCurrentUserRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetCurrentUserRequest.ProtoReflect.Descriptor instead.
func (*GetCurrentUserRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{6}
}

// Authenticated user identity as validated by the gateway.
type GetCurrentUserResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Stable identity subject (for example, the OIDC `sub` claim).
	Subject string `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
	// Human-readable identity name when supplied by the authentication provider.
	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// Roles granted to the authenticated identity.
	Roles []string `protobuf:"bytes,3,rep,name=roles,proto3" json:"roles,omitempty"`
	// OAuth2 scopes granted to the authenticated identity.
	Scopes []string `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// Authentication provider that established the identity.
	IdentityProvider string `protobuf:"bytes,5,opt,name=identity_provider,json=identityProvider,proto3" json:"identity_provider,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *GetCurrentUserResponse) Reset() {
	*x = GetCurrentUserResponse{}
	mi := &file_openshell_proto_msgTypes[7]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetCurrentUserResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetCurrentUserResponse) ProtoMessage() {}

func (x *GetCurrentUserResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[7]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetCurrentUserResponse.ProtoReflect.Descriptor instead.
func (*GetCurrentUserResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{7}
}

func (x *GetCurrentUserResponse) GetSubject() string {
	if x != nil {
		return x.Subject
	}
	return ""
}

func (x *GetCurrentUserResponse) GetDisplayName() string {
	if x != nil {
		return x.DisplayName
	}
	return ""
}

func (x *GetCurrentUserResponse) GetRoles() []string {
	if x != nil {
		return x.Roles
	}
	return nil
}

func (x *GetCurrentUserResponse) GetScopes() []string {
	if x != nil {
		return x.Scopes
	}
	return nil
}

func (x *GetCurrentUserResponse) GetIdentityProvider() string {
	if x != nil {
		return x.IdentityProvider
	}
	return ""
}

// Gateway info request.
type GetGatewayInfoRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetGatewayInfoRequest) Reset() {
	*x = GetGatewayInfoRequest{}
	mi := &file_openshell_proto_msgTypes[8]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetGatewayInfoRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetGatewayInfoRequest) ProtoMessage() {}

func (x *GetGatewayInfoRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[8]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetGatewayInfoRequest.ProtoReflect.Descriptor instead.
func (*GetGatewayInfoRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{8}
}

// Gateway info response.
type GetGatewayInfoResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Service status.
	Status ServiceStatus `protobuf:"varint,1,opt,name=status,proto3,enum=openshell.v1.ServiceStatus" json:"status,omitempty"`
	// OpenShell gateway binary version.
	GatewayVersion string `protobuf:"bytes,2,opt,name=gateway_version,json=gatewayVersion,proto3" json:"gateway_version,omitempty"`
	// Compute driver runtimes initialized by this gateway. Current gateways
	// return exactly one entry.
	ComputeDrivers []*ComputeDriverInfo `protobuf:"bytes,3,rep,name=compute_drivers,json=computeDrivers,proto3" json:"compute_drivers,omitempty"`
	// Negotiated non-secret metadata for every initialized extension.
	Extensions    []*NegotiatedExtensionInfo `protobuf:"bytes,4,rep,name=extensions,proto3" json:"extensions,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetGatewayInfoResponse) Reset() {
	*x = GetGatewayInfoResponse{}
	mi := &file_openshell_proto_msgTypes[9]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetGatewayInfoResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetGatewayInfoResponse) ProtoMessage() {}

func (x *GetGatewayInfoResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[9]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetGatewayInfoResponse.ProtoReflect.Descriptor instead.
func (*GetGatewayInfoResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{9}
}

func (x *GetGatewayInfoResponse) GetStatus() ServiceStatus {
	if x != nil {
		return x.Status
	}
	return ServiceStatus_SERVICE_STATUS_UNSPECIFIED
}

func (x *GetGatewayInfoResponse) GetGatewayVersion() string {
	if x != nil {
		return x.GatewayVersion
	}
	return ""
}

func (x *GetGatewayInfoResponse) GetComputeDrivers() []*ComputeDriverInfo {
	if x != nil {
		return x.ComputeDrivers
	}
	return nil
}

func (x *GetGatewayInfoResponse) GetExtensions() []*NegotiatedExtensionInfo {
	if x != nil {
		return x.Extensions
	}
	return nil
}

// Public, non-secret snapshot of one successful startup negotiation.
type NegotiatedExtensionInfo struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	Kind  ExtensionKind          `protobuf:"varint,1,opt,name=kind,proto3,enum=openshell.v1.ExtensionKind" json:"kind,omitempty"`
	// Gateway/operator-selected registration name.
	ConfiguredName string `protobuf:"bytes,2,opt,name=configured_name,json=configuredName,proto3" json:"configured_name,omitempty"`
	// Extension-reported implementation identity.
	ImplementationName string `protobuf:"bytes,3,opt,name=implementation_name,json=implementationName,proto3" json:"implementation_name,omitempty"`
	// Extension build version, distinct from the protocol version.
	ImplementationVersion string `protobuf:"bytes,4,opt,name=implementation_version,json=implementationVersion,proto3" json:"implementation_version,omitempty"`
	ProtocolMajor         uint32 `protobuf:"varint,5,opt,name=protocol_major,json=protocolMajor,proto3" json:"protocol_major,omitempty"`
	ProtocolMinor         uint32 `protobuf:"varint,6,opt,name=protocol_minor,json=protocolMinor,proto3" json:"protocol_minor,omitempty"`
	// Extension-supported optional capabilities, sorted for stable output.
	SupportedCapabilities []string `protobuf:"bytes,7,rep,name=supported_capabilities,json=supportedCapabilities,proto3" json:"supported_capabilities,omitempty"`
	// Capabilities the extension requires from the gateway.
	RequiredCapabilities []string `protobuf:"bytes,8,rep,name=required_capabilities,json=requiredCapabilities,proto3" json:"required_capabilities,omitempty"`
	unknownFields        protoimpl.UnknownFields
	sizeCache            protoimpl.SizeCache
}

func (x *NegotiatedExtensionInfo) Reset() {
	*x = NegotiatedExtensionInfo{}
	mi := &file_openshell_proto_msgTypes[10]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *NegotiatedExtensionInfo) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*NegotiatedExtensionInfo) ProtoMessage() {}

func (x *NegotiatedExtensionInfo) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[10]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use NegotiatedExtensionInfo.ProtoReflect.Descriptor instead.
func (*NegotiatedExtensionInfo) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{10}
}

func (x *NegotiatedExtensionInfo) GetKind() ExtensionKind {
	if x != nil {
		return x.Kind
	}
	return ExtensionKind_EXTENSION_KIND_UNSPECIFIED
}

func (x *NegotiatedExtensionInfo) GetConfiguredName() string {
	if x != nil {
		return x.ConfiguredName
	}
	return ""
}

func (x *NegotiatedExtensionInfo) GetImplementationName() string {
	if x != nil {
		return x.ImplementationName
	}
	return ""
}

func (x *NegotiatedExtensionInfo) GetImplementationVersion() string {
	if x != nil {
		return x.ImplementationVersion
	}
	return ""
}

func (x *NegotiatedExtensionInfo) GetProtocolMajor() uint32 {
	if x != nil {
		return x.ProtocolMajor
	}
	return 0
}

func (x *NegotiatedExtensionInfo) GetProtocolMinor() uint32 {
	if x != nil {
		return x.ProtocolMinor
	}
	return 0
}

func (x *NegotiatedExtensionInfo) GetSupportedCapabilities() []string {
	if x != nil {
		return x.SupportedCapabilities
	}
	return nil
}

func (x *NegotiatedExtensionInfo) GetRequiredCapabilities() []string {
	if x != nil {
		return x.RequiredCapabilities
	}
	return nil
}

// Info for one initialized compute driver runtime.
type ComputeDriverInfo struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-selected driver name used for routing and driver_config keys.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Capabilities reported by the driver during gateway runtime initialization.
	Capabilities  *ComputeDriverCapabilities `protobuf:"bytes,2,opt,name=capabilities,proto3" json:"capabilities,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ComputeDriverInfo) Reset() {
	*x = ComputeDriverInfo{}
	mi := &file_openshell_proto_msgTypes[11]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ComputeDriverInfo) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ComputeDriverInfo) ProtoMessage() {}

func (x *ComputeDriverInfo) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[11]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ComputeDriverInfo.ProtoReflect.Descriptor instead.
func (*ComputeDriverInfo) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{11}
}

func (x *ComputeDriverInfo) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ComputeDriverInfo) GetCapabilities() *ComputeDriverCapabilities {
	if x != nil {
		return x.Capabilities
	}
	return nil
}

// Public compute driver capability snapshot.
type ComputeDriverCapabilities struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Driver-reported human-readable name from the startup capability snapshot.
	DriverName string `protobuf:"bytes,1,opt,name=driver_name,json=driverName,proto3" json:"driver_name,omitempty"`
	// Driver-reported implementation version from the startup capability snapshot.
	DriverVersion string `protobuf:"bytes,2,opt,name=driver_version,json=driverVersion,proto3" json:"driver_version,omitempty"`
	// Static portable resource request forms reported by the driver.
	ResourceCapabilities *ResourceCapabilities `protobuf:"bytes,3,opt,name=resource_capabilities,json=resourceCapabilities,proto3" json:"resource_capabilities,omitempty"`
	unknownFields        protoimpl.UnknownFields
	sizeCache            protoimpl.SizeCache
}

func (x *ComputeDriverCapabilities) Reset() {
	*x = ComputeDriverCapabilities{}
	mi := &file_openshell_proto_msgTypes[12]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ComputeDriverCapabilities) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ComputeDriverCapabilities) ProtoMessage() {}

func (x *ComputeDriverCapabilities) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[12]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ComputeDriverCapabilities.ProtoReflect.Descriptor instead.
func (*ComputeDriverCapabilities) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{12}
}

func (x *ComputeDriverCapabilities) GetDriverName() string {
	if x != nil {
		return x.DriverName
	}
	return ""
}

func (x *ComputeDriverCapabilities) GetDriverVersion() string {
	if x != nil {
		return x.DriverVersion
	}
	return ""
}

func (x *ComputeDriverCapabilities) GetResourceCapabilities() *ResourceCapabilities {
	if x != nil {
		return x.ResourceCapabilities
	}
	return nil
}

// Static portable resource request forms reported by a compute driver.
// An omitted domain means the driver does not report that domain.
type ResourceCapabilities struct {
	state         protoimpl.MessageState      `protogen:"open.v1"`
	Cpu           *CpuResourceCapabilities    `protobuf:"bytes,1,opt,name=cpu,proto3" json:"cpu,omitempty"`
	Memory        *MemoryResourceCapabilities `protobuf:"bytes,2,opt,name=memory,proto3" json:"memory,omitempty"`
	Gpu           *GpuResourceCapabilities    `protobuf:"bytes,3,opt,name=gpu,proto3" json:"gpu,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ResourceCapabilities) Reset() {
	*x = ResourceCapabilities{}
	mi := &file_openshell_proto_msgTypes[13]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ResourceCapabilities) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ResourceCapabilities) ProtoMessage() {}

func (x *ResourceCapabilities) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[13]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ResourceCapabilities.ProtoReflect.Descriptor instead.
func (*ResourceCapabilities) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{13}
}

func (x *ResourceCapabilities) GetCpu() *CpuResourceCapabilities {
	if x != nil {
		return x.Cpu
	}
	return nil
}

func (x *ResourceCapabilities) GetMemory() *MemoryResourceCapabilities {
	if x != nil {
		return x.Memory
	}
	return nil
}

func (x *ResourceCapabilities) GetGpu() *GpuResourceCapabilities {
	if x != nil {
		return x.Gpu
	}
	return nil
}

type CpuResourceCapabilities struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The driver accepts and enforces a portable CPU limit.
	LimitSupported bool `protobuf:"varint,1,opt,name=limit_supported,json=limitSupported,proto3" json:"limit_supported,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *CpuResourceCapabilities) Reset() {
	*x = CpuResourceCapabilities{}
	mi := &file_openshell_proto_msgTypes[14]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CpuResourceCapabilities) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CpuResourceCapabilities) ProtoMessage() {}

func (x *CpuResourceCapabilities) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[14]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CpuResourceCapabilities.ProtoReflect.Descriptor instead.
func (*CpuResourceCapabilities) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{14}
}

func (x *CpuResourceCapabilities) GetLimitSupported() bool {
	if x != nil {
		return x.LimitSupported
	}
	return false
}

type MemoryResourceCapabilities struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The driver accepts and enforces a portable memory limit.
	LimitSupported bool `protobuf:"varint,1,opt,name=limit_supported,json=limitSupported,proto3" json:"limit_supported,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *MemoryResourceCapabilities) Reset() {
	*x = MemoryResourceCapabilities{}
	mi := &file_openshell_proto_msgTypes[15]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *MemoryResourceCapabilities) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*MemoryResourceCapabilities) ProtoMessage() {}

func (x *MemoryResourceCapabilities) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[15]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use MemoryResourceCapabilities.ProtoReflect.Descriptor instead.
func (*MemoryResourceCapabilities) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{15}
}

func (x *MemoryResourceCapabilities) GetLimitSupported() bool {
	if x != nil {
		return x.LimitSupported
	}
	return false
}

type GpuResourceCapabilities struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The driver accepts a GPU request with no explicit count.
	DefaultSelectionSupported bool `protobuf:"varint,1,opt,name=default_selection_supported,json=defaultSelectionSupported,proto3" json:"default_selection_supported,omitempty"`
	// The driver accepts an explicit `gpu.count` request.
	CountSelectionSupported bool `protobuf:"varint,2,opt,name=count_selection_supported,json=countSelectionSupported,proto3" json:"count_selection_supported,omitempty"`
	unknownFields           protoimpl.UnknownFields
	sizeCache               protoimpl.SizeCache
}

func (x *GpuResourceCapabilities) Reset() {
	*x = GpuResourceCapabilities{}
	mi := &file_openshell_proto_msgTypes[16]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GpuResourceCapabilities) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GpuResourceCapabilities) ProtoMessage() {}

func (x *GpuResourceCapabilities) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[16]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GpuResourceCapabilities.ProtoReflect.Descriptor instead.
func (*GpuResourceCapabilities) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{16}
}

func (x *GpuResourceCapabilities) GetDefaultSelectionSupported() bool {
	if x != nil {
		return x.DefaultSelectionSupported
	}
	return false
}

func (x *GpuResourceCapabilities) GetCountSelectionSupported() bool {
	if x != nil {
		return x.CountSelectionSupported
	}
	return false
}

// Public sandbox resource exposed by the OpenShell API.
//
// This is the canonical gateway-owned view of a sandbox. It merges user intent
// (`spec`) with gateway-managed metadata and status derived from internal
// compute-driver observations.
//
// Note: The `namespace` field has been removed from the public API. It remains
// in the internal `DriverSandbox` message as a compute-driver implementation detail.
type Sandbox struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Kubernetes-style metadata (id, name, labels, timestamps, resource version).
	Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Desired sandbox configuration submitted through the API.
	Spec *SandboxSpec `protobuf:"bytes,2,opt,name=spec,proto3" json:"spec,omitempty"`
	// Latest user-facing observed status derived by the gateway.
	Status *SandboxStatus `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
	// Read-only provenance for sandboxes created from a reusable workload template.
	CreatedFromWorkloadTemplate *SandboxWorkloadTemplateProvenance `protobuf:"bytes,20,opt,name=created_from_workload_template,json=createdFromWorkloadTemplate,proto3" json:"created_from_workload_template,omitempty"`
	unknownFields               protoimpl.UnknownFields
	sizeCache                   protoimpl.SizeCache
}

func (x *Sandbox) Reset() {
	*x = Sandbox{}
	mi := &file_openshell_proto_msgTypes[17]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *Sandbox) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*Sandbox) ProtoMessage() {}

func (x *Sandbox) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[17]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use Sandbox.ProtoReflect.Descriptor instead.
func (*Sandbox) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{17}
}

func (x *Sandbox) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *Sandbox) GetSpec() *SandboxSpec {
	if x != nil {
		return x.Spec
	}
	return nil
}

func (x *Sandbox) GetStatus() *SandboxStatus {
	if x != nil {
		return x.Status
	}
	return nil
}

func (x *Sandbox) GetCreatedFromWorkloadTemplate() *SandboxWorkloadTemplateProvenance {
	if x != nil {
		return x.CreatedFromWorkloadTemplate
	}
	return nil
}

// Desired sandbox configuration provided through the public API.
type SandboxSpec struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Log level exposed to processes running inside the sandbox.
	LogLevel string `protobuf:"bytes,1,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"`
	// Environment variables injected into the sandbox runtime.
	Environment map[string]string `protobuf:"bytes,5,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Container or VM template used to provision the sandbox.
	Template *SandboxTemplate `protobuf:"bytes,6,opt,name=template,proto3" json:"template,omitempty"`
	// Required sandbox policy configuration.
	Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"`
	// Provider names to attach to this sandbox.
	Providers []string `protobuf:"bytes,8,rep,name=providers,proto3" json:"providers,omitempty"`
	// Portable resource requirements used by the gateway for driver selection
	// and by drivers for provisioning.
	ResourceRequirements *ResourceRequirements `protobuf:"bytes,9,opt,name=resource_requirements,json=resourceRequirements,proto3" json:"resource_requirements,omitempty"`
	// Canonical command launched once by the sandbox supervisor. No shell
	// parsing is performed. The gateway normalizes an omitted command to the
	// portable scratch login shell before persistence.
	Command []string `protobuf:"bytes,12,rep,name=command,proto3" json:"command,omitempty"`
	// Allocate a retained pseudo-terminal for the main process.
	Tty bool `protobuf:"varint,13,opt,name=tty,proto3" json:"tty,omitempty"`
	// Gateway-owned attachment identity, changed atomically with the provider set.
	// Equality only: detach and reattach must not revive an older receipt.
	ProviderAttachmentEpoch string `protobuf:"bytes,14,opt,name=provider_attachment_epoch,json=providerAttachmentEpoch,proto3" json:"provider_attachment_epoch,omitempty"`
	unknownFields           protoimpl.UnknownFields
	sizeCache               protoimpl.SizeCache
}

func (x *SandboxSpec) Reset() {
	*x = SandboxSpec{}
	mi := &file_openshell_proto_msgTypes[18]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxSpec) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxSpec) ProtoMessage() {}

func (x *SandboxSpec) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[18]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxSpec.ProtoReflect.Descriptor instead.
func (*SandboxSpec) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{18}
}

func (x *SandboxSpec) GetLogLevel() string {
	if x != nil {
		return x.LogLevel
	}
	return ""
}

func (x *SandboxSpec) GetEnvironment() map[string]string {
	if x != nil {
		return x.Environment
	}
	return nil
}

func (x *SandboxSpec) GetTemplate() *SandboxTemplate {
	if x != nil {
		return x.Template
	}
	return nil
}

func (x *SandboxSpec) GetPolicy() *sandboxv1.SandboxPolicy {
	if x != nil {
		return x.Policy
	}
	return nil
}

func (x *SandboxSpec) GetProviders() []string {
	if x != nil {
		return x.Providers
	}
	return nil
}

func (x *SandboxSpec) GetResourceRequirements() *ResourceRequirements {
	if x != nil {
		return x.ResourceRequirements
	}
	return nil
}

func (x *SandboxSpec) GetCommand() []string {
	if x != nil {
		return x.Command
	}
	return nil
}

func (x *SandboxSpec) GetTty() bool {
	if x != nil {
		return x.Tty
	}
	return false
}

func (x *SandboxSpec) GetProviderAttachmentEpoch() string {
	if x != nil {
		return x.ProviderAttachmentEpoch
	}
	return ""
}

type ResourceRequirements struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// GPU requirements for the sandbox. Presence indicates a GPU request.
	Gpu           *GpuResourceRequirements `protobuf:"bytes,1,opt,name=gpu,proto3" json:"gpu,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ResourceRequirements) Reset() {
	*x = ResourceRequirements{}
	mi := &file_openshell_proto_msgTypes[19]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ResourceRequirements) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ResourceRequirements) ProtoMessage() {}

func (x *ResourceRequirements) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[19]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ResourceRequirements.ProtoReflect.Descriptor instead.
func (*ResourceRequirements) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{19}
}

func (x *ResourceRequirements) GetGpu() *GpuResourceRequirements {
	if x != nil {
		return x.Gpu
	}
	return nil
}

// Public GPU resource requirements.
type GpuResourceRequirements struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Optional number of GPUs requested. When omitted, the request is for one
	// GPU using the selected driver's default assignment behavior.
	Count         *uint32 `protobuf:"varint,1,opt,name=count,proto3,oneof" json:"count,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GpuResourceRequirements) Reset() {
	*x = GpuResourceRequirements{}
	mi := &file_openshell_proto_msgTypes[20]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GpuResourceRequirements) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GpuResourceRequirements) ProtoMessage() {}

func (x *GpuResourceRequirements) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[20]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GpuResourceRequirements.ProtoReflect.Descriptor instead.
func (*GpuResourceRequirements) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{20}
}

func (x *GpuResourceRequirements) GetCount() uint32 {
	if x != nil && x.Count != nil {
		return *x.Count
	}
	return 0
}

// Historical inline compute template mapped onto compute-driver template inputs.
//
// Despite its name, this is not a reusable named sandbox template resource. It
// is an inline part of `SandboxSpec` kept for v1 compatibility. A future
// breaking API cleanup may rename this message to free `SandboxTemplate` for
// the reusable template resource now represented by `SandboxWorkloadTemplate`.
type SandboxTemplate struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Fully-qualified OCI image reference used to boot the sandbox.
	Image string `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
	// Optional runtime class name requested from the compute platform.
	RuntimeClassName string `protobuf:"bytes,2,opt,name=runtime_class_name,json=runtimeClassName,proto3" json:"runtime_class_name,omitempty"`
	// Optional agent socket path exposed to the workload.
	AgentSocket string `protobuf:"bytes,3,opt,name=agent_socket,json=agentSocket,proto3" json:"agent_socket,omitempty"`
	// Labels applied to compute-platform resources for this sandbox.
	Labels map[string]string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Annotations applied to compute-platform resources for this sandbox.
	Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Additional environment variables injected by the template.
	Environment map[string]string `protobuf:"bytes,6,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Platform-specific compute resource requirements and limits.
	Resources *structpb.Struct `protobuf:"bytes,7,opt,name=resources,proto3" json:"resources,omitempty"`
	// Enable Kubernetes user namespace isolation (hostUsers: false).
	// When true, container UID 0 maps to a non-root host UID and capabilities
	// become namespaced. Requires Kubernetes 1.33+ with user namespace support
	// available (beta through 1.35, GA in 1.36+) and a supporting runtime.
	// When unset, the cluster-wide default is used.
	UserNamespaces *bool `protobuf:"varint,10,opt,name=user_namespaces,json=userNamespaces,proto3,oneof" json:"user_namespaces,omitempty"`
	// Driver-keyed opaque config envelope supplied by the caller.
	// The gateway selects the block matching the active compute driver and
	// forwards only that inner Struct to DriverSandboxTemplate.driver_config.
	// The selected driver owns nested schema validation.
	DriverConfig  *structpb.Struct `protobuf:"bytes,11,opt,name=driver_config,json=driverConfig,proto3" json:"driver_config,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxTemplate) Reset() {
	*x = SandboxTemplate{}
	mi := &file_openshell_proto_msgTypes[21]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxTemplate) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxTemplate) ProtoMessage() {}

func (x *SandboxTemplate) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[21]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxTemplate.ProtoReflect.Descriptor instead.
func (*SandboxTemplate) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{21}
}

func (x *SandboxTemplate) GetImage() string {
	if x != nil {
		return x.Image
	}
	return ""
}

func (x *SandboxTemplate) GetRuntimeClassName() string {
	if x != nil {
		return x.RuntimeClassName
	}
	return ""
}

func (x *SandboxTemplate) GetAgentSocket() string {
	if x != nil {
		return x.AgentSocket
	}
	return ""
}

func (x *SandboxTemplate) GetLabels() map[string]string {
	if x != nil {
		return x.Labels
	}
	return nil
}

func (x *SandboxTemplate) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

func (x *SandboxTemplate) GetEnvironment() map[string]string {
	if x != nil {
		return x.Environment
	}
	return nil
}

func (x *SandboxTemplate) GetResources() *structpb.Struct {
	if x != nil {
		return x.Resources
	}
	return nil
}

func (x *SandboxTemplate) GetUserNamespaces() bool {
	if x != nil && x.UserNamespaces != nil {
		return *x.UserNamespaces
	}
	return false
}

func (x *SandboxTemplate) GetDriverConfig() *structpb.Struct {
	if x != nil {
		return x.DriverConfig
	}
	return nil
}

// Reusable named sandbox workload template resource.
//
// This is the actual workspace-scoped template resource used to create
// sandboxes by reference. It uses the longer name in v1 to avoid colliding with
// the historical inline `SandboxTemplate` message. A future breaking API
// cleanup may rename this resource to `SandboxTemplate`.
type SandboxWorkloadTemplate struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Kubernetes-style metadata (id, name, labels, timestamps, resource version).
	Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Desired reusable workload shape and template-owned driver config.
	Spec          *SandboxWorkloadTemplateSpec `protobuf:"bytes,2,opt,name=spec,proto3" json:"spec,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxWorkloadTemplate) Reset() {
	*x = SandboxWorkloadTemplate{}
	mi := &file_openshell_proto_msgTypes[22]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxWorkloadTemplate) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxWorkloadTemplate) ProtoMessage() {}

func (x *SandboxWorkloadTemplate) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[22]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxWorkloadTemplate.ProtoReflect.Descriptor instead.
func (*SandboxWorkloadTemplate) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{22}
}

func (x *SandboxWorkloadTemplate) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *SandboxWorkloadTemplate) GetSpec() *SandboxWorkloadTemplateSpec {
	if x != nil {
		return x.Spec
	}
	return nil
}

type SandboxWorkloadTemplateSpec struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Portable workload shape.
	Workload *SandboxWorkloadConfig `protobuf:"bytes,1,opt,name=workload,proto3" json:"workload,omitempty"`
	// Driver-keyed opaque config envelope supplied by the template owner.
	DriverConfig *structpb.Struct `protobuf:"bytes,2,opt,name=driver_config,json=driverConfig,proto3" json:"driver_config,omitempty"`
	// Desired service level associated with this template.
	DesiredServiceLevel *SandboxServiceLevel `protobuf:"bytes,3,opt,name=desired_service_level,json=desiredServiceLevel,proto3" json:"desired_service_level,omitempty"`
	unknownFields       protoimpl.UnknownFields
	sizeCache           protoimpl.SizeCache
}

func (x *SandboxWorkloadTemplateSpec) Reset() {
	*x = SandboxWorkloadTemplateSpec{}
	mi := &file_openshell_proto_msgTypes[23]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxWorkloadTemplateSpec) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxWorkloadTemplateSpec) ProtoMessage() {}

func (x *SandboxWorkloadTemplateSpec) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[23]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxWorkloadTemplateSpec.ProtoReflect.Descriptor instead.
func (*SandboxWorkloadTemplateSpec) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{23}
}

func (x *SandboxWorkloadTemplateSpec) GetWorkload() *SandboxWorkloadConfig {
	if x != nil {
		return x.Workload
	}
	return nil
}

func (x *SandboxWorkloadTemplateSpec) GetDriverConfig() *structpb.Struct {
	if x != nil {
		return x.DriverConfig
	}
	return nil
}

func (x *SandboxWorkloadTemplateSpec) GetDesiredServiceLevel() *SandboxServiceLevel {
	if x != nil {
		return x.DesiredServiceLevel
	}
	return nil
}

type SandboxWorkloadConfig struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Fully-qualified OCI image reference used to boot the sandbox.
	Image string `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
	// Environment variables injected into the sandbox runtime.
	Environment map[string]string `protobuf:"bytes,2,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Portable resource requirements for sandboxes created from this workload.
	Resources     *SandboxResources `protobuf:"bytes,3,opt,name=resources,proto3" json:"resources,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxWorkloadConfig) Reset() {
	*x = SandboxWorkloadConfig{}
	mi := &file_openshell_proto_msgTypes[24]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxWorkloadConfig) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxWorkloadConfig) ProtoMessage() {}

func (x *SandboxWorkloadConfig) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[24]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxWorkloadConfig.ProtoReflect.Descriptor instead.
func (*SandboxWorkloadConfig) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{24}
}

func (x *SandboxWorkloadConfig) GetImage() string {
	if x != nil {
		return x.Image
	}
	return ""
}

func (x *SandboxWorkloadConfig) GetEnvironment() map[string]string {
	if x != nil {
		return x.Environment
	}
	return nil
}

func (x *SandboxWorkloadConfig) GetResources() *SandboxResources {
	if x != nil {
		return x.Resources
	}
	return nil
}

type SandboxResources struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Portable CPU quantity, for example "500m" or "2".
	Cpu string `protobuf:"bytes,1,opt,name=cpu,proto3" json:"cpu,omitempty"`
	// Portable memory quantity, for example "512Mi" or "2Gi".
	Memory string `protobuf:"bytes,2,opt,name=memory,proto3" json:"memory,omitempty"`
	// GPU requirements for the sandbox workload. Presence indicates a GPU
	// request. When count is omitted, the request uses the selected driver's
	// default GPU assignment behavior.
	Gpu           *GpuResourceRequirements `protobuf:"bytes,3,opt,name=gpu,proto3" json:"gpu,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxResources) Reset() {
	*x = SandboxResources{}
	mi := &file_openshell_proto_msgTypes[25]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxResources) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxResources) ProtoMessage() {}

func (x *SandboxResources) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[25]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxResources.ProtoReflect.Descriptor instead.
func (*SandboxResources) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{25}
}

func (x *SandboxResources) GetCpu() string {
	if x != nil {
		return x.Cpu
	}
	return ""
}

func (x *SandboxResources) GetMemory() string {
	if x != nil {
		return x.Memory
	}
	return ""
}

func (x *SandboxResources) GetGpu() *GpuResourceRequirements {
	if x != nil {
		return x.Gpu
	}
	return nil
}

type SandboxServiceLevel struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Startup       *SandboxStartup        `protobuf:"bytes,1,opt,name=startup,proto3" json:"startup,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxServiceLevel) Reset() {
	*x = SandboxServiceLevel{}
	mi := &file_openshell_proto_msgTypes[26]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxServiceLevel) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxServiceLevel) ProtoMessage() {}

func (x *SandboxServiceLevel) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[26]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxServiceLevel.ProtoReflect.Descriptor instead.
func (*SandboxServiceLevel) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{26}
}

func (x *SandboxServiceLevel) GetStartup() *SandboxStartup {
	if x != nil {
		return x.Startup
	}
	return nil
}

type SandboxStartup struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	ReadyWithin   *durationpb.Duration   `protobuf:"bytes,1,opt,name=ready_within,json=readyWithin,proto3" json:"ready_within,omitempty"`
	MaxBurst      uint32                 `protobuf:"varint,2,opt,name=max_burst,json=maxBurst,proto3" json:"max_burst,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxStartup) Reset() {
	*x = SandboxStartup{}
	mi := &file_openshell_proto_msgTypes[27]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxStartup) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxStartup) ProtoMessage() {}

func (x *SandboxStartup) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[27]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxStartup.ProtoReflect.Descriptor instead.
func (*SandboxStartup) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{27}
}

func (x *SandboxStartup) GetReadyWithin() *durationpb.Duration {
	if x != nil {
		return x.ReadyWithin
	}
	return nil
}

func (x *SandboxStartup) GetMaxBurst() uint32 {
	if x != nil {
		return x.MaxBurst
	}
	return 0
}

type SandboxWorkloadTemplateProvenance struct {
	state           protoimpl.MessageState `protogen:"open.v1"`
	Name            string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	ResourceVersion string                 `protobuf:"bytes,2,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *SandboxWorkloadTemplateProvenance) Reset() {
	*x = SandboxWorkloadTemplateProvenance{}
	mi := &file_openshell_proto_msgTypes[28]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxWorkloadTemplateProvenance) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxWorkloadTemplateProvenance) ProtoMessage() {}

func (x *SandboxWorkloadTemplateProvenance) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[28]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxWorkloadTemplateProvenance.ProtoReflect.Descriptor instead.
func (*SandboxWorkloadTemplateProvenance) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{28}
}

func (x *SandboxWorkloadTemplateProvenance) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *SandboxWorkloadTemplateProvenance) GetResourceVersion() string {
	if x != nil {
		return x.ResourceVersion
	}
	return ""
}

// User-facing sandbox status derived by the gateway from compute-driver observations.
//
// Public status does not embed driver-only flags such as `deleting`.
type SandboxStatus struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Name of the agent pod or equivalent runtime instance.
	AgentPod string `protobuf:"bytes,2,opt,name=agent_pod,json=agentPod,proto3" json:"agent_pod,omitempty"`
	// File descriptor or endpoint for reaching the agent service, when available.
	AgentFd string `protobuf:"bytes,3,opt,name=agent_fd,json=agentFd,proto3" json:"agent_fd,omitempty"`
	// File descriptor or endpoint for reaching the sandbox service, when available.
	SandboxFd string `protobuf:"bytes,4,opt,name=sandbox_fd,json=sandboxFd,proto3" json:"sandbox_fd,omitempty"`
	// Latest user-facing readiness and lifecycle conditions.
	Conditions []*SandboxCondition `protobuf:"bytes,5,rep,name=conditions,proto3" json:"conditions,omitempty"`
	// Gateway-derived lifecycle summary.
	Phase SandboxPhase `protobuf:"varint,6,opt,name=phase,proto3,enum=openshell.v1.SandboxPhase" json:"phase,omitempty"`
	// Currently active policy version (updated when sandbox reports loaded).
	CurrentPolicyVersion uint32 `protobuf:"varint,7,opt,name=current_policy_version,json=currentPolicyVersion,proto3" json:"current_policy_version,omitempty"`
	// Supervisor instance currently associated with the canonical main process.
	// The gateway uses this to reject stale exit reports after a restart.
	MainProcessInstanceId string `protobuf:"bytes,8,opt,name=main_process_instance_id,json=mainProcessInstanceId,proto3" json:"main_process_instance_id,omitempty"`
	// Normalized main process result. Signal exits use 128 + signal number.
	// Presence indicates that the canonical main process exited. Exit code 0
	// produces Completed; nonzero and signal-normalized exits produce Error.
	ExitCode *int32 `protobuf:"varint,9,opt,name=exit_code,json=exitCode,proto3,oneof" json:"exit_code,omitempty"`
	// Last accepted network result for each configured tool server endpoint.
	// Currently populated for MCP-over-HTTP endpoints. These passive results
	// remain separate from sandbox lifecycle conditions and readiness.
	EndpointStatuses []*EndpointStatus `protobuf:"bytes,10,rep,name=endpoint_statuses,json=endpointStatuses,proto3" json:"endpoint_statuses,omitempty"`
	// Independent of infrastructure phase; retained across driver observations.
	ConfigurationAdmission *SandboxConfigurationAdmission `protobuf:"bytes,11,opt,name=configuration_admission,json=configurationAdmission,proto3" json:"configuration_admission,omitempty"`
	// Durable first-acceptance marker. Absent on legacy records; never reset by restart.
	ConfigurationActivated *bool `protobuf:"varint,12,opt,name=configuration_activated,json=configurationActivated,proto3,oneof" json:"configuration_activated,omitempty"`
	// Gateway-owned repair window. Retained after timeout for inspection and retry.
	Provisioning  *SandboxProvisioning `protobuf:"bytes,13,opt,name=provisioning,proto3" json:"provisioning,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxStatus) Reset() {
	*x = SandboxStatus{}
	mi := &file_openshell_proto_msgTypes[29]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxStatus) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxStatus) ProtoMessage() {}

func (x *SandboxStatus) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[29]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxStatus.ProtoReflect.Descriptor instead.
func (*SandboxStatus) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{29}
}

func (x *SandboxStatus) GetAgentPod() string {
	if x != nil {
		return x.AgentPod
	}
	return ""
}

func (x *SandboxStatus) GetAgentFd() string {
	if x != nil {
		return x.AgentFd
	}
	return ""
}

func (x *SandboxStatus) GetSandboxFd() string {
	if x != nil {
		return x.SandboxFd
	}
	return ""
}

func (x *SandboxStatus) GetConditions() []*SandboxCondition {
	if x != nil {
		return x.Conditions
	}
	return nil
}

func (x *SandboxStatus) GetPhase() SandboxPhase {
	if x != nil {
		return x.Phase
	}
	return SandboxPhase_SANDBOX_PHASE_UNSPECIFIED
}

func (x *SandboxStatus) GetCurrentPolicyVersion() uint32 {
	if x != nil {
		return x.CurrentPolicyVersion
	}
	return 0
}

func (x *SandboxStatus) GetMainProcessInstanceId() string {
	if x != nil {
		return x.MainProcessInstanceId
	}
	return ""
}

func (x *SandboxStatus) GetExitCode() int32 {
	if x != nil && x.ExitCode != nil {
		return *x.ExitCode
	}
	return 0
}

func (x *SandboxStatus) GetEndpointStatuses() []*EndpointStatus {
	if x != nil {
		return x.EndpointStatuses
	}
	return nil
}

func (x *SandboxStatus) GetConfigurationAdmission() *SandboxConfigurationAdmission {
	if x != nil {
		return x.ConfigurationAdmission
	}
	return nil
}

func (x *SandboxStatus) GetConfigurationActivated() bool {
	if x != nil && x.ConfigurationActivated != nil {
		return *x.ConfigurationActivated
	}
	return false
}

func (x *SandboxStatus) GetProvisioning() *SandboxProvisioning {
	if x != nil {
		return x.Provisioning
	}
	return nil
}

// User-facing sandbox condition derived from platform or gateway observations.
type SandboxCondition struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Condition class, typically mirroring the underlying platform condition type.
	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
	// Condition status value such as `True`, `False`, or `Unknown`.
	Status string `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
	// Short machine-readable reason associated with the condition.
	Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
	// Human-readable condition message.
	Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
	// Timestamp reported by the condition owner for the last transition.
	TransitionTime *timestamppb.Timestamp `protobuf:"bytes,105,opt,name=transition_time,json=transitionTime,proto3" json:"transition_time,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *SandboxCondition) Reset() {
	*x = SandboxCondition{}
	mi := &file_openshell_proto_msgTypes[30]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxCondition) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxCondition) ProtoMessage() {}

func (x *SandboxCondition) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[30]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxCondition.ProtoReflect.Descriptor instead.
func (*SandboxCondition) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{30}
}

func (x *SandboxCondition) GetType() string {
	if x != nil {
		return x.Type
	}
	return ""
}

func (x *SandboxCondition) GetStatus() string {
	if x != nil {
		return x.Status
	}
	return ""
}

func (x *SandboxCondition) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

func (x *SandboxCondition) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

func (x *SandboxCondition) GetTransitionTime() *timestamppb.Timestamp {
	if x != nil {
		return x.TransitionTime
	}
	return nil
}

// Public platform event exposed on the sandbox watch stream.
type PlatformEvent struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Time when the event occurred.
	EventTime *timestamppb.Timestamp `protobuf:"bytes,101,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
	// Event source (e.g. "kubernetes", "docker", "process").
	Source string `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"`
	// Event type/severity (e.g. "Normal", "Warning").
	Type string `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
	// Short reason code (e.g. "Started", "Pulled", "Failed").
	Reason string `protobuf:"bytes,4,opt,name=reason,proto3" json:"reason,omitempty"`
	// Human-readable event message.
	Message string `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"`
	// Optional metadata as key-value pairs.
	Metadata      map[string]string `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PlatformEvent) Reset() {
	*x = PlatformEvent{}
	mi := &file_openshell_proto_msgTypes[31]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PlatformEvent) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PlatformEvent) ProtoMessage() {}

func (x *PlatformEvent) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[31]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PlatformEvent.ProtoReflect.Descriptor instead.
func (*PlatformEvent) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{31}
}

func (x *PlatformEvent) GetEventTime() *timestamppb.Timestamp {
	if x != nil {
		return x.EventTime
	}
	return nil
}

func (x *PlatformEvent) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

func (x *PlatformEvent) GetType() string {
	if x != nil {
		return x.Type
	}
	return ""
}

func (x *PlatformEvent) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

func (x *PlatformEvent) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

func (x *PlatformEvent) GetMetadata() map[string]string {
	if x != nil {
		return x.Metadata
	}
	return nil
}

// Create sandbox request.
type CreateSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,7,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Spec           *SandboxSpec                   `protobuf:"bytes,1,opt,name=spec,proto3" json:"spec,omitempty"`
	// Optional user-supplied sandbox name. When empty the server generates one.
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// Optional labels for the sandbox (key-value metadata).
	Labels map[string]string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Optional annotations for the sandbox (non-selector metadata).
	Annotations map[string]string `protobuf:"bytes,4,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// One-shot launch hint indicating that the creating client will attach to
	// the canonical main process. The supervisor keeps the terminal transport
	// alive until that attachment connects and closes naturally.
	AwaitMainProcessAttachment bool `protobuf:"varint,5,opt,name=await_main_process_attachment,json=awaitMainProcessAttachment,proto3" json:"await_main_process_attachment,omitempty"`
	// Workspace-scoped SandboxWorkloadTemplate name to resolve at creation time.
	WorkloadTemplate string `protobuf:"bytes,6,opt,name=workload_template,json=workloadTemplate,proto3" json:"workload_template,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId string `protobuf:"bytes,8,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	// HTTP services to expose when the sandbox is created. Endpoints are
	// registered after the sandbox has been persisted and route only while the
	// sandbox is ready.
	ServiceExposures []*SandboxServiceExposure `protobuf:"bytes,9,rep,name=service_exposures,json=serviceExposures,proto3" json:"service_exposures,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *CreateSandboxRequest) Reset() {
	*x = CreateSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[32]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateSandboxRequest) ProtoMessage() {}

func (x *CreateSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[32]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateSandboxRequest.ProtoReflect.Descriptor instead.
func (*CreateSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{32}
}

func (x *CreateSandboxRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *CreateSandboxRequest) GetSpec() *SandboxSpec {
	if x != nil {
		return x.Spec
	}
	return nil
}

func (x *CreateSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *CreateSandboxRequest) GetLabels() map[string]string {
	if x != nil {
		return x.Labels
	}
	return nil
}

func (x *CreateSandboxRequest) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

func (x *CreateSandboxRequest) GetAwaitMainProcessAttachment() bool {
	if x != nil {
		return x.AwaitMainProcessAttachment
	}
	return false
}

func (x *CreateSandboxRequest) GetWorkloadTemplate() string {
	if x != nil {
		return x.WorkloadTemplate
	}
	return ""
}

func (x *CreateSandboxRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

func (x *CreateSandboxRequest) GetServiceExposures() []*SandboxServiceExposure {
	if x != nil {
		return x.ServiceExposures
	}
	return nil
}

type CreateSandboxTemplateRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Template       *SandboxWorkloadTemplate       `protobuf:"bytes,1,opt,name=template,proto3" json:"template,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,3,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateSandboxTemplateRequest) Reset() {
	*x = CreateSandboxTemplateRequest{}
	mi := &file_openshell_proto_msgTypes[33]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateSandboxTemplateRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateSandboxTemplateRequest) ProtoMessage() {}

func (x *CreateSandboxTemplateRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[33]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateSandboxTemplateRequest.ProtoReflect.Descriptor instead.
func (*CreateSandboxTemplateRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{33}
}

func (x *CreateSandboxTemplateRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *CreateSandboxTemplateRequest) GetTemplate() *SandboxWorkloadTemplate {
	if x != nil {
		return x.Template
	}
	return nil
}

func (x *CreateSandboxTemplateRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type GetSandboxTemplateRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Name           string                         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *GetSandboxTemplateRequest) Reset() {
	*x = GetSandboxTemplateRequest{}
	mi := &file_openshell_proto_msgTypes[34]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxTemplateRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxTemplateRequest) ProtoMessage() {}

func (x *GetSandboxTemplateRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[34]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxTemplateRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxTemplateRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{34}
}

func (x *GetSandboxTemplateRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetSandboxTemplateRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

type ListSandboxTemplatesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Named and all-workspaces selections are accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// The maximum number of templates to return. Zero uses 100. Values above
	// 1000 are coerced to 1000; negative values are invalid.
	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Token from a previous ListSandboxTemplates response. All other request
	// parameters except page_size must match the request that produced it.
	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Optional label selector in key=value comma-separated form.
	LabelSelector string `protobuf:"bytes,3,opt,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxTemplatesRequest) Reset() {
	*x = ListSandboxTemplatesRequest{}
	mi := &file_openshell_proto_msgTypes[35]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxTemplatesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxTemplatesRequest) ProtoMessage() {}

func (x *ListSandboxTemplatesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[35]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxTemplatesRequest.ProtoReflect.Descriptor instead.
func (*ListSandboxTemplatesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{35}
}

func (x *ListSandboxTemplatesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ListSandboxTemplatesRequest) GetPageSize() int32 {
	if x != nil {
		return x.PageSize
	}
	return 0
}

func (x *ListSandboxTemplatesRequest) GetPageToken() string {
	if x != nil {
		return x.PageToken
	}
	return ""
}

func (x *ListSandboxTemplatesRequest) GetLabelSelector() string {
	if x != nil {
		return x.LabelSelector
	}
	return ""
}

type DeleteSandboxTemplateRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Name           string                         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Succeed with ALREADY_ABSENT if the target is missing. Authorization and
	// parent-workspace checks still apply.
	AllowMissing bool `protobuf:"varint,3,opt,name=allow_missing,json=allowMissing,proto3" json:"allow_missing,omitempty"`
	// Optional nonzero UUID. Same ID and payload replay success for 24 hours.
	RequestId     string `protobuf:"bytes,4,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteSandboxTemplateRequest) Reset() {
	*x = DeleteSandboxTemplateRequest{}
	mi := &file_openshell_proto_msgTypes[36]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteSandboxTemplateRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteSandboxTemplateRequest) ProtoMessage() {}

func (x *DeleteSandboxTemplateRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[36]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteSandboxTemplateRequest.ProtoReflect.Descriptor instead.
func (*DeleteSandboxTemplateRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{36}
}

func (x *DeleteSandboxTemplateRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *DeleteSandboxTemplateRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *DeleteSandboxTemplateRequest) GetAllowMissing() bool {
	if x != nil {
		return x.AllowMissing
	}
	return false
}

func (x *DeleteSandboxTemplateRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type SandboxTemplateResponse struct {
	state         protoimpl.MessageState   `protogen:"open.v1"`
	Template      *SandboxWorkloadTemplate `protobuf:"bytes,1,opt,name=template,proto3" json:"template,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxTemplateResponse) Reset() {
	*x = SandboxTemplateResponse{}
	mi := &file_openshell_proto_msgTypes[37]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxTemplateResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxTemplateResponse) ProtoMessage() {}

func (x *SandboxTemplateResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[37]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxTemplateResponse.ProtoReflect.Descriptor instead.
func (*SandboxTemplateResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{37}
}

func (x *SandboxTemplateResponse) GetTemplate() *SandboxWorkloadTemplate {
	if x != nil {
		return x.Template
	}
	return nil
}

type ListSandboxTemplatesResponse struct {
	state     protoimpl.MessageState     `protogen:"open.v1"`
	Templates []*SandboxWorkloadTemplate `protobuf:"bytes,1,rep,name=templates,proto3" json:"templates,omitempty"`
	// Token for the next page. Empty when there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxTemplatesResponse) Reset() {
	*x = ListSandboxTemplatesResponse{}
	mi := &file_openshell_proto_msgTypes[38]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxTemplatesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxTemplatesResponse) ProtoMessage() {}

func (x *ListSandboxTemplatesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[38]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxTemplatesResponse.ProtoReflect.Descriptor instead.
func (*ListSandboxTemplatesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{38}
}

func (x *ListSandboxTemplatesResponse) GetTemplates() []*SandboxWorkloadTemplate {
	if x != nil {
		return x.Templates
	}
	return nil
}

func (x *ListSandboxTemplatesResponse) GetNextPageToken() string {
	if x != nil {
		return x.NextPageToken
	}
	return ""
}

type DeleteSandboxTemplateResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Outcome       DeletionOutcome        `protobuf:"varint,2,opt,name=outcome,proto3,enum=openshell.v1.DeletionOutcome" json:"outcome,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteSandboxTemplateResponse) Reset() {
	*x = DeleteSandboxTemplateResponse{}
	mi := &file_openshell_proto_msgTypes[39]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteSandboxTemplateResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteSandboxTemplateResponse) ProtoMessage() {}

func (x *DeleteSandboxTemplateResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[39]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteSandboxTemplateResponse.ProtoReflect.Descriptor instead.
func (*DeleteSandboxTemplateResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{39}
}

func (x *DeleteSandboxTemplateResponse) GetOutcome() DeletionOutcome {
	if x != nil {
		return x.Outcome
	}
	return DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED
}

// Request a gateway-owned staging slot for a local rootfs tar archive.
type BeginRootfsTarStagingRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Base file name of the local archive. The gateway uses it only to name the
	// staged file; path separators and traversal components are rejected.
	FileName string `protobuf:"bytes,1,opt,name=file_name,json=fileName,proto3" json:"file_name,omitempty"`
	// Size of the local archive in bytes, checked against the driver limit
	// before the gateway allocates a slot.
	SizeBytes     uint64 `protobuf:"varint,2,opt,name=size_bytes,json=sizeBytes,proto3" json:"size_bytes,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *BeginRootfsTarStagingRequest) Reset() {
	*x = BeginRootfsTarStagingRequest{}
	mi := &file_openshell_proto_msgTypes[40]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *BeginRootfsTarStagingRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*BeginRootfsTarStagingRequest) ProtoMessage() {}

func (x *BeginRootfsTarStagingRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[40]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use BeginRootfsTarStagingRequest.ProtoReflect.Descriptor instead.
func (*BeginRootfsTarStagingRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{40}
}

func (x *BeginRootfsTarStagingRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *BeginRootfsTarStagingRequest) GetFileName() string {
	if x != nil {
		return x.FileName
	}
	return ""
}

func (x *BeginRootfsTarStagingRequest) GetSizeBytes() uint64 {
	if x != nil {
		return x.SizeBytes
	}
	return 0
}

// Gateway-issued staging slot.
type BeginRootfsTarStagingResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Opaque single-use token. Pass it as
	// `template.driver_config.<driver>.rootfs_tar_staging_token` on
	// CreateSandbox. The first CreateSandbox presenting it consumes it.
	StagingToken string `protobuf:"bytes,1,opt,name=staging_token,json=stagingToken,proto3" json:"staging_token,omitempty"`
	// Absolute path on the gateway host the client must write the archive to.
	UploadPath string `protobuf:"bytes,2,opt,name=upload_path,json=uploadPath,proto3" json:"upload_path,omitempty"`
	// Maximum accepted archive size in bytes, enforced again by the driver.
	MaxBytes uint64 `protobuf:"varint,3,opt,name=max_bytes,json=maxBytes,proto3" json:"max_bytes,omitempty"`
	// Wall-clock deadline after which the gateway reclaims the slot.
	ExpirationTime *timestamppb.Timestamp `protobuf:"bytes,104,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *BeginRootfsTarStagingResponse) Reset() {
	*x = BeginRootfsTarStagingResponse{}
	mi := &file_openshell_proto_msgTypes[41]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *BeginRootfsTarStagingResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*BeginRootfsTarStagingResponse) ProtoMessage() {}

func (x *BeginRootfsTarStagingResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[41]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use BeginRootfsTarStagingResponse.ProtoReflect.Descriptor instead.
func (*BeginRootfsTarStagingResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{41}
}

func (x *BeginRootfsTarStagingResponse) GetStagingToken() string {
	if x != nil {
		return x.StagingToken
	}
	return ""
}

func (x *BeginRootfsTarStagingResponse) GetUploadPath() string {
	if x != nil {
		return x.UploadPath
	}
	return ""
}

func (x *BeginRootfsTarStagingResponse) GetMaxBytes() uint64 {
	if x != nil {
		return x.MaxBytes
	}
	return 0
}

func (x *BeginRootfsTarStagingResponse) GetExpirationTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ExpirationTime
	}
	return nil
}

// Get sandbox request.
type GetSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Name           string                         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *GetSandboxRequest) Reset() {
	*x = GetSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[42]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxRequest) ProtoMessage() {}

func (x *GetSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[42]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{42}
}

func (x *GetSandboxRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

// List sandboxes request.
type ListSandboxesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Named and all-workspaces selections are accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// The maximum number of sandboxes to return. Zero uses 100. Values above
	// 1000 are coerced to 1000; negative values are invalid.
	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Token from a previous ListSandboxes response. All other request parameters
	// except page_size must match the request that produced it.
	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Optional label selector for filtering (format: "key1=value1,key2=value2").
	LabelSelector string `protobuf:"bytes,3,opt,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxesRequest) Reset() {
	*x = ListSandboxesRequest{}
	mi := &file_openshell_proto_msgTypes[43]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxesRequest) ProtoMessage() {}

func (x *ListSandboxesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[43]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxesRequest.ProtoReflect.Descriptor instead.
func (*ListSandboxesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{43}
}

func (x *ListSandboxesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ListSandboxesRequest) GetPageSize() int32 {
	if x != nil {
		return x.PageSize
	}
	return 0
}

func (x *ListSandboxesRequest) GetPageToken() string {
	if x != nil {
		return x.PageToken
	}
	return ""
}

func (x *ListSandboxesRequest) GetLabelSelector() string {
	if x != nil {
		return x.LabelSelector
	}
	return ""
}

// List providers attached to a sandbox request.
type ListSandboxProvidersRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Sandbox        string                         `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *ListSandboxProvidersRequest) Reset() {
	*x = ListSandboxProvidersRequest{}
	mi := &file_openshell_proto_msgTypes[44]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxProvidersRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxProvidersRequest) ProtoMessage() {}

func (x *ListSandboxProvidersRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[44]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxProvidersRequest.ProtoReflect.Descriptor instead.
func (*ListSandboxProvidersRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{44}
}

func (x *ListSandboxProvidersRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ListSandboxProvidersRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

// Attach provider to sandbox request.
type AttachSandboxProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Sandbox        string                         `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Provider name to attach.
	Provider string `protobuf:"bytes,2,opt,name=provider,proto3" json:"provider,omitempty"`
	// Expected resource version for optimistic concurrency control.
	// If 0, the server uses the current version (backward compatibility).
	// If non-zero, the server validates that the sandbox's current resource_version
	// matches this value before applying the mutation, returning ABORTED on mismatch.
	ExpectedResourceVersion uint64 `protobuf:"varint,3,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,5,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AttachSandboxProviderRequest) Reset() {
	*x = AttachSandboxProviderRequest{}
	mi := &file_openshell_proto_msgTypes[45]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AttachSandboxProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AttachSandboxProviderRequest) ProtoMessage() {}

func (x *AttachSandboxProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[45]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AttachSandboxProviderRequest.ProtoReflect.Descriptor instead.
func (*AttachSandboxProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{45}
}

func (x *AttachSandboxProviderRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *AttachSandboxProviderRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *AttachSandboxProviderRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *AttachSandboxProviderRequest) GetExpectedResourceVersion() uint64 {
	if x != nil {
		return x.ExpectedResourceVersion
	}
	return 0
}

func (x *AttachSandboxProviderRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Detach provider from sandbox request.
type DetachSandboxProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Sandbox        string                         `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Provider name to detach.
	Provider string `protobuf:"bytes,2,opt,name=provider,proto3" json:"provider,omitempty"`
	// Expected resource version for optimistic concurrency control.
	// If 0, the server uses the current version (backward compatibility).
	// If non-zero, the server validates that the sandbox's current resource_version
	// matches this value before applying the mutation, returning ABORTED on mismatch.
	ExpectedResourceVersion uint64 `protobuf:"varint,3,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,5,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DetachSandboxProviderRequest) Reset() {
	*x = DetachSandboxProviderRequest{}
	mi := &file_openshell_proto_msgTypes[46]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DetachSandboxProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DetachSandboxProviderRequest) ProtoMessage() {}

func (x *DetachSandboxProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[46]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DetachSandboxProviderRequest.ProtoReflect.Descriptor instead.
func (*DetachSandboxProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{46}
}

func (x *DetachSandboxProviderRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *DetachSandboxProviderRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *DetachSandboxProviderRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *DetachSandboxProviderRequest) GetExpectedResourceVersion() uint64 {
	if x != nil {
		return x.ExpectedResourceVersion
	}
	return 0
}

func (x *DetachSandboxProviderRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Delete sandbox request.
type DeleteSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Canonical sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Succeed with ALREADY_ABSENT if the target is missing. Does not wait for
	// asynchronous cleanup and does not suppress authorization or parent errors.
	AllowMissing bool `protobuf:"varint,3,opt,name=allow_missing,json=allowMissing,proto3" json:"allow_missing,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,4,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteSandboxRequest) Reset() {
	*x = DeleteSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[47]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteSandboxRequest) ProtoMessage() {}

func (x *DeleteSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[47]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteSandboxRequest.ProtoReflect.Descriptor instead.
func (*DeleteSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{47}
}

func (x *DeleteSandboxRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *DeleteSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *DeleteSandboxRequest) GetAllowMissing() bool {
	if x != nil {
		return x.AllowMissing
	}
	return false
}

func (x *DeleteSandboxRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Stop sandbox request.
type StopSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Name           string                         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,3,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *StopSandboxRequest) Reset() {
	*x = StopSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[48]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StopSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StopSandboxRequest) ProtoMessage() {}

func (x *StopSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[48]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StopSandboxRequest.ProtoReflect.Descriptor instead.
func (*StopSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{48}
}

func (x *StopSandboxRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *StopSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *StopSandboxRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Start sandbox request.
type StartSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Name           string                         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,3,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *StartSandboxRequest) Reset() {
	*x = StartSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[49]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StartSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StartSandboxRequest) ProtoMessage() {}

func (x *StartSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[49]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StartSandboxRequest.ProtoReflect.Descriptor instead.
func (*StartSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{49}
}

func (x *StartSandboxRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *StartSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *StartSandboxRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Sandbox response.
type SandboxResponse struct {
	state   protoimpl.MessageState `protogen:"open.v1"`
	Sandbox *Sandbox               `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Service URLs created by CreateSandbox, keyed by service name. The empty
	// key identifies the unnamed service. Other sandbox RPCs return an empty map.
	ServiceUrls   map[string]string `protobuf:"bytes,2,rep,name=service_urls,json=serviceUrls,proto3" json:"service_urls,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxResponse) Reset() {
	*x = SandboxResponse{}
	mi := &file_openshell_proto_msgTypes[50]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxResponse) ProtoMessage() {}

func (x *SandboxResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[50]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxResponse.ProtoReflect.Descriptor instead.
func (*SandboxResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{50}
}

func (x *SandboxResponse) GetSandbox() *Sandbox {
	if x != nil {
		return x.Sandbox
	}
	return nil
}

func (x *SandboxResponse) GetServiceUrls() map[string]string {
	if x != nil {
		return x.ServiceUrls
	}
	return nil
}

// List sandboxes response.
type ListSandboxesResponse struct {
	state     protoimpl.MessageState `protogen:"open.v1"`
	Sandboxes []*Sandbox             `protobuf:"bytes,1,rep,name=sandboxes,proto3" json:"sandboxes,omitempty"`
	// Token for the next page. Empty when there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxesResponse) Reset() {
	*x = ListSandboxesResponse{}
	mi := &file_openshell_proto_msgTypes[51]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxesResponse) ProtoMessage() {}

func (x *ListSandboxesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[51]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxesResponse.ProtoReflect.Descriptor instead.
func (*ListSandboxesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{51}
}

func (x *ListSandboxesResponse) GetSandboxes() []*Sandbox {
	if x != nil {
		return x.Sandboxes
	}
	return nil
}

func (x *ListSandboxesResponse) GetNextPageToken() string {
	if x != nil {
		return x.NextPageToken
	}
	return ""
}

// List providers attached to a sandbox response.
type ListSandboxProvidersResponse struct {
	state         protoimpl.MessageState  `protogen:"open.v1"`
	Providers     []*datamodelv1.Provider `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxProvidersResponse) Reset() {
	*x = ListSandboxProvidersResponse{}
	mi := &file_openshell_proto_msgTypes[52]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxProvidersResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxProvidersResponse) ProtoMessage() {}

func (x *ListSandboxProvidersResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[52]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxProvidersResponse.ProtoReflect.Descriptor instead.
func (*ListSandboxProvidersResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{52}
}

func (x *ListSandboxProvidersResponse) GetProviders() []*datamodelv1.Provider {
	if x != nil {
		return x.Providers
	}
	return nil
}

// Attach provider to sandbox response.
type AttachSandboxProviderResponse struct {
	state   protoimpl.MessageState `protogen:"open.v1"`
	Sandbox *Sandbox               `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// True when the provider was newly attached. False means it was already attached.
	Attached bool `protobuf:"varint,2,opt,name=attached,proto3" json:"attached,omitempty"`
	// Persisted intent; readiness requires current supervisor observations.
	Receipt       *ProviderMutationReceipt `protobuf:"bytes,3,opt,name=receipt,proto3" json:"receipt,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AttachSandboxProviderResponse) Reset() {
	*x = AttachSandboxProviderResponse{}
	mi := &file_openshell_proto_msgTypes[53]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AttachSandboxProviderResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AttachSandboxProviderResponse) ProtoMessage() {}

func (x *AttachSandboxProviderResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[53]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AttachSandboxProviderResponse.ProtoReflect.Descriptor instead.
func (*AttachSandboxProviderResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{53}
}

func (x *AttachSandboxProviderResponse) GetSandbox() *Sandbox {
	if x != nil {
		return x.Sandbox
	}
	return nil
}

func (x *AttachSandboxProviderResponse) GetAttached() bool {
	if x != nil {
		return x.Attached
	}
	return false
}

func (x *AttachSandboxProviderResponse) GetReceipt() *ProviderMutationReceipt {
	if x != nil {
		return x.Receipt
	}
	return nil
}

// Detach provider from sandbox response.
type DetachSandboxProviderResponse struct {
	state   protoimpl.MessageState `protogen:"open.v1"`
	Sandbox *Sandbox               `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// True when the provider was removed. False means it was not attached.
	Detached bool `protobuf:"varint,2,opt,name=detached,proto3" json:"detached,omitempty"`
	// Revocation is complete only when this receipt reports REVOKED.
	Receipt       *ProviderMutationReceipt `protobuf:"bytes,3,opt,name=receipt,proto3" json:"receipt,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DetachSandboxProviderResponse) Reset() {
	*x = DetachSandboxProviderResponse{}
	mi := &file_openshell_proto_msgTypes[54]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DetachSandboxProviderResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DetachSandboxProviderResponse) ProtoMessage() {}

func (x *DetachSandboxProviderResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[54]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DetachSandboxProviderResponse.ProtoReflect.Descriptor instead.
func (*DetachSandboxProviderResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{54}
}

func (x *DetachSandboxProviderResponse) GetSandbox() *Sandbox {
	if x != nil {
		return x.Sandbox
	}
	return nil
}

func (x *DetachSandboxProviderResponse) GetDetached() bool {
	if x != nil {
		return x.Detached
	}
	return false
}

func (x *DetachSandboxProviderResponse) GetReceipt() *ProviderMutationReceipt {
	if x != nil {
		return x.Receipt
	}
	return nil
}

// Exact desired authority. Revisions are opaque identities, never ordered.
type ProviderDesiredIdentity struct {
	state           protoimpl.MessageState `protogen:"open.v1"`
	SandboxId       string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	Sandbox         string                 `protobuf:"bytes,2,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	AttachmentEpoch string                 `protobuf:"bytes,3,opt,name=attachment_epoch,json=attachmentEpoch,proto3" json:"attachment_epoch,omitempty"`
	// Empty for a detached provider.
	ProviderId              string `protobuf:"bytes,4,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"`
	ProviderResourceVersion uint64 `protobuf:"varint,5,opt,name=provider_resource_version,json=providerResourceVersion,proto3" json:"provider_resource_version,omitempty"`
	ProviderEnvRevision     uint64 `protobuf:"varint,6,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"`
	ConfigRevision          uint64 `protobuf:"varint,7,opt,name=config_revision,json=configRevision,proto3" json:"config_revision,omitempty"`
	PolicyHash              string `protobuf:"bytes,8,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	unknownFields           protoimpl.UnknownFields
	sizeCache               protoimpl.SizeCache
}

func (x *ProviderDesiredIdentity) Reset() {
	*x = ProviderDesiredIdentity{}
	mi := &file_openshell_proto_msgTypes[55]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderDesiredIdentity) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderDesiredIdentity) ProtoMessage() {}

func (x *ProviderDesiredIdentity) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[55]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderDesiredIdentity.ProtoReflect.Descriptor instead.
func (*ProviderDesiredIdentity) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{55}
}

func (x *ProviderDesiredIdentity) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ProviderDesiredIdentity) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *ProviderDesiredIdentity) GetAttachmentEpoch() string {
	if x != nil {
		return x.AttachmentEpoch
	}
	return ""
}

func (x *ProviderDesiredIdentity) GetProviderId() string {
	if x != nil {
		return x.ProviderId
	}
	return ""
}

func (x *ProviderDesiredIdentity) GetProviderResourceVersion() uint64 {
	if x != nil {
		return x.ProviderResourceVersion
	}
	return 0
}

func (x *ProviderDesiredIdentity) GetProviderEnvRevision() uint64 {
	if x != nil {
		return x.ProviderEnvRevision
	}
	return 0
}

func (x *ProviderDesiredIdentity) GetConfigRevision() uint64 {
	if x != nil {
		return x.ConfigRevision
	}
	return 0
}

func (x *ProviderDesiredIdentity) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

// Identifies one component snapshot revision. Revisions are equality tokens,
// not members of one shared ordering domain.
type ConfigSnapshotRevision struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Component:
	//
	//	*ConfigSnapshotRevision_SandboxConfig
	//	*ConfigSnapshotRevision_ProviderEnvironment
	//	*ConfigSnapshotRevision_ProviderTarget
	Component     isConfigSnapshotRevision_Component `protobuf_oneof:"component"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ConfigSnapshotRevision) Reset() {
	*x = ConfigSnapshotRevision{}
	mi := &file_openshell_proto_msgTypes[56]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ConfigSnapshotRevision) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ConfigSnapshotRevision) ProtoMessage() {}

func (x *ConfigSnapshotRevision) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[56]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ConfigSnapshotRevision.ProtoReflect.Descriptor instead.
func (*ConfigSnapshotRevision) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{56}
}

func (x *ConfigSnapshotRevision) GetComponent() isConfigSnapshotRevision_Component {
	if x != nil {
		return x.Component
	}
	return nil
}

func (x *ConfigSnapshotRevision) GetSandboxConfig() *SandboxConfigRevision {
	if x != nil {
		if x, ok := x.Component.(*ConfigSnapshotRevision_SandboxConfig); ok {
			return x.SandboxConfig
		}
	}
	return nil
}

func (x *ConfigSnapshotRevision) GetProviderEnvironment() uint64 {
	if x != nil {
		if x, ok := x.Component.(*ConfigSnapshotRevision_ProviderEnvironment); ok {
			return x.ProviderEnvironment
		}
	}
	return 0
}

func (x *ConfigSnapshotRevision) GetProviderTarget() *ProviderDesiredIdentity {
	if x != nil {
		if x, ok := x.Component.(*ConfigSnapshotRevision_ProviderTarget); ok {
			return x.ProviderTarget
		}
	}
	return nil
}

type isConfigSnapshotRevision_Component interface {
	isConfigSnapshotRevision_Component()
}

type ConfigSnapshotRevision_SandboxConfig struct {
	SandboxConfig *SandboxConfigRevision `protobuf:"bytes,1,opt,name=sandbox_config,json=sandboxConfig,proto3,oneof"`
}

type ConfigSnapshotRevision_ProviderEnvironment struct {
	ProviderEnvironment uint64 `protobuf:"varint,2,opt,name=provider_environment,json=providerEnvironment,proto3,oneof"`
}

type ConfigSnapshotRevision_ProviderTarget struct {
	// Complete desired authority for one sandbox-scoped provider mutation.
	ProviderTarget *ProviderDesiredIdentity `protobuf:"bytes,3,opt,name=provider_target,json=providerTarget,proto3,oneof"`
}

func (*ConfigSnapshotRevision_SandboxConfig) isConfigSnapshotRevision_Component() {}

func (*ConfigSnapshotRevision_ProviderEnvironment) isConfigSnapshotRevision_Component() {}

func (*ConfigSnapshotRevision_ProviderTarget) isConfigSnapshotRevision_Component() {}

// Identity needed to correlate effective sandbox configuration with the
// policy-history row whose apply status the gateway records.
type SandboxConfigRevision struct {
	state               protoimpl.MessageState `protogen:"open.v1"`
	ConfigRevision      uint64                 `protobuf:"varint,1,opt,name=config_revision,json=configRevision,proto3" json:"config_revision,omitempty"`
	PolicyVersion       uint32                 `protobuf:"varint,2,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	PolicySource        sandboxv1.PolicySource `protobuf:"varint,3,opt,name=policy_source,json=policySource,proto3,enum=openshell.sandbox.v1.PolicySource" json:"policy_source,omitempty"`
	GlobalPolicyVersion uint32                 `protobuf:"varint,4,opt,name=global_policy_version,json=globalPolicyVersion,proto3" json:"global_policy_version,omitempty"`
	// Monotonic revision of the sandbox-scoped settings row. This disambiguates
	// setting operations whose effective config fingerprint is equality-only.
	SettingsRevision uint64 `protobuf:"varint,5,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *SandboxConfigRevision) Reset() {
	*x = SandboxConfigRevision{}
	mi := &file_openshell_proto_msgTypes[57]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxConfigRevision) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxConfigRevision) ProtoMessage() {}

func (x *SandboxConfigRevision) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[57]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxConfigRevision.ProtoReflect.Descriptor instead.
func (*SandboxConfigRevision) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{57}
}

func (x *SandboxConfigRevision) GetConfigRevision() uint64 {
	if x != nil {
		return x.ConfigRevision
	}
	return 0
}

func (x *SandboxConfigRevision) GetPolicyVersion() uint32 {
	if x != nil {
		return x.PolicyVersion
	}
	return 0
}

func (x *SandboxConfigRevision) GetPolicySource() sandboxv1.PolicySource {
	if x != nil {
		return x.PolicySource
	}
	return sandboxv1.PolicySource(0)
}

func (x *SandboxConfigRevision) GetGlobalPolicyVersion() uint32 {
	if x != nil {
		return x.GlobalPolicyVersion
	}
	return 0
}

func (x *SandboxConfigRevision) GetSettingsRevision() uint64 {
	if x != nil {
		return x.SettingsRevision
	}
	return 0
}

// Durable progress for one sandbox-scoped desired-state mutation. Snapshot
// contents and credentials are never stored in this resource.
type ConfigUpdateOperation struct {
	state          protoimpl.MessageState     `protogen:"open.v1"`
	OperationId    string                     `protobuf:"bytes,1,opt,name=operation_id,json=operationId,proto3" json:"operation_id,omitempty"`
	SandboxId      string                     `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	Component      ConfigComponent            `protobuf:"varint,3,opt,name=component,proto3,enum=openshell.v1.ConfigComponent" json:"component,omitempty"`
	TargetRevision *ConfigSnapshotRevision    `protobuf:"bytes,4,opt,name=target_revision,json=targetRevision,proto3" json:"target_revision,omitempty"`
	State          ConfigUpdateOperationState `protobuf:"varint,5,opt,name=state,proto3,enum=openshell.v1.ConfigUpdateOperationState" json:"state,omitempty"`
	Outcome        ConfigApplyOutcome         `protobuf:"varint,6,opt,name=outcome,proto3,enum=openshell.v1.ConfigApplyOutcome" json:"outcome,omitempty"`
	SanitizedError string                     `protobuf:"bytes,7,opt,name=sanitized_error,json=sanitizedError,proto3" json:"sanitized_error,omitempty"`
	CreatedTime    *timestamppb.Timestamp     `protobuf:"bytes,108,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"`
	UpdatedTime    *timestamppb.Timestamp     `protobuf:"bytes,109,opt,name=updated_time,json=updatedTime,proto3" json:"updated_time,omitempty"`
	// Absent until the operation reaches a terminal state.
	CompletedTime *timestamppb.Timestamp `protobuf:"bytes,110,opt,name=completed_time,json=completedTime,proto3" json:"completed_time,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ConfigUpdateOperation) Reset() {
	*x = ConfigUpdateOperation{}
	mi := &file_openshell_proto_msgTypes[58]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ConfigUpdateOperation) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ConfigUpdateOperation) ProtoMessage() {}

func (x *ConfigUpdateOperation) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[58]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ConfigUpdateOperation.ProtoReflect.Descriptor instead.
func (*ConfigUpdateOperation) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{58}
}

func (x *ConfigUpdateOperation) GetOperationId() string {
	if x != nil {
		return x.OperationId
	}
	return ""
}

func (x *ConfigUpdateOperation) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ConfigUpdateOperation) GetComponent() ConfigComponent {
	if x != nil {
		return x.Component
	}
	return ConfigComponent_CONFIG_COMPONENT_UNSPECIFIED
}

func (x *ConfigUpdateOperation) GetTargetRevision() *ConfigSnapshotRevision {
	if x != nil {
		return x.TargetRevision
	}
	return nil
}

func (x *ConfigUpdateOperation) GetState() ConfigUpdateOperationState {
	if x != nil {
		return x.State
	}
	return ConfigUpdateOperationState_CONFIG_UPDATE_OPERATION_STATE_UNSPECIFIED
}

func (x *ConfigUpdateOperation) GetOutcome() ConfigApplyOutcome {
	if x != nil {
		return x.Outcome
	}
	return ConfigApplyOutcome_CONFIG_APPLY_OUTCOME_UNSPECIFIED
}

func (x *ConfigUpdateOperation) GetSanitizedError() string {
	if x != nil {
		return x.SanitizedError
	}
	return ""
}

func (x *ConfigUpdateOperation) GetCreatedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.CreatedTime
	}
	return nil
}

func (x *ConfigUpdateOperation) GetUpdatedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.UpdatedTime
	}
	return nil
}

func (x *ConfigUpdateOperation) GetCompletedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.CompletedTime
	}
	return nil
}

// Immutable, secret-free record of one sandbox's intended provider mutation.
type ProviderMutationReceipt struct {
	state     protoimpl.MessageState `protogen:"open.v1"`
	ReceiptId string                 `protobuf:"bytes,1,opt,name=receipt_id,json=receiptId,proto3" json:"receipt_id,omitempty"`
	// Shared by all sandbox receipts from one provider update.
	MutationId    string                   `protobuf:"bytes,2,opt,name=mutation_id,json=mutationId,proto3" json:"mutation_id,omitempty"`
	Provider      string                   `protobuf:"bytes,3,opt,name=provider,proto3" json:"provider,omitempty"`
	Workspace     string                   `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"`
	Kind          ProviderMutationKind     `protobuf:"varint,5,opt,name=kind,proto3,enum=openshell.v1.ProviderMutationKind" json:"kind,omitempty"`
	Desired       *ProviderDesiredIdentity `protobuf:"bytes,6,opt,name=desired,proto3" json:"desired,omitempty"`
	PersistedTime *timestamppb.Timestamp   `protobuf:"bytes,107,opt,name=persisted_time,json=persistedTime,proto3" json:"persisted_time,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderMutationReceipt) Reset() {
	*x = ProviderMutationReceipt{}
	mi := &file_openshell_proto_msgTypes[59]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderMutationReceipt) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderMutationReceipt) ProtoMessage() {}

func (x *ProviderMutationReceipt) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[59]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderMutationReceipt.ProtoReflect.Descriptor instead.
func (*ProviderMutationReceipt) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{59}
}

func (x *ProviderMutationReceipt) GetReceiptId() string {
	if x != nil {
		return x.ReceiptId
	}
	return ""
}

func (x *ProviderMutationReceipt) GetMutationId() string {
	if x != nil {
		return x.MutationId
	}
	return ""
}

func (x *ProviderMutationReceipt) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *ProviderMutationReceipt) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

func (x *ProviderMutationReceipt) GetKind() ProviderMutationKind {
	if x != nil {
		return x.Kind
	}
	return ProviderMutationKind_PROVIDER_MUTATION_KIND_UNSPECIFIED
}

func (x *ProviderMutationReceipt) GetDesired() *ProviderDesiredIdentity {
	if x != nil {
		return x.Desired
	}
	return nil
}

func (x *ProviderMutationReceipt) GetPersistedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.PersistedTime
	}
	return nil
}

// Installed state reported by the current supervisor. Process installation is
// acknowledged by the authenticated sandbox boundary after replacing its
// environment for future process launches.
type ProviderReadinessObservation struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-issued identifier from the current ConnectSupervisor response.
	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// Monotonic only within this connection; unrelated to revision fingerprints.
	Sequence                   uint64                  `protobuf:"varint,2,opt,name=sequence,proto3" json:"sequence,omitempty"`
	AttachmentEpoch            string                  `protobuf:"bytes,3,opt,name=attachment_epoch,json=attachmentEpoch,proto3" json:"attachment_epoch,omitempty"`
	ProviderEnvRevision        uint64                  `protobuf:"varint,4,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"`
	ConfigRevision             uint64                  `protobuf:"varint,5,opt,name=config_revision,json=configRevision,proto3" json:"config_revision,omitempty"`
	PolicyHash                 string                  `protobuf:"bytes,6,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	CredentialsInstalled       bool                    `protobuf:"varint,7,opt,name=credentials_installed,json=credentialsInstalled,proto3" json:"credentials_installed,omitempty"`
	PolicyActive               bool                    `protobuf:"varint,8,opt,name=policy_active,json=policyActive,proto3" json:"policy_active,omitempty"`
	LaunchEnvironmentInstalled bool                    `protobuf:"varint,9,opt,name=launch_environment_installed,json=launchEnvironmentInstalled,proto3" json:"launch_environment_installed,omitempty"`
	ProcessInstanceId          string                  `protobuf:"bytes,10,opt,name=process_instance_id,json=processInstanceId,proto3" json:"process_instance_id,omitempty"`
	Reason                     ProviderReadinessReason `protobuf:"varint,11,opt,name=reason,proto3,enum=openshell.v1.ProviderReadinessReason" json:"reason,omitempty"`
	unknownFields              protoimpl.UnknownFields
	sizeCache                  protoimpl.SizeCache
}

func (x *ProviderReadinessObservation) Reset() {
	*x = ProviderReadinessObservation{}
	mi := &file_openshell_proto_msgTypes[60]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderReadinessObservation) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderReadinessObservation) ProtoMessage() {}

func (x *ProviderReadinessObservation) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[60]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderReadinessObservation.ProtoReflect.Descriptor instead.
func (*ProviderReadinessObservation) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{60}
}

func (x *ProviderReadinessObservation) GetSessionId() string {
	if x != nil {
		return x.SessionId
	}
	return ""
}

func (x *ProviderReadinessObservation) GetSequence() uint64 {
	if x != nil {
		return x.Sequence
	}
	return 0
}

func (x *ProviderReadinessObservation) GetAttachmentEpoch() string {
	if x != nil {
		return x.AttachmentEpoch
	}
	return ""
}

func (x *ProviderReadinessObservation) GetProviderEnvRevision() uint64 {
	if x != nil {
		return x.ProviderEnvRevision
	}
	return 0
}

func (x *ProviderReadinessObservation) GetConfigRevision() uint64 {
	if x != nil {
		return x.ConfigRevision
	}
	return 0
}

func (x *ProviderReadinessObservation) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *ProviderReadinessObservation) GetCredentialsInstalled() bool {
	if x != nil {
		return x.CredentialsInstalled
	}
	return false
}

func (x *ProviderReadinessObservation) GetPolicyActive() bool {
	if x != nil {
		return x.PolicyActive
	}
	return false
}

func (x *ProviderReadinessObservation) GetLaunchEnvironmentInstalled() bool {
	if x != nil {
		return x.LaunchEnvironmentInstalled
	}
	return false
}

func (x *ProviderReadinessObservation) GetProcessInstanceId() string {
	if x != nil {
		return x.ProcessInstanceId
	}
	return ""
}

func (x *ProviderReadinessObservation) GetReason() ProviderReadinessReason {
	if x != nil {
		return x.Reason
	}
	return ProviderReadinessReason_PROVIDER_READINESS_REASON_UNSPECIFIED
}

// Operator view of desired and observed state; contains no credential material.
type ProviderReadinessStatus struct {
	state             protoimpl.MessageState        `protogen:"open.v1"`
	Receipt           *ProviderMutationReceipt      `protobuf:"bytes,1,opt,name=receipt,proto3" json:"receipt,omitempty"`
	State             ProviderReadinessState        `protobuf:"varint,2,opt,name=state,proto3,enum=openshell.v1.ProviderReadinessState" json:"state,omitempty"`
	Reason            ProviderReadinessReason       `protobuf:"varint,3,opt,name=reason,proto3,enum=openshell.v1.ProviderReadinessReason" json:"reason,omitempty"`
	Observed          *ProviderReadinessObservation `protobuf:"bytes,4,opt,name=observed,proto3" json:"observed,omitempty"`
	NetworkInstanceId string                        `protobuf:"bytes,5,opt,name=network_instance_id,json=networkInstanceId,proto3" json:"network_instance_id,omitempty"`
	// Absent until the current supervisor session supplies accepted evidence.
	ObservedTime  *timestamppb.Timestamp `protobuf:"bytes,106,opt,name=observed_time,json=observedTime,proto3" json:"observed_time,omitempty"`
	EvaluatedTime *timestamppb.Timestamp `protobuf:"bytes,107,opt,name=evaluated_time,json=evaluatedTime,proto3" json:"evaluated_time,omitempty"`
	// Durable operation for the receipt, including its terminal apply outcome.
	Operation     *ConfigUpdateOperation `protobuf:"bytes,8,opt,name=operation,proto3" json:"operation,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderReadinessStatus) Reset() {
	*x = ProviderReadinessStatus{}
	mi := &file_openshell_proto_msgTypes[61]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderReadinessStatus) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderReadinessStatus) ProtoMessage() {}

func (x *ProviderReadinessStatus) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[61]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderReadinessStatus.ProtoReflect.Descriptor instead.
func (*ProviderReadinessStatus) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{61}
}

func (x *ProviderReadinessStatus) GetReceipt() *ProviderMutationReceipt {
	if x != nil {
		return x.Receipt
	}
	return nil
}

func (x *ProviderReadinessStatus) GetState() ProviderReadinessState {
	if x != nil {
		return x.State
	}
	return ProviderReadinessState_PROVIDER_READINESS_STATE_UNSPECIFIED
}

func (x *ProviderReadinessStatus) GetReason() ProviderReadinessReason {
	if x != nil {
		return x.Reason
	}
	return ProviderReadinessReason_PROVIDER_READINESS_REASON_UNSPECIFIED
}

func (x *ProviderReadinessStatus) GetObserved() *ProviderReadinessObservation {
	if x != nil {
		return x.Observed
	}
	return nil
}

func (x *ProviderReadinessStatus) GetNetworkInstanceId() string {
	if x != nil {
		return x.NetworkInstanceId
	}
	return ""
}

func (x *ProviderReadinessStatus) GetObservedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ObservedTime
	}
	return nil
}

func (x *ProviderReadinessStatus) GetEvaluatedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.EvaluatedTime
	}
	return nil
}

func (x *ProviderReadinessStatus) GetOperation() *ConfigUpdateOperation {
	if x != nil {
		return x.Operation
	}
	return nil
}

// Query an immutable receipt, or reconstruct the current desired state when
// receipt_id is empty. The sandbox identity must match the receipt.
type GetSandboxProviderStatusRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Sandbox        string                         `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	Provider       string                         `protobuf:"bytes,2,opt,name=provider,proto3" json:"provider,omitempty"`
	ReceiptId      string                         `protobuf:"bytes,3,opt,name=receipt_id,json=receiptId,proto3" json:"receipt_id,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *GetSandboxProviderStatusRequest) Reset() {
	*x = GetSandboxProviderStatusRequest{}
	mi := &file_openshell_proto_msgTypes[62]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxProviderStatusRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxProviderStatusRequest) ProtoMessage() {}

func (x *GetSandboxProviderStatusRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[62]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxProviderStatusRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxProviderStatusRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{62}
}

func (x *GetSandboxProviderStatusRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetSandboxProviderStatusRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *GetSandboxProviderStatusRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *GetSandboxProviderStatusRequest) GetReceiptId() string {
	if x != nil {
		return x.ReceiptId
	}
	return ""
}

type GetSandboxProviderStatusResponse struct {
	state         protoimpl.MessageState   `protogen:"open.v1"`
	Status        *ProviderReadinessStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxProviderStatusResponse) Reset() {
	*x = GetSandboxProviderStatusResponse{}
	mi := &file_openshell_proto_msgTypes[63]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxProviderStatusResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxProviderStatusResponse) ProtoMessage() {}

func (x *GetSandboxProviderStatusResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[63]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxProviderStatusResponse.ProtoReflect.Descriptor instead.
func (*GetSandboxProviderStatusResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{63}
}

func (x *GetSandboxProviderStatusResponse) GetStatus() *ProviderReadinessStatus {
	if x != nil {
		return x.Status
	}
	return nil
}

// Installation evidence from the authenticated supervisor for this sandbox.
// A caller-provided instance identifier alone never establishes authority.
type ReportProviderReadinessRequest struct {
	state         protoimpl.MessageState        `protogen:"open.v1"`
	SandboxId     string                        `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	Observation   *ProviderReadinessObservation `protobuf:"bytes,2,opt,name=observation,proto3" json:"observation,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportProviderReadinessRequest) Reset() {
	*x = ReportProviderReadinessRequest{}
	mi := &file_openshell_proto_msgTypes[64]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportProviderReadinessRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportProviderReadinessRequest) ProtoMessage() {}

func (x *ReportProviderReadinessRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[64]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportProviderReadinessRequest.ProtoReflect.Descriptor instead.
func (*ReportProviderReadinessRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{64}
}

func (x *ReportProviderReadinessRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ReportProviderReadinessRequest) GetObservation() *ProviderReadinessObservation {
	if x != nil {
		return x.Observation
	}
	return nil
}

// Acknowledges accepted evidence without granting a separate session authority.
// Identical retries do not extend the evidence's original acceptance time.
type ReportProviderReadinessResponse struct {
	state            protoimpl.MessageState `protogen:"open.v1"`
	AcceptedSequence uint64                 `protobuf:"varint,1,opt,name=accepted_sequence,json=acceptedSequence,proto3" json:"accepted_sequence,omitempty"`
	ReportInterval   *durationpb.Duration   `protobuf:"bytes,102,opt,name=report_interval,json=reportInterval,proto3" json:"report_interval,omitempty"`
	ObservationTtl   *durationpb.Duration   `protobuf:"bytes,103,opt,name=observation_ttl,json=observationTtl,proto3" json:"observation_ttl,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *ReportProviderReadinessResponse) Reset() {
	*x = ReportProviderReadinessResponse{}
	mi := &file_openshell_proto_msgTypes[65]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportProviderReadinessResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportProviderReadinessResponse) ProtoMessage() {}

func (x *ReportProviderReadinessResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[65]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportProviderReadinessResponse.ProtoReflect.Descriptor instead.
func (*ReportProviderReadinessResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{65}
}

func (x *ReportProviderReadinessResponse) GetAcceptedSequence() uint64 {
	if x != nil {
		return x.AcceptedSequence
	}
	return 0
}

func (x *ReportProviderReadinessResponse) GetReportInterval() *durationpb.Duration {
	if x != nil {
		return x.ReportInterval
	}
	return nil
}

func (x *ReportProviderReadinessResponse) GetObservationTtl() *durationpb.Duration {
	if x != nil {
		return x.ObservationTtl
	}
	return nil
}

// Delete sandbox response.
type DeleteSandboxResponse struct {
	state   protoimpl.MessageState `protogen:"open.v1"`
	Outcome DeletionOutcome        `protobuf:"varint,2,opt,name=outcome,proto3,enum=openshell.v1.DeletionOutcome" json:"outcome,omitempty"`
	// Immutable identity of the targeted sandbox, empty for ALREADY_ABSENT.
	// A same-name replacement is not part of this deletion.
	SandboxId     string `protobuf:"bytes,3,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteSandboxResponse) Reset() {
	*x = DeleteSandboxResponse{}
	mi := &file_openshell_proto_msgTypes[66]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteSandboxResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteSandboxResponse) ProtoMessage() {}

func (x *DeleteSandboxResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[66]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteSandboxResponse.ProtoReflect.Descriptor instead.
func (*DeleteSandboxResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{66}
}

func (x *DeleteSandboxResponse) GetOutcome() DeletionOutcome {
	if x != nil {
		return x.Outcome
	}
	return DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED
}

func (x *DeleteSandboxResponse) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

// Create SSH session request.
type CreateSshSessionRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Sandbox        string                         `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *CreateSshSessionRequest) Reset() {
	*x = CreateSshSessionRequest{}
	mi := &file_openshell_proto_msgTypes[67]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateSshSessionRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateSshSessionRequest) ProtoMessage() {}

func (x *CreateSshSessionRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[67]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateSshSessionRequest.ProtoReflect.Descriptor instead.
func (*CreateSshSessionRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{67}
}

func (x *CreateSshSessionRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *CreateSshSessionRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

// Create SSH session response.
//
// Fields are interpolated into an SSH `ProxyCommand` string that OpenSSH
// executes through `/bin/sh -c` on the caller's workstation. Servers MUST
// uphold the charset contract below; clients MUST reject responses that
// violate it. The client's own escaping provides defense-in-depth, but
// narrow charsets close injection vectors at the trust boundary.
type CreateSshSessionResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id. [A-Za-z0-9._-]{1,128}.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Session token for the gateway tunnel. URL-safe ASCII
	// ([A-Za-z0-9._~+/=-]) up to 4096 bytes. No shell metacharacters or
	// whitespace.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// Gateway host for SSH proxy connection. IPv4 address, bracketed IPv6
	// address, or DNS hostname (Punycode-encoded for IDN). Alphanumeric plus
	// `.-:[]` only, up to 253 bytes.
	GatewayHost string `protobuf:"bytes,3,opt,name=gateway_host,json=gatewayHost,proto3" json:"gateway_host,omitempty"`
	// Gateway port for SSH proxy connection. Must be in range 1..=65535.
	GatewayPort uint32 `protobuf:"varint,4,opt,name=gateway_port,json=gatewayPort,proto3" json:"gateway_port,omitempty"`
	// Gateway scheme. Must be exactly "http" or "https".
	GatewayScheme string `protobuf:"bytes,5,opt,name=gateway_scheme,json=gatewayScheme,proto3" json:"gateway_scheme,omitempty"`
	// Optional host key fingerprint. If non-empty, [A-Za-z0-9:+/=-] only.
	HostKeyFingerprint string `protobuf:"bytes,7,opt,name=host_key_fingerprint,json=hostKeyFingerprint,proto3" json:"host_key_fingerprint,omitempty"`
	// Absolute expiry. Absence means no expiry.
	ExpirationTime *timestamppb.Timestamp `protobuf:"bytes,108,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *CreateSshSessionResponse) Reset() {
	*x = CreateSshSessionResponse{}
	mi := &file_openshell_proto_msgTypes[68]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateSshSessionResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateSshSessionResponse) ProtoMessage() {}

func (x *CreateSshSessionResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[68]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateSshSessionResponse.ProtoReflect.Descriptor instead.
func (*CreateSshSessionResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{68}
}

func (x *CreateSshSessionResponse) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *CreateSshSessionResponse) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *CreateSshSessionResponse) GetGatewayHost() string {
	if x != nil {
		return x.GatewayHost
	}
	return ""
}

func (x *CreateSshSessionResponse) GetGatewayPort() uint32 {
	if x != nil {
		return x.GatewayPort
	}
	return 0
}

func (x *CreateSshSessionResponse) GetGatewayScheme() string {
	if x != nil {
		return x.GatewayScheme
	}
	return ""
}

func (x *CreateSshSessionResponse) GetHostKeyFingerprint() string {
	if x != nil {
		return x.HostKeyFingerprint
	}
	return ""
}

func (x *CreateSshSessionResponse) GetExpirationTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ExpirationTime
	}
	return nil
}

// Request to expose an HTTP service running inside a sandbox.
type ExposeServiceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,5,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Service name within the sandbox.
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// Loopback TCP port inside the sandbox.
	TargetPort uint32 `protobuf:"varint,3,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
	// Whether to print/use the browser-facing service URL.
	Domain  bool   `protobuf:"varint,4,opt,name=domain,proto3" json:"domain,omitempty"`
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,6,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExposeServiceRequest) Reset() {
	*x = ExposeServiceRequest{}
	mi := &file_openshell_proto_msgTypes[69]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExposeServiceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExposeServiceRequest) ProtoMessage() {}

func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[69]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead.
func (*ExposeServiceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{69}
}

func (x *ExposeServiceRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ExposeServiceRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ExposeServiceRequest) GetTargetPort() uint32 {
	if x != nil {
		return x.TargetPort
	}
	return 0
}

func (x *ExposeServiceRequest) GetDomain() bool {
	if x != nil {
		return x.Domain
	}
	return false
}

func (x *ExposeServiceRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *ExposeServiceRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Request to fetch an exposed sandbox service endpoint.
type GetServiceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Service name within the sandbox. Empty selects the unnamed endpoint.
	Name          string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Sandbox       string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetServiceRequest) Reset() {
	*x = GetServiceRequest{}
	mi := &file_openshell_proto_msgTypes[70]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetServiceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetServiceRequest) ProtoMessage() {}

func (x *GetServiceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[70]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetServiceRequest.ProtoReflect.Descriptor instead.
func (*GetServiceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{70}
}

func (x *GetServiceRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetServiceRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *GetServiceRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

// Request to list exposed sandbox service endpoints.
type ListServicesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Named and all-workspaces selections are accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// The maximum number of services to return. Zero uses 100. Values above
	// 1000 are coerced to 1000; negative values are invalid.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Token from a previous ListServices response. All other request parameters
	// except page_size must match the request that produced it.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Optional sandbox name. Empty lists endpoints for all sandboxes.
	Sandbox       string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListServicesRequest) Reset() {
	*x = ListServicesRequest{}
	mi := &file_openshell_proto_msgTypes[71]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListServicesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListServicesRequest) ProtoMessage() {}

func (x *ListServicesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[71]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListServicesRequest.ProtoReflect.Descriptor instead.
func (*ListServicesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{71}
}

func (x *ListServicesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ListServicesRequest) GetPageSize() int32 {
	if x != nil {
		return x.PageSize
	}
	return 0
}

func (x *ListServicesRequest) GetPageToken() string {
	if x != nil {
		return x.PageToken
	}
	return ""
}

func (x *ListServicesRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

// Response containing exposed sandbox service endpoints.
type ListServicesResponse struct {
	state    protoimpl.MessageState     `protogen:"open.v1"`
	Services []*ServiceEndpointResponse `protobuf:"bytes,1,rep,name=services,proto3" json:"services,omitempty"`
	// Token for the next page. Empty when there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListServicesResponse) Reset() {
	*x = ListServicesResponse{}
	mi := &file_openshell_proto_msgTypes[72]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListServicesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListServicesResponse) ProtoMessage() {}

func (x *ListServicesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[72]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListServicesResponse.ProtoReflect.Descriptor instead.
func (*ListServicesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{72}
}

func (x *ListServicesResponse) GetServices() []*ServiceEndpointResponse {
	if x != nil {
		return x.Services
	}
	return nil
}

func (x *ListServicesResponse) GetNextPageToken() string {
	if x != nil {
		return x.NextPageToken
	}
	return ""
}

// Request to delete an exposed sandbox service endpoint.
type DeleteServiceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Service name within the sandbox. Empty selects the unnamed endpoint.
	Name         string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Sandbox      string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	AllowMissing bool   `protobuf:"varint,4,opt,name=allow_missing,json=allowMissing,proto3" json:"allow_missing,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,5,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteServiceRequest) Reset() {
	*x = DeleteServiceRequest{}
	mi := &file_openshell_proto_msgTypes[73]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteServiceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteServiceRequest) ProtoMessage() {}

func (x *DeleteServiceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[73]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteServiceRequest.ProtoReflect.Descriptor instead.
func (*DeleteServiceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{73}
}

func (x *DeleteServiceRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *DeleteServiceRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *DeleteServiceRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *DeleteServiceRequest) GetAllowMissing() bool {
	if x != nil {
		return x.AllowMissing
	}
	return false
}

func (x *DeleteServiceRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Response for deleting an exposed sandbox service endpoint.
type DeleteServiceResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Outcome       DeletionOutcome        `protobuf:"varint,2,opt,name=outcome,proto3,enum=openshell.v1.DeletionOutcome" json:"outcome,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteServiceResponse) Reset() {
	*x = DeleteServiceResponse{}
	mi := &file_openshell_proto_msgTypes[74]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteServiceResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteServiceResponse) ProtoMessage() {}

func (x *DeleteServiceResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[74]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteServiceResponse.ProtoReflect.Descriptor instead.
func (*DeleteServiceResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{74}
}

func (x *DeleteServiceResponse) GetOutcome() DeletionOutcome {
	if x != nil {
		return x.Outcome
	}
	return DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED
}

// Persisted sandbox service endpoint.
type ServiceEndpoint struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Kubernetes-style metadata.
	Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Sandbox object ID.
	SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Sandbox name.
	Sandbox string `protobuf:"bytes,3,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Service name within the sandbox.
	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
	// Loopback TCP port inside the sandbox.
	TargetPort uint32 `protobuf:"varint,5,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
	// Whether browser-facing service routing is enabled for this endpoint.
	Domain        bool `protobuf:"varint,6,opt,name=domain,proto3" json:"domain,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ServiceEndpoint) Reset() {
	*x = ServiceEndpoint{}
	mi := &file_openshell_proto_msgTypes[75]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ServiceEndpoint) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ServiceEndpoint) ProtoMessage() {}

func (x *ServiceEndpoint) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[75]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ServiceEndpoint.ProtoReflect.Descriptor instead.
func (*ServiceEndpoint) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{75}
}

func (x *ServiceEndpoint) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *ServiceEndpoint) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ServiceEndpoint) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *ServiceEndpoint) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ServiceEndpoint) GetTargetPort() uint32 {
	if x != nil {
		return x.TargetPort
	}
	return 0
}

func (x *ServiceEndpoint) GetDomain() bool {
	if x != nil {
		return x.Domain
	}
	return false
}

// Response containing a service endpoint and, when available, its local URL.
type ServiceEndpointResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Endpoint      *ServiceEndpoint       `protobuf:"bytes,1,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
	Url           string                 `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ServiceEndpointResponse) Reset() {
	*x = ServiceEndpointResponse{}
	mi := &file_openshell_proto_msgTypes[76]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ServiceEndpointResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ServiceEndpointResponse) ProtoMessage() {}

func (x *ServiceEndpointResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[76]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ServiceEndpointResponse.ProtoReflect.Descriptor instead.
func (*ServiceEndpointResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{76}
}

func (x *ServiceEndpointResponse) GetEndpoint() *ServiceEndpoint {
	if x != nil {
		return x.Endpoint
	}
	return nil
}

func (x *ServiceEndpointResponse) GetUrl() string {
	if x != nil {
		return x.Url
	}
	return ""
}

// Revoke SSH session request.
type RevokeSshSessionRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Session token to revoke.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// A missing token is NOT_FOUND unless this is true. Revoking an existing,
	// already-revoked session succeeds with COMPLETED.
	AllowMissing  bool `protobuf:"varint,2,opt,name=allow_missing,json=allowMissing,proto3" json:"allow_missing,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RevokeSshSessionRequest) Reset() {
	*x = RevokeSshSessionRequest{}
	mi := &file_openshell_proto_msgTypes[77]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RevokeSshSessionRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RevokeSshSessionRequest) ProtoMessage() {}

func (x *RevokeSshSessionRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[77]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RevokeSshSessionRequest.ProtoReflect.Descriptor instead.
func (*RevokeSshSessionRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{77}
}

func (x *RevokeSshSessionRequest) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *RevokeSshSessionRequest) GetAllowMissing() bool {
	if x != nil {
		return x.AllowMissing
	}
	return false
}

// Revoke SSH session response.
type RevokeSshSessionResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Outcome       DeletionOutcome        `protobuf:"varint,2,opt,name=outcome,proto3,enum=openshell.v1.DeletionOutcome" json:"outcome,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RevokeSshSessionResponse) Reset() {
	*x = RevokeSshSessionResponse{}
	mi := &file_openshell_proto_msgTypes[78]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RevokeSshSessionResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RevokeSshSessionResponse) ProtoMessage() {}

func (x *RevokeSshSessionResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[78]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RevokeSshSessionResponse.ProtoReflect.Descriptor instead.
func (*RevokeSshSessionResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{78}
}

func (x *RevokeSshSessionResponse) GetOutcome() DeletionOutcome {
	if x != nil {
		return x.Outcome
	}
	return DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED
}

// Execute command request.
type ExecSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,12,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Canonical sandbox name.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Command and arguments.
	Command []string `protobuf:"bytes,2,rep,name=command,proto3" json:"command,omitempty"`
	// Optional working directory.
	Workdir string `protobuf:"bytes,3,opt,name=workdir,proto3" json:"workdir,omitempty"`
	// Optional environment overrides.
	Environment map[string]string `protobuf:"bytes,4,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Optional execution timeout. Absence means no timeout.
	ExecutionTimeout *durationpb.Duration `protobuf:"bytes,105,opt,name=execution_timeout,json=executionTimeout,proto3" json:"execution_timeout,omitempty"`
	// Optional stdin payload passed to the command.
	Stdin []byte `protobuf:"bytes,6,opt,name=stdin,proto3" json:"stdin,omitempty"`
	// Request a pseudo-terminal for the remote command.
	Tty bool `protobuf:"varint,7,opt,name=tty,proto3" json:"tty,omitempty"`
	// Initial terminal columns (used when tty=true, 0 = use default).
	Cols uint32 `protobuf:"varint,8,opt,name=cols,proto3" json:"cols,omitempty"`
	// Initial terminal rows (used when tty=true, 0 = use default).
	Rows uint32 `protobuf:"varint,9,opt,name=rows,proto3" json:"rows,omitempty"`
	// Skip sourcing shell login/profile startup files before running the command.
	// When false (the default), the command runs through a login shell
	// (`bash -lc`) so user startup files (.bash_profile/.profile, and .bashrc if
	// sourced by them) are applied. When true, the command runs without those
	// files (`bash -c`), for automation that needs predictable startup behavior.
	NoLoginShell  bool `protobuf:"varint,10,opt,name=no_login_shell,json=noLoginShell,proto3" json:"no_login_shell,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxRequest) Reset() {
	*x = ExecSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[79]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxRequest) ProtoMessage() {}

func (x *ExecSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[79]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxRequest.ProtoReflect.Descriptor instead.
func (*ExecSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{79}
}

func (x *ExecSandboxRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ExecSandboxRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *ExecSandboxRequest) GetCommand() []string {
	if x != nil {
		return x.Command
	}
	return nil
}

func (x *ExecSandboxRequest) GetWorkdir() string {
	if x != nil {
		return x.Workdir
	}
	return ""
}

func (x *ExecSandboxRequest) GetEnvironment() map[string]string {
	if x != nil {
		return x.Environment
	}
	return nil
}

func (x *ExecSandboxRequest) GetExecutionTimeout() *durationpb.Duration {
	if x != nil {
		return x.ExecutionTimeout
	}
	return nil
}

func (x *ExecSandboxRequest) GetStdin() []byte {
	if x != nil {
		return x.Stdin
	}
	return nil
}

func (x *ExecSandboxRequest) GetTty() bool {
	if x != nil {
		return x.Tty
	}
	return false
}

func (x *ExecSandboxRequest) GetCols() uint32 {
	if x != nil {
		return x.Cols
	}
	return 0
}

func (x *ExecSandboxRequest) GetRows() uint32 {
	if x != nil {
		return x.Rows
	}
	return 0
}

func (x *ExecSandboxRequest) GetNoLoginShell() bool {
	if x != nil {
		return x.NoLoginShell
	}
	return false
}

// One stdout chunk from a sandbox exec.
type ExecSandboxStdout struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Data          []byte                 `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxStdout) Reset() {
	*x = ExecSandboxStdout{}
	mi := &file_openshell_proto_msgTypes[80]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxStdout) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxStdout) ProtoMessage() {}

func (x *ExecSandboxStdout) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[80]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxStdout.ProtoReflect.Descriptor instead.
func (*ExecSandboxStdout) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{80}
}

func (x *ExecSandboxStdout) GetData() []byte {
	if x != nil {
		return x.Data
	}
	return nil
}

// One stderr chunk from a sandbox exec.
type ExecSandboxStderr struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Data          []byte                 `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxStderr) Reset() {
	*x = ExecSandboxStderr{}
	mi := &file_openshell_proto_msgTypes[81]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxStderr) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxStderr) ProtoMessage() {}

func (x *ExecSandboxStderr) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[81]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxStderr.ProtoReflect.Descriptor instead.
func (*ExecSandboxStderr) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{81}
}

func (x *ExecSandboxStderr) GetData() []byte {
	if x != nil {
		return x.Data
	}
	return nil
}

// Final exit status for a sandbox exec.
type ExecSandboxExit struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	ExitCode      int32                  `protobuf:"varint,1,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxExit) Reset() {
	*x = ExecSandboxExit{}
	mi := &file_openshell_proto_msgTypes[82]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxExit) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxExit) ProtoMessage() {}

func (x *ExecSandboxExit) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[82]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxExit.ProtoReflect.Descriptor instead.
func (*ExecSandboxExit) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{82}
}

func (x *ExecSandboxExit) GetExitCode() int32 {
	if x != nil {
		return x.ExitCode
	}
	return 0
}

// One event in a sandbox exec stream.
type ExecSandboxEvent struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*ExecSandboxEvent_Stdout
	//	*ExecSandboxEvent_Stderr
	//	*ExecSandboxEvent_Exit
	Payload       isExecSandboxEvent_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxEvent) Reset() {
	*x = ExecSandboxEvent{}
	mi := &file_openshell_proto_msgTypes[83]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxEvent) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxEvent) ProtoMessage() {}

func (x *ExecSandboxEvent) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[83]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxEvent.ProtoReflect.Descriptor instead.
func (*ExecSandboxEvent) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{83}
}

func (x *ExecSandboxEvent) GetPayload() isExecSandboxEvent_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *ExecSandboxEvent) GetStdout() *ExecSandboxStdout {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxEvent_Stdout); ok {
			return x.Stdout
		}
	}
	return nil
}

func (x *ExecSandboxEvent) GetStderr() *ExecSandboxStderr {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxEvent_Stderr); ok {
			return x.Stderr
		}
	}
	return nil
}

func (x *ExecSandboxEvent) GetExit() *ExecSandboxExit {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxEvent_Exit); ok {
			return x.Exit
		}
	}
	return nil
}

type isExecSandboxEvent_Payload interface {
	isExecSandboxEvent_Payload()
}

type ExecSandboxEvent_Stdout struct {
	Stdout *ExecSandboxStdout `protobuf:"bytes,1,opt,name=stdout,proto3,oneof"`
}

type ExecSandboxEvent_Stderr struct {
	Stderr *ExecSandboxStderr `protobuf:"bytes,2,opt,name=stderr,proto3,oneof"`
}

type ExecSandboxEvent_Exit struct {
	Exit *ExecSandboxExit `protobuf:"bytes,3,opt,name=exit,proto3,oneof"`
}

func (*ExecSandboxEvent_Stdout) isExecSandboxEvent_Payload() {}

func (*ExecSandboxEvent_Stderr) isExecSandboxEvent_Payload() {}

func (*ExecSandboxEvent_Exit) isExecSandboxEvent_Payload() {}

// Initial frame for one TCP forward stream.
type TcpForwardInit struct {
	state     protoimpl.MessageState `protogen:"open.v1"`
	Sandbox   string                 `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	Workspace string                 `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	// Optional service identifier for audit/correlation.
	ServiceId string `protobuf:"bytes,4,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
	// Target the gateway should request from the supervisor.
	//
	// Types that are valid to be assigned to Target:
	//
	//	*TcpForwardInit_Ssh
	//	*TcpForwardInit_Tcp
	Target isTcpForwardInit_Target `protobuf_oneof:"target"`
	// Optional target-specific authorization token. SSH targets use this as the
	// short-lived SSH session token issued by CreateSshSession.
	AuthorizationToken string `protobuf:"bytes,7,opt,name=authorization_token,json=authorizationToken,proto3" json:"authorization_token,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *TcpForwardInit) Reset() {
	*x = TcpForwardInit{}
	mi := &file_openshell_proto_msgTypes[84]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TcpForwardInit) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TcpForwardInit) ProtoMessage() {}

func (x *TcpForwardInit) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[84]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TcpForwardInit.ProtoReflect.Descriptor instead.
func (*TcpForwardInit) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{84}
}

func (x *TcpForwardInit) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *TcpForwardInit) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

func (x *TcpForwardInit) GetServiceId() string {
	if x != nil {
		return x.ServiceId
	}
	return ""
}

func (x *TcpForwardInit) GetTarget() isTcpForwardInit_Target {
	if x != nil {
		return x.Target
	}
	return nil
}

func (x *TcpForwardInit) GetSsh() *SshRelayTarget {
	if x != nil {
		if x, ok := x.Target.(*TcpForwardInit_Ssh); ok {
			return x.Ssh
		}
	}
	return nil
}

func (x *TcpForwardInit) GetTcp() *TcpRelayTarget {
	if x != nil {
		if x, ok := x.Target.(*TcpForwardInit_Tcp); ok {
			return x.Tcp
		}
	}
	return nil
}

func (x *TcpForwardInit) GetAuthorizationToken() string {
	if x != nil {
		return x.AuthorizationToken
	}
	return ""
}

type isTcpForwardInit_Target interface {
	isTcpForwardInit_Target()
}

type TcpForwardInit_Ssh struct {
	Ssh *SshRelayTarget `protobuf:"bytes,5,opt,name=ssh,proto3,oneof"`
}

type TcpForwardInit_Tcp struct {
	Tcp *TcpRelayTarget `protobuf:"bytes,6,opt,name=tcp,proto3,oneof"`
}

func (*TcpForwardInit_Ssh) isTcpForwardInit_Target() {}

func (*TcpForwardInit_Tcp) isTcpForwardInit_Target() {}

// A single frame on the CLI-to-gateway TCP forward stream.
type TcpForwardFrame struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*TcpForwardFrame_Init
	//	*TcpForwardFrame_Data
	Payload       isTcpForwardFrame_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *TcpForwardFrame) Reset() {
	*x = TcpForwardFrame{}
	mi := &file_openshell_proto_msgTypes[85]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TcpForwardFrame) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TcpForwardFrame) ProtoMessage() {}

func (x *TcpForwardFrame) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[85]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TcpForwardFrame.ProtoReflect.Descriptor instead.
func (*TcpForwardFrame) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{85}
}

func (x *TcpForwardFrame) GetPayload() isTcpForwardFrame_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *TcpForwardFrame) GetInit() *TcpForwardInit {
	if x != nil {
		if x, ok := x.Payload.(*TcpForwardFrame_Init); ok {
			return x.Init
		}
	}
	return nil
}

func (x *TcpForwardFrame) GetData() []byte {
	if x != nil {
		if x, ok := x.Payload.(*TcpForwardFrame_Data); ok {
			return x.Data
		}
	}
	return nil
}

type isTcpForwardFrame_Payload interface {
	isTcpForwardFrame_Payload()
}

type TcpForwardFrame_Init struct {
	Init *TcpForwardInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"`
}

type TcpForwardFrame_Data struct {
	Data []byte `protobuf:"bytes,2,opt,name=data,proto3,oneof"`
}

func (*TcpForwardFrame_Init) isTcpForwardFrame_Payload() {}

func (*TcpForwardFrame_Data) isTcpForwardFrame_Payload() {}

// Client-to-server message for interactive exec.
type ExecSandboxInput struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*ExecSandboxInput_Start
	//	*ExecSandboxInput_Stdin
	//	*ExecSandboxInput_Resize
	Payload       isExecSandboxInput_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxInput) Reset() {
	*x = ExecSandboxInput{}
	mi := &file_openshell_proto_msgTypes[86]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxInput) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxInput) ProtoMessage() {}

func (x *ExecSandboxInput) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[86]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxInput.ProtoReflect.Descriptor instead.
func (*ExecSandboxInput) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{86}
}

func (x *ExecSandboxInput) GetPayload() isExecSandboxInput_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *ExecSandboxInput) GetStart() *ExecSandboxRequest {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxInput_Start); ok {
			return x.Start
		}
	}
	return nil
}

func (x *ExecSandboxInput) GetStdin() []byte {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxInput_Stdin); ok {
			return x.Stdin
		}
	}
	return nil
}

func (x *ExecSandboxInput) GetResize() *ExecSandboxWindowResize {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxInput_Resize); ok {
			return x.Resize
		}
	}
	return nil
}

type isExecSandboxInput_Payload interface {
	isExecSandboxInput_Payload()
}

type ExecSandboxInput_Start struct {
	// First message: exec request metadata.
	Start *ExecSandboxRequest `protobuf:"bytes,1,opt,name=start,proto3,oneof"`
}

type ExecSandboxInput_Stdin struct {
	// Subsequent messages: raw stdin bytes.
	Stdin []byte `protobuf:"bytes,2,opt,name=stdin,proto3,oneof"`
}

type ExecSandboxInput_Resize struct {
	// Terminal window size change.
	Resize *ExecSandboxWindowResize `protobuf:"bytes,3,opt,name=resize,proto3,oneof"`
}

func (*ExecSandboxInput_Start) isExecSandboxInput_Payload() {}

func (*ExecSandboxInput_Stdin) isExecSandboxInput_Payload() {}

func (*ExecSandboxInput_Resize) isExecSandboxInput_Payload() {}

// Terminal window resize event for interactive exec.
type ExecSandboxWindowResize struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Cols          uint32                 `protobuf:"varint,1,opt,name=cols,proto3" json:"cols,omitempty"`
	Rows          uint32                 `protobuf:"varint,2,opt,name=rows,proto3" json:"rows,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxWindowResize) Reset() {
	*x = ExecSandboxWindowResize{}
	mi := &file_openshell_proto_msgTypes[87]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxWindowResize) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxWindowResize) ProtoMessage() {}

func (x *ExecSandboxWindowResize) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[87]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxWindowResize.ProtoReflect.Descriptor instead.
func (*ExecSandboxWindowResize) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{87}
}

func (x *ExecSandboxWindowResize) GetCols() uint32 {
	if x != nil {
		return x.Cols
	}
	return 0
}

func (x *ExecSandboxWindowResize) GetRows() uint32 {
	if x != nil {
		return x.Rows
	}
	return 0
}

// SSH session record stored in persistence.
type SshSession struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Kubernetes-style metadata (id, name, labels, timestamps, resource version).
	Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Sandbox id.
	SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Session token.
	Token string `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"`
	// Absolute expiry. Absence means no expiry.
	ExpirationTime *timestamppb.Timestamp `protobuf:"bytes,104,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
	// Revoked flag.
	Revoked       bool `protobuf:"varint,5,opt,name=revoked,proto3" json:"revoked,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SshSession) Reset() {
	*x = SshSession{}
	mi := &file_openshell_proto_msgTypes[88]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SshSession) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SshSession) ProtoMessage() {}

func (x *SshSession) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[88]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SshSession.ProtoReflect.Descriptor instead.
func (*SshSession) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{88}
}

func (x *SshSession) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *SshSession) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *SshSession) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *SshSession) GetExpirationTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ExpirationTime
	}
	return nil
}

func (x *SshSession) GetRevoked() bool {
	if x != nil {
		return x.Revoked
	}
	return false
}

// Watch sandbox request.
type WatchSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,11,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Canonical sandbox name.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Stream sandbox status snapshots.
	FollowStatus bool `protobuf:"varint,2,opt,name=follow_status,json=followStatus,proto3" json:"follow_status,omitempty"`
	// Stream openshell-server process logs correlated to this sandbox.
	FollowLogs bool `protobuf:"varint,3,opt,name=follow_logs,json=followLogs,proto3" json:"follow_logs,omitempty"`
	// Stream platform events correlated to this sandbox.
	FollowEvents bool `protobuf:"varint,4,opt,name=follow_events,json=followEvents,proto3" json:"follow_events,omitempty"`
	// Replay the last N log lines (best-effort) before following.
	LogTailLines uint32 `protobuf:"varint,5,opt,name=log_tail_lines,json=logTailLines,proto3" json:"log_tail_lines,omitempty"`
	// Replay the last N platform events (best-effort) before following.
	EventTail uint32 `protobuf:"varint,6,opt,name=event_tail,json=eventTail,proto3" json:"event_tail,omitempty"`
	// Stop streaming once the sandbox reaches READY or a terminal result phase
	// (COMPLETED, STOPPED, or ERROR).
	StopOnTerminal bool `protobuf:"varint,7,opt,name=stop_on_terminal,json=stopOnTerminal,proto3" json:"stop_on_terminal,omitempty"`
	// Only include log lines at or after this time. Absence means no time filter.
	// Applies to both tail replay and live streaming.
	SinceTime *timestamppb.Timestamp `protobuf:"bytes,108,opt,name=since_time,json=sinceTime,proto3" json:"since_time,omitempty"`
	// Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources.
	LogSources []string `protobuf:"bytes,9,rep,name=log_sources,json=logSources,proto3" json:"log_sources,omitempty"`
	// Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels.
	LogMinLevel   string `protobuf:"bytes,10,opt,name=log_min_level,json=logMinLevel,proto3" json:"log_min_level,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *WatchSandboxRequest) Reset() {
	*x = WatchSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[89]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *WatchSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*WatchSandboxRequest) ProtoMessage() {}

func (x *WatchSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[89]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use WatchSandboxRequest.ProtoReflect.Descriptor instead.
func (*WatchSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{89}
}

func (x *WatchSandboxRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *WatchSandboxRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *WatchSandboxRequest) GetFollowStatus() bool {
	if x != nil {
		return x.FollowStatus
	}
	return false
}

func (x *WatchSandboxRequest) GetFollowLogs() bool {
	if x != nil {
		return x.FollowLogs
	}
	return false
}

func (x *WatchSandboxRequest) GetFollowEvents() bool {
	if x != nil {
		return x.FollowEvents
	}
	return false
}

func (x *WatchSandboxRequest) GetLogTailLines() uint32 {
	if x != nil {
		return x.LogTailLines
	}
	return 0
}

func (x *WatchSandboxRequest) GetEventTail() uint32 {
	if x != nil {
		return x.EventTail
	}
	return 0
}

func (x *WatchSandboxRequest) GetStopOnTerminal() bool {
	if x != nil {
		return x.StopOnTerminal
	}
	return false
}

func (x *WatchSandboxRequest) GetSinceTime() *timestamppb.Timestamp {
	if x != nil {
		return x.SinceTime
	}
	return nil
}

func (x *WatchSandboxRequest) GetLogSources() []string {
	if x != nil {
		return x.LogSources
	}
	return nil
}

func (x *WatchSandboxRequest) GetLogMinLevel() string {
	if x != nil {
		return x.LogMinLevel
	}
	return ""
}

// One event in a sandbox watch stream.
type SandboxStreamEvent struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*SandboxStreamEvent_Sandbox
	//	*SandboxStreamEvent_Log
	//	*SandboxStreamEvent_Event
	//	*SandboxStreamEvent_Warning
	//	*SandboxStreamEvent_DraftPolicyUpdate
	Payload       isSandboxStreamEvent_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxStreamEvent) Reset() {
	*x = SandboxStreamEvent{}
	mi := &file_openshell_proto_msgTypes[90]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxStreamEvent) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxStreamEvent) ProtoMessage() {}

func (x *SandboxStreamEvent) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[90]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxStreamEvent.ProtoReflect.Descriptor instead.
func (*SandboxStreamEvent) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{90}
}

func (x *SandboxStreamEvent) GetPayload() isSandboxStreamEvent_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *SandboxStreamEvent) GetSandbox() *Sandbox {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_Sandbox); ok {
			return x.Sandbox
		}
	}
	return nil
}

func (x *SandboxStreamEvent) GetLog() *SandboxLogLine {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_Log); ok {
			return x.Log
		}
	}
	return nil
}

func (x *SandboxStreamEvent) GetEvent() *PlatformEvent {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_Event); ok {
			return x.Event
		}
	}
	return nil
}

func (x *SandboxStreamEvent) GetWarning() *SandboxStreamWarning {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_Warning); ok {
			return x.Warning
		}
	}
	return nil
}

func (x *SandboxStreamEvent) GetDraftPolicyUpdate() *DraftPolicyUpdate {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_DraftPolicyUpdate); ok {
			return x.DraftPolicyUpdate
		}
	}
	return nil
}

type isSandboxStreamEvent_Payload interface {
	isSandboxStreamEvent_Payload()
}

type SandboxStreamEvent_Sandbox struct {
	// Latest sandbox snapshot.
	Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3,oneof"`
}

type SandboxStreamEvent_Log struct {
	// One server log line/event.
	Log *SandboxLogLine `protobuf:"bytes,2,opt,name=log,proto3,oneof"`
}

type SandboxStreamEvent_Event struct {
	// One platform event.
	Event *PlatformEvent `protobuf:"bytes,3,opt,name=event,proto3,oneof"`
}

type SandboxStreamEvent_Warning struct {
	// Warning from the server (e.g. missed messages due to lag).
	Warning *SandboxStreamWarning `protobuf:"bytes,4,opt,name=warning,proto3,oneof"`
}

type SandboxStreamEvent_DraftPolicyUpdate struct {
	// Draft policy update notification.
	DraftPolicyUpdate *DraftPolicyUpdate `protobuf:"bytes,5,opt,name=draft_policy_update,json=draftPolicyUpdate,proto3,oneof"`
}

func (*SandboxStreamEvent_Sandbox) isSandboxStreamEvent_Payload() {}

func (*SandboxStreamEvent_Log) isSandboxStreamEvent_Payload() {}

func (*SandboxStreamEvent_Event) isSandboxStreamEvent_Payload() {}

func (*SandboxStreamEvent_Warning) isSandboxStreamEvent_Payload() {}

func (*SandboxStreamEvent_DraftPolicyUpdate) isSandboxStreamEvent_Payload() {}

// Log line correlated to a sandbox.
type SandboxLogLine struct {
	state     protoimpl.MessageState `protogen:"open.v1"`
	SandboxId string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	EventTime *timestamppb.Timestamp `protobuf:"bytes,102,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
	Level     string                 `protobuf:"bytes,3,opt,name=level,proto3" json:"level,omitempty"`
	Target    string                 `protobuf:"bytes,4,opt,name=target,proto3" json:"target,omitempty"`
	Message   string                 `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"`
	// Log source: "gateway" (server-side) or "sandbox" (supervisor).
	// Empty is treated as "gateway" for backward compatibility.
	Source string `protobuf:"bytes,6,opt,name=source,proto3" json:"source,omitempty"`
	// Structured key-value fields from the tracing event (e.g. dst_host, action).
	Fields        map[string]string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxLogLine) Reset() {
	*x = SandboxLogLine{}
	mi := &file_openshell_proto_msgTypes[91]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxLogLine) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxLogLine) ProtoMessage() {}

func (x *SandboxLogLine) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[91]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxLogLine.ProtoReflect.Descriptor instead.
func (*SandboxLogLine) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{91}
}

func (x *SandboxLogLine) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *SandboxLogLine) GetEventTime() *timestamppb.Timestamp {
	if x != nil {
		return x.EventTime
	}
	return nil
}

func (x *SandboxLogLine) GetLevel() string {
	if x != nil {
		return x.Level
	}
	return ""
}

func (x *SandboxLogLine) GetTarget() string {
	if x != nil {
		return x.Target
	}
	return ""
}

func (x *SandboxLogLine) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

func (x *SandboxLogLine) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

func (x *SandboxLogLine) GetFields() map[string]string {
	if x != nil {
		return x.Fields
	}
	return nil
}

type SandboxStreamWarning struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Message       string                 `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxStreamWarning) Reset() {
	*x = SandboxStreamWarning{}
	mi := &file_openshell_proto_msgTypes[92]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxStreamWarning) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxStreamWarning) ProtoMessage() {}

func (x *SandboxStreamWarning) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[92]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxStreamWarning.ProtoReflect.Descriptor instead.
func (*SandboxStreamWarning) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{92}
}

func (x *SandboxStreamWarning) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

// Create provider request.
type CreateProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Provider       *datamodelv1.Provider          `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,3,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateProviderRequest) Reset() {
	*x = CreateProviderRequest{}
	mi := &file_openshell_proto_msgTypes[93]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateProviderRequest) ProtoMessage() {}

func (x *CreateProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[93]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateProviderRequest.ProtoReflect.Descriptor instead.
func (*CreateProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{93}
}

func (x *CreateProviderRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *CreateProviderRequest) GetProvider() *datamodelv1.Provider {
	if x != nil {
		return x.Provider
	}
	return nil
}

func (x *CreateProviderRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Get provider request.
type GetProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Name           string                         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *GetProviderRequest) Reset() {
	*x = GetProviderRequest{}
	mi := &file_openshell_proto_msgTypes[94]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetProviderRequest) ProtoMessage() {}

func (x *GetProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[94]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetProviderRequest.ProtoReflect.Descriptor instead.
func (*GetProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{94}
}

func (x *GetProviderRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetProviderRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

// List providers request.
type ListProvidersRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Named and all-workspaces selections are accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// The maximum number of providers to return. Zero uses 100. Values above
	// 1000 are coerced to 1000; negative values are invalid.
	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Token from a previous ListProviders response. All other request parameters
	// except page_size must match the request that produced it.
	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListProvidersRequest) Reset() {
	*x = ListProvidersRequest{}
	mi := &file_openshell_proto_msgTypes[95]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListProvidersRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListProvidersRequest) ProtoMessage() {}

func (x *ListProvidersRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[95]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListProvidersRequest.ProtoReflect.Descriptor instead.
func (*ListProvidersRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{95}
}

func (x *ListProvidersRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ListProvidersRequest) GetPageSize() int32 {
	if x != nil {
		return x.PageSize
	}
	return 0
}

func (x *ListProvidersRequest) GetPageToken() string {
	if x != nil {
		return x.PageToken
	}
	return ""
}

// Update provider request.
type UpdateProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Provider       *datamodelv1.Provider          `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// Optional per-credential expiry timestamps to merge into the provider.
	// Omitted keys are unchanged. Use clear_credential_expiration_keys to remove
	// an existing expiry.
	CredentialExpirationTimes map[string]*timestamppb.Timestamp `protobuf:"bytes,102,rep,name=credential_expiration_times,json=credentialExpirationTimes,proto3" json:"credential_expiration_times,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Credential keys whose existing expiry should be removed.
	ClearCredentialExpirationKeys []string `protobuf:"bytes,103,rep,name=clear_credential_expiration_keys,json=clearCredentialExpirationKeys,proto3" json:"clear_credential_expiration_keys,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,4,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateProviderRequest) Reset() {
	*x = UpdateProviderRequest{}
	mi := &file_openshell_proto_msgTypes[96]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateProviderRequest) ProtoMessage() {}

func (x *UpdateProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[96]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateProviderRequest.ProtoReflect.Descriptor instead.
func (*UpdateProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{96}
}

func (x *UpdateProviderRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *UpdateProviderRequest) GetProvider() *datamodelv1.Provider {
	if x != nil {
		return x.Provider
	}
	return nil
}

func (x *UpdateProviderRequest) GetCredentialExpirationTimes() map[string]*timestamppb.Timestamp {
	if x != nil {
		return x.CredentialExpirationTimes
	}
	return nil
}

func (x *UpdateProviderRequest) GetClearCredentialExpirationKeys() []string {
	if x != nil {
		return x.ClearCredentialExpirationKeys
	}
	return nil
}

func (x *UpdateProviderRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Delete provider request.
type DeleteProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Name           string                         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	AllowMissing   bool                           `protobuf:"varint,4,opt,name=allow_missing,json=allowMissing,proto3" json:"allow_missing,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,5,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderRequest) Reset() {
	*x = DeleteProviderRequest{}
	mi := &file_openshell_proto_msgTypes[97]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderRequest) ProtoMessage() {}

func (x *DeleteProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[97]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderRequest.ProtoReflect.Descriptor instead.
func (*DeleteProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{97}
}

func (x *DeleteProviderRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *DeleteProviderRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *DeleteProviderRequest) GetAllowMissing() bool {
	if x != nil {
		return x.AllowMissing
	}
	return false
}

func (x *DeleteProviderRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Provider response.
type ProviderResponse struct {
	state    protoimpl.MessageState `protogen:"open.v1"`
	Provider *datamodelv1.Provider  `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// Selection-time sandbox target set for an update, with one receipt per target.
	// Sandboxes attached later are outside this operation's readiness result.
	TargetReceipts []*ProviderMutationReceipt `protobuf:"bytes,2,rep,name=target_receipts,json=targetReceipts,proto3" json:"target_receipts,omitempty"`
	// Identifies the update even when its target set is empty.
	MutationId    string `protobuf:"bytes,3,opt,name=mutation_id,json=mutationId,proto3" json:"mutation_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderResponse) Reset() {
	*x = ProviderResponse{}
	mi := &file_openshell_proto_msgTypes[98]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderResponse) ProtoMessage() {}

func (x *ProviderResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[98]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderResponse.ProtoReflect.Descriptor instead.
func (*ProviderResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{98}
}

func (x *ProviderResponse) GetProvider() *datamodelv1.Provider {
	if x != nil {
		return x.Provider
	}
	return nil
}

func (x *ProviderResponse) GetTargetReceipts() []*ProviderMutationReceipt {
	if x != nil {
		return x.TargetReceipts
	}
	return nil
}

func (x *ProviderResponse) GetMutationId() string {
	if x != nil {
		return x.MutationId
	}
	return ""
}

// List providers response.
type ListProvidersResponse struct {
	state     protoimpl.MessageState  `protogen:"open.v1"`
	Providers []*datamodelv1.Provider `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"`
	// Token for the next page. Empty when there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListProvidersResponse) Reset() {
	*x = ListProvidersResponse{}
	mi := &file_openshell_proto_msgTypes[99]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListProvidersResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListProvidersResponse) ProtoMessage() {}

func (x *ListProvidersResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[99]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListProvidersResponse.ProtoReflect.Descriptor instead.
func (*ListProvidersResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{99}
}

func (x *ListProvidersResponse) GetProviders() []*datamodelv1.Provider {
	if x != nil {
		return x.Providers
	}
	return nil
}

func (x *ListProvidersResponse) GetNextPageToken() string {
	if x != nil {
		return x.NextPageToken
	}
	return ""
}

// List provider type profiles request.
type ListProviderProfilesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Omit for platform profiles; otherwise select one named workspace.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// The maximum number of profiles to return. Zero uses 100. Values above
	// 1000 are coerced to 1000; negative values are invalid.
	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Token from a previous ListProviderProfiles response. All other request
	// parameters except page_size must match the request that produced it.
	PageToken     string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListProviderProfilesRequest) Reset() {
	*x = ListProviderProfilesRequest{}
	mi := &file_openshell_proto_msgTypes[100]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListProviderProfilesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListProviderProfilesRequest) ProtoMessage() {}

func (x *ListProviderProfilesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[100]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListProviderProfilesRequest.ProtoReflect.Descriptor instead.
func (*ListProviderProfilesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{100}
}

func (x *ListProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ListProviderProfilesRequest) GetPageSize() int32 {
	if x != nil {
		return x.PageSize
	}
	return 0
}

func (x *ListProviderProfilesRequest) GetPageToken() string {
	if x != nil {
		return x.PageToken
	}
	return ""
}

// Fetch provider type profile request.
type GetProviderProfileRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Omit for platform profiles; otherwise select one named workspace.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Id             string                         `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *GetProviderProfileRequest) Reset() {
	*x = GetProviderProfileRequest{}
	mi := &file_openshell_proto_msgTypes[101]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetProviderProfileRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetProviderProfileRequest) ProtoMessage() {}

func (x *GetProviderProfileRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[101]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetProviderProfileRequest.ProtoReflect.Descriptor instead.
func (*GetProviderProfileRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{101}
}

func (x *GetProviderProfileRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetProviderProfileRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

// Provider profile payload with optional source metadata for diagnostics.
type ProviderProfileImportItem struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Profile       *ProviderProfile       `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
	Source        string                 `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileImportItem) Reset() {
	*x = ProviderProfileImportItem{}
	mi := &file_openshell_proto_msgTypes[102]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileImportItem) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileImportItem) ProtoMessage() {}

func (x *ProviderProfileImportItem) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[102]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileImportItem.ProtoReflect.Descriptor instead.
func (*ProviderProfileImportItem) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{102}
}

func (x *ProviderProfileImportItem) GetProfile() *ProviderProfile {
	if x != nil {
		return x.Profile
	}
	return nil
}

func (x *ProviderProfileImportItem) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

// Provider profile validation diagnostic.
type ProviderProfileDiagnostic struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Source        string                 `protobuf:"bytes,1,opt,name=source,proto3" json:"source,omitempty"`
	ProfileId     string                 `protobuf:"bytes,2,opt,name=profile_id,json=profileId,proto3" json:"profile_id,omitempty"`
	Field         string                 `protobuf:"bytes,3,opt,name=field,proto3" json:"field,omitempty"`
	Message       string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
	Severity      string                 `protobuf:"bytes,5,opt,name=severity,proto3" json:"severity,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileDiagnostic) Reset() {
	*x = ProviderProfileDiagnostic{}
	mi := &file_openshell_proto_msgTypes[103]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileDiagnostic) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileDiagnostic) ProtoMessage() {}

func (x *ProviderProfileDiagnostic) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[103]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileDiagnostic.ProtoReflect.Descriptor instead.
func (*ProviderProfileDiagnostic) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{103}
}

func (x *ProviderProfileDiagnostic) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

func (x *ProviderProfileDiagnostic) GetProfileId() string {
	if x != nil {
		return x.ProfileId
	}
	return ""
}

func (x *ProviderProfileDiagnostic) GetField() string {
	if x != nil {
		return x.Field
	}
	return ""
}

func (x *ProviderProfileDiagnostic) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

func (x *ProviderProfileDiagnostic) GetSeverity() string {
	if x != nil {
		return x.Severity
	}
	return ""
}

// Endpoint selector for token grant audience overrides.
type ProviderCredentialTokenGrantAudienceOverride struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Optional: endpoint host selector. If omitted, inherits the profile endpoint host.
	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	// Optional: endpoint port selector. If omitted, matches the expanded profile endpoint port.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Optional: endpoint path selector. If omitted, inherits the profile endpoint path.
	Path string `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"`
	// Resource audience to request for matching endpoints.
	Audience string `protobuf:"bytes,4,opt,name=audience,proto3" json:"audience,omitempty"`
	// Optional: OAuth2 scopes to request. If omitted, inherits the token grant scopes.
	Scopes        []string `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderCredentialTokenGrantAudienceOverride) Reset() {
	*x = ProviderCredentialTokenGrantAudienceOverride{}
	mi := &file_openshell_proto_msgTypes[104]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialTokenGrantAudienceOverride) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialTokenGrantAudienceOverride) ProtoMessage() {}

func (x *ProviderCredentialTokenGrantAudienceOverride) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[104]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialTokenGrantAudienceOverride.ProtoReflect.Descriptor instead.
func (*ProviderCredentialTokenGrantAudienceOverride) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{104}
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetPath() string {
	if x != nil {
		return x.Path
	}
	return ""
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetAudience() string {
	if x != nil {
		return x.Audience
	}
	return ""
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetScopes() []string {
	if x != nil {
		return x.Scopes
	}
	return nil
}

type ProviderCredentialTokenGrantSubjectToken struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Source for the token exchange subject token. Phase one supports
	// "provider_credential".
	Source string `protobuf:"bytes,1,opt,name=source,proto3" json:"source,omitempty"`
	// Provider credential key that stores the subject token.
	Credential string `protobuf:"bytes,2,opt,name=credential,proto3" json:"credential,omitempty"`
	// OAuth2 subject_token_type. If omitted, OpenShell uses
	// urn:ietf:params:oauth:token-type:access_token.
	SubjectTokenType string `protobuf:"bytes,3,opt,name=subject_token_type,json=subjectTokenType,proto3" json:"subject_token_type,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *ProviderCredentialTokenGrantSubjectToken) Reset() {
	*x = ProviderCredentialTokenGrantSubjectToken{}
	mi := &file_openshell_proto_msgTypes[105]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialTokenGrantSubjectToken) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialTokenGrantSubjectToken) ProtoMessage() {}

func (x *ProviderCredentialTokenGrantSubjectToken) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[105]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialTokenGrantSubjectToken.ProtoReflect.Descriptor instead.
func (*ProviderCredentialTokenGrantSubjectToken) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{105}
}

func (x *ProviderCredentialTokenGrantSubjectToken) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

func (x *ProviderCredentialTokenGrantSubjectToken) GetCredential() string {
	if x != nil {
		return x.Credential
	}
	return ""
}

func (x *ProviderCredentialTokenGrantSubjectToken) GetSubjectTokenType() string {
	if x != nil {
		return x.SubjectTokenType
	}
	return ""
}

type ProviderCredentialTokenGrant struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// OAuth2 token endpoint URL (e.g., https://keycloak.example.com/realms/my-realm/protocol/openid-connect/token)
	TokenEndpoint string `protobuf:"bytes,1,opt,name=token_endpoint,json=tokenEndpoint,proto3" json:"token_endpoint,omitempty"`
	// Optional: default resource audience to request from the token service
	Audience string `protobuf:"bytes,2,opt,name=audience,proto3" json:"audience,omitempty"`
	// Optional: audience to request when fetching the JWT-SVID from SPIRE.
	// If omitted, the sandbox derives this from token_endpoint.
	JwtSvidAudience string `protobuf:"bytes,6,opt,name=jwt_svid_audience,json=jwtSvidAudience,proto3" json:"jwt_svid_audience,omitempty"`
	// Optional: OAuth2 scopes to request
	Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// Optional token cache TTL override. If absent, use expires_in from the token response.
	CacheTtl *durationpb.Duration `protobuf:"bytes,104,opt,name=cache_ttl,json=cacheTtl,proto3" json:"cache_ttl,omitempty"`
	// Optional: endpoint-specific resource audience overrides.
	AudienceOverrides []*ProviderCredentialTokenGrantAudienceOverride `protobuf:"bytes,5,rep,name=audience_overrides,json=audienceOverrides,proto3" json:"audience_overrides,omitempty"`
	// Optional: OAuth2 client_assertion_type value. If omitted, OpenShell uses
	// urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
	ClientAssertionType string `protobuf:"bytes,7,opt,name=client_assertion_type,json=clientAssertionType,proto3" json:"client_assertion_type,omitempty"`
	// Grant type. If omitted/unspecified, OpenShell treats this as client_credentials
	// for backwards compatibility.
	GrantType ProviderCredentialTokenGrantType `protobuf:"varint,8,opt,name=grant_type,json=grantType,proto3,enum=openshell.v1.ProviderCredentialTokenGrantType" json:"grant_type,omitempty"`
	// Subject token metadata for token_exchange grants.
	SubjectToken *ProviderCredentialTokenGrantSubjectToken `protobuf:"bytes,9,opt,name=subject_token,json=subjectToken,proto3" json:"subject_token,omitempty"`
	// OAuth2 requested_token_type. If omitted for token_exchange, OpenShell uses
	// urn:ietf:params:oauth:token-type:access_token.
	RequestedTokenType string `protobuf:"bytes,10,opt,name=requested_token_type,json=requestedTokenType,proto3" json:"requested_token_type,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *ProviderCredentialTokenGrant) Reset() {
	*x = ProviderCredentialTokenGrant{}
	mi := &file_openshell_proto_msgTypes[106]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialTokenGrant) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialTokenGrant) ProtoMessage() {}

func (x *ProviderCredentialTokenGrant) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[106]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialTokenGrant.ProtoReflect.Descriptor instead.
func (*ProviderCredentialTokenGrant) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{106}
}

func (x *ProviderCredentialTokenGrant) GetTokenEndpoint() string {
	if x != nil {
		return x.TokenEndpoint
	}
	return ""
}

func (x *ProviderCredentialTokenGrant) GetAudience() string {
	if x != nil {
		return x.Audience
	}
	return ""
}

func (x *ProviderCredentialTokenGrant) GetJwtSvidAudience() string {
	if x != nil {
		return x.JwtSvidAudience
	}
	return ""
}

func (x *ProviderCredentialTokenGrant) GetScopes() []string {
	if x != nil {
		return x.Scopes
	}
	return nil
}

func (x *ProviderCredentialTokenGrant) GetCacheTtl() *durationpb.Duration {
	if x != nil {
		return x.CacheTtl
	}
	return nil
}

func (x *ProviderCredentialTokenGrant) GetAudienceOverrides() []*ProviderCredentialTokenGrantAudienceOverride {
	if x != nil {
		return x.AudienceOverrides
	}
	return nil
}

func (x *ProviderCredentialTokenGrant) GetClientAssertionType() string {
	if x != nil {
		return x.ClientAssertionType
	}
	return ""
}

func (x *ProviderCredentialTokenGrant) GetGrantType() ProviderCredentialTokenGrantType {
	if x != nil {
		return x.GrantType
	}
	return ProviderCredentialTokenGrantType_PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_UNSPECIFIED
}

func (x *ProviderCredentialTokenGrant) GetSubjectToken() *ProviderCredentialTokenGrantSubjectToken {
	if x != nil {
		return x.SubjectToken
	}
	return nil
}

func (x *ProviderCredentialTokenGrant) GetRequestedTokenType() string {
	if x != nil {
		return x.RequestedTokenType
	}
	return ""
}

// Provider credential declaration.
type ProviderProfileCredential struct {
	state         protoimpl.MessageState        `protogen:"open.v1"`
	Name          string                        `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Description   string                        `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
	EnvVars       []string                      `protobuf:"bytes,3,rep,name=env_vars,json=envVars,proto3" json:"env_vars,omitempty"`
	Required      bool                          `protobuf:"varint,4,opt,name=required,proto3" json:"required,omitempty"`
	AuthStyle     string                        `protobuf:"bytes,5,opt,name=auth_style,json=authStyle,proto3" json:"auth_style,omitempty"`
	HeaderName    string                        `protobuf:"bytes,6,opt,name=header_name,json=headerName,proto3" json:"header_name,omitempty"`
	QueryParam    string                        `protobuf:"bytes,7,opt,name=query_param,json=queryParam,proto3" json:"query_param,omitempty"`
	Refresh       *ProviderCredentialRefresh    `protobuf:"bytes,8,opt,name=refresh,proto3" json:"refresh,omitempty"`
	PathTemplate  string                        `protobuf:"bytes,9,opt,name=path_template,json=pathTemplate,proto3" json:"path_template,omitempty"`
	TokenGrant    *ProviderCredentialTokenGrant `protobuf:"bytes,10,opt,name=token_grant,json=tokenGrant,proto3" json:"token_grant,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileCredential) Reset() {
	*x = ProviderProfileCredential{}
	mi := &file_openshell_proto_msgTypes[107]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileCredential) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileCredential) ProtoMessage() {}

func (x *ProviderProfileCredential) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[107]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileCredential.ProtoReflect.Descriptor instead.
func (*ProviderProfileCredential) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{107}
}

func (x *ProviderProfileCredential) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ProviderProfileCredential) GetDescription() string {
	if x != nil {
		return x.Description
	}
	return ""
}

func (x *ProviderProfileCredential) GetEnvVars() []string {
	if x != nil {
		return x.EnvVars
	}
	return nil
}

func (x *ProviderProfileCredential) GetRequired() bool {
	if x != nil {
		return x.Required
	}
	return false
}

func (x *ProviderProfileCredential) GetAuthStyle() string {
	if x != nil {
		return x.AuthStyle
	}
	return ""
}

func (x *ProviderProfileCredential) GetHeaderName() string {
	if x != nil {
		return x.HeaderName
	}
	return ""
}

func (x *ProviderProfileCredential) GetQueryParam() string {
	if x != nil {
		return x.QueryParam
	}
	return ""
}

func (x *ProviderProfileCredential) GetRefresh() *ProviderCredentialRefresh {
	if x != nil {
		return x.Refresh
	}
	return nil
}

func (x *ProviderProfileCredential) GetPathTemplate() string {
	if x != nil {
		return x.PathTemplate
	}
	return ""
}

func (x *ProviderProfileCredential) GetTokenGrant() *ProviderCredentialTokenGrant {
	if x != nil {
		return x.TokenGrant
	}
	return nil
}

type ProviderCredentialRefreshMaterial struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Description   string                 `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
	Required      bool                   `protobuf:"varint,3,opt,name=required,proto3" json:"required,omitempty"`
	Secret        bool                   `protobuf:"varint,4,opt,name=secret,proto3" json:"secret,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderCredentialRefreshMaterial) Reset() {
	*x = ProviderCredentialRefreshMaterial{}
	mi := &file_openshell_proto_msgTypes[108]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialRefreshMaterial) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialRefreshMaterial) ProtoMessage() {}

func (x *ProviderCredentialRefreshMaterial) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[108]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialRefreshMaterial.ProtoReflect.Descriptor instead.
func (*ProviderCredentialRefreshMaterial) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{108}
}

func (x *ProviderCredentialRefreshMaterial) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ProviderCredentialRefreshMaterial) GetDescription() string {
	if x != nil {
		return x.Description
	}
	return ""
}

func (x *ProviderCredentialRefreshMaterial) GetRequired() bool {
	if x != nil {
		return x.Required
	}
	return false
}

func (x *ProviderCredentialRefreshMaterial) GetSecret() bool {
	if x != nil {
		return x.Secret
	}
	return false
}

// Declares that a single refresh operation mints more than one credential.
// The refresh is attached to a primary credential; each additional output
// maps a strategy-defined semantic output id to a sibling credential whose
// env_vars receive the minted value.
type ProviderCredentialRefreshOutput struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Output        string                 `protobuf:"bytes,1,opt,name=output,proto3" json:"output,omitempty"`         // strategy-defined semantic output id (e.g. "session_token")
	Credential    string                 `protobuf:"bytes,2,opt,name=credential,proto3" json:"credential,omitempty"` // sibling credential name whose env_vars receive this output
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderCredentialRefreshOutput) Reset() {
	*x = ProviderCredentialRefreshOutput{}
	mi := &file_openshell_proto_msgTypes[109]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialRefreshOutput) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialRefreshOutput) ProtoMessage() {}

func (x *ProviderCredentialRefreshOutput) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[109]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialRefreshOutput.ProtoReflect.Descriptor instead.
func (*ProviderCredentialRefreshOutput) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{109}
}

func (x *ProviderCredentialRefreshOutput) GetOutput() string {
	if x != nil {
		return x.Output
	}
	return ""
}

func (x *ProviderCredentialRefreshOutput) GetCredential() string {
	if x != nil {
		return x.Credential
	}
	return ""
}

type ProviderCredentialRefresh struct {
	state             protoimpl.MessageState               `protogen:"open.v1"`
	Strategy          ProviderCredentialRefreshStrategy    `protobuf:"varint,1,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"`
	TokenUrl          string                               `protobuf:"bytes,2,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"`
	Scopes            []string                             `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"`
	RefreshBefore     *durationpb.Duration                 `protobuf:"bytes,104,opt,name=refresh_before,json=refreshBefore,proto3" json:"refresh_before,omitempty"`
	MaxLifetime       *durationpb.Duration                 `protobuf:"bytes,105,opt,name=max_lifetime,json=maxLifetime,proto3" json:"max_lifetime,omitempty"`
	Material          []*ProviderCredentialRefreshMaterial `protobuf:"bytes,6,rep,name=material,proto3" json:"material,omitempty"`
	AdditionalOutputs []*ProviderCredentialRefreshOutput   `protobuf:"bytes,7,rep,name=additional_outputs,json=additionalOutputs,proto3" json:"additional_outputs,omitempty"`
	unknownFields     protoimpl.UnknownFields
	sizeCache         protoimpl.SizeCache
}

func (x *ProviderCredentialRefresh) Reset() {
	*x = ProviderCredentialRefresh{}
	mi := &file_openshell_proto_msgTypes[110]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialRefresh) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialRefresh) ProtoMessage() {}

func (x *ProviderCredentialRefresh) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[110]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialRefresh.ProtoReflect.Descriptor instead.
func (*ProviderCredentialRefresh) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{110}
}

func (x *ProviderCredentialRefresh) GetStrategy() ProviderCredentialRefreshStrategy {
	if x != nil {
		return x.Strategy
	}
	return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED
}

func (x *ProviderCredentialRefresh) GetTokenUrl() string {
	if x != nil {
		return x.TokenUrl
	}
	return ""
}

func (x *ProviderCredentialRefresh) GetScopes() []string {
	if x != nil {
		return x.Scopes
	}
	return nil
}

func (x *ProviderCredentialRefresh) GetRefreshBefore() *durationpb.Duration {
	if x != nil {
		return x.RefreshBefore
	}
	return nil
}

func (x *ProviderCredentialRefresh) GetMaxLifetime() *durationpb.Duration {
	if x != nil {
		return x.MaxLifetime
	}
	return nil
}

func (x *ProviderCredentialRefresh) GetMaterial() []*ProviderCredentialRefreshMaterial {
	if x != nil {
		return x.Material
	}
	return nil
}

func (x *ProviderCredentialRefresh) GetAdditionalOutputs() []*ProviderCredentialRefreshOutput {
	if x != nil {
		return x.AdditionalOutputs
	}
	return nil
}

type ProviderCredentialRefreshStatus struct {
	state          protoimpl.MessageState            `protogen:"open.v1"`
	Provider       string                            `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	ProviderId     string                            `protobuf:"bytes,2,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"`
	CredentialKey  string                            `protobuf:"bytes,3,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	Strategy       ProviderCredentialRefreshStrategy `protobuf:"varint,4,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"`
	Status         string                            `protobuf:"bytes,5,opt,name=status,proto3" json:"status,omitempty"`
	ExpirationTime *timestamppb.Timestamp            `protobuf:"bytes,106,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
	// Next automatic refresh time. Absence means no automatic retry is scheduled;
	// use recovery_action to determine the required recovery workflow.
	NextRefreshTime *timestamppb.Timestamp                  `protobuf:"bytes,107,opt,name=next_refresh_time,json=nextRefreshTime,proto3" json:"next_refresh_time,omitempty"`
	LastRefreshTime *timestamppb.Timestamp                  `protobuf:"bytes,108,opt,name=last_refresh_time,json=lastRefreshTime,proto3" json:"last_refresh_time,omitempty"`
	LastError       string                                  `protobuf:"bytes,9,opt,name=last_error,json=lastError,proto3" json:"last_error,omitempty"`
	RecoveryAction  ProviderCredentialRefreshRecoveryAction `protobuf:"varint,10,opt,name=recovery_action,json=recoveryAction,proto3,enum=openshell.v1.ProviderCredentialRefreshRecoveryAction" json:"recovery_action,omitempty"`
	// Stable gateway-owned failure identifier, for example
	// "oauth_invalid_grant". This is not provider-controlled prose and
	// incorporates any recognized top-level OAuth error classification.
	FailureCode string `protobuf:"bytes,11,opt,name=failure_code,json=failureCode,proto3" json:"failure_code,omitempty"`
	// A bounded, recognized provider subtype that refines failure_code; clients
	// do not need a separate provider_error field. Unknown provider-controlled
	// values are not persisted or returned.
	ProviderErrorSubtype string                 `protobuf:"bytes,12,opt,name=provider_error_subtype,json=providerErrorSubtype,proto3" json:"provider_error_subtype,omitempty"`
	LastErrorTime        *timestamppb.Timestamp `protobuf:"bytes,113,opt,name=last_error_time,json=lastErrorTime,proto3" json:"last_error_time,omitempty"`
	unknownFields        protoimpl.UnknownFields
	sizeCache            protoimpl.SizeCache
}

func (x *ProviderCredentialRefreshStatus) Reset() {
	*x = ProviderCredentialRefreshStatus{}
	mi := &file_openshell_proto_msgTypes[111]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialRefreshStatus) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialRefreshStatus) ProtoMessage() {}

func (x *ProviderCredentialRefreshStatus) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[111]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialRefreshStatus.ProtoReflect.Descriptor instead.
func (*ProviderCredentialRefreshStatus) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{111}
}

func (x *ProviderCredentialRefreshStatus) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetProviderId() string {
	if x != nil {
		return x.ProviderId
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetStrategy() ProviderCredentialRefreshStrategy {
	if x != nil {
		return x.Strategy
	}
	return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED
}

func (x *ProviderCredentialRefreshStatus) GetStatus() string {
	if x != nil {
		return x.Status
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetExpirationTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ExpirationTime
	}
	return nil
}

func (x *ProviderCredentialRefreshStatus) GetNextRefreshTime() *timestamppb.Timestamp {
	if x != nil {
		return x.NextRefreshTime
	}
	return nil
}

func (x *ProviderCredentialRefreshStatus) GetLastRefreshTime() *timestamppb.Timestamp {
	if x != nil {
		return x.LastRefreshTime
	}
	return nil
}

func (x *ProviderCredentialRefreshStatus) GetLastError() string {
	if x != nil {
		return x.LastError
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetRecoveryAction() ProviderCredentialRefreshRecoveryAction {
	if x != nil {
		return x.RecoveryAction
	}
	return ProviderCredentialRefreshRecoveryAction_PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_UNSPECIFIED
}

func (x *ProviderCredentialRefreshStatus) GetFailureCode() string {
	if x != nil {
		return x.FailureCode
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetProviderErrorSubtype() string {
	if x != nil {
		return x.ProviderErrorSubtype
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetLastErrorTime() *timestamppb.Timestamp {
	if x != nil {
		return x.LastErrorTime
	}
	return nil
}

// Provider profile local discovery declaration.
type ProviderProfileDiscovery struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Credential names from ProviderProfile.credentials eligible for local discovery.
	Credentials   []string `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileDiscovery) Reset() {
	*x = ProviderProfileDiscovery{}
	mi := &file_openshell_proto_msgTypes[112]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileDiscovery) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileDiscovery) ProtoMessage() {}

func (x *ProviderProfileDiscovery) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[112]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileDiscovery.ProtoReflect.Descriptor instead.
func (*ProviderProfileDiscovery) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{112}
}

func (x *ProviderProfileDiscovery) GetCredentials() []string {
	if x != nil {
		return x.Credentials
	}
	return nil
}

type GetProviderRefreshStatusRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Provider       string                         `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	CredentialKey  string                         `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *GetProviderRefreshStatusRequest) Reset() {
	*x = GetProviderRefreshStatusRequest{}
	mi := &file_openshell_proto_msgTypes[113]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetProviderRefreshStatusRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetProviderRefreshStatusRequest) ProtoMessage() {}

func (x *GetProviderRefreshStatusRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[113]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetProviderRefreshStatusRequest.ProtoReflect.Descriptor instead.
func (*GetProviderRefreshStatusRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{113}
}

func (x *GetProviderRefreshStatusRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetProviderRefreshStatusRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *GetProviderRefreshStatusRequest) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

type GetProviderRefreshStatusResponse struct {
	state         protoimpl.MessageState             `protogen:"open.v1"`
	Credentials   []*ProviderCredentialRefreshStatus `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetProviderRefreshStatusResponse) Reset() {
	*x = GetProviderRefreshStatusResponse{}
	mi := &file_openshell_proto_msgTypes[114]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetProviderRefreshStatusResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetProviderRefreshStatusResponse) ProtoMessage() {}

func (x *GetProviderRefreshStatusResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[114]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetProviderRefreshStatusResponse.ProtoReflect.Descriptor instead.
func (*GetProviderRefreshStatusResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{114}
}

func (x *GetProviderRefreshStatusResponse) GetCredentials() []*ProviderCredentialRefreshStatus {
	if x != nil {
		return x.Credentials
	}
	return nil
}

type ConfigureProviderRefreshRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector    `protobuf:"bytes,7,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Provider       string                            `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	CredentialKey  string                            `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	Strategy       ProviderCredentialRefreshStrategy `protobuf:"varint,3,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"`
	Material       map[string]string                 `protobuf:"bytes,4,rep,name=material,proto3" json:"material,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Additional material names the caller requests be stored as secrets. Every
	// name must be present in material. The server also classifies secrets from
	// the authoritative provider profile and refresh strategy.
	SecretMaterialKeys []string               `protobuf:"bytes,5,rep,name=secret_material_keys,json=secretMaterialKeys,proto3" json:"secret_material_keys,omitempty"`
	ExpirationTime     *timestamppb.Timestamp `protobuf:"bytes,106,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,8,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ConfigureProviderRefreshRequest) Reset() {
	*x = ConfigureProviderRefreshRequest{}
	mi := &file_openshell_proto_msgTypes[115]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ConfigureProviderRefreshRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ConfigureProviderRefreshRequest) ProtoMessage() {}

func (x *ConfigureProviderRefreshRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[115]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ConfigureProviderRefreshRequest.ProtoReflect.Descriptor instead.
func (*ConfigureProviderRefreshRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{115}
}

func (x *ConfigureProviderRefreshRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ConfigureProviderRefreshRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *ConfigureProviderRefreshRequest) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *ConfigureProviderRefreshRequest) GetStrategy() ProviderCredentialRefreshStrategy {
	if x != nil {
		return x.Strategy
	}
	return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED
}

func (x *ConfigureProviderRefreshRequest) GetMaterial() map[string]string {
	if x != nil {
		return x.Material
	}
	return nil
}

func (x *ConfigureProviderRefreshRequest) GetSecretMaterialKeys() []string {
	if x != nil {
		return x.SecretMaterialKeys
	}
	return nil
}

func (x *ConfigureProviderRefreshRequest) GetExpirationTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ExpirationTime
	}
	return nil
}

func (x *ConfigureProviderRefreshRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type ConfigureProviderRefreshResponse struct {
	state         protoimpl.MessageState           `protogen:"open.v1"`
	Status        *ProviderCredentialRefreshStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ConfigureProviderRefreshResponse) Reset() {
	*x = ConfigureProviderRefreshResponse{}
	mi := &file_openshell_proto_msgTypes[116]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ConfigureProviderRefreshResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ConfigureProviderRefreshResponse) ProtoMessage() {}

func (x *ConfigureProviderRefreshResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[116]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ConfigureProviderRefreshResponse.ProtoReflect.Descriptor instead.
func (*ConfigureProviderRefreshResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{116}
}

func (x *ConfigureProviderRefreshResponse) GetStatus() *ProviderCredentialRefreshStatus {
	if x != nil {
		return x.Status
	}
	return nil
}

type RotateProviderCredentialRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Provider       string                         `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	CredentialKey  string                         `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,4,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RotateProviderCredentialRequest) Reset() {
	*x = RotateProviderCredentialRequest{}
	mi := &file_openshell_proto_msgTypes[117]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RotateProviderCredentialRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RotateProviderCredentialRequest) ProtoMessage() {}

func (x *RotateProviderCredentialRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[117]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RotateProviderCredentialRequest.ProtoReflect.Descriptor instead.
func (*RotateProviderCredentialRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{117}
}

func (x *RotateProviderCredentialRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *RotateProviderCredentialRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *RotateProviderCredentialRequest) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *RotateProviderCredentialRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type RotateProviderCredentialResponse struct {
	state         protoimpl.MessageState           `protogen:"open.v1"`
	Status        *ProviderCredentialRefreshStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RotateProviderCredentialResponse) Reset() {
	*x = RotateProviderCredentialResponse{}
	mi := &file_openshell_proto_msgTypes[118]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RotateProviderCredentialResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RotateProviderCredentialResponse) ProtoMessage() {}

func (x *RotateProviderCredentialResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[118]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RotateProviderCredentialResponse.ProtoReflect.Descriptor instead.
func (*RotateProviderCredentialResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{118}
}

func (x *RotateProviderCredentialResponse) GetStatus() *ProviderCredentialRefreshStatus {
	if x != nil {
		return x.Status
	}
	return nil
}

type DeleteProviderRefreshRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Provider       string                         `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	CredentialKey  string                         `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	AllowMissing   bool                           `protobuf:"varint,5,opt,name=allow_missing,json=allowMissing,proto3" json:"allow_missing,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,6,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderRefreshRequest) Reset() {
	*x = DeleteProviderRefreshRequest{}
	mi := &file_openshell_proto_msgTypes[119]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderRefreshRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderRefreshRequest) ProtoMessage() {}

func (x *DeleteProviderRefreshRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[119]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderRefreshRequest.ProtoReflect.Descriptor instead.
func (*DeleteProviderRefreshRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{119}
}

func (x *DeleteProviderRefreshRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *DeleteProviderRefreshRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *DeleteProviderRefreshRequest) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *DeleteProviderRefreshRequest) GetAllowMissing() bool {
	if x != nil {
		return x.AllowMissing
	}
	return false
}

func (x *DeleteProviderRefreshRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type DeleteProviderRefreshResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Outcome       DeletionOutcome        `protobuf:"varint,2,opt,name=outcome,proto3,enum=openshell.v1.DeletionOutcome" json:"outcome,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderRefreshResponse) Reset() {
	*x = DeleteProviderRefreshResponse{}
	mi := &file_openshell_proto_msgTypes[120]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderRefreshResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderRefreshResponse) ProtoMessage() {}

func (x *DeleteProviderRefreshResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[120]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderRefreshResponse.ProtoReflect.Descriptor instead.
func (*DeleteProviderRefreshResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{120}
}

func (x *DeleteProviderRefreshResponse) GetOutcome() DeletionOutcome {
	if x != nil {
		return x.Outcome
	}
	return DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED
}

// Provider type profile metadata exposed to clients.
type ProviderProfile struct {
	state            protoimpl.MessageState       `protogen:"open.v1"`
	Id               string                       `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	DisplayName      string                       `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	Description      string                       `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	Category         ProviderProfileCategory      `protobuf:"varint,4,opt,name=category,proto3,enum=openshell.v1.ProviderProfileCategory" json:"category,omitempty"`
	Credentials      []*ProviderProfileCredential `protobuf:"bytes,5,rep,name=credentials,proto3" json:"credentials,omitempty"`
	Endpoints        []*sandboxv1.NetworkEndpoint `protobuf:"bytes,6,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
	Binaries         []*sandboxv1.NetworkBinary   `protobuf:"bytes,7,rep,name=binaries,proto3" json:"binaries,omitempty"`
	InferenceCapable bool                         `protobuf:"varint,8,opt,name=inference_capable,json=inferenceCapable,proto3" json:"inference_capable,omitempty"`
	Discovery        *ProviderProfileDiscovery    `protobuf:"bytes,9,opt,name=discovery,proto3" json:"discovery,omitempty"`
	// Storage resource version for custom profiles. Built-in profiles and new
	// profile files use 0. Gateway responses set this for stored custom profiles.
	// Update calls use this for optimistic concurrency.
	ResourceVersion uint64 `protobuf:"varint,10,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"`
	// Optional non-secret annotations attached by profile sources or importers.
	Annotations map[string]string `protobuf:"bytes,11,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Server-set provenance: "builtin", "user", or "interceptor/{name}".
	// Ignored on import/update payloads.
	Source string `protobuf:"bytes,12,opt,name=source,proto3" json:"source,omitempty"`
	// Server-set visibility: "platform", "workspace", or empty for
	// non-scoped sources. Ignored on import/update payloads.
	Scope         string `protobuf:"bytes,13,opt,name=scope,proto3" json:"scope,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfile) Reset() {
	*x = ProviderProfile{}
	mi := &file_openshell_proto_msgTypes[121]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfile) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfile) ProtoMessage() {}

func (x *ProviderProfile) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[121]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfile.ProtoReflect.Descriptor instead.
func (*ProviderProfile) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{121}
}

func (x *ProviderProfile) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *ProviderProfile) GetDisplayName() string {
	if x != nil {
		return x.DisplayName
	}
	return ""
}

func (x *ProviderProfile) GetDescription() string {
	if x != nil {
		return x.Description
	}
	return ""
}

func (x *ProviderProfile) GetCategory() ProviderProfileCategory {
	if x != nil {
		return x.Category
	}
	return ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_UNSPECIFIED
}

func (x *ProviderProfile) GetCredentials() []*ProviderProfileCredential {
	if x != nil {
		return x.Credentials
	}
	return nil
}

func (x *ProviderProfile) GetEndpoints() []*sandboxv1.NetworkEndpoint {
	if x != nil {
		return x.Endpoints
	}
	return nil
}

func (x *ProviderProfile) GetBinaries() []*sandboxv1.NetworkBinary {
	if x != nil {
		return x.Binaries
	}
	return nil
}

func (x *ProviderProfile) GetInferenceCapable() bool {
	if x != nil {
		return x.InferenceCapable
	}
	return false
}

func (x *ProviderProfile) GetDiscovery() *ProviderProfileDiscovery {
	if x != nil {
		return x.Discovery
	}
	return nil
}

func (x *ProviderProfile) GetResourceVersion() uint64 {
	if x != nil {
		return x.ResourceVersion
	}
	return 0
}

func (x *ProviderProfile) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

func (x *ProviderProfile) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

func (x *ProviderProfile) GetScope() string {
	if x != nil {
		return x.Scope
	}
	return ""
}

// Provider profile response.
type ProviderProfileResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Profile       *ProviderProfile       `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileResponse) Reset() {
	*x = ProviderProfileResponse{}
	mi := &file_openshell_proto_msgTypes[122]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileResponse) ProtoMessage() {}

func (x *ProviderProfileResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[122]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileResponse.ProtoReflect.Descriptor instead.
func (*ProviderProfileResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{122}
}

func (x *ProviderProfileResponse) GetProfile() *ProviderProfile {
	if x != nil {
		return x.Profile
	}
	return nil
}

// List provider profiles response.
type ListProviderProfilesResponse struct {
	state    protoimpl.MessageState `protogen:"open.v1"`
	Profiles []*ProviderProfile     `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"`
	// Token for the next page. Empty when there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListProviderProfilesResponse) Reset() {
	*x = ListProviderProfilesResponse{}
	mi := &file_openshell_proto_msgTypes[123]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListProviderProfilesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListProviderProfilesResponse) ProtoMessage() {}

func (x *ListProviderProfilesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[123]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListProviderProfilesResponse.ProtoReflect.Descriptor instead.
func (*ListProviderProfilesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{123}
}

func (x *ListProviderProfilesResponse) GetProfiles() []*ProviderProfile {
	if x != nil {
		return x.Profiles
	}
	return nil
}

func (x *ListProviderProfilesResponse) GetNextPageToken() string {
	if x != nil {
		return x.NextPageToken
	}
	return ""
}

// Import custom provider profiles request.
type ImportProviderProfilesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Omit for platform profiles; otherwise select one named workspace.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Profiles       []*ProviderProfileImportItem   `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,3,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ImportProviderProfilesRequest) Reset() {
	*x = ImportProviderProfilesRequest{}
	mi := &file_openshell_proto_msgTypes[124]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ImportProviderProfilesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ImportProviderProfilesRequest) ProtoMessage() {}

func (x *ImportProviderProfilesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[124]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ImportProviderProfilesRequest.ProtoReflect.Descriptor instead.
func (*ImportProviderProfilesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{124}
}

func (x *ImportProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ImportProviderProfilesRequest) GetProfiles() []*ProviderProfileImportItem {
	if x != nil {
		return x.Profiles
	}
	return nil
}

func (x *ImportProviderProfilesRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Import custom provider profiles response.
type ImportProviderProfilesResponse struct {
	state         protoimpl.MessageState       `protogen:"open.v1"`
	Diagnostics   []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
	Profiles      []*ProviderProfile           `protobuf:"bytes,2,rep,name=profiles,proto3" json:"profiles,omitempty"`
	Imported      bool                         `protobuf:"varint,3,opt,name=imported,proto3" json:"imported,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ImportProviderProfilesResponse) Reset() {
	*x = ImportProviderProfilesResponse{}
	mi := &file_openshell_proto_msgTypes[125]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ImportProviderProfilesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ImportProviderProfilesResponse) ProtoMessage() {}

func (x *ImportProviderProfilesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[125]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ImportProviderProfilesResponse.ProtoReflect.Descriptor instead.
func (*ImportProviderProfilesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{125}
}

func (x *ImportProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic {
	if x != nil {
		return x.Diagnostics
	}
	return nil
}

func (x *ImportProviderProfilesResponse) GetProfiles() []*ProviderProfile {
	if x != nil {
		return x.Profiles
	}
	return nil
}

func (x *ImportProviderProfilesResponse) GetImported() bool {
	if x != nil {
		return x.Imported
	}
	return false
}

// Update one custom provider profile request.
type UpdateProviderProfilesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Omit for platform profiles; otherwise select one named workspace.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Profile        *ProviderProfileImportItem     `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
	// Expected storage resource version for optimistic concurrency control.
	// If 0, the server uses the resource_version embedded in profile.profile.
	// Updates without a non-zero version are rejected to prevent stale files from
	// silently overwriting newer profile definitions.
	ExpectedResourceVersion uint64 `protobuf:"varint,2,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"`
	// Existing custom provider profile ID to update. The payload ID must match.
	Id string `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,5,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateProviderProfilesRequest) Reset() {
	*x = UpdateProviderProfilesRequest{}
	mi := &file_openshell_proto_msgTypes[126]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateProviderProfilesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateProviderProfilesRequest) ProtoMessage() {}

func (x *UpdateProviderProfilesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[126]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateProviderProfilesRequest.ProtoReflect.Descriptor instead.
func (*UpdateProviderProfilesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{126}
}

func (x *UpdateProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *UpdateProviderProfilesRequest) GetProfile() *ProviderProfileImportItem {
	if x != nil {
		return x.Profile
	}
	return nil
}

func (x *UpdateProviderProfilesRequest) GetExpectedResourceVersion() uint64 {
	if x != nil {
		return x.ExpectedResourceVersion
	}
	return 0
}

func (x *UpdateProviderProfilesRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *UpdateProviderProfilesRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Update one custom provider profile response.
type UpdateProviderProfilesResponse struct {
	state         protoimpl.MessageState       `protogen:"open.v1"`
	Diagnostics   []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
	Profile       *ProviderProfile             `protobuf:"bytes,2,opt,name=profile,proto3" json:"profile,omitempty"`
	Updated       bool                         `protobuf:"varint,3,opt,name=updated,proto3" json:"updated,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateProviderProfilesResponse) Reset() {
	*x = UpdateProviderProfilesResponse{}
	mi := &file_openshell_proto_msgTypes[127]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateProviderProfilesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateProviderProfilesResponse) ProtoMessage() {}

func (x *UpdateProviderProfilesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[127]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateProviderProfilesResponse.ProtoReflect.Descriptor instead.
func (*UpdateProviderProfilesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{127}
}

func (x *UpdateProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic {
	if x != nil {
		return x.Diagnostics
	}
	return nil
}

func (x *UpdateProviderProfilesResponse) GetProfile() *ProviderProfile {
	if x != nil {
		return x.Profile
	}
	return nil
}

func (x *UpdateProviderProfilesResponse) GetUpdated() bool {
	if x != nil {
		return x.Updated
	}
	return false
}

// Lint provider profiles request.
type LintProviderProfilesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Omit for platform profiles; otherwise select one named workspace.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Profiles       []*ProviderProfileImportItem   `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *LintProviderProfilesRequest) Reset() {
	*x = LintProviderProfilesRequest{}
	mi := &file_openshell_proto_msgTypes[128]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *LintProviderProfilesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*LintProviderProfilesRequest) ProtoMessage() {}

func (x *LintProviderProfilesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[128]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use LintProviderProfilesRequest.ProtoReflect.Descriptor instead.
func (*LintProviderProfilesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{128}
}

func (x *LintProviderProfilesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *LintProviderProfilesRequest) GetProfiles() []*ProviderProfileImportItem {
	if x != nil {
		return x.Profiles
	}
	return nil
}

// Lint provider profiles response.
type LintProviderProfilesResponse struct {
	state         protoimpl.MessageState       `protogen:"open.v1"`
	Diagnostics   []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
	Valid         bool                         `protobuf:"varint,2,opt,name=valid,proto3" json:"valid,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *LintProviderProfilesResponse) Reset() {
	*x = LintProviderProfilesResponse{}
	mi := &file_openshell_proto_msgTypes[129]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *LintProviderProfilesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*LintProviderProfilesResponse) ProtoMessage() {}

func (x *LintProviderProfilesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[129]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use LintProviderProfilesResponse.ProtoReflect.Descriptor instead.
func (*LintProviderProfilesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{129}
}

func (x *LintProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic {
	if x != nil {
		return x.Diagnostics
	}
	return nil
}

func (x *LintProviderProfilesResponse) GetValid() bool {
	if x != nil {
		return x.Valid
	}
	return false
}

// Delete provider response.
type DeleteProviderResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Outcome       DeletionOutcome        `protobuf:"varint,2,opt,name=outcome,proto3,enum=openshell.v1.DeletionOutcome" json:"outcome,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderResponse) Reset() {
	*x = DeleteProviderResponse{}
	mi := &file_openshell_proto_msgTypes[130]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderResponse) ProtoMessage() {}

func (x *DeleteProviderResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[130]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderResponse.ProtoReflect.Descriptor instead.
func (*DeleteProviderResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{130}
}

func (x *DeleteProviderResponse) GetOutcome() DeletionOutcome {
	if x != nil {
		return x.Outcome
	}
	return DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED
}

// Delete custom provider profile request.
type DeleteProviderProfileRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Omit for platform profiles; otherwise select one named workspace.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Id             string                         `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	AllowMissing   bool                           `protobuf:"varint,3,opt,name=allow_missing,json=allowMissing,proto3" json:"allow_missing,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,4,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderProfileRequest) Reset() {
	*x = DeleteProviderProfileRequest{}
	mi := &file_openshell_proto_msgTypes[131]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderProfileRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderProfileRequest) ProtoMessage() {}

func (x *DeleteProviderProfileRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[131]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderProfileRequest.ProtoReflect.Descriptor instead.
func (*DeleteProviderProfileRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{131}
}

func (x *DeleteProviderProfileRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *DeleteProviderProfileRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *DeleteProviderProfileRequest) GetAllowMissing() bool {
	if x != nil {
		return x.AllowMissing
	}
	return false
}

func (x *DeleteProviderProfileRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Delete custom provider profile response.
type DeleteProviderProfileResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Outcome       DeletionOutcome        `protobuf:"varint,2,opt,name=outcome,proto3,enum=openshell.v1.DeletionOutcome" json:"outcome,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderProfileResponse) Reset() {
	*x = DeleteProviderProfileResponse{}
	mi := &file_openshell_proto_msgTypes[132]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderProfileResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderProfileResponse) ProtoMessage() {}

func (x *DeleteProviderProfileResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[132]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderProfileResponse.ProtoReflect.Descriptor instead.
func (*DeleteProviderProfileResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{132}
}

func (x *DeleteProviderProfileResponse) GetOutcome() DeletionOutcome {
	if x != nil {
		return x.Outcome
	}
	return DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED
}

// Get sandbox provider environment request.
type GetSandboxProviderEnvironmentRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The sandbox ID.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Whether the requesting supervisor enforces endpoint bindings for static
	// provider credentials. Gateways withhold static credential material when
	// this capability is absent.
	SupportsStaticCredentialBindings bool `protobuf:"varint,2,opt,name=supports_static_credential_bindings,json=supportsStaticCredentialBindings,proto3" json:"supports_static_credential_bindings,omitempty"`
	unknownFields                    protoimpl.UnknownFields
	sizeCache                        protoimpl.SizeCache
}

func (x *GetSandboxProviderEnvironmentRequest) Reset() {
	*x = GetSandboxProviderEnvironmentRequest{}
	mi := &file_openshell_proto_msgTypes[133]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxProviderEnvironmentRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxProviderEnvironmentRequest) ProtoMessage() {}

func (x *GetSandboxProviderEnvironmentRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[133]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxProviderEnvironmentRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxProviderEnvironmentRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{133}
}

func (x *GetSandboxProviderEnvironmentRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *GetSandboxProviderEnvironmentRequest) GetSupportsStaticCredentialBindings() bool {
	if x != nil {
		return x.SupportsStaticCredentialBindings
	}
	return false
}

// One network endpoint at which a static provider credential may be resolved.
type StaticCredentialEndpointBinding struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Port          uint32                 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	Path          string                 `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *StaticCredentialEndpointBinding) Reset() {
	*x = StaticCredentialEndpointBinding{}
	mi := &file_openshell_proto_msgTypes[134]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StaticCredentialEndpointBinding) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StaticCredentialEndpointBinding) ProtoMessage() {}

func (x *StaticCredentialEndpointBinding) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[134]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StaticCredentialEndpointBinding.ProtoReflect.Descriptor instead.
func (*StaticCredentialEndpointBinding) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{134}
}

func (x *StaticCredentialEndpointBinding) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *StaticCredentialEndpointBinding) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *StaticCredentialEndpointBinding) GetPath() string {
	if x != nil {
		return x.Path
	}
	return ""
}

// Endpoint allowlist for one static provider credential environment variable.
type StaticCredentialBinding struct {
	state     protoimpl.MessageState             `protogen:"open.v1"`
	Endpoints []*StaticCredentialEndpointBinding `protobuf:"bytes,1,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
	// Stable identity of the provider credential that produced this binding.
	// Supervisors use it to retain old revision placeholders only across
	// rotations of the same provider credential.
	CredentialIdentity string `protobuf:"bytes,2,opt,name=credential_identity,json=credentialIdentity,proto3" json:"credential_identity,omitempty"`
	// Opaque gateway-issued handle for a refresh-managed credential identity
	// epoch. When non-empty, supervisors keep the workload placeholder stable
	// across access-token rotations and replace only the resolver value. The
	// handle changes when the sandbox, provider, credential key, refresh
	// authorization epoch, or endpoint authorization boundary changes.
	WorkloadCredentialHandle string `protobuf:"bytes,3,opt,name=workload_credential_handle,json=workloadCredentialHandle,proto3" json:"workload_credential_handle,omitempty"`
	unknownFields            protoimpl.UnknownFields
	sizeCache                protoimpl.SizeCache
}

func (x *StaticCredentialBinding) Reset() {
	*x = StaticCredentialBinding{}
	mi := &file_openshell_proto_msgTypes[135]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StaticCredentialBinding) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StaticCredentialBinding) ProtoMessage() {}

func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[135]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StaticCredentialBinding.ProtoReflect.Descriptor instead.
func (*StaticCredentialBinding) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{135}
}

func (x *StaticCredentialBinding) GetEndpoints() []*StaticCredentialEndpointBinding {
	if x != nil {
		return x.Endpoints
	}
	return nil
}

func (x *StaticCredentialBinding) GetCredentialIdentity() string {
	if x != nil {
		return x.CredentialIdentity
	}
	return ""
}

func (x *StaticCredentialBinding) GetWorkloadCredentialHandle() string {
	if x != nil {
		return x.WorkloadCredentialHandle
	}
	return ""
}

// Get sandbox provider environment response.
type GetSandboxProviderEnvironmentResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Provider credential environment variables.
	Environment map[string]string `protobuf:"bytes,1,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Fingerprint for the provider credential inputs that produced environment.
	ProviderEnvRevision uint64 `protobuf:"varint,2,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"`
	// Expiration timestamps for returned environment variables.
	CredentialExpirationTimes map[string]*timestamppb.Timestamp `protobuf:"bytes,103,rep,name=credential_expiration_times,json=credentialExpirationTimes,proto3" json:"credential_expiration_times,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Dynamic credentials that require token grants or other runtime injection.
	// Maps endpoint-bound provider metadata to credential metadata.
	// Supervisor uses this to inject Authorization headers for token grant credentials.
	DynamicCredentials map[string]*ProviderProfileCredential `protobuf:"bytes,4,rep,name=dynamic_credentials,json=dynamicCredentials,proto3" json:"dynamic_credentials,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Endpoint allowlists for static credential environment variables. Metadata
	// can be incomplete when a provider profile is invalid; capable supervisors
	// reject all static material in that snapshot while preserving independently
	// endpoint-bound dynamic credentials.
	StaticCredentialBindings map[string]*StaticCredentialBinding `protobuf:"bytes,5,rep,name=static_credential_bindings,json=staticCredentialBindings,proto3" json:"static_credential_bindings,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Environment variables that contain provider configuration rather than
	// credentials and therefore do not require endpoint-scoped resolution.
	NonSecretEnvironmentKeys []string `protobuf:"bytes,6,rep,name=non_secret_environment_keys,json=nonSecretEnvironmentKeys,proto3" json:"non_secret_environment_keys,omitempty"`
	// Attachment identity captured with the returned provider records.
	ProviderAttachmentEpoch string `protobuf:"bytes,7,opt,name=provider_attachment_epoch,json=providerAttachmentEpoch,proto3" json:"provider_attachment_epoch,omitempty"`
	// Effective policy identity used to derive this snapshot's endpoint bindings.
	PolicyHash string `protobuf:"bytes,8,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Nonzero when material was withheld; installing an empty map is not readiness.
	ReadinessReason ProviderReadinessReason `protobuf:"varint,9,opt,name=readiness_reason,json=readinessReason,proto3,enum=openshell.v1.ProviderReadinessReason" json:"readiness_reason,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *GetSandboxProviderEnvironmentResponse) Reset() {
	*x = GetSandboxProviderEnvironmentResponse{}
	mi := &file_openshell_proto_msgTypes[136]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxProviderEnvironmentResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxProviderEnvironmentResponse) ProtoMessage() {}

func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[136]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxProviderEnvironmentResponse.ProtoReflect.Descriptor instead.
func (*GetSandboxProviderEnvironmentResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{136}
}

func (x *GetSandboxProviderEnvironmentResponse) GetEnvironment() map[string]string {
	if x != nil {
		return x.Environment
	}
	return nil
}

func (x *GetSandboxProviderEnvironmentResponse) GetProviderEnvRevision() uint64 {
	if x != nil {
		return x.ProviderEnvRevision
	}
	return 0
}

func (x *GetSandboxProviderEnvironmentResponse) GetCredentialExpirationTimes() map[string]*timestamppb.Timestamp {
	if x != nil {
		return x.CredentialExpirationTimes
	}
	return nil
}

func (x *GetSandboxProviderEnvironmentResponse) GetDynamicCredentials() map[string]*ProviderProfileCredential {
	if x != nil {
		return x.DynamicCredentials
	}
	return nil
}

func (x *GetSandboxProviderEnvironmentResponse) GetStaticCredentialBindings() map[string]*StaticCredentialBinding {
	if x != nil {
		return x.StaticCredentialBindings
	}
	return nil
}

func (x *GetSandboxProviderEnvironmentResponse) GetNonSecretEnvironmentKeys() []string {
	if x != nil {
		return x.NonSecretEnvironmentKeys
	}
	return nil
}

func (x *GetSandboxProviderEnvironmentResponse) GetProviderAttachmentEpoch() string {
	if x != nil {
		return x.ProviderAttachmentEpoch
	}
	return ""
}

func (x *GetSandboxProviderEnvironmentResponse) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *GetSandboxProviderEnvironmentResponse) GetReadinessReason() ProviderReadinessReason {
	if x != nil {
		return x.ReadinessReason
	}
	return ProviderReadinessReason_PROVIDER_READINESS_REASON_UNSPECIFIED
}

type ExchangeProviderSubjectTokenRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The sandbox ID. Must match the authenticated sandbox principal.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Attached provider record holding the configured subject token credential.
	Provider string `protobuf:"bytes,2,opt,name=provider,proto3" json:"provider,omitempty"`
	// Provider profile credential that declares the token_exchange grant.
	CredentialKey string `protobuf:"bytes,3,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	// Supervisor JWT-SVID. The gateway verifies this and uses its `sub` claim
	// as the requested audience for the intermediate token.
	SupervisorJwtSvid string `protobuf:"bytes,4,opt,name=supervisor_jwt_svid,json=supervisorJwtSvid,proto3" json:"supervisor_jwt_svid,omitempty"`
	unknownFields     protoimpl.UnknownFields
	sizeCache         protoimpl.SizeCache
}

func (x *ExchangeProviderSubjectTokenRequest) Reset() {
	*x = ExchangeProviderSubjectTokenRequest{}
	mi := &file_openshell_proto_msgTypes[137]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExchangeProviderSubjectTokenRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExchangeProviderSubjectTokenRequest) ProtoMessage() {}

func (x *ExchangeProviderSubjectTokenRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[137]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExchangeProviderSubjectTokenRequest.ProtoReflect.Descriptor instead.
func (*ExchangeProviderSubjectTokenRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{137}
}

func (x *ExchangeProviderSubjectTokenRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ExchangeProviderSubjectTokenRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *ExchangeProviderSubjectTokenRequest) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *ExchangeProviderSubjectTokenRequest) GetSupervisorJwtSvid() string {
	if x != nil {
		return x.SupervisorJwtSvid
	}
	return ""
}

type ExchangeProviderSubjectTokenResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	AccessToken   string                 `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	ExpiresAfter  *durationpb.Duration   `protobuf:"bytes,102,opt,name=expires_after,json=expiresAfter,proto3" json:"expires_after,omitempty"`
	TokenType     string                 `protobuf:"bytes,3,opt,name=token_type,json=tokenType,proto3" json:"token_type,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExchangeProviderSubjectTokenResponse) Reset() {
	*x = ExchangeProviderSubjectTokenResponse{}
	mi := &file_openshell_proto_msgTypes[138]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExchangeProviderSubjectTokenResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExchangeProviderSubjectTokenResponse) ProtoMessage() {}

func (x *ExchangeProviderSubjectTokenResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[138]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExchangeProviderSubjectTokenResponse.ProtoReflect.Descriptor instead.
func (*ExchangeProviderSubjectTokenResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{138}
}

func (x *ExchangeProviderSubjectTokenResponse) GetAccessToken() string {
	if x != nil {
		return x.AccessToken
	}
	return ""
}

func (x *ExchangeProviderSubjectTokenResponse) GetExpiresAfter() *durationpb.Duration {
	if x != nil {
		return x.ExpiresAfter
	}
	return nil
}

func (x *ExchangeProviderSubjectTokenResponse) GetTokenType() string {
	if x != nil {
		return x.TokenType
	}
	return ""
}

// Update sandbox policy request.
type UpdateConfigRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Omit for global updates; otherwise select one named workspace.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,10,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// The new policy to apply.
	//
	// Sandbox scope (`global=false`):
	//   - only network_policies may differ from create-time
	//     policy; static fields must match version 1.
	//
	// Global scope (`global=true`):
	// - applies to all sandboxes in full (no merge).
	Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"`
	// Optional single setting key to mutate.
	SettingKey string `protobuf:"bytes,3,opt,name=setting_key,json=settingKey,proto3" json:"setting_key,omitempty"`
	// Setting value for upsert operations.
	SettingValue *sandboxv1.SettingValue `protobuf:"bytes,4,opt,name=setting_value,json=settingValue,proto3" json:"setting_value,omitempty"`
	// Delete the setting key from scope.
	// Sandbox-scoped deletes are rejected; only global delete is supported.
	DeleteSetting bool `protobuf:"varint,5,opt,name=delete_setting,json=deleteSetting,proto3" json:"delete_setting,omitempty"`
	// Apply mutation at gateway-global scope.
	Global bool `protobuf:"varint,6,opt,name=global,proto3" json:"global,omitempty"`
	// Batched incremental policy merge operations. Sandbox-scoped only.
	MergeOperations []*PolicyMergeOperation `protobuf:"bytes,7,rep,name=merge_operations,json=mergeOperations,proto3" json:"merge_operations,omitempty"`
	// Expected resource version for optimistic concurrency control (sandbox-scoped only).
	// If 0, the server uses the current version (backward compatibility).
	// If non-zero, the server validates that the sandbox's current resource_version
	// matches this value before applying the mutation, returning ABORTED on mismatch.
	// Ignored for global-scoped updates.
	ExpectedResourceVersion uint64 `protobuf:"varint,8,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"`
	// Caller-provided annotations associated with a sandbox-scoped update. Values
	// must not contain secrets; the gateway treats them as opaque metadata and does
	// not interpret or verify their semantics. For policy updates, the gateway
	// stores the annotations immutably with the revision and merges them into
	// sandbox metadata as a convenience projection. For setting-only updates, it
	// only merges them into sandbox metadata.
	Annotations map[string]string `protobuf:"bytes,9,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Required for sandbox-scoped updates and empty for global updates.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,11,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateConfigRequest) Reset() {
	*x = UpdateConfigRequest{}
	mi := &file_openshell_proto_msgTypes[139]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateConfigRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateConfigRequest) ProtoMessage() {}

func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[139]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateConfigRequest.ProtoReflect.Descriptor instead.
func (*UpdateConfigRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{139}
}

func (x *UpdateConfigRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *UpdateConfigRequest) GetPolicy() *sandboxv1.SandboxPolicy {
	if x != nil {
		return x.Policy
	}
	return nil
}

func (x *UpdateConfigRequest) GetSettingKey() string {
	if x != nil {
		return x.SettingKey
	}
	return ""
}

func (x *UpdateConfigRequest) GetSettingValue() *sandboxv1.SettingValue {
	if x != nil {
		return x.SettingValue
	}
	return nil
}

func (x *UpdateConfigRequest) GetDeleteSetting() bool {
	if x != nil {
		return x.DeleteSetting
	}
	return false
}

func (x *UpdateConfigRequest) GetGlobal() bool {
	if x != nil {
		return x.Global
	}
	return false
}

func (x *UpdateConfigRequest) GetMergeOperations() []*PolicyMergeOperation {
	if x != nil {
		return x.MergeOperations
	}
	return nil
}

func (x *UpdateConfigRequest) GetExpectedResourceVersion() uint64 {
	if x != nil {
		return x.ExpectedResourceVersion
	}
	return 0
}

func (x *UpdateConfigRequest) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

func (x *UpdateConfigRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *UpdateConfigRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type PolicyMergeOperation struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Operation:
	//
	//	*PolicyMergeOperation_AddRule
	//	*PolicyMergeOperation_RemoveEndpoint
	//	*PolicyMergeOperation_RemoveRule
	//	*PolicyMergeOperation_AddDenyRules
	//	*PolicyMergeOperation_AddAllowRules
	//	*PolicyMergeOperation_RemoveBinary
	Operation     isPolicyMergeOperation_Operation `protobuf_oneof:"operation"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PolicyMergeOperation) Reset() {
	*x = PolicyMergeOperation{}
	mi := &file_openshell_proto_msgTypes[140]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PolicyMergeOperation) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PolicyMergeOperation) ProtoMessage() {}

func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[140]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PolicyMergeOperation.ProtoReflect.Descriptor instead.
func (*PolicyMergeOperation) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{140}
}

func (x *PolicyMergeOperation) GetOperation() isPolicyMergeOperation_Operation {
	if x != nil {
		return x.Operation
	}
	return nil
}

func (x *PolicyMergeOperation) GetAddRule() *AddNetworkRule {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_AddRule); ok {
			return x.AddRule
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetRemoveEndpoint() *RemoveNetworkEndpoint {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_RemoveEndpoint); ok {
			return x.RemoveEndpoint
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetRemoveRule() *RemoveNetworkRule {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_RemoveRule); ok {
			return x.RemoveRule
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetAddDenyRules() *AddDenyRules {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_AddDenyRules); ok {
			return x.AddDenyRules
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetAddAllowRules() *AddAllowRules {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_AddAllowRules); ok {
			return x.AddAllowRules
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetRemoveBinary() *RemoveNetworkBinary {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_RemoveBinary); ok {
			return x.RemoveBinary
		}
	}
	return nil
}

type isPolicyMergeOperation_Operation interface {
	isPolicyMergeOperation_Operation()
}

type PolicyMergeOperation_AddRule struct {
	AddRule *AddNetworkRule `protobuf:"bytes,1,opt,name=add_rule,json=addRule,proto3,oneof"`
}

type PolicyMergeOperation_RemoveEndpoint struct {
	RemoveEndpoint *RemoveNetworkEndpoint `protobuf:"bytes,2,opt,name=remove_endpoint,json=removeEndpoint,proto3,oneof"`
}

type PolicyMergeOperation_RemoveRule struct {
	RemoveRule *RemoveNetworkRule `protobuf:"bytes,3,opt,name=remove_rule,json=removeRule,proto3,oneof"`
}

type PolicyMergeOperation_AddDenyRules struct {
	AddDenyRules *AddDenyRules `protobuf:"bytes,4,opt,name=add_deny_rules,json=addDenyRules,proto3,oneof"`
}

type PolicyMergeOperation_AddAllowRules struct {
	AddAllowRules *AddAllowRules `protobuf:"bytes,5,opt,name=add_allow_rules,json=addAllowRules,proto3,oneof"`
}

type PolicyMergeOperation_RemoveBinary struct {
	RemoveBinary *RemoveNetworkBinary `protobuf:"bytes,6,opt,name=remove_binary,json=removeBinary,proto3,oneof"`
}

func (*PolicyMergeOperation_AddRule) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_RemoveEndpoint) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_RemoveRule) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_AddDenyRules) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_AddAllowRules) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_RemoveBinary) isPolicyMergeOperation_Operation() {}

type AddNetworkRule struct {
	state         protoimpl.MessageState       `protogen:"open.v1"`
	RuleName      string                       `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	Rule          *sandboxv1.NetworkPolicyRule `protobuf:"bytes,2,opt,name=rule,proto3" json:"rule,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddNetworkRule) Reset() {
	*x = AddNetworkRule{}
	mi := &file_openshell_proto_msgTypes[141]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddNetworkRule) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddNetworkRule) ProtoMessage() {}

func (x *AddNetworkRule) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[141]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddNetworkRule.ProtoReflect.Descriptor instead.
func (*AddNetworkRule) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{141}
}

func (x *AddNetworkRule) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *AddNetworkRule) GetRule() *sandboxv1.NetworkPolicyRule {
	if x != nil {
		return x.Rule
	}
	return nil
}

type RemoveNetworkEndpoint struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	RuleName      string                 `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	Host          string                 `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
	Port          uint32                 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoveNetworkEndpoint) Reset() {
	*x = RemoveNetworkEndpoint{}
	mi := &file_openshell_proto_msgTypes[142]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveNetworkEndpoint) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveNetworkEndpoint) ProtoMessage() {}

func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[142]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveNetworkEndpoint.ProtoReflect.Descriptor instead.
func (*RemoveNetworkEndpoint) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{142}
}

func (x *RemoveNetworkEndpoint) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *RemoveNetworkEndpoint) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *RemoveNetworkEndpoint) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

type RemoveNetworkRule struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	RuleName      string                 `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoveNetworkRule) Reset() {
	*x = RemoveNetworkRule{}
	mi := &file_openshell_proto_msgTypes[143]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveNetworkRule) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveNetworkRule) ProtoMessage() {}

func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[143]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveNetworkRule.ProtoReflect.Descriptor instead.
func (*RemoveNetworkRule) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{143}
}

func (x *RemoveNetworkRule) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

// Exact endpoint and complete authorization scope affected by an L7 append.
// All ports and binaries must match the stored target; omitted scope is invalid.
type L7RuleTarget struct {
	state    protoimpl.MessageState `protogen:"open.v1"`
	RuleName string                 `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	Host     string                 `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
	Ports    []uint32               `protobuf:"varint,3,rep,packed,name=ports,proto3" json:"ports,omitempty"`
	// An absent path requires a unique endpoint. An empty path selects an
	// endpoint without a path selector. This is not the appended request path.
	Path *string `protobuf:"bytes,4,opt,name=path,proto3,oneof" json:"path,omitempty"`
	// Declare either a nonempty binary list or any_binary, never both.
	Binaries      []*sandboxv1.NetworkBinary `protobuf:"bytes,5,rep,name=binaries,proto3" json:"binaries,omitempty"`
	AnyBinary     bool                       `protobuf:"varint,6,opt,name=any_binary,json=anyBinary,proto3" json:"any_binary,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *L7RuleTarget) Reset() {
	*x = L7RuleTarget{}
	mi := &file_openshell_proto_msgTypes[144]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *L7RuleTarget) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*L7RuleTarget) ProtoMessage() {}

func (x *L7RuleTarget) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[144]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use L7RuleTarget.ProtoReflect.Descriptor instead.
func (*L7RuleTarget) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{144}
}

func (x *L7RuleTarget) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *L7RuleTarget) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *L7RuleTarget) GetPorts() []uint32 {
	if x != nil {
		return x.Ports
	}
	return nil
}

func (x *L7RuleTarget) GetPath() string {
	if x != nil && x.Path != nil {
		return *x.Path
	}
	return ""
}

func (x *L7RuleTarget) GetBinaries() []*sandboxv1.NetworkBinary {
	if x != nil {
		return x.Binaries
	}
	return nil
}

func (x *L7RuleTarget) GetAnyBinary() bool {
	if x != nil {
		return x.AnyBinary
	}
	return false
}

type AddDenyRules struct {
	state         protoimpl.MessageState  `protogen:"open.v1"`
	DenyRules     []*sandboxv1.L7DenyRule `protobuf:"bytes,3,rep,name=deny_rules,json=denyRules,proto3" json:"deny_rules,omitempty"`
	Target        *L7RuleTarget           `protobuf:"bytes,4,opt,name=target,proto3" json:"target,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddDenyRules) Reset() {
	*x = AddDenyRules{}
	mi := &file_openshell_proto_msgTypes[145]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddDenyRules) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddDenyRules) ProtoMessage() {}

func (x *AddDenyRules) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[145]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddDenyRules.ProtoReflect.Descriptor instead.
func (*AddDenyRules) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{145}
}

func (x *AddDenyRules) GetDenyRules() []*sandboxv1.L7DenyRule {
	if x != nil {
		return x.DenyRules
	}
	return nil
}

func (x *AddDenyRules) GetTarget() *L7RuleTarget {
	if x != nil {
		return x.Target
	}
	return nil
}

type AddAllowRules struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Rules         []*sandboxv1.L7Rule    `protobuf:"bytes,3,rep,name=rules,proto3" json:"rules,omitempty"`
	Target        *L7RuleTarget          `protobuf:"bytes,4,opt,name=target,proto3" json:"target,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddAllowRules) Reset() {
	*x = AddAllowRules{}
	mi := &file_openshell_proto_msgTypes[146]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddAllowRules) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddAllowRules) ProtoMessage() {}

func (x *AddAllowRules) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[146]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddAllowRules.ProtoReflect.Descriptor instead.
func (*AddAllowRules) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{146}
}

func (x *AddAllowRules) GetRules() []*sandboxv1.L7Rule {
	if x != nil {
		return x.Rules
	}
	return nil
}

func (x *AddAllowRules) GetTarget() *L7RuleTarget {
	if x != nil {
		return x.Target
	}
	return nil
}

type RemoveNetworkBinary struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	RuleName      string                 `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	BinaryPath    string                 `protobuf:"bytes,2,opt,name=binary_path,json=binaryPath,proto3" json:"binary_path,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoveNetworkBinary) Reset() {
	*x = RemoveNetworkBinary{}
	mi := &file_openshell_proto_msgTypes[147]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveNetworkBinary) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveNetworkBinary) ProtoMessage() {}

func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[147]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveNetworkBinary.ProtoReflect.Descriptor instead.
func (*RemoveNetworkBinary) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{147}
}

func (x *RemoveNetworkBinary) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *RemoveNetworkBinary) GetBinaryPath() string {
	if x != nil {
		return x.BinaryPath
	}
	return ""
}

// Update sandbox policy response.
type UpdateConfigResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Assigned policy version (monotonically increasing per sandbox).
	Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// SHA-256 hash of the serialized policy payload.
	PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Settings revision for the scope that was modified.
	SettingsRevision uint64 `protobuf:"varint,3,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"`
	// True when a setting delete operation removed an existing key.
	Deleted bool `protobuf:"varint,4,opt,name=deleted,proto3" json:"deleted,omitempty"`
	// Sandbox metadata annotations after the update. Empty for global updates.
	Annotations   map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateConfigResponse) Reset() {
	*x = UpdateConfigResponse{}
	mi := &file_openshell_proto_msgTypes[148]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateConfigResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateConfigResponse) ProtoMessage() {}

func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[148]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateConfigResponse.ProtoReflect.Descriptor instead.
func (*UpdateConfigResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{148}
}

func (x *UpdateConfigResponse) GetVersion() uint32 {
	if x != nil {
		return x.Version
	}
	return 0
}

func (x *UpdateConfigResponse) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *UpdateConfigResponse) GetSettingsRevision() uint64 {
	if x != nil {
		return x.SettingsRevision
	}
	return 0
}

func (x *UpdateConfigResponse) GetDeleted() bool {
	if x != nil {
		return x.Deleted
	}
	return false
}

func (x *UpdateConfigResponse) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

// Get sandbox policy status request.
type GetSandboxPolicyStatusRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Omit for global queries; otherwise select one named workspace.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// The specific policy version to query. 0 means latest.
	Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
	// Query global policy revisions instead of a sandbox-scoped one.
	Global        bool   `protobuf:"varint,3,opt,name=global,proto3" json:"global,omitempty"`
	Sandbox       string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxPolicyStatusRequest) Reset() {
	*x = GetSandboxPolicyStatusRequest{}
	mi := &file_openshell_proto_msgTypes[149]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxPolicyStatusRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxPolicyStatusRequest) ProtoMessage() {}

func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[149]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxPolicyStatusRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxPolicyStatusRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{149}
}

func (x *GetSandboxPolicyStatusRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetSandboxPolicyStatusRequest) GetVersion() uint32 {
	if x != nil {
		return x.Version
	}
	return 0
}

func (x *GetSandboxPolicyStatusRequest) GetGlobal() bool {
	if x != nil {
		return x.Global
	}
	return false
}

func (x *GetSandboxPolicyStatusRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

// Get sandbox policy status response.
type GetSandboxPolicyStatusResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The queried policy revision.
	Revision *SandboxPolicyRevision `protobuf:"bytes,1,opt,name=revision,proto3" json:"revision,omitempty"`
	// The currently active (loaded) policy version for this sandbox.
	ActiveVersion uint32 `protobuf:"varint,2,opt,name=active_version,json=activeVersion,proto3" json:"active_version,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxPolicyStatusResponse) Reset() {
	*x = GetSandboxPolicyStatusResponse{}
	mi := &file_openshell_proto_msgTypes[150]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxPolicyStatusResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxPolicyStatusResponse) ProtoMessage() {}

func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[150]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxPolicyStatusResponse.ProtoReflect.Descriptor instead.
func (*GetSandboxPolicyStatusResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{150}
}

func (x *GetSandboxPolicyStatusResponse) GetRevision() *SandboxPolicyRevision {
	if x != nil {
		return x.Revision
	}
	return nil
}

func (x *GetSandboxPolicyStatusResponse) GetActiveVersion() uint32 {
	if x != nil {
		return x.ActiveVersion
	}
	return 0
}

// List sandbox policies request.
type ListSandboxPoliciesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Omit for global queries; otherwise select one named workspace.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,5,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// The maximum number of revisions to return. Zero uses 100. Values above
	// 1000 are coerced to 1000; negative values are invalid.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Token from a previous ListSandboxPolicies response. All other request
	// parameters except page_size must match the request that produced it.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// List global policy revisions instead of sandbox-scoped ones.
	Global        bool   `protobuf:"varint,4,opt,name=global,proto3" json:"global,omitempty"`
	Sandbox       string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxPoliciesRequest) Reset() {
	*x = ListSandboxPoliciesRequest{}
	mi := &file_openshell_proto_msgTypes[151]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxPoliciesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxPoliciesRequest) ProtoMessage() {}

func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[151]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxPoliciesRequest.ProtoReflect.Descriptor instead.
func (*ListSandboxPoliciesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{151}
}

func (x *ListSandboxPoliciesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ListSandboxPoliciesRequest) GetPageSize() int32 {
	if x != nil {
		return x.PageSize
	}
	return 0
}

func (x *ListSandboxPoliciesRequest) GetPageToken() string {
	if x != nil {
		return x.PageToken
	}
	return ""
}

func (x *ListSandboxPoliciesRequest) GetGlobal() bool {
	if x != nil {
		return x.Global
	}
	return false
}

func (x *ListSandboxPoliciesRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

// List sandbox policies response.
type ListSandboxPoliciesResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Invalid historical payloads remain visible as failed projections so one
	// legacy row cannot hide the rest of the policy history.
	Revisions []*SandboxPolicyRevision `protobuf:"bytes,1,rep,name=revisions,proto3" json:"revisions,omitempty"`
	// Token for the next page. Empty when there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxPoliciesResponse) Reset() {
	*x = ListSandboxPoliciesResponse{}
	mi := &file_openshell_proto_msgTypes[152]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxPoliciesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxPoliciesResponse) ProtoMessage() {}

func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[152]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxPoliciesResponse.ProtoReflect.Descriptor instead.
func (*ListSandboxPoliciesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{152}
}

func (x *ListSandboxPoliciesResponse) GetRevisions() []*SandboxPolicyRevision {
	if x != nil {
		return x.Revisions
	}
	return nil
}

func (x *ListSandboxPoliciesResponse) GetNextPageToken() string {
	if x != nil {
		return x.NextPageToken
	}
	return ""
}

// Report policy load status (called by sandbox runtime after reload attempt).
type ReportPolicyStatusRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// The policy version that was attempted.
	Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
	// Load result status.
	Status PolicyStatus `protobuf:"varint,3,opt,name=status,proto3,enum=openshell.v1.PolicyStatus" json:"status,omitempty"`
	// Error message if status is FAILED.
	LoadError     string `protobuf:"bytes,4,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportPolicyStatusRequest) Reset() {
	*x = ReportPolicyStatusRequest{}
	mi := &file_openshell_proto_msgTypes[153]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportPolicyStatusRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportPolicyStatusRequest) ProtoMessage() {}

func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[153]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportPolicyStatusRequest.ProtoReflect.Descriptor instead.
func (*ReportPolicyStatusRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{153}
}

func (x *ReportPolicyStatusRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ReportPolicyStatusRequest) GetVersion() uint32 {
	if x != nil {
		return x.Version
	}
	return 0
}

func (x *ReportPolicyStatusRequest) GetStatus() PolicyStatus {
	if x != nil {
		return x.Status
	}
	return PolicyStatus_POLICY_STATUS_UNSPECIFIED
}

func (x *ReportPolicyStatusRequest) GetLoadError() string {
	if x != nil {
		return x.LoadError
	}
	return ""
}

// Report policy status response.
type ReportPolicyStatusResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportPolicyStatusResponse) Reset() {
	*x = ReportPolicyStatusResponse{}
	mi := &file_openshell_proto_msgTypes[154]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportPolicyStatusResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportPolicyStatusResponse) ProtoMessage() {}

func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[154]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportPolicyStatusResponse.ProtoReflect.Descriptor instead.
func (*ReportPolicyStatusResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{154}
}

type SandboxConfigurationAdmission struct {
	state               protoimpl.MessageState      `protogen:"open.v1"`
	InstanceId          string                      `protobuf:"bytes,1,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
	State               ConfigurationAdmissionState `protobuf:"varint,2,opt,name=state,proto3,enum=openshell.v1.ConfigurationAdmissionState" json:"state,omitempty"`
	PolicyVersion       uint32                      `protobuf:"varint,3,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	PolicyHash          string                      `protobuf:"bytes,4,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	ConfigRevision      uint64                      `protobuf:"varint,5,opt,name=config_revision,json=configRevision,proto3" json:"config_revision,omitempty"`
	ProviderEnvRevision uint64                      `protobuf:"varint,6,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"`
	Error               string                      `protobuf:"bytes,7,opt,name=error,proto3" json:"error,omitempty"`
	unknownFields       protoimpl.UnknownFields
	sizeCache           protoimpl.SizeCache
}

func (x *SandboxConfigurationAdmission) Reset() {
	*x = SandboxConfigurationAdmission{}
	mi := &file_openshell_proto_msgTypes[155]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxConfigurationAdmission) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxConfigurationAdmission) ProtoMessage() {}

func (x *SandboxConfigurationAdmission) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[155]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxConfigurationAdmission.ProtoReflect.Descriptor instead.
func (*SandboxConfigurationAdmission) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{155}
}

func (x *SandboxConfigurationAdmission) GetInstanceId() string {
	if x != nil {
		return x.InstanceId
	}
	return ""
}

func (x *SandboxConfigurationAdmission) GetState() ConfigurationAdmissionState {
	if x != nil {
		return x.State
	}
	return ConfigurationAdmissionState_CONFIGURATION_ADMISSION_STATE_UNSPECIFIED
}

func (x *SandboxConfigurationAdmission) GetPolicyVersion() uint32 {
	if x != nil {
		return x.PolicyVersion
	}
	return 0
}

func (x *SandboxConfigurationAdmission) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *SandboxConfigurationAdmission) GetConfigRevision() uint64 {
	if x != nil {
		return x.ConfigRevision
	}
	return 0
}

func (x *SandboxConfigurationAdmission) GetProviderEnvRevision() uint64 {
	if x != nil {
		return x.ProviderEnvRevision
	}
	return 0
}

func (x *SandboxConfigurationAdmission) GetError() string {
	if x != nil {
		return x.Error
	}
	return ""
}

type ReportSandboxConfigurationRequest struct {
	state     protoimpl.MessageState         `protogen:"open.v1"`
	SandboxId string                         `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	Admission *SandboxConfigurationAdmission `protobuf:"bytes,2,opt,name=admission,proto3" json:"admission,omitempty"`
	// Pending registration replaces only this previously observed instance.
	ExpectedInstanceId string `protobuf:"bytes,3,opt,name=expected_instance_id,json=expectedInstanceId,proto3" json:"expected_instance_id,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *ReportSandboxConfigurationRequest) Reset() {
	*x = ReportSandboxConfigurationRequest{}
	mi := &file_openshell_proto_msgTypes[156]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportSandboxConfigurationRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportSandboxConfigurationRequest) ProtoMessage() {}

func (x *ReportSandboxConfigurationRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[156]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportSandboxConfigurationRequest.ProtoReflect.Descriptor instead.
func (*ReportSandboxConfigurationRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{156}
}

func (x *ReportSandboxConfigurationRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ReportSandboxConfigurationRequest) GetAdmission() *SandboxConfigurationAdmission {
	if x != nil {
		return x.Admission
	}
	return nil
}

func (x *ReportSandboxConfigurationRequest) GetExpectedInstanceId() string {
	if x != nil {
		return x.ExpectedInstanceId
	}
	return ""
}

type ReportSandboxConfigurationResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportSandboxConfigurationResponse) Reset() {
	*x = ReportSandboxConfigurationResponse{}
	mi := &file_openshell_proto_msgTypes[157]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportSandboxConfigurationResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportSandboxConfigurationResponse) ProtoMessage() {}

func (x *ReportSandboxConfigurationResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[157]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportSandboxConfigurationResponse.ProtoReflect.Descriptor instead.
func (*ReportSandboxConfigurationResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{157}
}

// A versioned policy revision with metadata.
type SandboxPolicyRevision struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Policy version (monotonically increasing per sandbox).
	Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// SHA-256 hash of the canonical serialized policy payload. Empty in a
	// ListSandboxPolicies projection when the stored payload is invalid under
	// the current schema and therefore has no trusted canonical identity.
	PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Load status of this revision. ListSandboxPolicies reports FAILED when a
	// stored historical payload is invalid under the current schema, regardless
	// of its persisted sandbox load status.
	Status PolicyStatus `protobuf:"varint,3,opt,name=status,proto3,enum=openshell.v1.PolicyStatus" json:"status,omitempty"`
	// Sandbox load error, or the schema-validation diagnostic for an invalid
	// historical row returned by ListSandboxPolicies.
	LoadError string `protobuf:"bytes,4,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"`
	// Time when this revision was created.
	CreatedTime *timestamppb.Timestamp `protobuf:"bytes,105,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"`
	// Time when this revision was loaded by the sandbox. Absent if not loaded.
	LoadedTime *timestamppb.Timestamp `protobuf:"bytes,106,opt,name=loaded_time,json=loadedTime,proto3" json:"loaded_time,omitempty"`
	// The full policy (only populated when explicitly requested).
	Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"`
	// Immutable provenance supplied with this policy revision.
	Provenance    map[string]string `protobuf:"bytes,8,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxPolicyRevision) Reset() {
	*x = SandboxPolicyRevision{}
	mi := &file_openshell_proto_msgTypes[158]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxPolicyRevision) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxPolicyRevision) ProtoMessage() {}

func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[158]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxPolicyRevision.ProtoReflect.Descriptor instead.
func (*SandboxPolicyRevision) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{158}
}

func (x *SandboxPolicyRevision) GetVersion() uint32 {
	if x != nil {
		return x.Version
	}
	return 0
}

func (x *SandboxPolicyRevision) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *SandboxPolicyRevision) GetStatus() PolicyStatus {
	if x != nil {
		return x.Status
	}
	return PolicyStatus_POLICY_STATUS_UNSPECIFIED
}

func (x *SandboxPolicyRevision) GetLoadError() string {
	if x != nil {
		return x.LoadError
	}
	return ""
}

func (x *SandboxPolicyRevision) GetCreatedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.CreatedTime
	}
	return nil
}

func (x *SandboxPolicyRevision) GetLoadedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.LoadedTime
	}
	return nil
}

func (x *SandboxPolicyRevision) GetPolicy() *sandboxv1.SandboxPolicy {
	if x != nil {
		return x.Policy
	}
	return nil
}

func (x *SandboxPolicyRevision) GetProvenance() map[string]string {
	if x != nil {
		return x.Provenance
	}
	return nil
}

// Get sandbox logs request (one-shot fetch).
type GetSandboxLogsRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,6,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Canonical sandbox name.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Maximum number of log lines to return. 0 means use default (2000).
	Lines uint32 `protobuf:"varint,2,opt,name=lines,proto3" json:"lines,omitempty"`
	// Only include logs at or after this time. Absence means no filter.
	SinceTime *timestamppb.Timestamp `protobuf:"bytes,103,opt,name=since_time,json=sinceTime,proto3" json:"since_time,omitempty"`
	// Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources.
	Sources []string `protobuf:"bytes,4,rep,name=sources,proto3" json:"sources,omitempty"`
	// Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels.
	MinLevel      string `protobuf:"bytes,5,opt,name=min_level,json=minLevel,proto3" json:"min_level,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxLogsRequest) Reset() {
	*x = GetSandboxLogsRequest{}
	mi := &file_openshell_proto_msgTypes[159]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxLogsRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxLogsRequest) ProtoMessage() {}

func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[159]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxLogsRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxLogsRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{159}
}

func (x *GetSandboxLogsRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetSandboxLogsRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *GetSandboxLogsRequest) GetLines() uint32 {
	if x != nil {
		return x.Lines
	}
	return 0
}

func (x *GetSandboxLogsRequest) GetSinceTime() *timestamppb.Timestamp {
	if x != nil {
		return x.SinceTime
	}
	return nil
}

func (x *GetSandboxLogsRequest) GetSources() []string {
	if x != nil {
		return x.Sources
	}
	return nil
}

func (x *GetSandboxLogsRequest) GetMinLevel() string {
	if x != nil {
		return x.MinLevel
	}
	return ""
}

// Batch of log lines pushed from sandbox to server.
type PushSandboxLogsRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The sandbox ID.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Log lines to ingest.
	Logs          []*SandboxLogLine `protobuf:"bytes,2,rep,name=logs,proto3" json:"logs,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PushSandboxLogsRequest) Reset() {
	*x = PushSandboxLogsRequest{}
	mi := &file_openshell_proto_msgTypes[160]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PushSandboxLogsRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PushSandboxLogsRequest) ProtoMessage() {}

func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[160]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PushSandboxLogsRequest.ProtoReflect.Descriptor instead.
func (*PushSandboxLogsRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{160}
}

func (x *PushSandboxLogsRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *PushSandboxLogsRequest) GetLogs() []*SandboxLogLine {
	if x != nil {
		return x.Logs
	}
	return nil
}

// Push sandbox logs response.
type PushSandboxLogsResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PushSandboxLogsResponse) Reset() {
	*x = PushSandboxLogsResponse{}
	mi := &file_openshell_proto_msgTypes[161]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PushSandboxLogsResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PushSandboxLogsResponse) ProtoMessage() {}

func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[161]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PushSandboxLogsResponse.ProtoReflect.Descriptor instead.
func (*PushSandboxLogsResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{161}
}

// Get sandbox logs response.
type GetSandboxLogsResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Log lines in chronological order.
	Logs []*SandboxLogLine `protobuf:"bytes,1,rep,name=logs,proto3" json:"logs,omitempty"`
	// Total number of lines in the server's buffer for this sandbox.
	BufferTotal   uint32 `protobuf:"varint,2,opt,name=buffer_total,json=bufferTotal,proto3" json:"buffer_total,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxLogsResponse) Reset() {
	*x = GetSandboxLogsResponse{}
	mi := &file_openshell_proto_msgTypes[162]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxLogsResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxLogsResponse) ProtoMessage() {}

func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[162]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxLogsResponse.ProtoReflect.Descriptor instead.
func (*GetSandboxLogsResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{162}
}

func (x *GetSandboxLogsResponse) GetLogs() []*SandboxLogLine {
	if x != nil {
		return x.Logs
	}
	return nil
}

func (x *GetSandboxLogsResponse) GetBufferTotal() uint32 {
	if x != nil {
		return x.BufferTotal
	}
	return 0
}

// Envelope for supervisor-to-gateway messages on the ConnectSupervisor stream.
type SupervisorMessage struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*SupervisorMessage_Hello
	//	*SupervisorMessage_Heartbeat
	//	*SupervisorMessage_RelayOpenResult
	//	*SupervisorMessage_RelayClose
	Payload       isSupervisorMessage_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SupervisorMessage) Reset() {
	*x = SupervisorMessage{}
	mi := &file_openshell_proto_msgTypes[163]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SupervisorMessage) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SupervisorMessage) ProtoMessage() {}

func (x *SupervisorMessage) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[163]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SupervisorMessage.ProtoReflect.Descriptor instead.
func (*SupervisorMessage) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{163}
}

func (x *SupervisorMessage) GetPayload() isSupervisorMessage_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *SupervisorMessage) GetHello() *SupervisorHello {
	if x != nil {
		if x, ok := x.Payload.(*SupervisorMessage_Hello); ok {
			return x.Hello
		}
	}
	return nil
}

func (x *SupervisorMessage) GetHeartbeat() *SupervisorHeartbeat {
	if x != nil {
		if x, ok := x.Payload.(*SupervisorMessage_Heartbeat); ok {
			return x.Heartbeat
		}
	}
	return nil
}

func (x *SupervisorMessage) GetRelayOpenResult() *RelayOpenResult {
	if x != nil {
		if x, ok := x.Payload.(*SupervisorMessage_RelayOpenResult); ok {
			return x.RelayOpenResult
		}
	}
	return nil
}

func (x *SupervisorMessage) GetRelayClose() *RelayClose {
	if x != nil {
		if x, ok := x.Payload.(*SupervisorMessage_RelayClose); ok {
			return x.RelayClose
		}
	}
	return nil
}

type isSupervisorMessage_Payload interface {
	isSupervisorMessage_Payload()
}

type SupervisorMessage_Hello struct {
	Hello *SupervisorHello `protobuf:"bytes,1,opt,name=hello,proto3,oneof"`
}

type SupervisorMessage_Heartbeat struct {
	Heartbeat *SupervisorHeartbeat `protobuf:"bytes,2,opt,name=heartbeat,proto3,oneof"`
}

type SupervisorMessage_RelayOpenResult struct {
	RelayOpenResult *RelayOpenResult `protobuf:"bytes,3,opt,name=relay_open_result,json=relayOpenResult,proto3,oneof"`
}

type SupervisorMessage_RelayClose struct {
	RelayClose *RelayClose `protobuf:"bytes,4,opt,name=relay_close,json=relayClose,proto3,oneof"`
}

func (*SupervisorMessage_Hello) isSupervisorMessage_Payload() {}

func (*SupervisorMessage_Heartbeat) isSupervisorMessage_Payload() {}

func (*SupervisorMessage_RelayOpenResult) isSupervisorMessage_Payload() {}

func (*SupervisorMessage_RelayClose) isSupervisorMessage_Payload() {}

// Envelope for gateway-to-supervisor messages on the ConnectSupervisor stream.
type GatewayMessage struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*GatewayMessage_SessionAccepted
	//	*GatewayMessage_SessionRejected
	//	*GatewayMessage_Heartbeat
	//	*GatewayMessage_RelayOpen
	//	*GatewayMessage_RelayClose
	Payload       isGatewayMessage_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GatewayMessage) Reset() {
	*x = GatewayMessage{}
	mi := &file_openshell_proto_msgTypes[164]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GatewayMessage) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GatewayMessage) ProtoMessage() {}

func (x *GatewayMessage) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[164]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GatewayMessage.ProtoReflect.Descriptor instead.
func (*GatewayMessage) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{164}
}

func (x *GatewayMessage) GetPayload() isGatewayMessage_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *GatewayMessage) GetSessionAccepted() *SessionAccepted {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_SessionAccepted); ok {
			return x.SessionAccepted
		}
	}
	return nil
}

func (x *GatewayMessage) GetSessionRejected() *SessionRejected {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_SessionRejected); ok {
			return x.SessionRejected
		}
	}
	return nil
}

func (x *GatewayMessage) GetHeartbeat() *GatewayHeartbeat {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_Heartbeat); ok {
			return x.Heartbeat
		}
	}
	return nil
}

func (x *GatewayMessage) GetRelayOpen() *RelayOpen {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_RelayOpen); ok {
			return x.RelayOpen
		}
	}
	return nil
}

func (x *GatewayMessage) GetRelayClose() *RelayClose {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_RelayClose); ok {
			return x.RelayClose
		}
	}
	return nil
}

type isGatewayMessage_Payload interface {
	isGatewayMessage_Payload()
}

type GatewayMessage_SessionAccepted struct {
	SessionAccepted *SessionAccepted `protobuf:"bytes,1,opt,name=session_accepted,json=sessionAccepted,proto3,oneof"`
}

type GatewayMessage_SessionRejected struct {
	SessionRejected *SessionRejected `protobuf:"bytes,2,opt,name=session_rejected,json=sessionRejected,proto3,oneof"`
}

type GatewayMessage_Heartbeat struct {
	Heartbeat *GatewayHeartbeat `protobuf:"bytes,3,opt,name=heartbeat,proto3,oneof"`
}

type GatewayMessage_RelayOpen struct {
	RelayOpen *RelayOpen `protobuf:"bytes,4,opt,name=relay_open,json=relayOpen,proto3,oneof"`
}

type GatewayMessage_RelayClose struct {
	RelayClose *RelayClose `protobuf:"bytes,5,opt,name=relay_close,json=relayClose,proto3,oneof"`
}

func (*GatewayMessage_SessionAccepted) isGatewayMessage_Payload() {}

func (*GatewayMessage_SessionRejected) isGatewayMessage_Payload() {}

func (*GatewayMessage_Heartbeat) isGatewayMessage_Payload() {}

func (*GatewayMessage_RelayOpen) isGatewayMessage_Payload() {}

func (*GatewayMessage_RelayClose) isGatewayMessage_Payload() {}

// Supervisor identifies itself and the sandbox it manages.
type SupervisorHello struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox ID this supervisor manages.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Supervisor instance ID (e.g. boot id or process epoch).
	InstanceId string `protobuf:"bytes,2,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
	// Monotonic counter scoped to instance_id. Incremented for each reconnect so
	// gateways can distinguish a fresh supervisor connection from stale cleanup.
	ConnectionEpoch uint64 `protobuf:"varint,3,opt,name=connection_epoch,json=connectionEpoch,proto3" json:"connection_epoch,omitempty"`
	// The supervisor can report credential, policy, and launch-environment installation.
	SupportsProviderReadiness bool `protobuf:"varint,4,opt,name=supports_provider_readiness,json=supportsProviderReadiness,proto3" json:"supports_provider_readiness,omitempty"`
	unknownFields             protoimpl.UnknownFields
	sizeCache                 protoimpl.SizeCache
}

func (x *SupervisorHello) Reset() {
	*x = SupervisorHello{}
	mi := &file_openshell_proto_msgTypes[165]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SupervisorHello) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SupervisorHello) ProtoMessage() {}

func (x *SupervisorHello) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[165]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SupervisorHello.ProtoReflect.Descriptor instead.
func (*SupervisorHello) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{165}
}

func (x *SupervisorHello) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *SupervisorHello) GetInstanceId() string {
	if x != nil {
		return x.InstanceId
	}
	return ""
}

func (x *SupervisorHello) GetConnectionEpoch() uint64 {
	if x != nil {
		return x.ConnectionEpoch
	}
	return 0
}

func (x *SupervisorHello) GetSupportsProviderReadiness() bool {
	if x != nil {
		return x.SupportsProviderReadiness
	}
	return false
}

// Gateway accepts the supervisor session.
type SessionAccepted struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-assigned session ID for this connection.
	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// Recommended heartbeat interval.
	HeartbeatInterval *durationpb.Duration `protobuf:"bytes,102,opt,name=heartbeat_interval,json=heartbeatInterval,proto3" json:"heartbeat_interval,omitempty"`
	unknownFields     protoimpl.UnknownFields
	sizeCache         protoimpl.SizeCache
}

func (x *SessionAccepted) Reset() {
	*x = SessionAccepted{}
	mi := &file_openshell_proto_msgTypes[166]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SessionAccepted) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SessionAccepted) ProtoMessage() {}

func (x *SessionAccepted) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[166]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SessionAccepted.ProtoReflect.Descriptor instead.
func (*SessionAccepted) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{166}
}

func (x *SessionAccepted) GetSessionId() string {
	if x != nil {
		return x.SessionId
	}
	return ""
}

func (x *SessionAccepted) GetHeartbeatInterval() *durationpb.Duration {
	if x != nil {
		return x.HeartbeatInterval
	}
	return nil
}

// Gateway rejects the supervisor session.
type SessionRejected struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Human-readable rejection reason.
	Reason        string `protobuf:"bytes,1,opt,name=reason,proto3" json:"reason,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SessionRejected) Reset() {
	*x = SessionRejected{}
	mi := &file_openshell_proto_msgTypes[167]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SessionRejected) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SessionRejected) ProtoMessage() {}

func (x *SessionRejected) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[167]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SessionRejected.ProtoReflect.Descriptor instead.
func (*SessionRejected) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{167}
}

func (x *SessionRejected) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

// Supervisor heartbeat.
type SupervisorHeartbeat struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SupervisorHeartbeat) Reset() {
	*x = SupervisorHeartbeat{}
	mi := &file_openshell_proto_msgTypes[168]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SupervisorHeartbeat) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SupervisorHeartbeat) ProtoMessage() {}

func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[168]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SupervisorHeartbeat.ProtoReflect.Descriptor instead.
func (*SupervisorHeartbeat) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{168}
}

// Gateway heartbeat.
type GatewayHeartbeat struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GatewayHeartbeat) Reset() {
	*x = GatewayHeartbeat{}
	mi := &file_openshell_proto_msgTypes[169]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GatewayHeartbeat) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GatewayHeartbeat) ProtoMessage() {}

func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[169]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GatewayHeartbeat.ProtoReflect.Descriptor instead.
func (*GatewayHeartbeat) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{169}
}

// Terminal result reported before the supervisor shuts down. A successful RPC
// response confirms that the result was durably handled by the gateway.
type ReportMainProcessExitRequest struct {
	state      protoimpl.MessageState `protogen:"open.v1"`
	SandboxId  string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	InstanceId string                 `protobuf:"bytes,2,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
	// Normalized process result. Signal exits use 128 + signal number.
	ExitCode      int32 `protobuf:"varint,3,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportMainProcessExitRequest) Reset() {
	*x = ReportMainProcessExitRequest{}
	mi := &file_openshell_proto_msgTypes[170]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportMainProcessExitRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportMainProcessExitRequest) ProtoMessage() {}

func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[170]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportMainProcessExitRequest.ProtoReflect.Descriptor instead.
func (*ReportMainProcessExitRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{170}
}

func (x *ReportMainProcessExitRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ReportMainProcessExitRequest) GetInstanceId() string {
	if x != nil {
		return x.InstanceId
	}
	return ""
}

func (x *ReportMainProcessExitRequest) GetExitCode() int32 {
	if x != nil {
		return x.ExitCode
	}
	return 0
}

type ReportMainProcessExitResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportMainProcessExitResponse) Reset() {
	*x = ReportMainProcessExitResponse{}
	mi := &file_openshell_proto_msgTypes[171]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportMainProcessExitResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportMainProcessExitResponse) ProtoMessage() {}

func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[171]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportMainProcessExitResponse.ProtoReflect.Descriptor instead.
func (*ReportMainProcessExitResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{171}
}

// Terminal-delivery completion reported after all expected foreground SSH
// attachments close. A successful response permits ephemeral cleanup.
type FinalizeMainProcessExitRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	InstanceId    string                 `protobuf:"bytes,2,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *FinalizeMainProcessExitRequest) Reset() {
	*x = FinalizeMainProcessExitRequest{}
	mi := &file_openshell_proto_msgTypes[172]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *FinalizeMainProcessExitRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*FinalizeMainProcessExitRequest) ProtoMessage() {}

func (x *FinalizeMainProcessExitRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[172]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use FinalizeMainProcessExitRequest.ProtoReflect.Descriptor instead.
func (*FinalizeMainProcessExitRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{172}
}

func (x *FinalizeMainProcessExitRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *FinalizeMainProcessExitRequest) GetInstanceId() string {
	if x != nil {
		return x.InstanceId
	}
	return ""
}

type FinalizeMainProcessExitResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *FinalizeMainProcessExitResponse) Reset() {
	*x = FinalizeMainProcessExitResponse{}
	mi := &file_openshell_proto_msgTypes[173]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *FinalizeMainProcessExitResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*FinalizeMainProcessExitResponse) ProtoMessage() {}

func (x *FinalizeMainProcessExitResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[173]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use FinalizeMainProcessExitResponse.ProtoReflect.Descriptor instead.
func (*FinalizeMainProcessExitResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{173}
}

// Gateway requests the supervisor to open a relay channel.
//
// On receiving this, the supervisor should initiate a RelayStream RPC to
// the gateway, sending a RelayInit in the first RelayFrame to associate
// the new HTTP/2 stream with the pending relay slot. The supervisor
// bridges that stream to the requested local target.
type RelayOpen struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-allocated channel identifier (UUID).
	ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"`
	// Target the supervisor should dial inside the sandbox.
	// If absent, supervisors treat the relay as SSH for compatibility.
	//
	// Types that are valid to be assigned to Target:
	//
	//	*RelayOpen_Ssh
	//	*RelayOpen_Tcp
	Target isRelayOpen_Target `protobuf_oneof:"target"`
	// Optional service identifier for audit/correlation.
	ServiceId     string `protobuf:"bytes,5,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayOpen) Reset() {
	*x = RelayOpen{}
	mi := &file_openshell_proto_msgTypes[174]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayOpen) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayOpen) ProtoMessage() {}

func (x *RelayOpen) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[174]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayOpen.ProtoReflect.Descriptor instead.
func (*RelayOpen) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{174}
}

func (x *RelayOpen) GetChannelId() string {
	if x != nil {
		return x.ChannelId
	}
	return ""
}

func (x *RelayOpen) GetTarget() isRelayOpen_Target {
	if x != nil {
		return x.Target
	}
	return nil
}

func (x *RelayOpen) GetSsh() *SshRelayTarget {
	if x != nil {
		if x, ok := x.Target.(*RelayOpen_Ssh); ok {
			return x.Ssh
		}
	}
	return nil
}

func (x *RelayOpen) GetTcp() *TcpRelayTarget {
	if x != nil {
		if x, ok := x.Target.(*RelayOpen_Tcp); ok {
			return x.Tcp
		}
	}
	return nil
}

func (x *RelayOpen) GetServiceId() string {
	if x != nil {
		return x.ServiceId
	}
	return ""
}

type isRelayOpen_Target interface {
	isRelayOpen_Target()
}

type RelayOpen_Ssh struct {
	Ssh *SshRelayTarget `protobuf:"bytes,2,opt,name=ssh,proto3,oneof"`
}

type RelayOpen_Tcp struct {
	Tcp *TcpRelayTarget `protobuf:"bytes,3,opt,name=tcp,proto3,oneof"`
}

func (*RelayOpen_Ssh) isRelayOpen_Target() {}

func (*RelayOpen_Tcp) isRelayOpen_Target() {}

// Built-in SSH relay target.
type SshRelayTarget struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SshRelayTarget) Reset() {
	*x = SshRelayTarget{}
	mi := &file_openshell_proto_msgTypes[175]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SshRelayTarget) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SshRelayTarget) ProtoMessage() {}

func (x *SshRelayTarget) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[175]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SshRelayTarget.ProtoReflect.Descriptor instead.
func (*SshRelayTarget) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{175}
}

// TCP target dialed by the supervisor from inside the sandbox.
type TcpRelayTarget struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Phase 1 accepts loopback only: 127.0.0.1, ::1, or localhost.
	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	// Target port. Must fit in u16 and be non-zero.
	Port          uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *TcpRelayTarget) Reset() {
	*x = TcpRelayTarget{}
	mi := &file_openshell_proto_msgTypes[176]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TcpRelayTarget) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TcpRelayTarget) ProtoMessage() {}

func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[176]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TcpRelayTarget.ProtoReflect.Descriptor instead.
func (*TcpRelayTarget) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{176}
}

func (x *TcpRelayTarget) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *TcpRelayTarget) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

// Initial RelayStream frame sent by the supervisor to claim a pending relay.
type RelayInit struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-allocated channel identifier (UUID).
	ChannelId     string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayInit) Reset() {
	*x = RelayInit{}
	mi := &file_openshell_proto_msgTypes[177]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayInit) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayInit) ProtoMessage() {}

func (x *RelayInit) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[177]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayInit.ProtoReflect.Descriptor instead.
func (*RelayInit) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{177}
}

func (x *RelayInit) GetChannelId() string {
	if x != nil {
		return x.ChannelId
	}
	return ""
}

// A single frame on the RelayStream RPC.
//
// The supervisor MUST send `init` as the first frame. All subsequent frames
// in either direction carry raw bytes in `data`.
type RelayFrame struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*RelayFrame_Init
	//	*RelayFrame_Data
	Payload       isRelayFrame_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayFrame) Reset() {
	*x = RelayFrame{}
	mi := &file_openshell_proto_msgTypes[178]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayFrame) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayFrame) ProtoMessage() {}

func (x *RelayFrame) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[178]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayFrame.ProtoReflect.Descriptor instead.
func (*RelayFrame) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{178}
}

func (x *RelayFrame) GetPayload() isRelayFrame_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *RelayFrame) GetInit() *RelayInit {
	if x != nil {
		if x, ok := x.Payload.(*RelayFrame_Init); ok {
			return x.Init
		}
	}
	return nil
}

func (x *RelayFrame) GetData() []byte {
	if x != nil {
		if x, ok := x.Payload.(*RelayFrame_Data); ok {
			return x.Data
		}
	}
	return nil
}

type isRelayFrame_Payload interface {
	isRelayFrame_Payload()
}

type RelayFrame_Init struct {
	Init *RelayInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"`
}

type RelayFrame_Data struct {
	Data []byte `protobuf:"bytes,2,opt,name=data,proto3,oneof"`
}

func (*RelayFrame_Init) isRelayFrame_Payload() {}

func (*RelayFrame_Data) isRelayFrame_Payload() {}

// Initial frame for gateway peer relay forwarding.
type PeerRelayInit struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Stable sandbox UUID whose supervisor relay should be opened.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Relay target to ask the owning gateway to open on its local supervisor
	// session. The channel_id is assigned by the forwarding gateway.
	RelayOpen *RelayOpen `protobuf:"bytes,2,opt,name=relay_open,json=relayOpen,proto3" json:"relay_open,omitempty"`
	// Gateway replica id that initiated the peer relay.
	RequesterReplicaId string `protobuf:"bytes,3,opt,name=requester_replica_id,json=requesterReplicaId,proto3" json:"requester_replica_id,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *PeerRelayInit) Reset() {
	*x = PeerRelayInit{}
	mi := &file_openshell_proto_msgTypes[179]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PeerRelayInit) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PeerRelayInit) ProtoMessage() {}

func (x *PeerRelayInit) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[179]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PeerRelayInit.ProtoReflect.Descriptor instead.
func (*PeerRelayInit) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{179}
}

func (x *PeerRelayInit) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *PeerRelayInit) GetRelayOpen() *RelayOpen {
	if x != nil {
		return x.RelayOpen
	}
	return nil
}

func (x *PeerRelayInit) GetRequesterReplicaId() string {
	if x != nil {
		return x.RequesterReplicaId
	}
	return ""
}

// A single frame on the gateway-to-gateway peer relay RPC.
type PeerRelayFrame struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*PeerRelayFrame_Init
	//	*PeerRelayFrame_Data
	Payload       isPeerRelayFrame_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PeerRelayFrame) Reset() {
	*x = PeerRelayFrame{}
	mi := &file_openshell_proto_msgTypes[180]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PeerRelayFrame) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PeerRelayFrame) ProtoMessage() {}

func (x *PeerRelayFrame) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[180]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PeerRelayFrame.ProtoReflect.Descriptor instead.
func (*PeerRelayFrame) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{180}
}

func (x *PeerRelayFrame) GetPayload() isPeerRelayFrame_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *PeerRelayFrame) GetInit() *PeerRelayInit {
	if x != nil {
		if x, ok := x.Payload.(*PeerRelayFrame_Init); ok {
			return x.Init
		}
	}
	return nil
}

func (x *PeerRelayFrame) GetData() []byte {
	if x != nil {
		if x, ok := x.Payload.(*PeerRelayFrame_Data); ok {
			return x.Data
		}
	}
	return nil
}

type isPeerRelayFrame_Payload interface {
	isPeerRelayFrame_Payload()
}

type PeerRelayFrame_Init struct {
	Init *PeerRelayInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"`
}

type PeerRelayFrame_Data struct {
	Data []byte `protobuf:"bytes,2,opt,name=data,proto3,oneof"`
}

func (*PeerRelayFrame_Init) isPeerRelayFrame_Payload() {}

func (*PeerRelayFrame_Data) isPeerRelayFrame_Payload() {}

// Supervisor reports the result of a relay open request.
type RelayOpenResult struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Channel identifier from the RelayOpen request.
	ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"`
	// True if the relay was successfully established.
	Success bool `protobuf:"varint,2,opt,name=success,proto3" json:"success,omitempty"`
	// Error message if success is false.
	Error         string `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayOpenResult) Reset() {
	*x = RelayOpenResult{}
	mi := &file_openshell_proto_msgTypes[181]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayOpenResult) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayOpenResult) ProtoMessage() {}

func (x *RelayOpenResult) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[181]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayOpenResult.ProtoReflect.Descriptor instead.
func (*RelayOpenResult) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{181}
}

func (x *RelayOpenResult) GetChannelId() string {
	if x != nil {
		return x.ChannelId
	}
	return ""
}

func (x *RelayOpenResult) GetSuccess() bool {
	if x != nil {
		return x.Success
	}
	return false
}

func (x *RelayOpenResult) GetError() string {
	if x != nil {
		return x.Error
	}
	return ""
}

// Either side requests closure of a relay channel.
type RelayClose struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Channel identifier to close.
	ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"`
	// Optional reason for closure.
	Reason        string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayClose) Reset() {
	*x = RelayClose{}
	mi := &file_openshell_proto_msgTypes[182]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayClose) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayClose) ProtoMessage() {}

func (x *RelayClose) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[182]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayClose.ProtoReflect.Descriptor instead.
func (*RelayClose) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{182}
}

func (x *RelayClose) GetChannelId() string {
	if x != nil {
		return x.ChannelId
	}
	return ""
}

func (x *RelayClose) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

// Observed HTTP method+path pattern from L7 inspection.
type L7RequestSample struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// HTTP method: GET, POST, PUT, DELETE, etc.
	Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"`
	// HTTP path: /v1/models, /repos/myorg/issues
	Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
	// L7 decision: "audit" or "deny" (allowed requests not collected).
	Decision string `protobuf:"bytes,3,opt,name=decision,proto3" json:"decision,omitempty"`
	// Number of times this (method, path) was observed.
	Count         uint32 `protobuf:"varint,4,opt,name=count,proto3" json:"count,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *L7RequestSample) Reset() {
	*x = L7RequestSample{}
	mi := &file_openshell_proto_msgTypes[183]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *L7RequestSample) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*L7RequestSample) ProtoMessage() {}

func (x *L7RequestSample) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[183]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use L7RequestSample.ProtoReflect.Descriptor instead.
func (*L7RequestSample) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{183}
}

func (x *L7RequestSample) GetMethod() string {
	if x != nil {
		return x.Method
	}
	return ""
}

func (x *L7RequestSample) GetPath() string {
	if x != nil {
		return x.Path
	}
	return ""
}

func (x *L7RequestSample) GetDecision() string {
	if x != nil {
		return x.Decision
	}
	return ""
}

func (x *L7RequestSample) GetCount() uint32 {
	if x != nil {
		return x.Count
	}
	return 0
}

// Structured denial summary from sandbox aggregator.
type DenialSummary struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox ID that produced this summary.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Denied destination host.
	Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
	// Denied destination port.
	Port uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	// Binary that attempted the connection.
	Binary string `protobuf:"bytes,4,opt,name=binary,proto3" json:"binary,omitempty"`
	// Process ancestor chain.
	Ancestors []string `protobuf:"bytes,5,rep,name=ancestors,proto3" json:"ancestors,omitempty"`
	// Denial reason from OPA evaluation.
	DenyReason string `protobuf:"bytes,6,opt,name=deny_reason,json=denyReason,proto3" json:"deny_reason,omitempty"`
	// Time of the first denial.
	FirstSeenTime *timestamppb.Timestamp `protobuf:"bytes,107,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"`
	// Time of the most recent denial.
	LastSeenTime *timestamppb.Timestamp `protobuf:"bytes,108,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"`
	// Number of denials in the current window.
	Count uint32 `protobuf:"varint,9,opt,name=count,proto3" json:"count,omitempty"`
	// Events dropped during aggregator cooldown.
	SuppressedCount uint32 `protobuf:"varint,10,opt,name=suppressed_count,json=suppressedCount,proto3" json:"suppressed_count,omitempty"`
	// Cumulative lifetime count (never resets).
	TotalCount uint32 `protobuf:"varint,11,opt,name=total_count,json=totalCount,proto3" json:"total_count,omitempty"`
	// Distinct cmdline strings observed (sanitized of credentials).
	SampleCmdlines []string `protobuf:"bytes,12,rep,name=sample_cmdlines,json=sampleCmdlines,proto3" json:"sample_cmdlines,omitempty"`
	// SHA-256 of the binary for audit trail.
	BinarySha256 string `protobuf:"bytes,13,opt,name=binary_sha256,json=binarySha256,proto3" json:"binary_sha256,omitempty"`
	// True if emitted by stale-flush rather than threshold.
	Persistent bool `protobuf:"varint,14,opt,name=persistent,proto3" json:"persistent,omitempty"`
	// Denial category: "l4_deny", "l7_deny", "l7_audit", "ssrf".
	DenialStage string `protobuf:"bytes,15,opt,name=denial_stage,json=denialStage,proto3" json:"denial_stage,omitempty"`
	// Observed HTTP request patterns (from L7 inspection).
	L7RequestSamples []*L7RequestSample `protobuf:"bytes,16,rep,name=l7_request_samples,json=l7RequestSamples,proto3" json:"l7_request_samples,omitempty"`
	// True if L7 inspection was active during observation window.
	L7InspectionActive bool `protobuf:"varint,17,opt,name=l7_inspection_active,json=l7InspectionActive,proto3" json:"l7_inspection_active,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *DenialSummary) Reset() {
	*x = DenialSummary{}
	mi := &file_openshell_proto_msgTypes[184]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DenialSummary) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DenialSummary) ProtoMessage() {}

func (x *DenialSummary) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[184]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DenialSummary.ProtoReflect.Descriptor instead.
func (*DenialSummary) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{184}
}

func (x *DenialSummary) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *DenialSummary) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *DenialSummary) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *DenialSummary) GetBinary() string {
	if x != nil {
		return x.Binary
	}
	return ""
}

func (x *DenialSummary) GetAncestors() []string {
	if x != nil {
		return x.Ancestors
	}
	return nil
}

func (x *DenialSummary) GetDenyReason() string {
	if x != nil {
		return x.DenyReason
	}
	return ""
}

func (x *DenialSummary) GetFirstSeenTime() *timestamppb.Timestamp {
	if x != nil {
		return x.FirstSeenTime
	}
	return nil
}

func (x *DenialSummary) GetLastSeenTime() *timestamppb.Timestamp {
	if x != nil {
		return x.LastSeenTime
	}
	return nil
}

func (x *DenialSummary) GetCount() uint32 {
	if x != nil {
		return x.Count
	}
	return 0
}

func (x *DenialSummary) GetSuppressedCount() uint32 {
	if x != nil {
		return x.SuppressedCount
	}
	return 0
}

func (x *DenialSummary) GetTotalCount() uint32 {
	if x != nil {
		return x.TotalCount
	}
	return 0
}

func (x *DenialSummary) GetSampleCmdlines() []string {
	if x != nil {
		return x.SampleCmdlines
	}
	return nil
}

func (x *DenialSummary) GetBinarySha256() string {
	if x != nil {
		return x.BinarySha256
	}
	return ""
}

func (x *DenialSummary) GetPersistent() bool {
	if x != nil {
		return x.Persistent
	}
	return false
}

func (x *DenialSummary) GetDenialStage() string {
	if x != nil {
		return x.DenialStage
	}
	return ""
}

func (x *DenialSummary) GetL7RequestSamples() []*L7RequestSample {
	if x != nil {
		return x.L7RequestSamples
	}
	return nil
}

func (x *DenialSummary) GetL7InspectionActive() bool {
	if x != nil {
		return x.L7InspectionActive
	}
	return false
}

// Count of denied actions grouped only by sanitized telemetry category.
type DenialGroupCount struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sanitized denial category, e.g. "connect_policy", "l7_policy", "ssrf".
	DenyGroup string `protobuf:"bytes,1,opt,name=deny_group,json=denyGroup,proto3" json:"deny_group,omitempty"`
	// Number of denied actions in this category.
	DeniedCount   uint32 `protobuf:"varint,2,opt,name=denied_count,json=deniedCount,proto3" json:"denied_count,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DenialGroupCount) Reset() {
	*x = DenialGroupCount{}
	mi := &file_openshell_proto_msgTypes[185]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DenialGroupCount) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DenialGroupCount) ProtoMessage() {}

func (x *DenialGroupCount) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[185]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DenialGroupCount.ProtoReflect.Descriptor instead.
func (*DenialGroupCount) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{185}
}

func (x *DenialGroupCount) GetDenyGroup() string {
	if x != nil {
		return x.DenyGroup
	}
	return ""
}

func (x *DenialGroupCount) GetDeniedCount() uint32 {
	if x != nil {
		return x.DeniedCount
	}
	return 0
}

// Anonymous sandbox network activity counters. This intentionally excludes
// hosts, paths, binaries, raw deny reasons, sandbox IDs, and user content.
type NetworkActivitySummary struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Total observed network activities in the current window.
	NetworkActivityCount uint32 `protobuf:"varint,1,opt,name=network_activity_count,json=networkActivityCount,proto3" json:"network_activity_count,omitempty"`
	// Total denied actions in the current window.
	DeniedActionCount uint32 `protobuf:"varint,2,opt,name=denied_action_count,json=deniedActionCount,proto3" json:"denied_action_count,omitempty"`
	// Denied action counts grouped by sanitized category.
	DenialsByGroup []*DenialGroupCount `protobuf:"bytes,3,rep,name=denials_by_group,json=denialsByGroup,proto3" json:"denials_by_group,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *NetworkActivitySummary) Reset() {
	*x = NetworkActivitySummary{}
	mi := &file_openshell_proto_msgTypes[186]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *NetworkActivitySummary) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*NetworkActivitySummary) ProtoMessage() {}

func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[186]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use NetworkActivitySummary.ProtoReflect.Descriptor instead.
func (*NetworkActivitySummary) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{186}
}

func (x *NetworkActivitySummary) GetNetworkActivityCount() uint32 {
	if x != nil {
		return x.NetworkActivityCount
	}
	return 0
}

func (x *NetworkActivitySummary) GetDeniedActionCount() uint32 {
	if x != nil {
		return x.DeniedActionCount
	}
	return 0
}

func (x *NetworkActivitySummary) GetDenialsByGroup() []*DenialGroupCount {
	if x != nil {
		return x.DenialsByGroup
	}
	return nil
}

// A proposed policy rule with rationale and approval status.
type PolicyChunk struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Unique chunk identifier.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Approval status: "pending", "approved", "rejected".
	Status string `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
	// Proposed network_policies map key.
	RuleName string `protobuf:"bytes,3,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	// The proposed network policy rule.
	ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,4,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"`
	// Human-readable explanation of why this rule is proposed.
	Rationale string `protobuf:"bytes,5,opt,name=rationale,proto3" json:"rationale,omitempty"`
	// Security concerns flagged by analysis (empty if none).
	SecurityNotes string `protobuf:"bytes,6,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"`
	// Analysis confidence (0.0-1.0). 0 for mechanistic mode.
	Confidence float32 `protobuf:"fixed32,7,opt,name=confidence,proto3" json:"confidence,omitempty"`
	// IDs of denial summaries that led to this chunk.
	DenialSummaryIds []string `protobuf:"bytes,8,rep,name=denial_summary_ids,json=denialSummaryIds,proto3" json:"denial_summary_ids,omitempty"`
	// Time when this chunk was created.
	CreatedTime *timestamppb.Timestamp `protobuf:"bytes,109,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"`
	// Time when the user approved or rejected the chunk. Absent if undecided.
	DecidedTime *timestamppb.Timestamp `protobuf:"bytes,110,opt,name=decided_time,json=decidedTime,proto3" json:"decided_time,omitempty"`
	// Recommendation stage: "initial" or "refined" (progressive L7 visibility).
	Stage string `protobuf:"bytes,11,opt,name=stage,proto3" json:"stage,omitempty"`
	// For stage="refined": the initial chunk this replaces.
	SupersedesChunkId string `protobuf:"bytes,12,opt,name=supersedes_chunk_id,json=supersedesChunkId,proto3" json:"supersedes_chunk_id,omitempty"`
	// How many times this endpoint has been seen across denial flush cycles.
	HitCount int32 `protobuf:"varint,13,opt,name=hit_count,json=hitCount,proto3" json:"hit_count,omitempty"`
	// First time this endpoint was proposed.
	FirstSeenTime *timestamppb.Timestamp `protobuf:"bytes,114,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"`
	// Most recent time this endpoint was proposed again.
	LastSeenTime *timestamppb.Timestamp `protobuf:"bytes,115,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"`
	// Binary path that triggered the denial (denormalized for display convenience).
	Binary string `protobuf:"bytes,16,opt,name=binary,proto3" json:"binary,omitempty"`
	// Validation verdict from gateway-side static checks (prover output).
	// Free-form summary string for human consumption in the inbox card.
	// Empty until the prover has run for this chunk.
	ValidationResult string `protobuf:"bytes,17,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"`
	// Operator-supplied free-form text accompanying a rejection. Populated
	// when the reviewer rejects via `RejectDraftChunkRequest.reason`; surfaced
	// back to the in-sandbox agent so it can revise the proposal.
	// Empty for non-rejected chunks.
	RejectionReason string `protobuf:"bytes,18,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"`
	// Gateway-side merge/application preflight failure. Kept separate from
	// prover output and operator rejection so clients can explain why a
	// prover-clean proposal is not currently applicable.
	ApplicationError string `protobuf:"bytes,19,opt,name=application_error,json=applicationError,proto3" json:"application_error,omitempty"`
	// Opaque digest binding review to the exact live inputs and complete
	// effective candidate evaluated by the gateway.
	ReviewToken string `protobuf:"bytes,20,opt,name=review_token,json=reviewToken,proto3" json:"review_token,omitempty"`
	// Deterministic hashes for compact candidate display and diagnostics.
	CurrentEffectivePolicyHash   string `protobuf:"bytes,21,opt,name=current_effective_policy_hash,json=currentEffectivePolicyHash,proto3" json:"current_effective_policy_hash,omitempty"`
	CandidateEffectivePolicyHash string `protobuf:"bytes,22,opt,name=candidate_effective_policy_hash,json=candidateEffectivePolicyHash,proto3" json:"candidate_effective_policy_hash,omitempty"`
	// Complete effective policies used for review. These contain policy
	// configuration only; credential secret values are never materialized.
	CurrentEffectivePolicy   *sandboxv1.SandboxPolicy `protobuf:"bytes,23,opt,name=current_effective_policy,json=currentEffectivePolicy,proto3" json:"current_effective_policy,omitempty"`
	CandidateEffectivePolicy *sandboxv1.SandboxPolicy `protobuf:"bytes,24,opt,name=candidate_effective_policy,json=candidateEffectivePolicy,proto3" json:"candidate_effective_policy,omitempty"`
	unknownFields            protoimpl.UnknownFields
	sizeCache                protoimpl.SizeCache
}

func (x *PolicyChunk) Reset() {
	*x = PolicyChunk{}
	mi := &file_openshell_proto_msgTypes[187]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PolicyChunk) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PolicyChunk) ProtoMessage() {}

func (x *PolicyChunk) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[187]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PolicyChunk.ProtoReflect.Descriptor instead.
func (*PolicyChunk) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{187}
}

func (x *PolicyChunk) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *PolicyChunk) GetStatus() string {
	if x != nil {
		return x.Status
	}
	return ""
}

func (x *PolicyChunk) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *PolicyChunk) GetProposedRule() *sandboxv1.NetworkPolicyRule {
	if x != nil {
		return x.ProposedRule
	}
	return nil
}

func (x *PolicyChunk) GetRationale() string {
	if x != nil {
		return x.Rationale
	}
	return ""
}

func (x *PolicyChunk) GetSecurityNotes() string {
	if x != nil {
		return x.SecurityNotes
	}
	return ""
}

func (x *PolicyChunk) GetConfidence() float32 {
	if x != nil {
		return x.Confidence
	}
	return 0
}

func (x *PolicyChunk) GetDenialSummaryIds() []string {
	if x != nil {
		return x.DenialSummaryIds
	}
	return nil
}

func (x *PolicyChunk) GetCreatedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.CreatedTime
	}
	return nil
}

func (x *PolicyChunk) GetDecidedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.DecidedTime
	}
	return nil
}

func (x *PolicyChunk) GetStage() string {
	if x != nil {
		return x.Stage
	}
	return ""
}

func (x *PolicyChunk) GetSupersedesChunkId() string {
	if x != nil {
		return x.SupersedesChunkId
	}
	return ""
}

func (x *PolicyChunk) GetHitCount() int32 {
	if x != nil {
		return x.HitCount
	}
	return 0
}

func (x *PolicyChunk) GetFirstSeenTime() *timestamppb.Timestamp {
	if x != nil {
		return x.FirstSeenTime
	}
	return nil
}

func (x *PolicyChunk) GetLastSeenTime() *timestamppb.Timestamp {
	if x != nil {
		return x.LastSeenTime
	}
	return nil
}

func (x *PolicyChunk) GetBinary() string {
	if x != nil {
		return x.Binary
	}
	return ""
}

func (x *PolicyChunk) GetValidationResult() string {
	if x != nil {
		return x.ValidationResult
	}
	return ""
}

func (x *PolicyChunk) GetRejectionReason() string {
	if x != nil {
		return x.RejectionReason
	}
	return ""
}

func (x *PolicyChunk) GetApplicationError() string {
	if x != nil {
		return x.ApplicationError
	}
	return ""
}

func (x *PolicyChunk) GetReviewToken() string {
	if x != nil {
		return x.ReviewToken
	}
	return ""
}

func (x *PolicyChunk) GetCurrentEffectivePolicyHash() string {
	if x != nil {
		return x.CurrentEffectivePolicyHash
	}
	return ""
}

func (x *PolicyChunk) GetCandidateEffectivePolicyHash() string {
	if x != nil {
		return x.CandidateEffectivePolicyHash
	}
	return ""
}

func (x *PolicyChunk) GetCurrentEffectivePolicy() *sandboxv1.SandboxPolicy {
	if x != nil {
		return x.CurrentEffectivePolicy
	}
	return nil
}

func (x *PolicyChunk) GetCandidateEffectivePolicy() *sandboxv1.SandboxPolicy {
	if x != nil {
		return x.CandidateEffectivePolicy
	}
	return nil
}

// Notification that the draft policy was updated.
type DraftPolicyUpdate struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Current draft version.
	DraftVersion uint64 `protobuf:"varint,1,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"`
	// Number of new chunks added in this update.
	NewChunks uint32 `protobuf:"varint,2,opt,name=new_chunks,json=newChunks,proto3" json:"new_chunks,omitempty"`
	// Total pending chunks awaiting approval.
	TotalPending uint32 `protobuf:"varint,3,opt,name=total_pending,json=totalPending,proto3" json:"total_pending,omitempty"`
	// Brief description of what changed.
	Summary       string `protobuf:"bytes,4,opt,name=summary,proto3" json:"summary,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DraftPolicyUpdate) Reset() {
	*x = DraftPolicyUpdate{}
	mi := &file_openshell_proto_msgTypes[188]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DraftPolicyUpdate) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DraftPolicyUpdate) ProtoMessage() {}

func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[188]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DraftPolicyUpdate.ProtoReflect.Descriptor instead.
func (*DraftPolicyUpdate) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{188}
}

func (x *DraftPolicyUpdate) GetDraftVersion() uint64 {
	if x != nil {
		return x.DraftVersion
	}
	return 0
}

func (x *DraftPolicyUpdate) GetNewChunks() uint32 {
	if x != nil {
		return x.NewChunks
	}
	return 0
}

func (x *DraftPolicyUpdate) GetTotalPending() uint32 {
	if x != nil {
		return x.TotalPending
	}
	return 0
}

func (x *DraftPolicyUpdate) GetSummary() string {
	if x != nil {
		return x.Summary
	}
	return ""
}

// Submit analysis results from sandbox to gateway.
type SubmitPolicyAnalysisRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,6,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Aggregated denial summaries.
	Summaries []*DenialSummary `protobuf:"bytes,1,rep,name=summaries,proto3" json:"summaries,omitempty"`
	// Proposed policy chunks (validated by sandbox OPA engine).
	ProposedChunks []*PolicyChunk `protobuf:"bytes,2,rep,name=proposed_chunks,json=proposedChunks,proto3" json:"proposed_chunks,omitempty"`
	// Analysis mode. `mechanistic` is the observation-driven path from the
	// denial aggregator — chunks targeting the same host|port|binary fold
	// into one row with hit_count incremented. `agent_authored` is an
	// intentional proposal from an in-sandbox agent — each submission lands
	// as its own chunk so the redraft-after-rejection loop has a stable id
	// to watch. Other values are treated as agent-style (no dedup) so a new
	// mode does not silently collapse proposals.
	AnalysisMode string `protobuf:"bytes,3,opt,name=analysis_mode,json=analysisMode,proto3" json:"analysis_mode,omitempty"`
	// Sandbox name. The authenticated sandbox principal remains authoritative
	// for this internal callback.
	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
	// Anonymous network activity counters.
	NetworkActivitySummaries []*NetworkActivitySummary `protobuf:"bytes,5,rep,name=network_activity_summaries,json=networkActivitySummaries,proto3" json:"network_activity_summaries,omitempty"`
	unknownFields            protoimpl.UnknownFields
	sizeCache                protoimpl.SizeCache
}

func (x *SubmitPolicyAnalysisRequest) Reset() {
	*x = SubmitPolicyAnalysisRequest{}
	mi := &file_openshell_proto_msgTypes[189]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SubmitPolicyAnalysisRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SubmitPolicyAnalysisRequest) ProtoMessage() {}

func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[189]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SubmitPolicyAnalysisRequest.ProtoReflect.Descriptor instead.
func (*SubmitPolicyAnalysisRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{189}
}

func (x *SubmitPolicyAnalysisRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *SubmitPolicyAnalysisRequest) GetSummaries() []*DenialSummary {
	if x != nil {
		return x.Summaries
	}
	return nil
}

func (x *SubmitPolicyAnalysisRequest) GetProposedChunks() []*PolicyChunk {
	if x != nil {
		return x.ProposedChunks
	}
	return nil
}

func (x *SubmitPolicyAnalysisRequest) GetAnalysisMode() string {
	if x != nil {
		return x.AnalysisMode
	}
	return ""
}

func (x *SubmitPolicyAnalysisRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *SubmitPolicyAnalysisRequest) GetNetworkActivitySummaries() []*NetworkActivitySummary {
	if x != nil {
		return x.NetworkActivitySummaries
	}
	return nil
}

type SubmitPolicyAnalysisResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Number of chunks accepted by the gateway.
	AcceptedChunks uint32 `protobuf:"varint,1,opt,name=accepted_chunks,json=acceptedChunks,proto3" json:"accepted_chunks,omitempty"`
	// Number of chunks rejected by gateway validation.
	RejectedChunks uint32 `protobuf:"varint,2,opt,name=rejected_chunks,json=rejectedChunks,proto3" json:"rejected_chunks,omitempty"`
	// Reasons for each rejected chunk.
	RejectionReasons []string `protobuf:"bytes,3,rep,name=rejection_reasons,json=rejectionReasons,proto3" json:"rejection_reasons,omitempty"`
	// Server-assigned chunk IDs for the accepted chunks, in submission order.
	// Agents use these to watch proposal state via policy.local's
	// GET /v1/proposals/{id} and /wait endpoints.
	AcceptedChunkIds []string `protobuf:"bytes,4,rep,name=accepted_chunk_ids,json=acceptedChunkIds,proto3" json:"accepted_chunk_ids,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *SubmitPolicyAnalysisResponse) Reset() {
	*x = SubmitPolicyAnalysisResponse{}
	mi := &file_openshell_proto_msgTypes[190]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SubmitPolicyAnalysisResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SubmitPolicyAnalysisResponse) ProtoMessage() {}

func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[190]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SubmitPolicyAnalysisResponse.ProtoReflect.Descriptor instead.
func (*SubmitPolicyAnalysisResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{190}
}

func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunks() uint32 {
	if x != nil {
		return x.AcceptedChunks
	}
	return 0
}

func (x *SubmitPolicyAnalysisResponse) GetRejectedChunks() uint32 {
	if x != nil {
		return x.RejectedChunks
	}
	return 0
}

func (x *SubmitPolicyAnalysisResponse) GetRejectionReasons() []string {
	if x != nil {
		return x.RejectionReasons
	}
	return nil
}

func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunkIds() []string {
	if x != nil {
		return x.AcceptedChunkIds
	}
	return nil
}

// Get draft policy for a sandbox.
type GetDraftPolicyRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Optional status filter: "pending", "approved", "rejected", or "" for all.
	StatusFilter  string `protobuf:"bytes,2,opt,name=status_filter,json=statusFilter,proto3" json:"status_filter,omitempty"`
	Sandbox       string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetDraftPolicyRequest) Reset() {
	*x = GetDraftPolicyRequest{}
	mi := &file_openshell_proto_msgTypes[191]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetDraftPolicyRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetDraftPolicyRequest) ProtoMessage() {}

func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[191]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetDraftPolicyRequest.ProtoReflect.Descriptor instead.
func (*GetDraftPolicyRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{191}
}

func (x *GetDraftPolicyRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetDraftPolicyRequest) GetStatusFilter() string {
	if x != nil {
		return x.StatusFilter
	}
	return ""
}

func (x *GetDraftPolicyRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

type GetDraftPolicyResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Draft policy chunks.
	Chunks []*PolicyChunk `protobuf:"bytes,1,rep,name=chunks,proto3" json:"chunks,omitempty"`
	// LLM-generated summary of all analysis (empty in mechanistic mode).
	RollingSummary string `protobuf:"bytes,2,opt,name=rolling_summary,json=rollingSummary,proto3" json:"rolling_summary,omitempty"`
	// Current draft version.
	DraftVersion uint64 `protobuf:"varint,3,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"`
	// Time when the last analysis completed.
	LastAnalyzedTime *timestamppb.Timestamp `protobuf:"bytes,104,opt,name=last_analyzed_time,json=lastAnalyzedTime,proto3" json:"last_analyzed_time,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *GetDraftPolicyResponse) Reset() {
	*x = GetDraftPolicyResponse{}
	mi := &file_openshell_proto_msgTypes[192]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetDraftPolicyResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetDraftPolicyResponse) ProtoMessage() {}

func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[192]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetDraftPolicyResponse.ProtoReflect.Descriptor instead.
func (*GetDraftPolicyResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{192}
}

func (x *GetDraftPolicyResponse) GetChunks() []*PolicyChunk {
	if x != nil {
		return x.Chunks
	}
	return nil
}

func (x *GetDraftPolicyResponse) GetRollingSummary() string {
	if x != nil {
		return x.RollingSummary
	}
	return ""
}

func (x *GetDraftPolicyResponse) GetDraftVersion() uint64 {
	if x != nil {
		return x.DraftVersion
	}
	return 0
}

func (x *GetDraftPolicyResponse) GetLastAnalyzedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.LastAnalyzedTime
	}
	return nil
}

// Approve a single draft chunk.
type ApproveDraftChunkRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Chunk ID to approve.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// Token returned with the reviewed PolicyChunk. Approval fails with
	// FAILED_PRECONDITION if live decision inputs no longer match it.
	ReviewToken string `protobuf:"bytes,4,opt,name=review_token,json=reviewToken,proto3" json:"review_token,omitempty"`
	Sandbox     string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,5,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ApproveDraftChunkRequest) Reset() {
	*x = ApproveDraftChunkRequest{}
	mi := &file_openshell_proto_msgTypes[193]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ApproveDraftChunkRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ApproveDraftChunkRequest) ProtoMessage() {}

func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[193]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ApproveDraftChunkRequest.ProtoReflect.Descriptor instead.
func (*ApproveDraftChunkRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{193}
}

func (x *ApproveDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ApproveDraftChunkRequest) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

func (x *ApproveDraftChunkRequest) GetReviewToken() string {
	if x != nil {
		return x.ReviewToken
	}
	return ""
}

func (x *ApproveDraftChunkRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *ApproveDraftChunkRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type ApproveDraftChunkResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// New policy version after merge.
	PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	// SHA-256 hash of the new policy.
	PolicyHash    string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ApproveDraftChunkResponse) Reset() {
	*x = ApproveDraftChunkResponse{}
	mi := &file_openshell_proto_msgTypes[194]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ApproveDraftChunkResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ApproveDraftChunkResponse) ProtoMessage() {}

func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[194]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ApproveDraftChunkResponse.ProtoReflect.Descriptor instead.
func (*ApproveDraftChunkResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{194}
}

func (x *ApproveDraftChunkResponse) GetPolicyVersion() uint32 {
	if x != nil {
		return x.PolicyVersion
	}
	return 0
}

func (x *ApproveDraftChunkResponse) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

// Reject a single draft chunk.
type RejectDraftChunkRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Chunk ID to reject.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// Optional reason for rejection (fed to LLM context in future analysis).
	Reason  string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,5,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RejectDraftChunkRequest) Reset() {
	*x = RejectDraftChunkRequest{}
	mi := &file_openshell_proto_msgTypes[195]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RejectDraftChunkRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RejectDraftChunkRequest) ProtoMessage() {}

func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[195]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RejectDraftChunkRequest.ProtoReflect.Descriptor instead.
func (*RejectDraftChunkRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{195}
}

func (x *RejectDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *RejectDraftChunkRequest) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

func (x *RejectDraftChunkRequest) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

func (x *RejectDraftChunkRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *RejectDraftChunkRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type RejectDraftChunkResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RejectDraftChunkResponse) Reset() {
	*x = RejectDraftChunkResponse{}
	mi := &file_openshell_proto_msgTypes[196]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RejectDraftChunkResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RejectDraftChunkResponse) ProtoMessage() {}

func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[196]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RejectDraftChunkResponse.ProtoReflect.Descriptor instead.
func (*RejectDraftChunkResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{196}
}

// Approve all pending chunks.
type DraftChunkApproval struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	ChunkId       string                 `protobuf:"bytes,1,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	ReviewToken   string                 `protobuf:"bytes,2,opt,name=review_token,json=reviewToken,proto3" json:"review_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DraftChunkApproval) Reset() {
	*x = DraftChunkApproval{}
	mi := &file_openshell_proto_msgTypes[197]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DraftChunkApproval) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DraftChunkApproval) ProtoMessage() {}

func (x *DraftChunkApproval) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[197]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DraftChunkApproval.ProtoReflect.Descriptor instead.
func (*DraftChunkApproval) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{197}
}

func (x *DraftChunkApproval) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

func (x *DraftChunkApproval) GetReviewToken() string {
	if x != nil {
		return x.ReviewToken
	}
	return ""
}

type ApproveAllDraftChunksRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Include chunks with security_notes (default false: skips them).
	IncludeSecurityFlagged bool `protobuf:"varint,2,opt,name=include_security_flagged,json=includeSecurityFlagged,proto3" json:"include_security_flagged,omitempty"`
	// Exact reviewed chunks and tokens. The server validates them against one
	// live snapshot, stages compatible operations in order, and writes once.
	Approvals []*DraftChunkApproval `protobuf:"bytes,3,rep,name=approvals,proto3" json:"approvals,omitempty"`
	Sandbox   string                `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,5,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ApproveAllDraftChunksRequest) Reset() {
	*x = ApproveAllDraftChunksRequest{}
	mi := &file_openshell_proto_msgTypes[198]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ApproveAllDraftChunksRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ApproveAllDraftChunksRequest) ProtoMessage() {}

func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[198]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ApproveAllDraftChunksRequest.ProtoReflect.Descriptor instead.
func (*ApproveAllDraftChunksRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{198}
}

func (x *ApproveAllDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ApproveAllDraftChunksRequest) GetIncludeSecurityFlagged() bool {
	if x != nil {
		return x.IncludeSecurityFlagged
	}
	return false
}

func (x *ApproveAllDraftChunksRequest) GetApprovals() []*DraftChunkApproval {
	if x != nil {
		return x.Approvals
	}
	return nil
}

func (x *ApproveAllDraftChunksRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *ApproveAllDraftChunksRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type ApproveAllDraftChunksResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// New policy version after merge.
	PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	// SHA-256 hash of the new policy.
	PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Number of chunks approved.
	ChunksApproved uint32 `protobuf:"varint,3,opt,name=chunks_approved,json=chunksApproved,proto3" json:"chunks_approved,omitempty"`
	// Number of chunks skipped for any reason, including security flags,
	// stale or invalid candidates, and conflicts within the staged batch.
	ChunksSkipped uint32 `protobuf:"varint,4,opt,name=chunks_skipped,json=chunksSkipped,proto3" json:"chunks_skipped,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ApproveAllDraftChunksResponse) Reset() {
	*x = ApproveAllDraftChunksResponse{}
	mi := &file_openshell_proto_msgTypes[199]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ApproveAllDraftChunksResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ApproveAllDraftChunksResponse) ProtoMessage() {}

func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[199]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ApproveAllDraftChunksResponse.ProtoReflect.Descriptor instead.
func (*ApproveAllDraftChunksResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{199}
}

func (x *ApproveAllDraftChunksResponse) GetPolicyVersion() uint32 {
	if x != nil {
		return x.PolicyVersion
	}
	return 0
}

func (x *ApproveAllDraftChunksResponse) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *ApproveAllDraftChunksResponse) GetChunksApproved() uint32 {
	if x != nil {
		return x.ChunksApproved
	}
	return 0
}

func (x *ApproveAllDraftChunksResponse) GetChunksSkipped() uint32 {
	if x != nil {
		return x.ChunksSkipped
	}
	return 0
}

// Edit a pending chunk in-place.
type EditDraftChunkRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,4,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Chunk ID to edit.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// The modified rule (replaces existing proposed_rule).
	ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,3,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"`
	Sandbox      string                       `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,5,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *EditDraftChunkRequest) Reset() {
	*x = EditDraftChunkRequest{}
	mi := &file_openshell_proto_msgTypes[200]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *EditDraftChunkRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*EditDraftChunkRequest) ProtoMessage() {}

func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[200]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use EditDraftChunkRequest.ProtoReflect.Descriptor instead.
func (*EditDraftChunkRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{200}
}

func (x *EditDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *EditDraftChunkRequest) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

func (x *EditDraftChunkRequest) GetProposedRule() *sandboxv1.NetworkPolicyRule {
	if x != nil {
		return x.ProposedRule
	}
	return nil
}

func (x *EditDraftChunkRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *EditDraftChunkRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type EditDraftChunkResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *EditDraftChunkResponse) Reset() {
	*x = EditDraftChunkResponse{}
	mi := &file_openshell_proto_msgTypes[201]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *EditDraftChunkResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*EditDraftChunkResponse) ProtoMessage() {}

func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[201]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use EditDraftChunkResponse.ProtoReflect.Descriptor instead.
func (*EditDraftChunkResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{201}
}

// Reverse an approval (remove merged rule from active policy).
type UndoDraftChunkRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,3,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// Chunk ID to undo.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,4,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UndoDraftChunkRequest) Reset() {
	*x = UndoDraftChunkRequest{}
	mi := &file_openshell_proto_msgTypes[202]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UndoDraftChunkRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UndoDraftChunkRequest) ProtoMessage() {}

func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[202]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UndoDraftChunkRequest.ProtoReflect.Descriptor instead.
func (*UndoDraftChunkRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{202}
}

func (x *UndoDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *UndoDraftChunkRequest) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

func (x *UndoDraftChunkRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *UndoDraftChunkRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type UndoDraftChunkResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// New policy version after removal.
	PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	// SHA-256 hash of the updated policy.
	PolicyHash    string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UndoDraftChunkResponse) Reset() {
	*x = UndoDraftChunkResponse{}
	mi := &file_openshell_proto_msgTypes[203]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UndoDraftChunkResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UndoDraftChunkResponse) ProtoMessage() {}

func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[203]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UndoDraftChunkResponse.ProtoReflect.Descriptor instead.
func (*UndoDraftChunkResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{203}
}

func (x *UndoDraftChunkResponse) GetPolicyVersion() uint32 {
	if x != nil {
		return x.PolicyVersion
	}
	return 0
}

func (x *UndoDraftChunkResponse) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

// Clear all pending draft chunks for a sandbox.
type ClearDraftChunksRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Sandbox        string                         `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Optional nonzero UUID for durable at-most-once admission. Successful results
	// can be replayed for 24 hours; see the API errors and retries reference.
	RequestId     string `protobuf:"bytes,3,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ClearDraftChunksRequest) Reset() {
	*x = ClearDraftChunksRequest{}
	mi := &file_openshell_proto_msgTypes[204]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ClearDraftChunksRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ClearDraftChunksRequest) ProtoMessage() {}

func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[204]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ClearDraftChunksRequest.ProtoReflect.Descriptor instead.
func (*ClearDraftChunksRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{204}
}

func (x *ClearDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ClearDraftChunksRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *ClearDraftChunksRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

type ClearDraftChunksResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Number of chunks cleared.
	ChunksCleared uint32 `protobuf:"varint,1,opt,name=chunks_cleared,json=chunksCleared,proto3" json:"chunks_cleared,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ClearDraftChunksResponse) Reset() {
	*x = ClearDraftChunksResponse{}
	mi := &file_openshell_proto_msgTypes[205]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ClearDraftChunksResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ClearDraftChunksResponse) ProtoMessage() {}

func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[205]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ClearDraftChunksResponse.ProtoReflect.Descriptor instead.
func (*ClearDraftChunksResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{205}
}

func (x *ClearDraftChunksResponse) GetChunksCleared() uint32 {
	if x != nil {
		return x.ChunksCleared
	}
	return 0
}

// Get decision history for a sandbox's draft policy.
type GetDraftHistoryRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,2,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	Sandbox        string                         `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *GetDraftHistoryRequest) Reset() {
	*x = GetDraftHistoryRequest{}
	mi := &file_openshell_proto_msgTypes[206]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetDraftHistoryRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetDraftHistoryRequest) ProtoMessage() {}

func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[206]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetDraftHistoryRequest.ProtoReflect.Descriptor instead.
func (*GetDraftHistoryRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{206}
}

func (x *GetDraftHistoryRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *GetDraftHistoryRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

type DraftHistoryEntry struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Time when the event occurred.
	EventTime *timestamppb.Timestamp `protobuf:"bytes,101,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
	// Event type: "denial_detected", "analysis_cycle", "approved",
	// "rejected", "edited", "undone", "cleared".
	EventType string `protobuf:"bytes,2,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
	// Human-readable description.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Associated chunk ID (if applicable).
	ChunkId       string `protobuf:"bytes,4,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DraftHistoryEntry) Reset() {
	*x = DraftHistoryEntry{}
	mi := &file_openshell_proto_msgTypes[207]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DraftHistoryEntry) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DraftHistoryEntry) ProtoMessage() {}

func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[207]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DraftHistoryEntry.ProtoReflect.Descriptor instead.
func (*DraftHistoryEntry) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{207}
}

func (x *DraftHistoryEntry) GetEventTime() *timestamppb.Timestamp {
	if x != nil {
		return x.EventTime
	}
	return nil
}

func (x *DraftHistoryEntry) GetEventType() string {
	if x != nil {
		return x.EventType
	}
	return ""
}

func (x *DraftHistoryEntry) GetDescription() string {
	if x != nil {
		return x.Description
	}
	return ""
}

func (x *DraftHistoryEntry) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

type GetDraftHistoryResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Chronological decision history.
	Entries       []*DraftHistoryEntry `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetDraftHistoryResponse) Reset() {
	*x = GetDraftHistoryResponse{}
	mi := &file_openshell_proto_msgTypes[208]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetDraftHistoryResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetDraftHistoryResponse) ProtoMessage() {}

func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[208]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetDraftHistoryResponse.ProtoReflect.Descriptor instead.
func (*GetDraftHistoryResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{208}
}

func (x *GetDraftHistoryResponse) GetEntries() []*DraftHistoryEntry {
	if x != nil {
		return x.Entries
	}
	return nil
}

// Create workspace request.
type CreateWorkspaceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace name. Must be a valid DNS-1123 label.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional labels for the workspace (key-value metadata).
	Labels map[string]string `protobuf:"bytes,2,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Optional nonzero UUID. Same ID and payload replay success for 24 hours.
	RequestId     string `protobuf:"bytes,3,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateWorkspaceRequest) Reset() {
	*x = CreateWorkspaceRequest{}
	mi := &file_openshell_proto_msgTypes[209]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateWorkspaceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateWorkspaceRequest) ProtoMessage() {}

func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[209]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateWorkspaceRequest.ProtoReflect.Descriptor instead.
func (*CreateWorkspaceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{209}
}

func (x *CreateWorkspaceRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *CreateWorkspaceRequest) GetLabels() map[string]string {
	if x != nil {
		return x.Labels
	}
	return nil
}

func (x *CreateWorkspaceRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Create workspace response.
type CreateWorkspaceResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Workspace     *datamodelv1.Workspace `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateWorkspaceResponse) Reset() {
	*x = CreateWorkspaceResponse{}
	mi := &file_openshell_proto_msgTypes[210]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateWorkspaceResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateWorkspaceResponse) ProtoMessage() {}

func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[210]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateWorkspaceResponse.ProtoReflect.Descriptor instead.
func (*CreateWorkspaceResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{210}
}

func (x *CreateWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace {
	if x != nil {
		return x.Workspace
	}
	return nil
}

// Get workspace request.
type GetWorkspaceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace name (canonical lookup key).
	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetWorkspaceRequest) Reset() {
	*x = GetWorkspaceRequest{}
	mi := &file_openshell_proto_msgTypes[211]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetWorkspaceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetWorkspaceRequest) ProtoMessage() {}

func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[211]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetWorkspaceRequest.ProtoReflect.Descriptor instead.
func (*GetWorkspaceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{211}
}

func (x *GetWorkspaceRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

// Get workspace response.
type GetWorkspaceResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Workspace     *datamodelv1.Workspace `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetWorkspaceResponse) Reset() {
	*x = GetWorkspaceResponse{}
	mi := &file_openshell_proto_msgTypes[212]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetWorkspaceResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetWorkspaceResponse) ProtoMessage() {}

func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[212]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetWorkspaceResponse.ProtoReflect.Descriptor instead.
func (*GetWorkspaceResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{212}
}

func (x *GetWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace {
	if x != nil {
		return x.Workspace
	}
	return nil
}

// List workspaces request.
type ListWorkspacesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The maximum number of workspaces to return. Zero uses 100. Values above
	// 1000 are coerced to 1000; negative values are invalid.
	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Token from a previous ListWorkspaces response. All other request parameters
	// except page_size must match the request that produced it.
	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Optional label selector for filtering (format: "key1=value1,key2=value2").
	LabelSelector string `protobuf:"bytes,3,opt,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListWorkspacesRequest) Reset() {
	*x = ListWorkspacesRequest{}
	mi := &file_openshell_proto_msgTypes[213]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListWorkspacesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListWorkspacesRequest) ProtoMessage() {}

func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[213]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListWorkspacesRequest.ProtoReflect.Descriptor instead.
func (*ListWorkspacesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{213}
}

func (x *ListWorkspacesRequest) GetPageSize() int32 {
	if x != nil {
		return x.PageSize
	}
	return 0
}

func (x *ListWorkspacesRequest) GetPageToken() string {
	if x != nil {
		return x.PageToken
	}
	return ""
}

func (x *ListWorkspacesRequest) GetLabelSelector() string {
	if x != nil {
		return x.LabelSelector
	}
	return ""
}

// List workspaces response.
type ListWorkspacesResponse struct {
	state      protoimpl.MessageState   `protogen:"open.v1"`
	Workspaces []*datamodelv1.Workspace `protobuf:"bytes,1,rep,name=workspaces,proto3" json:"workspaces,omitempty"`
	// Token for the next page. Empty when there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListWorkspacesResponse) Reset() {
	*x = ListWorkspacesResponse{}
	mi := &file_openshell_proto_msgTypes[214]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListWorkspacesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListWorkspacesResponse) ProtoMessage() {}

func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[214]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListWorkspacesResponse.ProtoReflect.Descriptor instead.
func (*ListWorkspacesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{214}
}

func (x *ListWorkspacesResponse) GetWorkspaces() []*datamodelv1.Workspace {
	if x != nil {
		return x.Workspaces
	}
	return nil
}

func (x *ListWorkspacesResponse) GetNextPageToken() string {
	if x != nil {
		return x.NextPageToken
	}
	return ""
}

// Delete workspace request.
type DeleteWorkspaceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace name (canonical lookup key).
	Name         string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	AllowMissing bool   `protobuf:"varint,2,opt,name=allow_missing,json=allowMissing,proto3" json:"allow_missing,omitempty"`
	// Optional nonzero UUID. Same ID and payload replay success for 24 hours.
	RequestId     string `protobuf:"bytes,3,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteWorkspaceRequest) Reset() {
	*x = DeleteWorkspaceRequest{}
	mi := &file_openshell_proto_msgTypes[215]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteWorkspaceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteWorkspaceRequest) ProtoMessage() {}

func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[215]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteWorkspaceRequest.ProtoReflect.Descriptor instead.
func (*DeleteWorkspaceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{215}
}

func (x *DeleteWorkspaceRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *DeleteWorkspaceRequest) GetAllowMissing() bool {
	if x != nil {
		return x.AllowMissing
	}
	return false
}

func (x *DeleteWorkspaceRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Delete workspace response.
type DeleteWorkspaceResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Outcome       DeletionOutcome        `protobuf:"varint,2,opt,name=outcome,proto3,enum=openshell.v1.DeletionOutcome" json:"outcome,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteWorkspaceResponse) Reset() {
	*x = DeleteWorkspaceResponse{}
	mi := &file_openshell_proto_msgTypes[216]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteWorkspaceResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteWorkspaceResponse) ProtoMessage() {}

func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[216]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteWorkspaceResponse.ProtoReflect.Descriptor instead.
func (*DeleteWorkspaceResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{216}
}

func (x *DeleteWorkspaceResponse) GetOutcome() DeletionOutcome {
	if x != nil {
		return x.Outcome
	}
	return DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED
}

// Workspace membership record.
type WorkspaceMember struct {
	state    protoimpl.MessageState  `protogen:"open.v1"`
	Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// OIDC subject claim identifying the principal.
	PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"`
	// Role assigned to the principal within the workspace.
	Role          WorkspaceRole `protobuf:"varint,3,opt,name=role,proto3,enum=openshell.v1.WorkspaceRole" json:"role,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *WorkspaceMember) Reset() {
	*x = WorkspaceMember{}
	mi := &file_openshell_proto_msgTypes[217]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *WorkspaceMember) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*WorkspaceMember) ProtoMessage() {}

func (x *WorkspaceMember) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[217]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use WorkspaceMember.ProtoReflect.Descriptor instead.
func (*WorkspaceMember) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{217}
}

func (x *WorkspaceMember) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *WorkspaceMember) GetPrincipalSubject() string {
	if x != nil {
		return x.PrincipalSubject
	}
	return ""
}

func (x *WorkspaceMember) GetRole() WorkspaceRole {
	if x != nil {
		return x.Role
	}
	return WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED
}

// Add workspace member request.
type AddWorkspaceMemberRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,1,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// OIDC subject claim identifying the principal.
	PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"`
	// Role to assign.
	Role WorkspaceRole `protobuf:"varint,3,opt,name=role,proto3,enum=openshell.v1.WorkspaceRole" json:"role,omitempty"`
	// Optional nonzero UUID. Same ID and payload replay success for 24 hours.
	RequestId     string `protobuf:"bytes,4,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddWorkspaceMemberRequest) Reset() {
	*x = AddWorkspaceMemberRequest{}
	mi := &file_openshell_proto_msgTypes[218]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddWorkspaceMemberRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddWorkspaceMemberRequest) ProtoMessage() {}

func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[218]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddWorkspaceMemberRequest.ProtoReflect.Descriptor instead.
func (*AddWorkspaceMemberRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{218}
}

func (x *AddWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *AddWorkspaceMemberRequest) GetPrincipalSubject() string {
	if x != nil {
		return x.PrincipalSubject
	}
	return ""
}

func (x *AddWorkspaceMemberRequest) GetRole() WorkspaceRole {
	if x != nil {
		return x.Role
	}
	return WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED
}

func (x *AddWorkspaceMemberRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Add workspace member response.
type AddWorkspaceMemberResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Member        *WorkspaceMember       `protobuf:"bytes,1,opt,name=member,proto3" json:"member,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddWorkspaceMemberResponse) Reset() {
	*x = AddWorkspaceMemberResponse{}
	mi := &file_openshell_proto_msgTypes[219]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddWorkspaceMemberResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddWorkspaceMemberResponse) ProtoMessage() {}

func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[219]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddWorkspaceMemberResponse.ProtoReflect.Descriptor instead.
func (*AddWorkspaceMemberResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{219}
}

func (x *AddWorkspaceMemberResponse) GetMember() *WorkspaceMember {
	if x != nil {
		return x.Member
	}
	return nil
}

// Remove workspace member request.
type RemoveWorkspaceMemberRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,1,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// OIDC subject claim identifying the principal to remove.
	PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"`
	AllowMissing     bool   `protobuf:"varint,3,opt,name=allow_missing,json=allowMissing,proto3" json:"allow_missing,omitempty"`
	// Optional nonzero UUID. Same ID and payload replay success for 24 hours.
	RequestId     string `protobuf:"bytes,4,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoveWorkspaceMemberRequest) Reset() {
	*x = RemoveWorkspaceMemberRequest{}
	mi := &file_openshell_proto_msgTypes[220]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveWorkspaceMemberRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveWorkspaceMemberRequest) ProtoMessage() {}

func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[220]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveWorkspaceMemberRequest.ProtoReflect.Descriptor instead.
func (*RemoveWorkspaceMemberRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{220}
}

func (x *RemoveWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *RemoveWorkspaceMemberRequest) GetPrincipalSubject() string {
	if x != nil {
		return x.PrincipalSubject
	}
	return ""
}

func (x *RemoveWorkspaceMemberRequest) GetAllowMissing() bool {
	if x != nil {
		return x.AllowMissing
	}
	return false
}

func (x *RemoveWorkspaceMemberRequest) GetRequestId() string {
	if x != nil {
		return x.RequestId
	}
	return ""
}

// Remove workspace member response.
type RemoveWorkspaceMemberResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Outcome       DeletionOutcome        `protobuf:"varint,2,opt,name=outcome,proto3,enum=openshell.v1.DeletionOutcome" json:"outcome,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoveWorkspaceMemberResponse) Reset() {
	*x = RemoveWorkspaceMemberResponse{}
	mi := &file_openshell_proto_msgTypes[221]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveWorkspaceMemberResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveWorkspaceMemberResponse) ProtoMessage() {}

func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[221]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveWorkspaceMemberResponse.ProtoReflect.Descriptor instead.
func (*RemoveWorkspaceMemberResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{221}
}

func (x *RemoveWorkspaceMemberResponse) GetOutcome() DeletionOutcome {
	if x != nil {
		return x.Outcome
	}
	return DeletionOutcome_DELETION_OUTCOME_UNSPECIFIED
}

// List workspace members request.
type ListWorkspaceMembersRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace scope. Only a named workspace selection is accepted.
	WorkspaceScope *datamodelv1.WorkspaceSelector `protobuf:"bytes,1,opt,name=workspace_scope,json=workspaceScope,proto3" json:"workspace_scope,omitempty"`
	// The maximum number of members to return. Zero uses 100. Values above
	// 1000 are coerced to 1000; negative values are invalid.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Token from a previous ListWorkspaceMembers response. All other request
	// parameters except page_size must match the request that produced it.
	PageToken     string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListWorkspaceMembersRequest) Reset() {
	*x = ListWorkspaceMembersRequest{}
	mi := &file_openshell_proto_msgTypes[222]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListWorkspaceMembersRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListWorkspaceMembersRequest) ProtoMessage() {}

func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[222]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListWorkspaceMembersRequest.ProtoReflect.Descriptor instead.
func (*ListWorkspaceMembersRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{222}
}

func (x *ListWorkspaceMembersRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
	if x != nil {
		return x.WorkspaceScope
	}
	return nil
}

func (x *ListWorkspaceMembersRequest) GetPageSize() int32 {
	if x != nil {
		return x.PageSize
	}
	return 0
}

func (x *ListWorkspaceMembersRequest) GetPageToken() string {
	if x != nil {
		return x.PageToken
	}
	return ""
}

// List workspace members response.
type ListWorkspaceMembersResponse struct {
	state   protoimpl.MessageState `protogen:"open.v1"`
	Members []*WorkspaceMember     `protobuf:"bytes,1,rep,name=members,proto3" json:"members,omitempty"`
	// Token for the next page. Empty when there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListWorkspaceMembersResponse) Reset() {
	*x = ListWorkspaceMembersResponse{}
	mi := &file_openshell_proto_msgTypes[223]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListWorkspaceMembersResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListWorkspaceMembersResponse) ProtoMessage() {}

func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[223]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListWorkspaceMembersResponse.ProtoReflect.Descriptor instead.
func (*ListWorkspaceMembersResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{223}
}

func (x *ListWorkspaceMembersResponse) GetMembers() []*WorkspaceMember {
	if x != nil {
		return x.Members
	}
	return nil
}

func (x *ListWorkspaceMembersResponse) GetNextPageToken() string {
	if x != nil {
		return x.NextPageToken
	}
	return ""
}

// Short-lived credential for one policy-authorized extension service.
// Kept at the end of the file so adding it does not renumber existing
// generated message descriptors.
type ExtensionServiceCredential struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Operator registration name used to correlate the credential with the
	// stable service registration delivered by GetSandboxConfig.
	ServiceName string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
	// Gateway-minted JWT with an audience derived from the registration.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// Absolute expiry of the token.
	ExpirationTime *timestamppb.Timestamp `protobuf:"bytes,103,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *ExtensionServiceCredential) Reset() {
	*x = ExtensionServiceCredential{}
	mi := &file_openshell_proto_msgTypes[224]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExtensionServiceCredential) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExtensionServiceCredential) ProtoMessage() {}

func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[224]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExtensionServiceCredential.ProtoReflect.Descriptor instead.
func (*ExtensionServiceCredential) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{224}
}

func (x *ExtensionServiceCredential) GetServiceName() string {
	if x != nil {
		return x.ServiceName
	}
	return ""
}

func (x *ExtensionServiceCredential) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *ExtensionServiceCredential) GetExpirationTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ExpirationTime
	}
	return nil
}

// One redacted endpoint result in a supervisor's complete status report.
type EndpointObservation struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Stable identifier derived from the configured host, ports, and path.
	EndpointId string `protobuf:"bytes,1,opt,name=endpoint_id,json=endpointId,proto3" json:"endpoint_id,omitempty"`
	// Latest result under the reported configuration and supervisor session.
	Result        EndpointResult `protobuf:"varint,2,opt,name=result,proto3,enum=openshell.v1.EndpointResult" json:"result,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *EndpointObservation) Reset() {
	*x = EndpointObservation{}
	mi := &file_openshell_proto_msgTypes[225]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *EndpointObservation) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*EndpointObservation) ProtoMessage() {}

func (x *EndpointObservation) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[225]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use EndpointObservation.ProtoReflect.Descriptor instead.
func (*EndpointObservation) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{225}
}

func (x *EndpointObservation) GetEndpointId() string {
	if x != nil {
		return x.EndpointId
	}
	return ""
}

func (x *EndpointObservation) GetResult() EndpointResult {
	if x != nil {
		return x.Result
	}
	return EndpointResult_ENDPOINT_RESULT_UNSPECIFIED
}

// Complete endpoint status report for the caller's current configuration.
type ReportEndpointStatusRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id. Must match the authenticated sandbox principal.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Hash from the active effective policy delivered by the gateway.
	PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Provider environment revision delivered with the active configuration.
	ProviderEnvRevision uint64 `protobuf:"varint,3,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"`
	// Exactly one result for every distinct observed endpoint in the policy.
	Observations []*EndpointObservation `protobuf:"bytes,4,rep,name=observations,proto3" json:"observations,omitempty"`
	// Endpoints with a new observation in this batch. Omitted endpoints retain
	// their prior report time; an identical retry never advances report time.
	ObservedEndpointIds []string `protobuf:"bytes,5,rep,name=observed_endpoint_ids,json=observedEndpointIds,proto3" json:"observed_endpoint_ids,omitempty"`
	// Active ConnectSupervisor session that owns these observations.
	SupervisorSessionId string `protobuf:"bytes,6,opt,name=supervisor_session_id,json=supervisorSessionId,proto3" json:"supervisor_session_id,omitempty"`
	// Monotonically increasing sequence within the authenticated session. Gaps
	// are allowed when an inventory reset supersedes a frozen snapshot. Retrying
	// a report preserves its complete body and sequence for idempotent acknowledgement.
	ReportSequence uint64 `protobuf:"varint,7,opt,name=report_sequence,json=reportSequence,proto3" json:"report_sequence,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *ReportEndpointStatusRequest) Reset() {
	*x = ReportEndpointStatusRequest{}
	mi := &file_openshell_proto_msgTypes[226]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportEndpointStatusRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportEndpointStatusRequest) ProtoMessage() {}

func (x *ReportEndpointStatusRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[226]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportEndpointStatusRequest.ProtoReflect.Descriptor instead.
func (*ReportEndpointStatusRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{226}
}

func (x *ReportEndpointStatusRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ReportEndpointStatusRequest) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *ReportEndpointStatusRequest) GetProviderEnvRevision() uint64 {
	if x != nil {
		return x.ProviderEnvRevision
	}
	return 0
}

func (x *ReportEndpointStatusRequest) GetObservations() []*EndpointObservation {
	if x != nil {
		return x.Observations
	}
	return nil
}

func (x *ReportEndpointStatusRequest) GetObservedEndpointIds() []string {
	if x != nil {
		return x.ObservedEndpointIds
	}
	return nil
}

func (x *ReportEndpointStatusRequest) GetSupervisorSessionId() string {
	if x != nil {
		return x.SupervisorSessionId
	}
	return ""
}

func (x *ReportEndpointStatusRequest) GetReportSequence() uint64 {
	if x != nil {
		return x.ReportSequence
	}
	return 0
}

// Empty acknowledgement for a persisted endpoint status report.
type ReportEndpointStatusResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportEndpointStatusResponse) Reset() {
	*x = ReportEndpointStatusResponse{}
	mi := &file_openshell_proto_msgTypes[227]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportEndpointStatusResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportEndpointStatusResponse) ProtoMessage() {}

func (x *ReportEndpointStatusResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[227]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportEndpointStatusResponse.ProtoReflect.Descriptor instead.
func (*ReportEndpointStatusResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{227}
}

// A configured endpoint and its last accepted network result in one record.
// Address fields contain policy selectors, never request URLs or credentials.
type EndpointStatus struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Stable identifier for selecting this endpoint without parsing display text.
	EndpointId string `protobuf:"bytes,1,opt,name=endpoint_id,json=endpointId,proto3" json:"endpoint_id,omitempty"`
	// Lowercase configured endpoint host.
	Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
	// Sorted, deduplicated effective endpoint ports. Validated endpoints have at
	// least one port.
	Ports []uint32 `protobuf:"varint,3,rep,packed,name=ports,proto3" json:"ports,omitempty"`
	// Canonical configured path selector; an unrestricted path is /**.
	Path string `protobuf:"bytes,4,opt,name=path,proto3" json:"path,omitempty"`
	// Last accepted result, aggregated across configured callers and ports.
	// NoObservedExchange retains the address and has no report timestamp.
	LastResult EndpointResult `protobuf:"varint,5,opt,name=last_result,json=lastResult,proto3,enum=openshell.v1.EndpointResult" json:"last_result,omitempty"`
	// Time when the gateway accepted the observation. This is not the request
	// time: still-valid evidence can be reaccepted after a reset. Identical
	// same-sequence retries do not advance it. Absent until a result is reported.
	LastReportedTime *timestamppb.Timestamp `protobuf:"bytes,106,opt,name=last_reported_time,json=lastReportedTime,proto3" json:"last_reported_time,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *EndpointStatus) Reset() {
	*x = EndpointStatus{}
	mi := &file_openshell_proto_msgTypes[228]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *EndpointStatus) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*EndpointStatus) ProtoMessage() {}

func (x *EndpointStatus) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[228]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use EndpointStatus.ProtoReflect.Descriptor instead.
func (*EndpointStatus) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{228}
}

func (x *EndpointStatus) GetEndpointId() string {
	if x != nil {
		return x.EndpointId
	}
	return ""
}

func (x *EndpointStatus) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *EndpointStatus) GetPorts() []uint32 {
	if x != nil {
		return x.Ports
	}
	return nil
}

func (x *EndpointStatus) GetPath() string {
	if x != nil {
		return x.Path
	}
	return ""
}

func (x *EndpointStatus) GetLastResult() EndpointResult {
	if x != nil {
		return x.LastResult
	}
	return EndpointResult_ENDPOINT_RESULT_UNSPECIFIED
}

func (x *EndpointStatus) GetLastReportedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.LastReportedTime
	}
	return nil
}

// Durable provisioning attempt, independent of supervisor registration and polling.
type SandboxProvisioning struct {
	state                   protoimpl.MessageState `protogen:"open.v1"`
	AttemptId               string                 `protobuf:"bytes,1,opt,name=attempt_id,json=attemptId,proto3" json:"attempt_id,omitempty"`
	ConfigurationChangeId   string                 `protobuf:"bytes,2,opt,name=configuration_change_id,json=configurationChangeId,proto3" json:"configuration_change_id,omitempty"`
	ConfigurationChangeTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=configuration_change_time,json=configurationChangeTime,proto3" json:"configuration_change_time,omitempty"`
	FirstRejectionTime      *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=first_rejection_time,json=firstRejectionTime,proto3" json:"first_rejection_time,omitempty"`
	// Present only while the repair window is armed.
	Deadline    *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=deadline,proto3" json:"deadline,omitempty"`
	TimeoutTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=timeout_time,json=timeoutTime,proto3" json:"timeout_time,omitempty"`
	// Set only after both supervisor and workload compute have been reclaimed.
	CleanupCompletedTime *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=cleanup_completed_time,json=cleanupCompletedTime,proto3" json:"cleanup_completed_time,omitempty"`
	// A safe gateway-authored diagnostic; never a raw driver error.
	CleanupError string `protobuf:"bytes,8,opt,name=cleanup_error,json=cleanupError,proto3" json:"cleanup_error,omitempty"`
	// Durable backoff for interrupted or failed reclamation.
	CleanupRetryTime *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=cleanup_retry_time,json=cleanupRetryTime,proto3" json:"cleanup_retry_time,omitempty"`
	// Attachment edits have their own durable clock; status writes do not change it.
	AttachmentChangeId   string                 `protobuf:"bytes,10,opt,name=attachment_change_id,json=attachmentChangeId,proto3" json:"attachment_change_id,omitempty"`
	AttachmentChangeTime *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=attachment_change_time,json=attachmentChangeTime,proto3" json:"attachment_change_time,omitempty"`
	unknownFields        protoimpl.UnknownFields
	sizeCache            protoimpl.SizeCache
}

func (x *SandboxProvisioning) Reset() {
	*x = SandboxProvisioning{}
	mi := &file_openshell_proto_msgTypes[229]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxProvisioning) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxProvisioning) ProtoMessage() {}

func (x *SandboxProvisioning) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[229]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxProvisioning.ProtoReflect.Descriptor instead.
func (*SandboxProvisioning) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{229}
}

func (x *SandboxProvisioning) GetAttemptId() string {
	if x != nil {
		return x.AttemptId
	}
	return ""
}

func (x *SandboxProvisioning) GetConfigurationChangeId() string {
	if x != nil {
		return x.ConfigurationChangeId
	}
	return ""
}

func (x *SandboxProvisioning) GetConfigurationChangeTime() *timestamppb.Timestamp {
	if x != nil {
		return x.ConfigurationChangeTime
	}
	return nil
}

func (x *SandboxProvisioning) GetFirstRejectionTime() *timestamppb.Timestamp {
	if x != nil {
		return x.FirstRejectionTime
	}
	return nil
}

func (x *SandboxProvisioning) GetDeadline() *timestamppb.Timestamp {
	if x != nil {
		return x.Deadline
	}
	return nil
}

func (x *SandboxProvisioning) GetTimeoutTime() *timestamppb.Timestamp {
	if x != nil {
		return x.TimeoutTime
	}
	return nil
}

func (x *SandboxProvisioning) GetCleanupCompletedTime() *timestamppb.Timestamp {
	if x != nil {
		return x.CleanupCompletedTime
	}
	return nil
}

func (x *SandboxProvisioning) GetCleanupError() string {
	if x != nil {
		return x.CleanupError
	}
	return ""
}

func (x *SandboxProvisioning) GetCleanupRetryTime() *timestamppb.Timestamp {
	if x != nil {
		return x.CleanupRetryTime
	}
	return nil
}

func (x *SandboxProvisioning) GetAttachmentChangeId() string {
	if x != nil {
		return x.AttachmentChangeId
	}
	return ""
}

func (x *SandboxProvisioning) GetAttachmentChangeTime() *timestamppb.Timestamp {
	if x != nil {
		return x.AttachmentChangeTime
	}
	return nil
}

// Create-time request to expose one loopback HTTP service in a sandbox.
type SandboxServiceExposure struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Service name within the sandbox. Empty selects the unnamed endpoint.
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// Loopback TCP port inside the sandbox.
	TargetPort    uint32 `protobuf:"varint,2,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxServiceExposure) Reset() {
	*x = SandboxServiceExposure{}
	mi := &file_openshell_proto_msgTypes[230]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxServiceExposure) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxServiceExposure) ProtoMessage() {}

func (x *SandboxServiceExposure) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[230]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxServiceExposure.ProtoReflect.Descriptor instead.
func (*SandboxServiceExposure) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{230}
}

func (x *SandboxServiceExposure) GetService() string {
	if x != nil {
		return x.Service
	}
	return ""
}

func (x *SandboxServiceExposure) GetTargetPort() uint32 {
	if x != nil {
		return x.TargetPort
	}
	return 0
}

var File_openshell_proto protoreflect.FileDescriptor

const file_openshell_proto_rawDesc = "" +
	"\n" +
	"\x0fopenshell.proto\x12\fopenshell.v1\x1a\x0fdatamodel.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\roptions.proto\x1a\rsandbox.proto\"\x1a\n" +
	"\x18IssueSandboxTokenRequest\"\x91\x01\n" +
	"\x19IssueSandboxTokenResponse\x12\x1a\n" +
	"\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12C\n" +
	"\x0fexpiration_time\x18f \x01(\v2\x1a.google.protobuf.TimestampR\x0eexpirationTimeJ\x04\b\x02\x10\x03R\rexpires_at_ms\"T\n" +
	"\x1aRefreshSandboxTokenRequest\x126\n" +
	"\x17extension_service_names\x18\x01 \x03(\tR\x15extensionServiceNames\"\xd8\x03\n" +
	"\x1bRefreshSandboxTokenResponse\x12\x1a\n" +
	"\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12C\n" +
	"\x0fexpiration_time\x18f \x01(\v2\x1a.google.protobuf.TimestampR\x0eexpirationTime\x12]\n" +
	"\x15extension_credentials\x18\x03 \x03(\v2(.openshell.v1.ExtensionServiceCredentialR\x14extensionCredentials\x12)\n" +
	"\rsandbox_token\x18\x04 \x01(\tB\x04\x88\xb5\x18\x01R\fsandboxToken\x12R\n" +
	"\x17sandbox_expiration_time\x18i \x01(\v2\x1a.google.protobuf.TimestampR\x15sandboxExpirationTime\x12\x1d\n" +
	"\n" +
	"session_id\x18\x06 \x01(\tR\tsessionId\x12)\n" +
	"\x10credential_epoch\x18\a \x01(\x04R\x0fcredentialEpochJ\x04\b\x02\x10\x03J\x04\b\x05\x10\x06R\rexpires_at_msR\x15sandbox_expires_at_ms\"\x0f\n" +
	"\rHealthRequest\"_\n" +
	"\x0eHealthResponse\x123\n" +
	"\x06status\x18\x01 \x01(\x0e2\x1b.openshell.v1.ServiceStatusR\x06status\x12\x18\n" +
	"\aversion\x18\x02 \x01(\tR\aversion\"\x17\n" +
	"\x15GetCurrentUserRequest\"\xb0\x01\n" +
	"\x16GetCurrentUserResponse\x12\x18\n" +
	"\asubject\x18\x01 \x01(\tR\asubject\x12!\n" +
	"\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12\x14\n" +
	"\x05roles\x18\x03 \x03(\tR\x05roles\x12\x16\n" +
	"\x06scopes\x18\x04 \x03(\tR\x06scopes\x12+\n" +
	"\x11identity_provider\x18\x05 \x01(\tR\x10identityProvider\"\x17\n" +
	"\x15GetGatewayInfoRequest\"\x87\x02\n" +
	"\x16GetGatewayInfoResponse\x123\n" +
	"\x06status\x18\x01 \x01(\x0e2\x1b.openshell.v1.ServiceStatusR\x06status\x12'\n" +
	"\x0fgateway_version\x18\x02 \x01(\tR\x0egatewayVersion\x12H\n" +
	"\x0fcompute_drivers\x18\x03 \x03(\v2\x1f.openshell.v1.ComputeDriverInfoR\x0ecomputeDrivers\x12E\n" +
	"\n" +
	"extensions\x18\x04 \x03(\v2%.openshell.v1.NegotiatedExtensionInfoR\n" +
	"extensions\"\x95\x03\n" +
	"\x17NegotiatedExtensionInfo\x12/\n" +
	"\x04kind\x18\x01 \x01(\x0e2\x1b.openshell.v1.ExtensionKindR\x04kind\x12'\n" +
	"\x0fconfigured_name\x18\x02 \x01(\tR\x0econfiguredName\x12/\n" +
	"\x13implementation_name\x18\x03 \x01(\tR\x12implementationName\x125\n" +
	"\x16implementation_version\x18\x04 \x01(\tR\x15implementationVersion\x12%\n" +
	"\x0eprotocol_major\x18\x05 \x01(\rR\rprotocolMajor\x12%\n" +
	"\x0eprotocol_minor\x18\x06 \x01(\rR\rprotocolMinor\x125\n" +
	"\x16supported_capabilities\x18\a \x03(\tR\x15supportedCapabilities\x123\n" +
	"\x15required_capabilities\x18\b \x03(\tR\x14requiredCapabilities\"t\n" +
	"\x11ComputeDriverInfo\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12K\n" +
	"\fcapabilities\x18\x02 \x01(\v2'.openshell.v1.ComputeDriverCapabilitiesR\fcapabilities\"\xbc\x01\n" +
	"\x19ComputeDriverCapabilities\x12\x1f\n" +
	"\vdriver_name\x18\x01 \x01(\tR\n" +
	"driverName\x12%\n" +
	"\x0edriver_version\x18\x02 \x01(\tR\rdriverVersion\x12W\n" +
	"\x15resource_capabilities\x18\x03 \x01(\v2\".openshell.v1.ResourceCapabilitiesR\x14resourceCapabilities\"\xca\x01\n" +
	"\x14ResourceCapabilities\x127\n" +
	"\x03cpu\x18\x01 \x01(\v2%.openshell.v1.CpuResourceCapabilitiesR\x03cpu\x12@\n" +
	"\x06memory\x18\x02 \x01(\v2(.openshell.v1.MemoryResourceCapabilitiesR\x06memory\x127\n" +
	"\x03gpu\x18\x03 \x01(\v2%.openshell.v1.GpuResourceCapabilitiesR\x03gpu\"B\n" +
	"\x17CpuResourceCapabilities\x12'\n" +
	"\x0flimit_supported\x18\x01 \x01(\bR\x0elimitSupported\"E\n" +
	"\x1aMemoryResourceCapabilities\x12'\n" +
	"\x0flimit_supported\x18\x01 \x01(\bR\x0elimitSupported\"\x95\x01\n" +
	"\x17GpuResourceCapabilities\x12>\n" +
	"\x1bdefault_selection_supported\x18\x01 \x01(\bR\x19defaultSelectionSupported\x12:\n" +
	"\x19count_selection_supported\x18\x02 \x01(\bR\x17countSelectionSupported\"\xce\x02\n" +
	"\aSandbox\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12-\n" +
	"\x04spec\x18\x02 \x01(\v2\x19.openshell.v1.SandboxSpecR\x04spec\x123\n" +
	"\x06status\x18\x03 \x01(\v2\x1b.openshell.v1.SandboxStatusR\x06status\x12t\n" +
	"\x1ecreated_from_workload_template\x18\x14 \x01(\v2/.openshell.v1.SandboxWorkloadTemplateProvenanceR\x1bcreatedFromWorkloadTemplateJ\x04\b\x04\x10\x05J\x04\b\x05\x10\x06R\x05phaseR\x16current_policy_version\"\xbf\x04\n" +
	"\vSandboxSpec\x12\x1b\n" +
	"\tlog_level\x18\x01 \x01(\tR\blogLevel\x12L\n" +
	"\venvironment\x18\x05 \x03(\v2*.openshell.v1.SandboxSpec.EnvironmentEntryR\venvironment\x129\n" +
	"\btemplate\x18\x06 \x01(\v2\x1d.openshell.v1.SandboxTemplateR\btemplate\x12;\n" +
	"\x06policy\x18\a \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x1c\n" +
	"\tproviders\x18\b \x03(\tR\tproviders\x12W\n" +
	"\x15resource_requirements\x18\t \x01(\v2\".openshell.v1.ResourceRequirementsR\x14resourceRequirements\x12\x18\n" +
	"\acommand\x18\f \x03(\tR\acommand\x12\x10\n" +
	"\x03tty\x18\r \x01(\bR\x03tty\x12:\n" +
	"\x19provider_attachment_epoch\x18\x0e \x01(\tR\x17providerAttachmentEpoch\x1a>\n" +
	"\x10EnvironmentEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\n" +
	"\x10\vJ\x04\b\v\x10\fR\n" +
	"gpu_deviceR\x16proposal_approval_mode\"O\n" +
	"\x14ResourceRequirements\x127\n" +
	"\x03gpu\x18\x01 \x01(\v2%.openshell.v1.GpuResourceRequirementsR\x03gpu\">\n" +
	"\x17GpuResourceRequirements\x12\x19\n" +
	"\x05count\x18\x01 \x01(\rH\x00R\x05count\x88\x01\x01B\b\n" +
	"\x06_count\"\xef\x05\n" +
	"\x0fSandboxTemplate\x12\x14\n" +
	"\x05image\x18\x01 \x01(\tR\x05image\x12,\n" +
	"\x12runtime_class_name\x18\x02 \x01(\tR\x10runtimeClassName\x12!\n" +
	"\fagent_socket\x18\x03 \x01(\tR\vagentSocket\x12A\n" +
	"\x06labels\x18\x04 \x03(\v2).openshell.v1.SandboxTemplate.LabelsEntryR\x06labels\x12P\n" +
	"\vannotations\x18\x05 \x03(\v2..openshell.v1.SandboxTemplate.AnnotationsEntryR\vannotations\x12P\n" +
	"\venvironment\x18\x06 \x03(\v2..openshell.v1.SandboxTemplate.EnvironmentEntryR\venvironment\x125\n" +
	"\tresources\x18\a \x01(\v2\x17.google.protobuf.StructR\tresources\x12,\n" +
	"\x0fuser_namespaces\x18\n" +
	" \x01(\bH\x00R\x0euserNamespaces\x88\x01\x01\x12<\n" +
	"\rdriver_config\x18\v \x01(\v2\x17.google.protobuf.StructR\fdriverConfig\x1a9\n" +
	"\vLabelsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
	"\x10EnvironmentEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x12\n" +
	"\x10_user_namespacesJ\x04\b\t\x10\n" +
	"R\x16volume_claim_templates\"\x98\x01\n" +
	"\x17SandboxWorkloadTemplate\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12=\n" +
	"\x04spec\x18\x02 \x01(\v2).openshell.v1.SandboxWorkloadTemplateSpecR\x04spec\"\xf3\x01\n" +
	"\x1bSandboxWorkloadTemplateSpec\x12?\n" +
	"\bworkload\x18\x01 \x01(\v2#.openshell.v1.SandboxWorkloadConfigR\bworkload\x12<\n" +
	"\rdriver_config\x18\x02 \x01(\v2\x17.google.protobuf.StructR\fdriverConfig\x12U\n" +
	"\x15desired_service_level\x18\x03 \x01(\v2!.openshell.v1.SandboxServiceLevelR\x13desiredServiceLevel\"\x83\x02\n" +
	"\x15SandboxWorkloadConfig\x12\x14\n" +
	"\x05image\x18\x01 \x01(\tR\x05image\x12V\n" +
	"\venvironment\x18\x02 \x03(\v24.openshell.v1.SandboxWorkloadConfig.EnvironmentEntryR\venvironment\x12<\n" +
	"\tresources\x18\x03 \x01(\v2\x1e.openshell.v1.SandboxResourcesR\tresources\x1a>\n" +
	"\x10EnvironmentEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"u\n" +
	"\x10SandboxResources\x12\x10\n" +
	"\x03cpu\x18\x01 \x01(\tR\x03cpu\x12\x16\n" +
	"\x06memory\x18\x02 \x01(\tR\x06memory\x127\n" +
	"\x03gpu\x18\x03 \x01(\v2%.openshell.v1.GpuResourceRequirementsR\x03gpu\"M\n" +
	"\x13SandboxServiceLevel\x126\n" +
	"\astartup\x18\x01 \x01(\v2\x1c.openshell.v1.SandboxStartupR\astartup\"k\n" +
	"\x0eSandboxStartup\x12<\n" +
	"\fready_within\x18\x01 \x01(\v2\x19.google.protobuf.DurationR\vreadyWithin\x12\x1b\n" +
	"\tmax_burst\x18\x02 \x01(\rR\bmaxBurst\"b\n" +
	"!SandboxWorkloadTemplateProvenance\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12)\n" +
	"\x10resource_version\x18\x02 \x01(\tR\x0fresourceVersion\"\xc9\x05\n" +
	"\rSandboxStatus\x12\x1b\n" +
	"\tagent_pod\x18\x02 \x01(\tR\bagentPod\x12\x19\n" +
	"\bagent_fd\x18\x03 \x01(\tR\aagentFd\x12\x1d\n" +
	"\n" +
	"sandbox_fd\x18\x04 \x01(\tR\tsandboxFd\x12>\n" +
	"\n" +
	"conditions\x18\x05 \x03(\v2\x1e.openshell.v1.SandboxConditionR\n" +
	"conditions\x120\n" +
	"\x05phase\x18\x06 \x01(\x0e2\x1a.openshell.v1.SandboxPhaseR\x05phase\x124\n" +
	"\x16current_policy_version\x18\a \x01(\rR\x14currentPolicyVersion\x127\n" +
	"\x18main_process_instance_id\x18\b \x01(\tR\x15mainProcessInstanceId\x12 \n" +
	"\texit_code\x18\t \x01(\x05H\x00R\bexitCode\x88\x01\x01\x12I\n" +
	"\x11endpoint_statuses\x18\n" +
	" \x03(\v2\x1c.openshell.v1.EndpointStatusR\x10endpointStatuses\x12d\n" +
	"\x17configuration_admission\x18\v \x01(\v2+.openshell.v1.SandboxConfigurationAdmissionR\x16configurationAdmission\x12<\n" +
	"\x17configuration_activated\x18\f \x01(\bH\x01R\x16configurationActivated\x88\x01\x01\x12E\n" +
	"\fprovisioning\x18\r \x01(\v2!.openshell.v1.SandboxProvisioningR\fprovisioningB\f\n" +
	"\n" +
	"_exit_codeB\x1a\n" +
	"\x18_configuration_activated\"\xd1\x01\n" +
	"\x10SandboxCondition\x12\x12\n" +
	"\x04type\x18\x01 \x01(\tR\x04type\x12\x16\n" +
	"\x06status\x18\x02 \x01(\tR\x06status\x12\x16\n" +
	"\x06reason\x18\x03 \x01(\tR\x06reason\x12\x18\n" +
	"\amessage\x18\x04 \x01(\tR\amessage\x12C\n" +
	"\x0ftransition_time\x18i \x01(\v2\x1a.google.protobuf.TimestampR\x0etransitionTimeJ\x04\b\x05\x10\x06R\x14last_transition_time\"\xc0\x02\n" +
	"\rPlatformEvent\x129\n" +
	"\n" +
	"event_time\x18e \x01(\v2\x1a.google.protobuf.TimestampR\teventTime\x12\x16\n" +
	"\x06source\x18\x02 \x01(\tR\x06source\x12\x12\n" +
	"\x04type\x18\x03 \x01(\tR\x04type\x12\x16\n" +
	"\x06reason\x18\x04 \x01(\tR\x06reason\x12\x18\n" +
	"\amessage\x18\x05 \x01(\tR\amessage\x12E\n" +
	"\bmetadata\x18\x06 \x03(\v2).openshell.v1.PlatformEvent.MetadataEntryR\bmetadata\x1a;\n" +
	"\rMetadataEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\x01\x10\x02R\ftimestamp_ms\"\xa9\x05\n" +
	"\x14CreateSandboxRequest\x12R\n" +
	"\x0fworkspace_scope\x18\a \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12-\n" +
	"\x04spec\x18\x01 \x01(\v2\x19.openshell.v1.SandboxSpecR\x04spec\x12\x12\n" +
	"\x04name\x18\x02 \x01(\tR\x04name\x12F\n" +
	"\x06labels\x18\x03 \x03(\v2..openshell.v1.CreateSandboxRequest.LabelsEntryR\x06labels\x12U\n" +
	"\vannotations\x18\x04 \x03(\v23.openshell.v1.CreateSandboxRequest.AnnotationsEntryR\vannotations\x12A\n" +
	"\x1dawait_main_process_attachment\x18\x05 \x01(\bR\x1aawaitMainProcessAttachment\x12+\n" +
	"\x11workload_template\x18\x06 \x01(\tR\x10workloadTemplate\x12\x1d\n" +
	"\n" +
	"request_id\x18\b \x01(\tR\trequestId\x12Q\n" +
	"\x11service_exposures\x18\t \x03(\v2$.openshell.v1.SandboxServiceExposureR\x10serviceExposures\x1a9\n" +
	"\vLabelsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xd4\x01\n" +
	"\x1cCreateSandboxTemplateRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12A\n" +
	"\btemplate\x18\x01 \x01(\v2%.openshell.v1.SandboxWorkloadTemplateR\btemplate\x12\x1d\n" +
	"\n" +
	"request_id\x18\x03 \x01(\tR\trequestId\"\x83\x01\n" +
	"\x19GetSandboxTemplateRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\"\xd4\x01\n" +
	"\x1bListSandboxTemplatesRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1b\n" +
	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
	"\n" +
	"page_token\x18\x02 \x01(\tR\tpageToken\x12%\n" +
	"\x0elabel_selector\x18\x03 \x01(\tR\rlabelSelector\"\xca\x01\n" +
	"\x1cDeleteSandboxTemplateRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12#\n" +
	"\rallow_missing\x18\x03 \x01(\bR\fallowMissing\x12\x1d\n" +
	"\n" +
	"request_id\x18\x04 \x01(\tR\trequestId\"\\\n" +
	"\x17SandboxTemplateResponse\x12A\n" +
	"\btemplate\x18\x01 \x01(\v2%.openshell.v1.SandboxWorkloadTemplateR\btemplate\"\x8b\x01\n" +
	"\x1cListSandboxTemplatesResponse\x12C\n" +
	"\ttemplates\x18\x01 \x03(\v2%.openshell.v1.SandboxWorkloadTemplateR\ttemplates\x12&\n" +
	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"g\n" +
	"\x1dDeleteSandboxTemplateResponse\x127\n" +
	"\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\xae\x01\n" +
	"\x1cBeginRootfsTarStagingRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1b\n" +
	"\tfile_name\x18\x01 \x01(\tR\bfileName\x12\x1d\n" +
	"\n" +
	"size_bytes\x18\x02 \x01(\x04R\tsizeBytes\"\xdc\x01\n" +
	"\x1dBeginRootfsTarStagingResponse\x12#\n" +
	"\rstaging_token\x18\x01 \x01(\tR\fstagingToken\x12\x1f\n" +
	"\vupload_path\x18\x02 \x01(\tR\n" +
	"uploadPath\x12\x1b\n" +
	"\tmax_bytes\x18\x03 \x01(\x04R\bmaxBytes\x12C\n" +
	"\x0fexpiration_time\x18h \x01(\v2\x1a.google.protobuf.TimestampR\x0eexpirationTimeJ\x04\b\x04\x10\x05R\rexpires_at_ms\"{\n" +
	"\x11GetSandboxRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\"\xcd\x01\n" +
	"\x14ListSandboxesRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1b\n" +
	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
	"\n" +
	"page_token\x18\x02 \x01(\tR\tpageToken\x12%\n" +
	"\x0elabel_selector\x18\x03 \x01(\tR\rlabelSelector\"\x8b\x01\n" +
	"\x1bListSandboxProvidersRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\"\x83\x02\n" +
	"\x1cAttachSandboxProviderRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1a\n" +
	"\bprovider\x18\x02 \x01(\tR\bprovider\x12:\n" +
	"\x19expected_resource_version\x18\x03 \x01(\x04R\x17expectedResourceVersion\x12\x1d\n" +
	"\n" +
	"request_id\x18\x05 \x01(\tR\trequestId\"\x83\x02\n" +
	"\x1cDetachSandboxProviderRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1a\n" +
	"\bprovider\x18\x02 \x01(\tR\bprovider\x12:\n" +
	"\x19expected_resource_version\x18\x03 \x01(\x04R\x17expectedResourceVersion\x12\x1d\n" +
	"\n" +
	"request_id\x18\x05 \x01(\tR\trequestId\"\xc2\x01\n" +
	"\x14DeleteSandboxRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12#\n" +
	"\rallow_missing\x18\x03 \x01(\bR\fallowMissing\x12\x1d\n" +
	"\n" +
	"request_id\x18\x04 \x01(\tR\trequestId\"\x9b\x01\n" +
	"\x12StopSandboxRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1d\n" +
	"\n" +
	"request_id\x18\x03 \x01(\tR\trequestId\"\x9c\x01\n" +
	"\x13StartSandboxRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1d\n" +
	"\n" +
	"request_id\x18\x03 \x01(\tR\trequestId\"\xd5\x01\n" +
	"\x0fSandboxResponse\x12/\n" +
	"\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\x12Q\n" +
	"\fservice_urls\x18\x02 \x03(\v2..openshell.v1.SandboxResponse.ServiceUrlsEntryR\vserviceUrls\x1a>\n" +
	"\x10ServiceUrlsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"t\n" +
	"\x15ListSandboxesResponse\x123\n" +
	"\tsandboxes\x18\x01 \x03(\v2\x15.openshell.v1.SandboxR\tsandboxes\x12&\n" +
	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"^\n" +
	"\x1cListSandboxProvidersResponse\x12>\n" +
	"\tproviders\x18\x01 \x03(\v2 .openshell.datamodel.v1.ProviderR\tproviders\"\xad\x01\n" +
	"\x1dAttachSandboxProviderResponse\x12/\n" +
	"\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\x12\x1a\n" +
	"\battached\x18\x02 \x01(\bR\battached\x12?\n" +
	"\areceipt\x18\x03 \x01(\v2%.openshell.v1.ProviderMutationReceiptR\areceipt\"\xad\x01\n" +
	"\x1dDetachSandboxProviderResponse\x12/\n" +
	"\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\x12\x1a\n" +
	"\bdetached\x18\x02 \x01(\bR\bdetached\x12?\n" +
	"\areceipt\x18\x03 \x01(\v2%.openshell.v1.ProviderMutationReceiptR\areceipt\"\xd8\x02\n" +
	"\x17ProviderDesiredIdentity\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x18\n" +
	"\asandbox\x18\x02 \x01(\tR\asandbox\x12)\n" +
	"\x10attachment_epoch\x18\x03 \x01(\tR\x0fattachmentEpoch\x12\x1f\n" +
	"\vprovider_id\x18\x04 \x01(\tR\n" +
	"providerId\x12:\n" +
	"\x19provider_resource_version\x18\x05 \x01(\x04R\x17providerResourceVersion\x122\n" +
	"\x15provider_env_revision\x18\x06 \x01(\x04R\x13providerEnvRevision\x12'\n" +
	"\x0fconfig_revision\x18\a \x01(\x04R\x0econfigRevision\x12\x1f\n" +
	"\vpolicy_hash\x18\b \x01(\tR\n" +
	"policyHash\"\xfa\x01\n" +
	"\x16ConfigSnapshotRevision\x12L\n" +
	"\x0esandbox_config\x18\x01 \x01(\v2#.openshell.v1.SandboxConfigRevisionH\x00R\rsandboxConfig\x123\n" +
	"\x14provider_environment\x18\x02 \x01(\x04H\x00R\x13providerEnvironment\x12P\n" +
	"\x0fprovider_target\x18\x03 \x01(\v2%.openshell.v1.ProviderDesiredIdentityH\x00R\x0eproviderTargetB\v\n" +
	"\tcomponent\"\x91\x02\n" +
	"\x15SandboxConfigRevision\x12'\n" +
	"\x0fconfig_revision\x18\x01 \x01(\x04R\x0econfigRevision\x12%\n" +
	"\x0epolicy_version\x18\x02 \x01(\rR\rpolicyVersion\x12G\n" +
	"\rpolicy_source\x18\x03 \x01(\x0e2\".openshell.sandbox.v1.PolicySourceR\fpolicySource\x122\n" +
	"\x15global_policy_version\x18\x04 \x01(\rR\x13globalPolicyVersion\x12+\n" +
	"\x11settings_revision\x18\x05 \x01(\x04R\x10settingsRevision\"\x8c\x05\n" +
	"\x15ConfigUpdateOperation\x12!\n" +
	"\foperation_id\x18\x01 \x01(\tR\voperationId\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12;\n" +
	"\tcomponent\x18\x03 \x01(\x0e2\x1d.openshell.v1.ConfigComponentR\tcomponent\x12M\n" +
	"\x0ftarget_revision\x18\x04 \x01(\v2$.openshell.v1.ConfigSnapshotRevisionR\x0etargetRevision\x12>\n" +
	"\x05state\x18\x05 \x01(\x0e2(.openshell.v1.ConfigUpdateOperationStateR\x05state\x12:\n" +
	"\aoutcome\x18\x06 \x01(\x0e2 .openshell.v1.ConfigApplyOutcomeR\aoutcome\x12'\n" +
	"\x0fsanitized_error\x18\a \x01(\tR\x0esanitizedError\x12=\n" +
	"\fcreated_time\x18l \x01(\v2\x1a.google.protobuf.TimestampR\vcreatedTime\x12=\n" +
	"\fupdated_time\x18m \x01(\v2\x1a.google.protobuf.TimestampR\vupdatedTime\x12A\n" +
	"\x0ecompleted_time\x18n \x01(\v2\x1a.google.protobuf.TimestampR\rcompletedTimeJ\x04\b\b\x10\tJ\x04\b\t\x10\n" +
	"J\x04\b\n" +
	"\x10\vR\rcreated_at_msR\rupdated_at_msR\x0fcompleted_at_ms\"\xe6\x02\n" +
	"\x17ProviderMutationReceipt\x12\x1d\n" +
	"\n" +
	"receipt_id\x18\x01 \x01(\tR\treceiptId\x12\x1f\n" +
	"\vmutation_id\x18\x02 \x01(\tR\n" +
	"mutationId\x12\x1a\n" +
	"\bprovider\x18\x03 \x01(\tR\bprovider\x12\x1c\n" +
	"\tworkspace\x18\x04 \x01(\tR\tworkspace\x126\n" +
	"\x04kind\x18\x05 \x01(\x0e2\".openshell.v1.ProviderMutationKindR\x04kind\x12?\n" +
	"\adesired\x18\x06 \x01(\v2%.openshell.v1.ProviderDesiredIdentityR\adesired\x12A\n" +
	"\x0epersisted_time\x18k \x01(\v2\x1a.google.protobuf.TimestampR\rpersistedTimeJ\x04\b\a\x10\bR\x0fpersisted_at_ms\"\x8d\x04\n" +
	"\x1cProviderReadinessObservation\x12\x1d\n" +
	"\n" +
	"session_id\x18\x01 \x01(\tR\tsessionId\x12\x1a\n" +
	"\bsequence\x18\x02 \x01(\x04R\bsequence\x12)\n" +
	"\x10attachment_epoch\x18\x03 \x01(\tR\x0fattachmentEpoch\x122\n" +
	"\x15provider_env_revision\x18\x04 \x01(\x04R\x13providerEnvRevision\x12'\n" +
	"\x0fconfig_revision\x18\x05 \x01(\x04R\x0econfigRevision\x12\x1f\n" +
	"\vpolicy_hash\x18\x06 \x01(\tR\n" +
	"policyHash\x123\n" +
	"\x15credentials_installed\x18\a \x01(\bR\x14credentialsInstalled\x12#\n" +
	"\rpolicy_active\x18\b \x01(\bR\fpolicyActive\x12@\n" +
	"\x1claunch_environment_installed\x18\t \x01(\bR\x1alaunchEnvironmentInstalled\x12.\n" +
	"\x13process_instance_id\x18\n" +
	" \x01(\tR\x11processInstanceId\x12=\n" +
	"\x06reason\x18\v \x01(\x0e2%.openshell.v1.ProviderReadinessReasonR\x06reason\"\xc1\x04\n" +
	"\x17ProviderReadinessStatus\x12?\n" +
	"\areceipt\x18\x01 \x01(\v2%.openshell.v1.ProviderMutationReceiptR\areceipt\x12:\n" +
	"\x05state\x18\x02 \x01(\x0e2$.openshell.v1.ProviderReadinessStateR\x05state\x12=\n" +
	"\x06reason\x18\x03 \x01(\x0e2%.openshell.v1.ProviderReadinessReasonR\x06reason\x12F\n" +
	"\bobserved\x18\x04 \x01(\v2*.openshell.v1.ProviderReadinessObservationR\bobserved\x12.\n" +
	"\x13network_instance_id\x18\x05 \x01(\tR\x11networkInstanceId\x12?\n" +
	"\robserved_time\x18j \x01(\v2\x1a.google.protobuf.TimestampR\fobservedTime\x12A\n" +
	"\x0eevaluated_time\x18k \x01(\v2\x1a.google.protobuf.TimestampR\revaluatedTime\x12A\n" +
	"\toperation\x18\b \x01(\v2#.openshell.v1.ConfigUpdateOperationR\toperationJ\x04\b\x06\x10\aJ\x04\b\a\x10\bR\x0eobserved_at_msR\x0fevaluated_at_ms\"\xca\x01\n" +
	"\x1fGetSandboxProviderStatusRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1a\n" +
	"\bprovider\x18\x02 \x01(\tR\bprovider\x12\x1d\n" +
	"\n" +
	"receipt_id\x18\x03 \x01(\tR\treceiptId\"a\n" +
	" GetSandboxProviderStatusResponse\x12=\n" +
	"\x06status\x18\x01 \x01(\v2%.openshell.v1.ProviderReadinessStatusR\x06status\"\x8d\x01\n" +
	"\x1eReportProviderReadinessRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12L\n" +
	"\vobservation\x18\x02 \x01(\v2*.openshell.v1.ProviderReadinessObservationR\vobservation\"\x94\x02\n" +
	"\x1fReportProviderReadinessResponse\x12+\n" +
	"\x11accepted_sequence\x18\x01 \x01(\x04R\x10acceptedSequence\x12B\n" +
	"\x0freport_interval\x18f \x01(\v2\x19.google.protobuf.DurationR\x0ereportInterval\x12B\n" +
	"\x0fobservation_ttl\x18g \x01(\v2\x19.google.protobuf.DurationR\x0eobservationTtlJ\x04\b\x02\x10\x03J\x04\b\x03\x10\x04R\x17report_interval_secondsR\x17observation_ttl_seconds\"~\n" +
	"\x15DeleteSandboxResponse\x127\n" +
	"\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcome\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x03 \x01(\tR\tsandboxIdJ\x04\b\x01\x10\x02R\adeleted\"\x87\x01\n" +
	"\x17CreateSshSessionRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\"\xce\x02\n" +
	"\x18CreateSshSessionResponse\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1a\n" +
	"\x05token\x18\x02 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12!\n" +
	"\fgateway_host\x18\x03 \x01(\tR\vgatewayHost\x12!\n" +
	"\fgateway_port\x18\x04 \x01(\rR\vgatewayPort\x12%\n" +
	"\x0egateway_scheme\x18\x05 \x01(\tR\rgatewayScheme\x120\n" +
	"\x14host_key_fingerprint\x18\a \x01(\tR\x12hostKeyFingerprint\x12C\n" +
	"\x0fexpiration_time\x18l \x01(\v2\x1a.google.protobuf.TimestampR\x0eexpirationTimeJ\x04\b\b\x10\tR\rexpires_at_ms\"\xf0\x01\n" +
	"\x14ExposeServiceRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x05 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x02 \x01(\tR\x04name\x12\x1f\n" +
	"\vtarget_port\x18\x03 \x01(\rR\n" +
	"targetPort\x12\x16\n" +
	"\x06domain\x18\x04 \x01(\bR\x06domain\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1d\n" +
	"\n" +
	"request_id\x18\x06 \x01(\tR\trequestId\"\x95\x01\n" +
	"\x11GetServiceRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x02 \x01(\tR\x04name\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\"\xbf\x01\n" +
	"\x13ListServicesRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1b\n" +
	"\tpage_size\x18\x02 \x01(\x05R\bpageSize\x12\x1d\n" +
	"\n" +
	"page_token\x18\x03 \x01(\tR\tpageToken\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\"\x81\x01\n" +
	"\x14ListServicesResponse\x12A\n" +
	"\bservices\x18\x01 \x03(\v2%.openshell.v1.ServiceEndpointResponseR\bservices\x12&\n" +
	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xdc\x01\n" +
	"\x14DeleteServiceRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x02 \x01(\tR\x04name\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12#\n" +
	"\rallow_missing\x18\x04 \x01(\bR\fallowMissing\x12\x1d\n" +
	"\n" +
	"request_id\x18\x05 \x01(\tR\trequestId\"_\n" +
	"\x15DeleteServiceResponse\x127\n" +
	"\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\xd7\x01\n" +
	"\x0fServiceEndpoint\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12\x18\n" +
	"\asandbox\x18\x03 \x01(\tR\asandbox\x12\x12\n" +
	"\x04name\x18\x04 \x01(\tR\x04name\x12\x1f\n" +
	"\vtarget_port\x18\x05 \x01(\rR\n" +
	"targetPort\x12\x16\n" +
	"\x06domain\x18\x06 \x01(\bR\x06domain\"f\n" +
	"\x17ServiceEndpointResponse\x129\n" +
	"\bendpoint\x18\x01 \x01(\v2\x1d.openshell.v1.ServiceEndpointR\bendpoint\x12\x10\n" +
	"\x03url\x18\x02 \x01(\tR\x03url\"Z\n" +
	"\x17RevokeSshSessionRequest\x12\x1a\n" +
	"\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12#\n" +
	"\rallow_missing\x18\x02 \x01(\bR\fallowMissing\"b\n" +
	"\x18RevokeSshSessionResponse\x127\n" +
	"\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\arevoked\"\xa0\x04\n" +
	"\x12ExecSandboxRequest\x12R\n" +
	"\x0fworkspace_scope\x18\f \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" +
	"\acommand\x18\x02 \x03(\tR\acommand\x12\x18\n" +
	"\aworkdir\x18\x03 \x01(\tR\aworkdir\x12S\n" +
	"\venvironment\x18\x04 \x03(\v21.openshell.v1.ExecSandboxRequest.EnvironmentEntryR\venvironment\x12F\n" +
	"\x11execution_timeout\x18i \x01(\v2\x19.google.protobuf.DurationR\x10executionTimeout\x12\x14\n" +
	"\x05stdin\x18\x06 \x01(\fR\x05stdin\x12\x10\n" +
	"\x03tty\x18\a \x01(\bR\x03tty\x12\x12\n" +
	"\x04cols\x18\b \x01(\rR\x04cols\x12\x12\n" +
	"\x04rows\x18\t \x01(\rR\x04rows\x12$\n" +
	"\x0eno_login_shell\x18\n" +
	" \x01(\bR\fnoLoginShell\x1a>\n" +
	"\x10EnvironmentEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\x05\x10\x06R\x0ftimeout_seconds\"'\n" +
	"\x11ExecSandboxStdout\x12\x12\n" +
	"\x04data\x18\x01 \x01(\fR\x04data\"'\n" +
	"\x11ExecSandboxStderr\x12\x12\n" +
	"\x04data\x18\x01 \x01(\fR\x04data\".\n" +
	"\x0fExecSandboxExit\x12\x1b\n" +
	"\texit_code\x18\x01 \x01(\x05R\bexitCode\"\xc8\x01\n" +
	"\x10ExecSandboxEvent\x129\n" +
	"\x06stdout\x18\x01 \x01(\v2\x1f.openshell.v1.ExecSandboxStdoutH\x00R\x06stdout\x129\n" +
	"\x06stderr\x18\x02 \x01(\v2\x1f.openshell.v1.ExecSandboxStderrH\x00R\x06stderr\x123\n" +
	"\x04exit\x18\x03 \x01(\v2\x1d.openshell.v1.ExecSandboxExitH\x00R\x04exitB\t\n" +
	"\apayload\"\x8c\x02\n" +
	"\x0eTcpForwardInit\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\x12\x1d\n" +
	"\n" +
	"service_id\x18\x04 \x01(\tR\tserviceId\x120\n" +
	"\x03ssh\x18\x05 \x01(\v2\x1c.openshell.v1.SshRelayTargetH\x00R\x03ssh\x120\n" +
	"\x03tcp\x18\x06 \x01(\v2\x1c.openshell.v1.TcpRelayTargetH\x00R\x03tcp\x125\n" +
	"\x13authorization_token\x18\a \x01(\tB\x04\x88\xb5\x18\x01R\x12authorizationTokenB\b\n" +
	"\x06target\"f\n" +
	"\x0fTcpForwardFrame\x122\n" +
	"\x04init\x18\x01 \x01(\v2\x1c.openshell.v1.TcpForwardInitH\x00R\x04init\x12\x14\n" +
	"\x04data\x18\x02 \x01(\fH\x00R\x04dataB\t\n" +
	"\apayload\"\xb0\x01\n" +
	"\x10ExecSandboxInput\x128\n" +
	"\x05start\x18\x01 \x01(\v2 .openshell.v1.ExecSandboxRequestH\x00R\x05start\x12\x16\n" +
	"\x05stdin\x18\x02 \x01(\fH\x00R\x05stdin\x12?\n" +
	"\x06resize\x18\x03 \x01(\v2%.openshell.v1.ExecSandboxWindowResizeH\x00R\x06resizeB\t\n" +
	"\apayload\"A\n" +
	"\x17ExecSandboxWindowResize\x12\x12\n" +
	"\x04cols\x18\x01 \x01(\rR\x04cols\x12\x12\n" +
	"\x04rows\x18\x02 \x01(\rR\x04rows\"\xfb\x01\n" +
	"\n" +
	"SshSession\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12\x1a\n" +
	"\x05token\x18\x03 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12C\n" +
	"\x0fexpiration_time\x18h \x01(\v2\x1a.google.protobuf.TimestampR\x0eexpirationTime\x12\x18\n" +
	"\arevoked\x18\x05 \x01(\bR\arevokedJ\x04\b\x04\x10\x05R\rexpires_at_ms\"\xf1\x03\n" +
	"\x13WatchSandboxRequest\x12R\n" +
	"\x0fworkspace_scope\x18\v \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12#\n" +
	"\rfollow_status\x18\x02 \x01(\bR\ffollowStatus\x12\x1f\n" +
	"\vfollow_logs\x18\x03 \x01(\bR\n" +
	"followLogs\x12#\n" +
	"\rfollow_events\x18\x04 \x01(\bR\ffollowEvents\x12$\n" +
	"\x0elog_tail_lines\x18\x05 \x01(\rR\flogTailLines\x12\x1d\n" +
	"\n" +
	"event_tail\x18\x06 \x01(\rR\teventTail\x12(\n" +
	"\x10stop_on_terminal\x18\a \x01(\bR\x0estopOnTerminal\x129\n" +
	"\n" +
	"since_time\x18l \x01(\v2\x1a.google.protobuf.TimestampR\tsinceTime\x12\x1f\n" +
	"\vlog_sources\x18\t \x03(\tR\n" +
	"logSources\x12\"\n" +
	"\rlog_min_level\x18\n" +
	" \x01(\tR\vlogMinLevelJ\x04\b\b\x10\tR\flog_since_ms\"\xcc\x02\n" +
	"\x12SandboxStreamEvent\x121\n" +
	"\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxH\x00R\asandbox\x120\n" +
	"\x03log\x18\x02 \x01(\v2\x1c.openshell.v1.SandboxLogLineH\x00R\x03log\x123\n" +
	"\x05event\x18\x03 \x01(\v2\x1b.openshell.v1.PlatformEventH\x00R\x05event\x12>\n" +
	"\awarning\x18\x04 \x01(\v2\".openshell.v1.SandboxStreamWarningH\x00R\awarning\x12Q\n" +
	"\x13draft_policy_update\x18\x05 \x01(\v2\x1f.openshell.v1.DraftPolicyUpdateH\x00R\x11draftPolicyUpdateB\t\n" +
	"\apayload\"\xdb\x02\n" +
	"\x0eSandboxLogLine\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x129\n" +
	"\n" +
	"event_time\x18f \x01(\v2\x1a.google.protobuf.TimestampR\teventTime\x12\x14\n" +
	"\x05level\x18\x03 \x01(\tR\x05level\x12\x16\n" +
	"\x06target\x18\x04 \x01(\tR\x06target\x12\x18\n" +
	"\amessage\x18\x05 \x01(\tR\amessage\x12\x16\n" +
	"\x06source\x18\x06 \x01(\tR\x06source\x12@\n" +
	"\x06fields\x18\a \x03(\v2(.openshell.v1.SandboxLogLine.FieldsEntryR\x06fields\x1a9\n" +
	"\vFieldsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\x02\x10\x03R\ftimestamp_ms\"0\n" +
	"\x14SandboxStreamWarning\x12\x18\n" +
	"\amessage\x18\x01 \x01(\tR\amessage\"\xc8\x01\n" +
	"\x15CreateProviderRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12<\n" +
	"\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\x12\x1d\n" +
	"\n" +
	"request_id\x18\x03 \x01(\tR\trequestId\"|\n" +
	"\x12GetProviderRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\"\xa6\x01\n" +
	"\x14ListProvidersRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1b\n" +
	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
	"\n" +
	"page_token\x18\x02 \x01(\tR\tpageToken\"\xa0\x04\n" +
	"\x15UpdateProviderRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12<\n" +
	"\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\x12\x82\x01\n" +
	"\x1bcredential_expiration_times\x18f \x03(\v2B.openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntryR\x19credentialExpirationTimes\x12G\n" +
	" clear_credential_expiration_keys\x18g \x03(\tR\x1dclearCredentialExpirationKeys\x12\x1d\n" +
	"\n" +
	"request_id\x18\x04 \x01(\tR\trequestId\x1ah\n" +
	"\x1eCredentialExpirationTimesEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x120\n" +
	"\x05value\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\x05value:\x028\x01J\x04\b\x02\x10\x03R\x18credential_expires_at_ms\"\xc3\x01\n" +
	"\x15DeleteProviderRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12#\n" +
	"\rallow_missing\x18\x04 \x01(\bR\fallowMissing\x12\x1d\n" +
	"\n" +
	"request_id\x18\x05 \x01(\tR\trequestId\"\xc1\x01\n" +
	"\x10ProviderResponse\x12<\n" +
	"\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\x12N\n" +
	"\x0ftarget_receipts\x18\x02 \x03(\v2%.openshell.v1.ProviderMutationReceiptR\x0etargetReceipts\x12\x1f\n" +
	"\vmutation_id\x18\x03 \x01(\tR\n" +
	"mutationId\"\x7f\n" +
	"\x15ListProvidersResponse\x12>\n" +
	"\tproviders\x18\x01 \x03(\v2 .openshell.datamodel.v1.ProviderR\tproviders\x12&\n" +
	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xad\x01\n" +
	"\x1bListProviderProfilesRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1b\n" +
	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
	"\n" +
	"page_token\x18\x02 \x01(\tR\tpageToken\"\x7f\n" +
	"\x19GetProviderProfileRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\"l\n" +
	"\x19ProviderProfileImportItem\x127\n" +
	"\aprofile\x18\x01 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\x12\x16\n" +
	"\x06source\x18\x02 \x01(\tR\x06source\"\x9e\x01\n" +
	"\x19ProviderProfileDiagnostic\x12\x16\n" +
	"\x06source\x18\x01 \x01(\tR\x06source\x12\x1d\n" +
	"\n" +
	"profile_id\x18\x02 \x01(\tR\tprofileId\x12\x14\n" +
	"\x05field\x18\x03 \x01(\tR\x05field\x12\x18\n" +
	"\amessage\x18\x04 \x01(\tR\amessage\x12\x1a\n" +
	"\bseverity\x18\x05 \x01(\tR\bseverity\"\x9e\x01\n" +
	",ProviderCredentialTokenGrantAudienceOverride\x12\x12\n" +
	"\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x02 \x01(\rR\x04port\x12\x12\n" +
	"\x04path\x18\x03 \x01(\tR\x04path\x12\x1a\n" +
	"\baudience\x18\x04 \x01(\tR\baudience\x12\x16\n" +
	"\x06scopes\x18\x05 \x03(\tR\x06scopes\"\x90\x01\n" +
	"(ProviderCredentialTokenGrantSubjectToken\x12\x16\n" +
	"\x06source\x18\x01 \x01(\tR\x06source\x12\x1e\n" +
	"\n" +
	"credential\x18\x02 \x01(\tR\n" +
	"credential\x12,\n" +
	"\x12subject_token_type\x18\x03 \x01(\tR\x10subjectTokenType\"\xf3\x04\n" +
	"\x1cProviderCredentialTokenGrant\x12%\n" +
	"\x0etoken_endpoint\x18\x01 \x01(\tR\rtokenEndpoint\x12\x1a\n" +
	"\baudience\x18\x02 \x01(\tR\baudience\x12*\n" +
	"\x11jwt_svid_audience\x18\x06 \x01(\tR\x0fjwtSvidAudience\x12\x16\n" +
	"\x06scopes\x18\x03 \x03(\tR\x06scopes\x126\n" +
	"\tcache_ttl\x18h \x01(\v2\x19.google.protobuf.DurationR\bcacheTtl\x12i\n" +
	"\x12audience_overrides\x18\x05 \x03(\v2:.openshell.v1.ProviderCredentialTokenGrantAudienceOverrideR\x11audienceOverrides\x122\n" +
	"\x15client_assertion_type\x18\a \x01(\tR\x13clientAssertionType\x12M\n" +
	"\n" +
	"grant_type\x18\b \x01(\x0e2..openshell.v1.ProviderCredentialTokenGrantTypeR\tgrantType\x12[\n" +
	"\rsubject_token\x18\t \x01(\v26.openshell.v1.ProviderCredentialTokenGrantSubjectTokenR\fsubjectToken\x120\n" +
	"\x14requested_token_type\x18\n" +
	" \x01(\tR\x12requestedTokenTypeJ\x04\b\x04\x10\x05R\x11cache_ttl_seconds\"\x9e\x03\n" +
	"\x19ProviderProfileCredential\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12 \n" +
	"\vdescription\x18\x02 \x01(\tR\vdescription\x12\x19\n" +
	"\benv_vars\x18\x03 \x03(\tR\aenvVars\x12\x1a\n" +
	"\brequired\x18\x04 \x01(\bR\brequired\x12\x1d\n" +
	"\n" +
	"auth_style\x18\x05 \x01(\tR\tauthStyle\x12\x1f\n" +
	"\vheader_name\x18\x06 \x01(\tR\n" +
	"headerName\x12\x1f\n" +
	"\vquery_param\x18\a \x01(\tR\n" +
	"queryParam\x12A\n" +
	"\arefresh\x18\b \x01(\v2'.openshell.v1.ProviderCredentialRefreshR\arefresh\x12#\n" +
	"\rpath_template\x18\t \x01(\tR\fpathTemplate\x12K\n" +
	"\vtoken_grant\x18\n" +
	" \x01(\v2*.openshell.v1.ProviderCredentialTokenGrantR\n" +
	"tokenGrant\"\x8d\x01\n" +
	"!ProviderCredentialRefreshMaterial\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12 \n" +
	"\vdescription\x18\x02 \x01(\tR\vdescription\x12\x1a\n" +
	"\brequired\x18\x03 \x01(\bR\brequired\x12\x16\n" +
	"\x06secret\x18\x04 \x01(\bR\x06secret\"Y\n" +
	"\x1fProviderCredentialRefreshOutput\x12\x16\n" +
	"\x06output\x18\x01 \x01(\tR\x06output\x12\x1e\n" +
	"\n" +
	"credential\x18\x02 \x01(\tR\n" +
	"credential\"\x82\x04\n" +
	"\x19ProviderCredentialRefresh\x12K\n" +
	"\bstrategy\x18\x01 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12\x1b\n" +
	"\ttoken_url\x18\x02 \x01(\tR\btokenUrl\x12\x16\n" +
	"\x06scopes\x18\x03 \x03(\tR\x06scopes\x12@\n" +
	"\x0erefresh_before\x18h \x01(\v2\x19.google.protobuf.DurationR\rrefreshBefore\x12<\n" +
	"\fmax_lifetime\x18i \x01(\v2\x19.google.protobuf.DurationR\vmaxLifetime\x12K\n" +
	"\bmaterial\x18\x06 \x03(\v2/.openshell.v1.ProviderCredentialRefreshMaterialR\bmaterial\x12\\\n" +
	"\x12additional_outputs\x18\a \x03(\v2-.openshell.v1.ProviderCredentialRefreshOutputR\x11additionalOutputsJ\x04\b\x04\x10\x05J\x04\b\x05\x10\x06R\x16refresh_before_secondsR\x14max_lifetime_seconds\"\xbc\x06\n" +
	"\x1fProviderCredentialRefreshStatus\x12\x1a\n" +
	"\bprovider\x18\x01 \x01(\tR\bprovider\x12\x1f\n" +
	"\vprovider_id\x18\x02 \x01(\tR\n" +
	"providerId\x12%\n" +
	"\x0ecredential_key\x18\x03 \x01(\tR\rcredentialKey\x12K\n" +
	"\bstrategy\x18\x04 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12\x16\n" +
	"\x06status\x18\x05 \x01(\tR\x06status\x12C\n" +
	"\x0fexpiration_time\x18j \x01(\v2\x1a.google.protobuf.TimestampR\x0eexpirationTime\x12F\n" +
	"\x11next_refresh_time\x18k \x01(\v2\x1a.google.protobuf.TimestampR\x0fnextRefreshTime\x12F\n" +
	"\x11last_refresh_time\x18l \x01(\v2\x1a.google.protobuf.TimestampR\x0flastRefreshTime\x12\x1d\n" +
	"\n" +
	"last_error\x18\t \x01(\tR\tlastError\x12^\n" +
	"\x0frecovery_action\x18\n" +
	" \x01(\x0e25.openshell.v1.ProviderCredentialRefreshRecoveryActionR\x0erecoveryAction\x12!\n" +
	"\ffailure_code\x18\v \x01(\tR\vfailureCode\x124\n" +
	"\x16provider_error_subtype\x18\f \x01(\tR\x14providerErrorSubtype\x12B\n" +
	"\x0flast_error_time\x18q \x01(\v2\x1a.google.protobuf.TimestampR\rlastErrorTimeJ\x04\b\x06\x10\aJ\x04\b\a\x10\bJ\x04\b\b\x10\tJ\x04\b\r\x10\x0eR\rexpires_at_msR\x12next_refresh_at_msR\x12last_refresh_at_msR\x10last_error_at_ms\"<\n" +
	"\x18ProviderProfileDiscovery\x12 \n" +
	"\vcredentials\x18\x01 \x03(\tR\vcredentials\"\xb8\x01\n" +
	"\x1fGetProviderRefreshStatusRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1a\n" +
	"\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" +
	"\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\"s\n" +
	" GetProviderRefreshStatusResponse\x12O\n" +
	"\vcredentials\x18\x01 \x03(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\vcredentials\"\xcc\x04\n" +
	"\x1fConfigureProviderRefreshRequest\x12R\n" +
	"\x0fworkspace_scope\x18\a \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1a\n" +
	"\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" +
	"\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12K\n" +
	"\bstrategy\x18\x03 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12]\n" +
	"\bmaterial\x18\x04 \x03(\v2;.openshell.v1.ConfigureProviderRefreshRequest.MaterialEntryB\x04\x88\xb5\x18\x01R\bmaterial\x120\n" +
	"\x14secret_material_keys\x18\x05 \x03(\tR\x12secretMaterialKeys\x12C\n" +
	"\x0fexpiration_time\x18j \x01(\v2\x1a.google.protobuf.TimestampR\x0eexpirationTime\x12\x1d\n" +
	"\n" +
	"request_id\x18\b \x01(\tR\trequestId\x1a;\n" +
	"\rMaterialEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\x06\x10\aR\rexpires_at_ms\"i\n" +
	" ConfigureProviderRefreshResponse\x12E\n" +
	"\x06status\x18\x01 \x01(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\x06status\"\xd7\x01\n" +
	"\x1fRotateProviderCredentialRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1a\n" +
	"\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" +
	"\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1d\n" +
	"\n" +
	"request_id\x18\x04 \x01(\tR\trequestId\"i\n" +
	" RotateProviderCredentialResponse\x12E\n" +
	"\x06status\x18\x01 \x01(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\x06status\"\xf9\x01\n" +
	"\x1cDeleteProviderRefreshRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1a\n" +
	"\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" +
	"\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12#\n" +
	"\rallow_missing\x18\x05 \x01(\bR\fallowMissing\x12\x1d\n" +
	"\n" +
	"request_id\x18\x06 \x01(\tR\trequestId\"g\n" +
	"\x1dDeleteProviderRefreshResponse\x127\n" +
	"\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\xd8\x05\n" +
	"\x0fProviderProfile\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12!\n" +
	"\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12 \n" +
	"\vdescription\x18\x03 \x01(\tR\vdescription\x12A\n" +
	"\bcategory\x18\x04 \x01(\x0e2%.openshell.v1.ProviderProfileCategoryR\bcategory\x12I\n" +
	"\vcredentials\x18\x05 \x03(\v2'.openshell.v1.ProviderProfileCredentialR\vcredentials\x12C\n" +
	"\tendpoints\x18\x06 \x03(\v2%.openshell.sandbox.v1.NetworkEndpointR\tendpoints\x12?\n" +
	"\bbinaries\x18\a \x03(\v2#.openshell.sandbox.v1.NetworkBinaryR\bbinaries\x12+\n" +
	"\x11inference_capable\x18\b \x01(\bR\x10inferenceCapable\x12D\n" +
	"\tdiscovery\x18\t \x01(\v2&.openshell.v1.ProviderProfileDiscoveryR\tdiscovery\x12)\n" +
	"\x10resource_version\x18\n" +
	" \x01(\x04R\x0fresourceVersion\x12P\n" +
	"\vannotations\x18\v \x03(\v2..openshell.v1.ProviderProfile.AnnotationsEntryR\vannotations\x12\x16\n" +
	"\x06source\x18\f \x01(\tR\x06source\x12\x14\n" +
	"\x05scope\x18\r \x01(\tR\x05scope\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"R\n" +
	"\x17ProviderProfileResponse\x127\n" +
	"\aprofile\x18\x01 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\"\x81\x01\n" +
	"\x1cListProviderProfilesResponse\x129\n" +
	"\bprofiles\x18\x01 \x03(\v2\x1d.openshell.v1.ProviderProfileR\bprofiles\x12&\n" +
	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xd7\x01\n" +
	"\x1dImportProviderProfilesRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12C\n" +
	"\bprofiles\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileImportItemR\bprofiles\x12\x1d\n" +
	"\n" +
	"request_id\x18\x03 \x01(\tR\trequestId\"\xc2\x01\n" +
	"\x1eImportProviderProfilesResponse\x12I\n" +
	"\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x129\n" +
	"\bprofiles\x18\x02 \x03(\v2\x1d.openshell.v1.ProviderProfileR\bprofiles\x12\x1a\n" +
	"\bimported\x18\x03 \x01(\bR\bimported\"\xa1\x02\n" +
	"\x1dUpdateProviderProfilesRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12A\n" +
	"\aprofile\x18\x01 \x01(\v2'.openshell.v1.ProviderProfileImportItemR\aprofile\x12:\n" +
	"\x19expected_resource_version\x18\x02 \x01(\x04R\x17expectedResourceVersion\x12\x0e\n" +
	"\x02id\x18\x03 \x01(\tR\x02id\x12\x1d\n" +
	"\n" +
	"request_id\x18\x05 \x01(\tR\trequestId\"\xbe\x01\n" +
	"\x1eUpdateProviderProfilesResponse\x12I\n" +
	"\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x127\n" +
	"\aprofile\x18\x02 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\x12\x18\n" +
	"\aupdated\x18\x03 \x01(\bR\aupdated\"\xb6\x01\n" +
	"\x1bLintProviderProfilesRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12C\n" +
	"\bprofiles\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileImportItemR\bprofiles\"\x7f\n" +
	"\x1cLintProviderProfilesResponse\x12I\n" +
	"\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x12\x14\n" +
	"\x05valid\x18\x02 \x01(\bR\x05valid\"`\n" +
	"\x16DeleteProviderResponse\x127\n" +
	"\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\xc6\x01\n" +
	"\x1cDeleteProviderProfileRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12#\n" +
	"\rallow_missing\x18\x03 \x01(\bR\fallowMissing\x12\x1d\n" +
	"\n" +
	"request_id\x18\x04 \x01(\tR\trequestId\"g\n" +
	"\x1dDeleteProviderProfileResponse\x127\n" +
	"\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\x94\x01\n" +
	"$GetSandboxProviderEnvironmentRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12M\n" +
	"#supports_static_credential_bindings\x18\x02 \x01(\bR supportsStaticCredentialBindings\"]\n" +
	"\x1fStaticCredentialEndpointBinding\x12\x12\n" +
	"\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x02 \x01(\rR\x04port\x12\x12\n" +
	"\x04path\x18\x03 \x01(\tR\x04path\"\xd5\x01\n" +
	"\x17StaticCredentialBinding\x12K\n" +
	"\tendpoints\x18\x01 \x03(\v2-.openshell.v1.StaticCredentialEndpointBindingR\tendpoints\x12/\n" +
	"\x13credential_identity\x18\x02 \x01(\tR\x12credentialIdentity\x12<\n" +
	"\x1aworkload_credential_handle\x18\x03 \x01(\tR\x18workloadCredentialHandle\"\x8a\n" +
	"\n" +
	"%GetSandboxProviderEnvironmentResponse\x12l\n" +
	"\venvironment\x18\x01 \x03(\v2D.openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntryB\x04\x88\xb5\x18\x01R\venvironment\x122\n" +
	"\x15provider_env_revision\x18\x02 \x01(\x04R\x13providerEnvRevision\x12\x92\x01\n" +
	"\x1bcredential_expiration_times\x18g \x03(\v2R.openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntryR\x19credentialExpirationTimes\x12|\n" +
	"\x13dynamic_credentials\x18\x04 \x03(\v2K.openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntryR\x12dynamicCredentials\x12\x8f\x01\n" +
	"\x1astatic_credential_bindings\x18\x05 \x03(\v2Q.openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntryR\x18staticCredentialBindings\x12=\n" +
	"\x1bnon_secret_environment_keys\x18\x06 \x03(\tR\x18nonSecretEnvironmentKeys\x12:\n" +
	"\x19provider_attachment_epoch\x18\a \x01(\tR\x17providerAttachmentEpoch\x12\x1f\n" +
	"\vpolicy_hash\x18\b \x01(\tR\n" +
	"policyHash\x12P\n" +
	"\x10readiness_reason\x18\t \x01(\x0e2%.openshell.v1.ProviderReadinessReasonR\x0freadinessReason\x1a>\n" +
	"\x10EnvironmentEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1ah\n" +
	"\x1eCredentialExpirationTimesEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x120\n" +
	"\x05value\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\x05value:\x028\x01\x1an\n" +
	"\x17DynamicCredentialsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12=\n" +
	"\x05value\x18\x02 \x01(\v2'.openshell.v1.ProviderProfileCredentialR\x05value:\x028\x01\x1ar\n" +
	"\x1dStaticCredentialBindingsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12;\n" +
	"\x05value\x18\x02 \x01(\v2%.openshell.v1.StaticCredentialBindingR\x05value:\x028\x01J\x04\b\x03\x10\x04R\x18credential_expires_at_ms\"\xbd\x01\n" +
	"#ExchangeProviderSubjectTokenRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1a\n" +
	"\bprovider\x18\x02 \x01(\tR\bprovider\x12%\n" +
	"\x0ecredential_key\x18\x03 \x01(\tR\rcredentialKey\x124\n" +
	"\x13supervisor_jwt_svid\x18\x04 \x01(\tB\x04\x88\xb5\x18\x01R\x11supervisorJwtSvid\"\xc0\x01\n" +
	"$ExchangeProviderSubjectTokenResponse\x12'\n" +
	"\faccess_token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\vaccessToken\x12>\n" +
	"\rexpires_after\x18f \x01(\v2\x19.google.protobuf.DurationR\fexpiresAfter\x12\x1d\n" +
	"\n" +
	"token_type\x18\x03 \x01(\tR\ttokenTypeJ\x04\b\x02\x10\x03R\n" +
	"expires_in\"\xa9\x05\n" +
	"\x13UpdateConfigRequest\x12R\n" +
	"\x0fworkspace_scope\x18\n" +
	" \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12;\n" +
	"\x06policy\x18\x02 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x1f\n" +
	"\vsetting_key\x18\x03 \x01(\tR\n" +
	"settingKey\x12G\n" +
	"\rsetting_value\x18\x04 \x01(\v2\".openshell.sandbox.v1.SettingValueR\fsettingValue\x12%\n" +
	"\x0edelete_setting\x18\x05 \x01(\bR\rdeleteSetting\x12\x16\n" +
	"\x06global\x18\x06 \x01(\bR\x06global\x12M\n" +
	"\x10merge_operations\x18\a \x03(\v2\".openshell.v1.PolicyMergeOperationR\x0fmergeOperations\x12:\n" +
	"\x19expected_resource_version\x18\b \x01(\x04R\x17expectedResourceVersion\x12T\n" +
	"\vannotations\x18\t \x03(\v22.openshell.v1.UpdateConfigRequest.AnnotationsEntryR\vannotations\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1d\n" +
	"\n" +
	"request_id\x18\v \x01(\tR\trequestId\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc7\x03\n" +
	"\x14PolicyMergeOperation\x129\n" +
	"\badd_rule\x18\x01 \x01(\v2\x1c.openshell.v1.AddNetworkRuleH\x00R\aaddRule\x12N\n" +
	"\x0fremove_endpoint\x18\x02 \x01(\v2#.openshell.v1.RemoveNetworkEndpointH\x00R\x0eremoveEndpoint\x12B\n" +
	"\vremove_rule\x18\x03 \x01(\v2\x1f.openshell.v1.RemoveNetworkRuleH\x00R\n" +
	"removeRule\x12B\n" +
	"\x0eadd_deny_rules\x18\x04 \x01(\v2\x1a.openshell.v1.AddDenyRulesH\x00R\faddDenyRules\x12E\n" +
	"\x0fadd_allow_rules\x18\x05 \x01(\v2\x1b.openshell.v1.AddAllowRulesH\x00R\raddAllowRules\x12H\n" +
	"\rremove_binary\x18\x06 \x01(\v2!.openshell.v1.RemoveNetworkBinaryH\x00R\fremoveBinaryB\v\n" +
	"\toperation\"j\n" +
	"\x0eAddNetworkRule\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\x12;\n" +
	"\x04rule\x18\x02 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\x04rule\"\\\n" +
	"\x15RemoveNetworkEndpoint\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\x12\x12\n" +
	"\x04host\x18\x02 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x03 \x01(\rR\x04port\"0\n" +
	"\x11RemoveNetworkRule\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\"\xd7\x01\n" +
	"\fL7RuleTarget\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\x12\x12\n" +
	"\x04host\x18\x02 \x01(\tR\x04host\x12\x14\n" +
	"\x05ports\x18\x03 \x03(\rR\x05ports\x12\x17\n" +
	"\x04path\x18\x04 \x01(\tH\x00R\x04path\x88\x01\x01\x12?\n" +
	"\bbinaries\x18\x05 \x03(\v2#.openshell.sandbox.v1.NetworkBinaryR\bbinaries\x12\x1d\n" +
	"\n" +
	"any_binary\x18\x06 \x01(\bR\tanyBinaryB\a\n" +
	"\x05_path\"\x9b\x01\n" +
	"\fAddDenyRules\x12?\n" +
	"\n" +
	"deny_rules\x18\x03 \x03(\v2 .openshell.sandbox.v1.L7DenyRuleR\tdenyRules\x122\n" +
	"\x06target\x18\x04 \x01(\v2\x1a.openshell.v1.L7RuleTargetR\x06targetJ\x04\b\x01\x10\x02J\x04\b\x02\x10\x03R\x04hostR\x04port\"\x8f\x01\n" +
	"\rAddAllowRules\x122\n" +
	"\x05rules\x18\x03 \x03(\v2\x1c.openshell.sandbox.v1.L7RuleR\x05rules\x122\n" +
	"\x06target\x18\x04 \x01(\v2\x1a.openshell.v1.L7RuleTargetR\x06targetJ\x04\b\x01\x10\x02J\x04\b\x02\x10\x03R\x04hostR\x04port\"S\n" +
	"\x13RemoveNetworkBinary\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\x12\x1f\n" +
	"\vbinary_path\x18\x02 \x01(\tR\n" +
	"binaryPath\"\xaf\x02\n" +
	"\x14UpdateConfigResponse\x12\x18\n" +
	"\aversion\x18\x01 \x01(\rR\aversion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\x12+\n" +
	"\x11settings_revision\x18\x03 \x01(\x04R\x10settingsRevision\x12\x18\n" +
	"\adeleted\x18\x04 \x01(\bR\adeleted\x12U\n" +
	"\vannotations\x18\x05 \x03(\v23.openshell.v1.UpdateConfigResponse.AnnotationsEntryR\vannotations\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xbf\x01\n" +
	"\x1dGetSandboxPolicyStatusRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\aversion\x18\x02 \x01(\rR\aversion\x12\x16\n" +
	"\x06global\x18\x03 \x01(\bR\x06global\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\"\x88\x01\n" +
	"\x1eGetSandboxPolicyStatusResponse\x12?\n" +
	"\brevision\x18\x01 \x01(\v2#.openshell.v1.SandboxPolicyRevisionR\brevision\x12%\n" +
	"\x0eactive_version\x18\x02 \x01(\rR\ractiveVersion\"\xde\x01\n" +
	"\x1aListSandboxPoliciesRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x05 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1b\n" +
	"\tpage_size\x18\x02 \x01(\x05R\bpageSize\x12\x1d\n" +
	"\n" +
	"page_token\x18\x03 \x01(\tR\tpageToken\x12\x16\n" +
	"\x06global\x18\x04 \x01(\bR\x06global\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\"\x88\x01\n" +
	"\x1bListSandboxPoliciesResponse\x12A\n" +
	"\trevisions\x18\x01 \x03(\v2#.openshell.v1.SandboxPolicyRevisionR\trevisions\x12&\n" +
	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xa7\x01\n" +
	"\x19ReportPolicyStatusRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x18\n" +
	"\aversion\x18\x02 \x01(\rR\aversion\x122\n" +
	"\x06status\x18\x03 \x01(\x0e2\x1a.openshell.v1.PolicyStatusR\x06status\x12\x1d\n" +
	"\n" +
	"load_error\x18\x04 \x01(\tR\tloadError\"\x1c\n" +
	"\x1aReportPolicyStatusResponse\"\xbc\x02\n" +
	"\x1dSandboxConfigurationAdmission\x12\x1f\n" +
	"\vinstance_id\x18\x01 \x01(\tR\n" +
	"instanceId\x12?\n" +
	"\x05state\x18\x02 \x01(\x0e2).openshell.v1.ConfigurationAdmissionStateR\x05state\x12%\n" +
	"\x0epolicy_version\x18\x03 \x01(\rR\rpolicyVersion\x12\x1f\n" +
	"\vpolicy_hash\x18\x04 \x01(\tR\n" +
	"policyHash\x12'\n" +
	"\x0fconfig_revision\x18\x05 \x01(\x04R\x0econfigRevision\x122\n" +
	"\x15provider_env_revision\x18\x06 \x01(\x04R\x13providerEnvRevision\x12\x14\n" +
	"\x05error\x18\a \x01(\tR\x05error\"\xbf\x01\n" +
	"!ReportSandboxConfigurationRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12I\n" +
	"\tadmission\x18\x02 \x01(\v2+.openshell.v1.SandboxConfigurationAdmissionR\tadmission\x120\n" +
	"\x14expected_instance_id\x18\x03 \x01(\tR\x12expectedInstanceId\"$\n" +
	"\"ReportSandboxConfigurationResponse\"\x9b\x04\n" +
	"\x15SandboxPolicyRevision\x12\x18\n" +
	"\aversion\x18\x01 \x01(\rR\aversion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\x122\n" +
	"\x06status\x18\x03 \x01(\x0e2\x1a.openshell.v1.PolicyStatusR\x06status\x12\x1d\n" +
	"\n" +
	"load_error\x18\x04 \x01(\tR\tloadError\x12=\n" +
	"\fcreated_time\x18i \x01(\v2\x1a.google.protobuf.TimestampR\vcreatedTime\x12;\n" +
	"\vloaded_time\x18j \x01(\v2\x1a.google.protobuf.TimestampR\n" +
	"loadedTime\x12;\n" +
	"\x06policy\x18\a \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12S\n" +
	"\n" +
	"provenance\x18\b \x03(\v23.openshell.v1.SandboxPolicyRevision.ProvenanceEntryR\n" +
	"provenance\x1a=\n" +
	"\x0fProvenanceEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\x05\x10\x06J\x04\b\x06\x10\aR\rcreated_at_msR\floaded_at_ms\"\x9d\x02\n" +
	"\x15GetSandboxLogsRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x06 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x14\n" +
	"\x05lines\x18\x02 \x01(\rR\x05lines\x129\n" +
	"\n" +
	"since_time\x18g \x01(\v2\x1a.google.protobuf.TimestampR\tsinceTime\x12\x18\n" +
	"\asources\x18\x04 \x03(\tR\asources\x12\x1b\n" +
	"\tmin_level\x18\x05 \x01(\tR\bminLevelJ\x04\b\x03\x10\x04R\bsince_ms\"i\n" +
	"\x16PushSandboxLogsRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x120\n" +
	"\x04logs\x18\x02 \x03(\v2\x1c.openshell.v1.SandboxLogLineR\x04logs\"\x19\n" +
	"\x17PushSandboxLogsResponse\"m\n" +
	"\x16GetSandboxLogsResponse\x120\n" +
	"\x04logs\x18\x01 \x03(\v2\x1c.openshell.v1.SandboxLogLineR\x04logs\x12!\n" +
	"\fbuffer_total\x18\x02 \x01(\rR\vbufferTotal\"\xa2\x02\n" +
	"\x11SupervisorMessage\x125\n" +
	"\x05hello\x18\x01 \x01(\v2\x1d.openshell.v1.SupervisorHelloH\x00R\x05hello\x12A\n" +
	"\theartbeat\x18\x02 \x01(\v2!.openshell.v1.SupervisorHeartbeatH\x00R\theartbeat\x12K\n" +
	"\x11relay_open_result\x18\x03 \x01(\v2\x1d.openshell.v1.RelayOpenResultH\x00R\x0frelayOpenResult\x12;\n" +
	"\vrelay_close\x18\x04 \x01(\v2\x18.openshell.v1.RelayCloseH\x00R\n" +
	"relayCloseB\t\n" +
	"\apayload\"\xea\x02\n" +
	"\x0eGatewayMessage\x12J\n" +
	"\x10session_accepted\x18\x01 \x01(\v2\x1d.openshell.v1.SessionAcceptedH\x00R\x0fsessionAccepted\x12J\n" +
	"\x10session_rejected\x18\x02 \x01(\v2\x1d.openshell.v1.SessionRejectedH\x00R\x0fsessionRejected\x12>\n" +
	"\theartbeat\x18\x03 \x01(\v2\x1e.openshell.v1.GatewayHeartbeatH\x00R\theartbeat\x128\n" +
	"\n" +
	"relay_open\x18\x04 \x01(\v2\x17.openshell.v1.RelayOpenH\x00R\trelayOpen\x12;\n" +
	"\vrelay_close\x18\x05 \x01(\v2\x18.openshell.v1.RelayCloseH\x00R\n" +
	"relayCloseB\t\n" +
	"\apayload\"\xbc\x01\n" +
	"\x0fSupervisorHello\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" +
	"\vinstance_id\x18\x02 \x01(\tR\n" +
	"instanceId\x12)\n" +
	"\x10connection_epoch\x18\x03 \x01(\x04R\x0fconnectionEpoch\x12>\n" +
	"\x1bsupports_provider_readiness\x18\x04 \x01(\bR\x19supportsProviderReadiness\"\x99\x01\n" +
	"\x0fSessionAccepted\x12\x1d\n" +
	"\n" +
	"session_id\x18\x01 \x01(\tR\tsessionId\x12H\n" +
	"\x12heartbeat_interval\x18f \x01(\v2\x19.google.protobuf.DurationR\x11heartbeatIntervalJ\x04\b\x02\x10\x03R\x17heartbeat_interval_secs\")\n" +
	"\x0fSessionRejected\x12\x16\n" +
	"\x06reason\x18\x01 \x01(\tR\x06reason\"\x15\n" +
	"\x13SupervisorHeartbeat\"\x12\n" +
	"\x10GatewayHeartbeat\"{\n" +
	"\x1cReportMainProcessExitRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" +
	"\vinstance_id\x18\x02 \x01(\tR\n" +
	"instanceId\x12\x1b\n" +
	"\texit_code\x18\x03 \x01(\x05R\bexitCode\"\x1f\n" +
	"\x1dReportMainProcessExitResponse\"`\n" +
	"\x1eFinalizeMainProcessExitRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" +
	"\vinstance_id\x18\x02 \x01(\tR\n" +
	"instanceId\"!\n" +
	"\x1fFinalizeMainProcessExitResponse\"\xb7\x01\n" +
	"\tRelayOpen\x12\x1d\n" +
	"\n" +
	"channel_id\x18\x01 \x01(\tR\tchannelId\x120\n" +
	"\x03ssh\x18\x02 \x01(\v2\x1c.openshell.v1.SshRelayTargetH\x00R\x03ssh\x120\n" +
	"\x03tcp\x18\x03 \x01(\v2\x1c.openshell.v1.TcpRelayTargetH\x00R\x03tcp\x12\x1d\n" +
	"\n" +
	"service_id\x18\x05 \x01(\tR\tserviceIdB\b\n" +
	"\x06target\"\x10\n" +
	"\x0eSshRelayTarget\"8\n" +
	"\x0eTcpRelayTarget\x12\x12\n" +
	"\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x02 \x01(\rR\x04port\"*\n" +
	"\tRelayInit\x12\x1d\n" +
	"\n" +
	"channel_id\x18\x01 \x01(\tR\tchannelId\"\\\n" +
	"\n" +
	"RelayFrame\x12-\n" +
	"\x04init\x18\x01 \x01(\v2\x17.openshell.v1.RelayInitH\x00R\x04init\x12\x14\n" +
	"\x04data\x18\x02 \x01(\fH\x00R\x04dataB\t\n" +
	"\apayload\"\x98\x01\n" +
	"\rPeerRelayInit\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x126\n" +
	"\n" +
	"relay_open\x18\x02 \x01(\v2\x17.openshell.v1.RelayOpenR\trelayOpen\x120\n" +
	"\x14requester_replica_id\x18\x03 \x01(\tR\x12requesterReplicaId\"d\n" +
	"\x0ePeerRelayFrame\x121\n" +
	"\x04init\x18\x01 \x01(\v2\x1b.openshell.v1.PeerRelayInitH\x00R\x04init\x12\x14\n" +
	"\x04data\x18\x02 \x01(\fH\x00R\x04dataB\t\n" +
	"\apayload\"`\n" +
	"\x0fRelayOpenResult\x12\x1d\n" +
	"\n" +
	"channel_id\x18\x01 \x01(\tR\tchannelId\x12\x18\n" +
	"\asuccess\x18\x02 \x01(\bR\asuccess\x12\x14\n" +
	"\x05error\x18\x03 \x01(\tR\x05error\"C\n" +
	"\n" +
	"RelayClose\x12\x1d\n" +
	"\n" +
	"channel_id\x18\x01 \x01(\tR\tchannelId\x12\x16\n" +
	"\x06reason\x18\x02 \x01(\tR\x06reason\"o\n" +
	"\x0fL7RequestSample\x12\x16\n" +
	"\x06method\x18\x01 \x01(\tR\x06method\x12\x12\n" +
	"\x04path\x18\x02 \x01(\tR\x04path\x12\x1a\n" +
	"\bdecision\x18\x03 \x01(\tR\bdecision\x12\x14\n" +
	"\x05count\x18\x04 \x01(\rR\x05count\"\xce\x05\n" +
	"\rDenialSummary\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x12\n" +
	"\x04host\x18\x02 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x03 \x01(\rR\x04port\x12\x16\n" +
	"\x06binary\x18\x04 \x01(\tR\x06binary\x12\x1c\n" +
	"\tancestors\x18\x05 \x03(\tR\tancestors\x12\x1f\n" +
	"\vdeny_reason\x18\x06 \x01(\tR\n" +
	"denyReason\x12B\n" +
	"\x0ffirst_seen_time\x18k \x01(\v2\x1a.google.protobuf.TimestampR\rfirstSeenTime\x12@\n" +
	"\x0elast_seen_time\x18l \x01(\v2\x1a.google.protobuf.TimestampR\flastSeenTime\x12\x14\n" +
	"\x05count\x18\t \x01(\rR\x05count\x12)\n" +
	"\x10suppressed_count\x18\n" +
	" \x01(\rR\x0fsuppressedCount\x12\x1f\n" +
	"\vtotal_count\x18\v \x01(\rR\n" +
	"totalCount\x12'\n" +
	"\x0fsample_cmdlines\x18\f \x03(\tR\x0esampleCmdlines\x12#\n" +
	"\rbinary_sha256\x18\r \x01(\tR\fbinarySha256\x12\x1e\n" +
	"\n" +
	"persistent\x18\x0e \x01(\bR\n" +
	"persistent\x12!\n" +
	"\fdenial_stage\x18\x0f \x01(\tR\vdenialStage\x12K\n" +
	"\x12l7_request_samples\x18\x10 \x03(\v2\x1d.openshell.v1.L7RequestSampleR\x10l7RequestSamples\x120\n" +
	"\x14l7_inspection_active\x18\x11 \x01(\bR\x12l7InspectionActiveJ\x04\b\a\x10\bJ\x04\b\b\x10\tR\rfirst_seen_msR\flast_seen_ms\"T\n" +
	"\x10DenialGroupCount\x12\x1d\n" +
	"\n" +
	"deny_group\x18\x01 \x01(\tR\tdenyGroup\x12!\n" +
	"\fdenied_count\x18\x02 \x01(\rR\vdeniedCount\"\xc8\x01\n" +
	"\x16NetworkActivitySummary\x124\n" +
	"\x16network_activity_count\x18\x01 \x01(\rR\x14networkActivityCount\x12.\n" +
	"\x13denied_action_count\x18\x02 \x01(\rR\x11deniedActionCount\x12H\n" +
	"\x10denials_by_group\x18\x03 \x03(\v2\x1e.openshell.v1.DenialGroupCountR\x0edenialsByGroup\"\xf9\t\n" +
	"\vPolicyChunk\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12\x16\n" +
	"\x06status\x18\x02 \x01(\tR\x06status\x12\x1b\n" +
	"\trule_name\x18\x03 \x01(\tR\bruleName\x12L\n" +
	"\rproposed_rule\x18\x04 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" +
	"\trationale\x18\x05 \x01(\tR\trationale\x12%\n" +
	"\x0esecurity_notes\x18\x06 \x01(\tR\rsecurityNotes\x12\x1e\n" +
	"\n" +
	"confidence\x18\a \x01(\x02R\n" +
	"confidence\x12,\n" +
	"\x12denial_summary_ids\x18\b \x03(\tR\x10denialSummaryIds\x12=\n" +
	"\fcreated_time\x18m \x01(\v2\x1a.google.protobuf.TimestampR\vcreatedTime\x12=\n" +
	"\fdecided_time\x18n \x01(\v2\x1a.google.protobuf.TimestampR\vdecidedTime\x12\x14\n" +
	"\x05stage\x18\v \x01(\tR\x05stage\x12.\n" +
	"\x13supersedes_chunk_id\x18\f \x01(\tR\x11supersedesChunkId\x12\x1b\n" +
	"\thit_count\x18\r \x01(\x05R\bhitCount\x12B\n" +
	"\x0ffirst_seen_time\x18r \x01(\v2\x1a.google.protobuf.TimestampR\rfirstSeenTime\x12@\n" +
	"\x0elast_seen_time\x18s \x01(\v2\x1a.google.protobuf.TimestampR\flastSeenTime\x12\x16\n" +
	"\x06binary\x18\x10 \x01(\tR\x06binary\x12+\n" +
	"\x11validation_result\x18\x11 \x01(\tR\x10validationResult\x12)\n" +
	"\x10rejection_reason\x18\x12 \x01(\tR\x0frejectionReason\x12+\n" +
	"\x11application_error\x18\x13 \x01(\tR\x10applicationError\x12!\n" +
	"\freview_token\x18\x14 \x01(\tR\vreviewToken\x12A\n" +
	"\x1dcurrent_effective_policy_hash\x18\x15 \x01(\tR\x1acurrentEffectivePolicyHash\x12E\n" +
	"\x1fcandidate_effective_policy_hash\x18\x16 \x01(\tR\x1ccandidateEffectivePolicyHash\x12]\n" +
	"\x18current_effective_policy\x18\x17 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x16currentEffectivePolicy\x12a\n" +
	"\x1acandidate_effective_policy\x18\x18 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x18candidateEffectivePolicyJ\x04\b\t\x10\n" +
	"J\x04\b\n" +
	"\x10\vJ\x04\b\x0e\x10\x0fJ\x04\b\x0f\x10\x10R\rcreated_at_msR\rdecided_at_msR\rfirst_seen_msR\flast_seen_ms\"\x96\x01\n" +
	"\x11DraftPolicyUpdate\x12#\n" +
	"\rdraft_version\x18\x01 \x01(\x04R\fdraftVersion\x12\x1d\n" +
	"\n" +
	"new_chunks\x18\x02 \x01(\rR\tnewChunks\x12#\n" +
	"\rtotal_pending\x18\x03 \x01(\rR\ftotalPending\x12\x18\n" +
	"\asummary\x18\x04 \x01(\tR\asummary\"\x8d\x03\n" +
	"\x1bSubmitPolicyAnalysisRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x06 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x129\n" +
	"\tsummaries\x18\x01 \x03(\v2\x1b.openshell.v1.DenialSummaryR\tsummaries\x12B\n" +
	"\x0fproposed_chunks\x18\x02 \x03(\v2\x19.openshell.v1.PolicyChunkR\x0eproposedChunks\x12#\n" +
	"\ranalysis_mode\x18\x03 \x01(\tR\fanalysisMode\x12\x12\n" +
	"\x04name\x18\x04 \x01(\tR\x04name\x12b\n" +
	"\x1anetwork_activity_summaries\x18\x05 \x03(\v2$.openshell.v1.NetworkActivitySummaryR\x18networkActivitySummaries\"\xcb\x01\n" +
	"\x1cSubmitPolicyAnalysisResponse\x12'\n" +
	"\x0faccepted_chunks\x18\x01 \x01(\rR\x0eacceptedChunks\x12'\n" +
	"\x0frejected_chunks\x18\x02 \x01(\rR\x0erejectedChunks\x12+\n" +
	"\x11rejection_reasons\x18\x03 \x03(\tR\x10rejectionReasons\x12,\n" +
	"\x12accepted_chunk_ids\x18\x04 \x03(\tR\x10acceptedChunkIds\"\xaa\x01\n" +
	"\x15GetDraftPolicyRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12#\n" +
	"\rstatus_filter\x18\x02 \x01(\tR\fstatusFilter\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\"\xfe\x01\n" +
	"\x16GetDraftPolicyResponse\x121\n" +
	"\x06chunks\x18\x01 \x03(\v2\x19.openshell.v1.PolicyChunkR\x06chunks\x12'\n" +
	"\x0frolling_summary\x18\x02 \x01(\tR\x0erollingSummary\x12#\n" +
	"\rdraft_version\x18\x03 \x01(\x04R\fdraftVersion\x12H\n" +
	"\x12last_analyzed_time\x18h \x01(\v2\x1a.google.protobuf.TimestampR\x10lastAnalyzedTimeJ\x04\b\x04\x10\x05R\x13last_analyzed_at_ms\"\xe5\x01\n" +
	"\x18ApproveDraftChunkRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x19\n" +
	"\bchunk_id\x18\x02 \x01(\tR\achunkId\x12!\n" +
	"\freview_token\x18\x04 \x01(\tR\vreviewToken\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1d\n" +
	"\n" +
	"request_id\x18\x05 \x01(\tR\trequestId\"c\n" +
	"\x19ApproveDraftChunkResponse\x12%\n" +
	"\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\"\xd9\x01\n" +
	"\x17RejectDraftChunkRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x19\n" +
	"\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x16\n" +
	"\x06reason\x18\x03 \x01(\tR\x06reason\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1d\n" +
	"\n" +
	"request_id\x18\x05 \x01(\tR\trequestId\"\x1a\n" +
	"\x18RejectDraftChunkResponse\"R\n" +
	"\x12DraftChunkApproval\x12\x19\n" +
	"\bchunk_id\x18\x01 \x01(\tR\achunkId\x12!\n" +
	"\freview_token\x18\x02 \x01(\tR\vreviewToken\"\xa5\x02\n" +
	"\x1cApproveAllDraftChunksRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x128\n" +
	"\x18include_security_flagged\x18\x02 \x01(\bR\x16includeSecurityFlagged\x12>\n" +
	"\tapprovals\x18\x03 \x03(\v2 .openshell.v1.DraftChunkApprovalR\tapprovals\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1d\n" +
	"\n" +
	"request_id\x18\x05 \x01(\tR\trequestId\"\xb7\x01\n" +
	"\x1dApproveAllDraftChunksResponse\x12%\n" +
	"\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\x12'\n" +
	"\x0fchunks_approved\x18\x03 \x01(\rR\x0echunksApproved\x12%\n" +
	"\x0echunks_skipped\x18\x04 \x01(\rR\rchunksSkipped\"\x8d\x02\n" +
	"\x15EditDraftChunkRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x04 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x19\n" +
	"\bchunk_id\x18\x02 \x01(\tR\achunkId\x12L\n" +
	"\rproposed_rule\x18\x03 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1d\n" +
	"\n" +
	"request_id\x18\x05 \x01(\tR\trequestId\"\x18\n" +
	"\x16EditDraftChunkResponse\"\xbf\x01\n" +
	"\x15UndoDraftChunkRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x03 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x19\n" +
	"\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1d\n" +
	"\n" +
	"request_id\x18\x04 \x01(\tR\trequestId\"`\n" +
	"\x16UndoDraftChunkResponse\x12%\n" +
	"\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\"\xa6\x01\n" +
	"\x17ClearDraftChunksRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x1d\n" +
	"\n" +
	"request_id\x18\x03 \x01(\tR\trequestId\"A\n" +
	"\x18ClearDraftChunksResponse\x12%\n" +
	"\x0echunks_cleared\x18\x01 \x01(\rR\rchunksCleared\"\x86\x01\n" +
	"\x16GetDraftHistoryRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x02 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\"\xbe\x01\n" +
	"\x11DraftHistoryEntry\x129\n" +
	"\n" +
	"event_time\x18e \x01(\v2\x1a.google.protobuf.TimestampR\teventTime\x12\x1d\n" +
	"\n" +
	"event_type\x18\x02 \x01(\tR\teventType\x12 \n" +
	"\vdescription\x18\x03 \x01(\tR\vdescription\x12\x19\n" +
	"\bchunk_id\x18\x04 \x01(\tR\achunkIdJ\x04\b\x01\x10\x02R\ftimestamp_ms\"T\n" +
	"\x17GetDraftHistoryResponse\x129\n" +
	"\aentries\x18\x01 \x03(\v2\x1f.openshell.v1.DraftHistoryEntryR\aentries\"\xd0\x01\n" +
	"\x16CreateWorkspaceRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12H\n" +
	"\x06labels\x18\x02 \x03(\v20.openshell.v1.CreateWorkspaceRequest.LabelsEntryR\x06labels\x12\x1d\n" +
	"\n" +
	"request_id\x18\x03 \x01(\tR\trequestId\x1a9\n" +
	"\vLabelsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"Z\n" +
	"\x17CreateWorkspaceResponse\x12?\n" +
	"\tworkspace\x18\x01 \x01(\v2!.openshell.datamodel.v1.WorkspaceR\tworkspace\")\n" +
	"\x13GetWorkspaceRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\"W\n" +
	"\x14GetWorkspaceResponse\x12?\n" +
	"\tworkspace\x18\x01 \x01(\v2!.openshell.datamodel.v1.WorkspaceR\tworkspace\"z\n" +
	"\x15ListWorkspacesRequest\x12\x1b\n" +
	"\tpage_size\x18\x01 \x01(\x05R\bpageSize\x12\x1d\n" +
	"\n" +
	"page_token\x18\x02 \x01(\tR\tpageToken\x12%\n" +
	"\x0elabel_selector\x18\x03 \x01(\tR\rlabelSelector\"\x83\x01\n" +
	"\x16ListWorkspacesResponse\x12A\n" +
	"\n" +
	"workspaces\x18\x01 \x03(\v2!.openshell.datamodel.v1.WorkspaceR\n" +
	"workspaces\x12&\n" +
	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"p\n" +
	"\x16DeleteWorkspaceRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12#\n" +
	"\rallow_missing\x18\x02 \x01(\bR\fallowMissing\x12\x1d\n" +
	"\n" +
	"request_id\x18\x03 \x01(\tR\trequestId\"a\n" +
	"\x17DeleteWorkspaceResponse\x127\n" +
	"\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\xaf\x01\n" +
	"\x0fWorkspaceMember\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12+\n" +
	"\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\x12/\n" +
	"\x04role\x18\x03 \x01(\x0e2\x1b.openshell.v1.WorkspaceRoleR\x04role\"\xec\x01\n" +
	"\x19AddWorkspaceMemberRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x01 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12+\n" +
	"\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\x12/\n" +
	"\x04role\x18\x03 \x01(\x0e2\x1b.openshell.v1.WorkspaceRoleR\x04role\x12\x1d\n" +
	"\n" +
	"request_id\x18\x04 \x01(\tR\trequestId\"S\n" +
	"\x1aAddWorkspaceMemberResponse\x125\n" +
	"\x06member\x18\x01 \x01(\v2\x1d.openshell.v1.WorkspaceMemberR\x06member\"\xe3\x01\n" +
	"\x1cRemoveWorkspaceMemberRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x01 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12+\n" +
	"\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\x12#\n" +
	"\rallow_missing\x18\x03 \x01(\bR\fallowMissing\x12\x1d\n" +
	"\n" +
	"request_id\x18\x04 \x01(\tR\trequestId\"g\n" +
	"\x1dRemoveWorkspaceMemberResponse\x127\n" +
	"\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\aremoved\"\xad\x01\n" +
	"\x1bListWorkspaceMembersRequest\x12R\n" +
	"\x0fworkspace_scope\x18\x01 \x01(\v2).openshell.datamodel.v1.WorkspaceSelectorR\x0eworkspaceScope\x12\x1b\n" +
	"\tpage_size\x18\x02 \x01(\x05R\bpageSize\x12\x1d\n" +
	"\n" +
	"page_token\x18\x03 \x01(\tR\tpageToken\"\x7f\n" +
	"\x1cListWorkspaceMembersResponse\x127\n" +
	"\amembers\x18\x01 \x03(\v2\x1d.openshell.v1.WorkspaceMemberR\amembers\x12&\n" +
	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xb5\x01\n" +
	"\x1aExtensionServiceCredential\x12!\n" +
	"\fservice_name\x18\x01 \x01(\tR\vserviceName\x12\x1a\n" +
	"\x05token\x18\x02 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12C\n" +
	"\x0fexpiration_time\x18g \x01(\v2\x1a.google.protobuf.TimestampR\x0eexpirationTimeJ\x04\b\x03\x10\x04R\rexpires_at_ms\"l\n" +
	"\x13EndpointObservation\x12\x1f\n" +
	"\vendpoint_id\x18\x01 \x01(\tR\n" +
	"endpointId\x124\n" +
	"\x06result\x18\x02 \x01(\x0e2\x1c.openshell.v1.EndpointResultR\x06result\"\xe9\x02\n" +
	"\x1bReportEndpointStatusRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\x122\n" +
	"\x15provider_env_revision\x18\x03 \x01(\x04R\x13providerEnvRevision\x12E\n" +
	"\fobservations\x18\x04 \x03(\v2!.openshell.v1.EndpointObservationR\fobservations\x122\n" +
	"\x15observed_endpoint_ids\x18\x05 \x03(\tR\x13observedEndpointIds\x122\n" +
	"\x15supervisor_session_id\x18\x06 \x01(\tR\x13supervisorSessionId\x12'\n" +
	"\x0freport_sequence\x18\a \x01(\x04R\x0ereportSequence\"\x1e\n" +
	"\x1cReportEndpointStatusResponse\"\x90\x02\n" +
	"\x0eEndpointStatus\x12\x1f\n" +
	"\vendpoint_id\x18\x01 \x01(\tR\n" +
	"endpointId\x12\x12\n" +
	"\x04host\x18\x02 \x01(\tR\x04host\x12\x14\n" +
	"\x05ports\x18\x03 \x03(\rR\x05ports\x12\x12\n" +
	"\x04path\x18\x04 \x01(\tR\x04path\x12=\n" +
	"\vlast_result\x18\x05 \x01(\x0e2\x1c.openshell.v1.EndpointResultR\n" +
	"lastResult\x12H\n" +
	"\x12last_reported_time\x18j \x01(\v2\x1a.google.protobuf.TimestampR\x10lastReportedTimeJ\x04\b\x06\x10\aR\x10last_reported_at\"\xce\x05\n" +
	"\x13SandboxProvisioning\x12\x1d\n" +
	"\n" +
	"attempt_id\x18\x01 \x01(\tR\tattemptId\x126\n" +
	"\x17configuration_change_id\x18\x02 \x01(\tR\x15configurationChangeId\x12V\n" +
	"\x19configuration_change_time\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\x17configurationChangeTime\x12L\n" +
	"\x14first_rejection_time\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\x12firstRejectionTime\x126\n" +
	"\bdeadline\x18\x05 \x01(\v2\x1a.google.protobuf.TimestampR\bdeadline\x12=\n" +
	"\ftimeout_time\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\vtimeoutTime\x12P\n" +
	"\x16cleanup_completed_time\x18\a \x01(\v2\x1a.google.protobuf.TimestampR\x14cleanupCompletedTime\x12#\n" +
	"\rcleanup_error\x18\b \x01(\tR\fcleanupError\x12H\n" +
	"\x12cleanup_retry_time\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\x10cleanupRetryTime\x120\n" +
	"\x14attachment_change_id\x18\n" +
	" \x01(\tR\x12attachmentChangeId\x12P\n" +
	"\x16attachment_change_time\x18\v \x01(\v2\x1a.google.protobuf.TimestampR\x14attachmentChangeTime\"S\n" +
	"\x16SandboxServiceExposure\x12\x18\n" +
	"\aservice\x18\x01 \x01(\tR\aservice\x12\x1f\n" +
	"\vtarget_port\x18\x02 \x01(\rR\n" +
	"targetPort*\xca\x01\n" +
	"\rExtensionKind\x12\x1e\n" +
	"\x1aEXTENSION_KIND_UNSPECIFIED\x10\x00\x12!\n" +
	"\x1dEXTENSION_KIND_COMPUTE_DRIVER\x10\x01\x12$\n" +
	" EXTENSION_KIND_CREDENTIAL_DRIVER\x10\x02\x12&\n" +
	"\"EXTENSION_KIND_GATEWAY_INTERCEPTOR\x10\x03\x12(\n" +
	"$EXTENSION_KIND_SUPERVISOR_MIDDLEWARE\x10\x04*\xa6\x02\n" +
	"\fSandboxPhase\x12\x1d\n" +
	"\x19SANDBOX_PHASE_UNSPECIFIED\x10\x00\x12\x1e\n" +
	"\x1aSANDBOX_PHASE_PROVISIONING\x10\x01\x12\x17\n" +
	"\x13SANDBOX_PHASE_READY\x10\x02\x12\x17\n" +
	"\x13SANDBOX_PHASE_ERROR\x10\x03\x12\x1a\n" +
	"\x16SANDBOX_PHASE_DELETING\x10\x04\x12\x19\n" +
	"\x15SANDBOX_PHASE_UNKNOWN\x10\x05\x12\x1a\n" +
	"\x16SANDBOX_PHASE_STOPPING\x10\x06\x12\x19\n" +
	"\x15SANDBOX_PHASE_STOPPED\x10\a\x12\x1a\n" +
	"\x16SANDBOX_PHASE_STARTING\x10\b\x12\x1b\n" +
	"\x17SANDBOX_PHASE_COMPLETED\x10\t*\xcb\x01\n" +
	"\x14ProviderMutationKind\x12&\n" +
	"\"PROVIDER_MUTATION_KIND_UNSPECIFIED\x10\x00\x12!\n" +
	"\x1dPROVIDER_MUTATION_KIND_ATTACH\x10\x01\x12!\n" +
	"\x1dPROVIDER_MUTATION_KIND_DETACH\x10\x02\x12!\n" +
	"\x1dPROVIDER_MUTATION_KIND_UPDATE\x10\x03\x12\"\n" +
	"\x1ePROVIDER_MUTATION_KIND_OBSERVE\x10\x04*\xcf\x02\n" +
	"\x16ProviderReadinessState\x12(\n" +
	"$PROVIDER_READINESS_STATE_UNSPECIFIED\x10\x00\x12&\n" +
	"\"PROVIDER_READINESS_STATE_PERSISTED\x10\x01\x12$\n" +
	" PROVIDER_READINESS_STATE_PENDING\x10\x02\x12\"\n" +
	"\x1ePROVIDER_READINESS_STATE_READY\x10\x03\x12%\n" +
	"!PROVIDER_READINESS_STATE_WITHHELD\x10\x04\x12$\n" +
	" PROVIDER_READINESS_STATE_REVOKED\x10\x05\x12#\n" +
	"\x1fPROVIDER_READINESS_STATE_FAILED\x10\x06\x12'\n" +
	"#PROVIDER_READINESS_STATE_SUPERSEDED\x10\a*\xda\x06\n" +
	"\x17ProviderReadinessReason\x12)\n" +
	"%PROVIDER_READINESS_REASON_UNSPECIFIED\x10\x00\x124\n" +
	"0PROVIDER_READINESS_REASON_WAITING_FOR_SUPERVISOR\x10\x01\x125\n" +
	"1PROVIDER_READINESS_REASON_WAITING_FOR_CREDENTIALS\x10\x02\x120\n" +
	",PROVIDER_READINESS_REASON_WAITING_FOR_POLICY\x10\x03\x121\n" +
	"-PROVIDER_READINESS_REASON_WAITING_FOR_PROCESS\x10\x04\x124\n" +
	"0PROVIDER_READINESS_REASON_UNSUPPORTED_SUPERVISOR\x10\x05\x122\n" +
	".PROVIDER_READINESS_REASON_CREDENTIALS_WITHHELD\x10\x06\x127\n" +
	"3PROVIDER_READINESS_REASON_CREDENTIAL_INSTALL_FAILED\x10\a\x126\n" +
	"2PROVIDER_READINESS_REASON_POLICY_ACTIVATION_FAILED\x10\b\x124\n" +
	"0PROVIDER_READINESS_REASON_PROCESS_INSTALL_FAILED\x10\t\x125\n" +
	"1PROVIDER_READINESS_REASON_SUPERVISOR_DISCONNECTED\x10\n" +
	"\x126\n" +
	"2PROVIDER_READINESS_REASON_SUPERVISOR_LEASE_EXPIRED\x10\v\x123\n" +
	"/PROVIDER_READINESS_REASON_DESIRED_STATE_CHANGED\x10\f\x120\n" +
	",PROVIDER_READINESS_REASON_CREDENTIAL_EXPIRED\x10\r\x12*\n" +
	"&PROVIDER_READINESS_REASON_LOCAL_POLICY\x10\x0e\x12/\n" +
	"+PROVIDER_READINESS_REASON_SNAPSHOT_MISMATCH\x10\x0f*\x83\x01\n" +
	"\x0fConfigComponent\x12 \n" +
	"\x1cCONFIG_COMPONENT_UNSPECIFIED\x10\x00\x12#\n" +
	"\x1fCONFIG_COMPONENT_SANDBOX_CONFIG\x10\x01\x12)\n" +
	"%CONFIG_COMPONENT_PROVIDER_ENVIRONMENT\x10\x02*\x8d\x03\n" +
	"\x12ConfigApplyOutcome\x12$\n" +
	" CONFIG_APPLY_OUTCOME_UNSPECIFIED\x10\x00\x12 \n" +
	"\x1cCONFIG_APPLY_OUTCOME_APPLIED\x10\x01\x12*\n" +
	"&CONFIG_APPLY_OUTCOME_IGNORED_DUPLICATE\x10\x02\x12&\n" +
	"\"CONFIG_APPLY_OUTCOME_IGNORED_STALE\x10\x03\x120\n" +
	",CONFIG_APPLY_OUTCOME_RETAINED_LOCAL_OVERRIDE\x10\x04\x12!\n" +
	"\x1dCONFIG_APPLY_OUTCOME_DEGRADED\x10\x05\x128\n" +
	"4CONFIG_APPLY_OUTCOME_FAILED_RETAINED_LAST_KNOWN_GOOD\x10\x06\x12&\n" +
	"\"CONFIG_APPLY_OUTCOME_FAILED_CLOSED\x10\a\x12$\n" +
	" CONFIG_APPLY_OUTCOME_UNSUPPORTED\x10\b*\xd2\x02\n" +
	"\x1aConfigUpdateOperationState\x12-\n" +
	")CONFIG_UPDATE_OPERATION_STATE_UNSPECIFIED\x10\x00\x12)\n" +
	"%CONFIG_UPDATE_OPERATION_STATE_PENDING\x10\x01\x12)\n" +
	"%CONFIG_UPDATE_OPERATION_STATE_APPLIED\x10\x02\x12*\n" +
	"&CONFIG_UPDATE_OPERATION_STATE_INACTIVE\x10\x03\x12(\n" +
	"$CONFIG_UPDATE_OPERATION_STATE_FAILED\x10\x04\x12,\n" +
	"(CONFIG_UPDATE_OPERATION_STATE_SUPERSEDED\x10\x05\x12+\n" +
	"'CONFIG_UPDATE_OPERATION_STATE_CANCELLED\x10\x06*\xce\x01\n" +
	" ProviderCredentialTokenGrantType\x124\n" +
	"0PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_UNSPECIFIED\x10\x00\x12;\n" +
	"7PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_CLIENT_CREDENTIALS\x10\x01\x127\n" +
	"3PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_TOKEN_EXCHANGE\x10\x02*\xc3\x03\n" +
	"!ProviderCredentialRefreshStrategy\x124\n" +
	"0PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED\x10\x00\x12/\n" +
	"+PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC\x10\x01\x121\n" +
	"-PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL\x10\x02\x12=\n" +
	"9PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN\x10\x03\x12B\n" +
	">PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS\x10\x04\x12C\n" +
	"?PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT\x10\x05\x12<\n" +
	"8PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE\x10\x06*\xdb\x02\n" +
	"\x17ProviderProfileCategory\x12)\n" +
	"%PROVIDER_PROFILE_CATEGORY_UNSPECIFIED\x10\x00\x12#\n" +
	"\x1fPROVIDER_PROFILE_CATEGORY_OTHER\x10\x01\x12'\n" +
	"#PROVIDER_PROFILE_CATEGORY_INFERENCE\x10\x02\x12#\n" +
	"\x1fPROVIDER_PROFILE_CATEGORY_AGENT\x10\x03\x12,\n" +
	"(PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL\x10\x04\x12'\n" +
	"#PROVIDER_PROFILE_CATEGORY_MESSAGING\x10\x05\x12\"\n" +
	"\x1ePROVIDER_PROFILE_CATEGORY_DATA\x10\x06\x12'\n" +
	"#PROVIDER_PROFILE_CATEGORY_KNOWLEDGE\x10\a*\xcf\x01\n" +
	"\x1bConfigurationAdmissionState\x12-\n" +
	")CONFIGURATION_ADMISSION_STATE_UNSPECIFIED\x10\x00\x12)\n" +
	"%CONFIGURATION_ADMISSION_STATE_PENDING\x10\x01\x12*\n" +
	"&CONFIGURATION_ADMISSION_STATE_ACCEPTED\x10\x02\x12*\n" +
	"&CONFIGURATION_ADMISSION_STATE_REJECTED\x10\x03*\x9a\x01\n" +
	"\fPolicyStatus\x12\x1d\n" +
	"\x19POLICY_STATUS_UNSPECIFIED\x10\x00\x12\x19\n" +
	"\x15POLICY_STATUS_PENDING\x10\x01\x12\x18\n" +
	"\x14POLICY_STATUS_LOADED\x10\x02\x12\x18\n" +
	"\x14POLICY_STATUS_FAILED\x10\x03\x12\x1c\n" +
	"\x18POLICY_STATUS_SUPERSEDED\x10\x04*\x86\x01\n" +
	"\rServiceStatus\x12\x1e\n" +
	"\x1aSERVICE_STATUS_UNSPECIFIED\x10\x00\x12\x1a\n" +
	"\x16SERVICE_STATUS_HEALTHY\x10\x01\x12\x1b\n" +
	"\x17SERVICE_STATUS_DEGRADED\x10\x02\x12\x1c\n" +
	"\x18SERVICE_STATUS_UNHEALTHY\x10\x03*b\n" +
	"\rWorkspaceRole\x12\x1e\n" +
	"\x1aWORKSPACE_ROLE_UNSPECIFIED\x10\x00\x12\x17\n" +
	"\x13WORKSPACE_ROLE_USER\x10\x01\x12\x18\n" +
	"\x14WORKSPACE_ROLE_ADMIN\x10\x02*\xda\x02\n" +
	"'ProviderCredentialRefreshRecoveryAction\x12;\n" +
	"7PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_UNSPECIFIED\x10\x00\x125\n" +
	"1PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_RETRY\x10\x01\x12;\n" +
	"7PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_REAUTHORIZE\x10\x02\x12A\n" +
	"=PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_FIX_CONFIGURATION\x10\x03\x12;\n" +
	"7PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_INVESTIGATE\x10\x04*\x97\x01\n" +
	"\x0fDeletionOutcome\x12 \n" +
	"\x1cDELETION_OUTCOME_UNSPECIFIED\x10\x00\x12\x1e\n" +
	"\x1aDELETION_OUTCOME_COMPLETED\x10\x01\x12\x1d\n" +
	"\x19DELETION_OUTCOME_ACCEPTED\x10\x02\x12#\n" +
	"\x1fDELETION_OUTCOME_ALREADY_ABSENT\x10\x03*\xc3\x02\n" +
	"\x0eEndpointResult\x12\x1f\n" +
	"\x1bENDPOINT_RESULT_UNSPECIFIED\x10\x00\x12(\n" +
	"$ENDPOINT_RESULT_NO_OBSERVED_EXCHANGE\x10\x01\x12*\n" +
	"&ENDPOINT_RESULT_HTTP_RESPONSE_RECEIVED\x10\x02\x12!\n" +
	"\x1dENDPOINT_RESULT_POLICY_DENIED\x10\x03\x12*\n" +
	"&ENDPOINT_RESULT_CREDENTIAL_UNAVAILABLE\x10\x04\x12\x1e\n" +
	"\x1aENDPOINT_RESULT_TLS_FAILED\x10\x05\x12$\n" +
	" ENDPOINT_RESULT_TRANSPORT_FAILED\x10\x06\x12%\n" +
	"!ENDPOINT_RESULT_UPSTREAM_REJECTED\x10\a2\xafU\n" +
	"\tOpenShell\x12Z\n" +
	"\x06Health\x12\x1b.openshell.v1.HealthRequest\x1a\x1c.openshell.v1.HealthResponse\"\x15\x82\xb5\x18\x11\n" +
	"\x0funauthenticated\x12i\n" +
	"\x0eGetCurrentUser\x12#.openshell.v1.GetCurrentUserRequest\x1a$.openshell.v1.GetCurrentUserResponse\"\f\x82\xb5\x18\b\n" +
	"\x06bearer\x12\x86\x01\n" +
	"\x0eGetGatewayInfo\x12#.openshell.v1.GetGatewayInfoRequest\x1a$.openshell.v1.GetGatewayInfoResponse\")\x82\xb5\x18%\n" +
	"\x06bearer\x1a\x0eplatform_admin\"\vconfig:read\x12u\n" +
	"\rCreateSandbox\x12\".openshell.v1.CreateSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12\x93\x01\n" +
	"\x15BeginRootfsTarStaging\x12*.openshell.v1.BeginRootfsTarStagingRequest\x1a+.openshell.v1.BeginRootfsTarStagingResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12n\n" +
	"\n" +
	"GetSandbox\x12\x1f.openshell.v1.GetSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12z\n" +
	"\rListSandboxes\x12\".openshell.v1.ListSandboxesRequest\x1a#.openshell.v1.ListSandboxesResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12\x8e\x01\n" +
	"\x15CreateSandboxTemplate\x12*.openshell.v1.CreateSandboxTemplateRequest\x1a%.openshell.v1.SandboxTemplateResponse\"\"\x82\xb5\x18\x1e\n" +
	"\x06bearer\x12\x05admin\"\rsandbox:write\x12\x86\x01\n" +
	"\x12GetSandboxTemplate\x12'.openshell.v1.GetSandboxTemplateRequest\x1a%.openshell.v1.SandboxTemplateResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12\x8f\x01\n" +
	"\x14ListSandboxTemplates\x12).openshell.v1.ListSandboxTemplatesRequest\x1a*.openshell.v1.ListSandboxTemplatesResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12\x94\x01\n" +
	"\x15DeleteSandboxTemplate\x12*.openshell.v1.DeleteSandboxTemplateRequest\x1a+.openshell.v1.DeleteSandboxTemplateResponse\"\"\x82\xb5\x18\x1e\n" +
	"\x06bearer\x12\x05admin\"\rsandbox:write\x12\x8f\x01\n" +
	"\x14ListSandboxProviders\x12).openshell.v1.ListSandboxProvidersRequest\x1a*.openshell.v1.ListSandboxProvidersResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12\x93\x01\n" +
	"\x15AttachSandboxProvider\x12*.openshell.v1.AttachSandboxProviderRequest\x1a+.openshell.v1.AttachSandboxProviderResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12\x93\x01\n" +
	"\x15DetachSandboxProvider\x12*.openshell.v1.DetachSandboxProviderRequest\x1a+.openshell.v1.DetachSandboxProviderResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12\x9b\x01\n" +
	"\x18GetSandboxProviderStatus\x12-.openshell.v1.GetSandboxProviderStatusRequest\x1a..openshell.v1.GetSandboxProviderStatusResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12{\n" +
	"\rDeleteSandbox\x12\".openshell.v1.DeleteSandboxRequest\x1a#.openshell.v1.DeleteSandboxResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12q\n" +
	"\vStopSandbox\x12 .openshell.v1.StopSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12s\n" +
	"\fStartSandbox\x12!.openshell.v1.StartSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12\x84\x01\n" +
	"\x10CreateSshSession\x12%.openshell.v1.CreateSshSessionRequest\x1a&.openshell.v1.CreateSshSessionResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12}\n" +
	"\rExposeService\x12\".openshell.v1.ExposeServiceRequest\x1a%.openshell.v1.ServiceEndpointResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12v\n" +
	"\n" +
	"GetService\x12\x1f.openshell.v1.GetServiceRequest\x1a%.openshell.v1.ServiceEndpointResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12w\n" +
	"\fListServices\x12!.openshell.v1.ListServicesRequest\x1a\".openshell.v1.ListServicesResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12{\n" +
	"\rDeleteService\x12\".openshell.v1.DeleteServiceRequest\x1a#.openshell.v1.DeleteServiceResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12\x84\x01\n" +
	"\x10RevokeSshSession\x12%.openshell.v1.RevokeSshSessionRequest\x1a&.openshell.v1.RevokeSshSessionResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12t\n" +
	"\vExecSandbox\x12 .openshell.v1.ExecSandboxRequest\x1a\x1e.openshell.v1.ExecSandboxEvent\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write0\x01\x12q\n" +
	"\n" +
	"ForwardTcp\x12\x1d.openshell.v1.TcpForwardFrame\x1a\x1d.openshell.v1.TcpForwardFrame\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write(\x010\x01\x12\x7f\n" +
	"\x16ExecSandboxInteractive\x12\x1e.openshell.v1.ExecSandboxInput\x1a\x1e.openshell.v1.ExecSandboxEvent\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write(\x010\x01\x12z\n" +
	"\x0eCreateProvider\x12#.openshell.v1.CreateProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12r\n" +
	"\vGetProvider\x12 .openshell.v1.GetProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12{\n" +
	"\rListProviders\x12\".openshell.v1.ListProvidersRequest\x1a#.openshell.v1.ListProvidersResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12\x90\x01\n" +
	"\x14ListProviderProfiles\x12).openshell.v1.ListProviderProfilesRequest\x1a*.openshell.v1.ListProviderProfilesResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12\x87\x01\n" +
	"\x12GetProviderProfile\x12'.openshell.v1.GetProviderProfileRequest\x1a%.openshell.v1.ProviderProfileResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12\x98\x01\n" +
	"\x16ImportProviderProfiles\x12+.openshell.v1.ImportProviderProfilesRequest\x1a,.openshell.v1.ImportProviderProfilesResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x98\x01\n" +
	"\x16UpdateProviderProfiles\x12+.openshell.v1.UpdateProviderProfilesRequest\x1a,.openshell.v1.UpdateProviderProfilesResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x90\x01\n" +
	"\x14LintProviderProfiles\x12).openshell.v1.LintProviderProfilesRequest\x1a*.openshell.v1.LintProviderProfilesResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12z\n" +
	"\x0eUpdateProvider\x12#.openshell.v1.UpdateProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x9c\x01\n" +
	"\x18GetProviderRefreshStatus\x12-.openshell.v1.GetProviderRefreshStatusRequest\x1a..openshell.v1.GetProviderRefreshStatusResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12\x9e\x01\n" +
	"\x18ConfigureProviderRefresh\x12-.openshell.v1.ConfigureProviderRefreshRequest\x1a..openshell.v1.ConfigureProviderRefreshResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x9e\x01\n" +
	"\x18RotateProviderCredential\x12-.openshell.v1.RotateProviderCredentialRequest\x1a..openshell.v1.RotateProviderCredentialResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x95\x01\n" +
	"\x15DeleteProviderRefresh\x12*.openshell.v1.DeleteProviderRefreshRequest\x1a+.openshell.v1.DeleteProviderRefreshResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x80\x01\n" +
	"\x0eDeleteProvider\x12#.openshell.v1.DeleteProviderRequest\x1a$.openshell.v1.DeleteProviderResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x95\x01\n" +
	"\x15DeleteProviderProfile\x12*.openshell.v1.DeleteProviderProfileRequest\x1a+.openshell.v1.DeleteProviderProfileResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x90\x01\n" +
	"\x10GetSandboxConfig\x12-.openshell.sandbox.v1.GetSandboxConfigRequest\x1a..openshell.sandbox.v1.GetSandboxConfigResponse\"\x1d\x82\xb5\x18\x19\n" +
	"\x04dual\x12\x04user\"\vconfig:read\x12\x8c\x01\n" +
	"\x10GetGatewayConfig\x12-.openshell.sandbox.v1.GetGatewayConfigRequest\x1a..openshell.sandbox.v1.GetGatewayConfigResponse\"\x19\x82\xb5\x18\x15\n" +
	"\x06bearer\"\vconfig:read\x12v\n" +
	"\fUpdateConfig\x12!.openshell.v1.UpdateConfigRequest\x1a\".openshell.v1.UpdateConfigResponse\"\x1f\x82\xb5\x18\x1b\n" +
	"\x04dual\x12\x05admin\"\fconfig:write\x12\x95\x01\n" +
	"\x16GetSandboxPolicyStatus\x12+.openshell.v1.GetSandboxPolicyStatusRequest\x1a,.openshell.v1.GetSandboxPolicyStatusResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12\x8c\x01\n" +
	"\x13ListSandboxPolicies\x12(.openshell.v1.ListSandboxPoliciesRequest\x1a).openshell.v1.ListSandboxPoliciesResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12v\n" +
	"\x12ReportPolicyStatus\x12'.openshell.v1.ReportPolicyStatusRequest\x1a(.openshell.v1.ReportPolicyStatusResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12|\n" +
	"\x14ReportEndpointStatus\x12).openshell.v1.ReportEndpointStatusRequest\x1a*.openshell.v1.ReportEndpointStatusResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12\x85\x01\n" +
	"\x17ReportProviderReadiness\x12,.openshell.v1.ReportProviderReadinessRequest\x1a-.openshell.v1.ReportProviderReadinessResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12\x8e\x01\n" +
	"\x1aReportSandboxConfiguration\x12/.openshell.v1.ReportSandboxConfigurationRequest\x1a0.openshell.v1.ReportSandboxConfigurationResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12\x97\x01\n" +
	"\x1dGetSandboxProviderEnvironment\x122.openshell.v1.GetSandboxProviderEnvironmentRequest\x1a3.openshell.v1.GetSandboxProviderEnvironmentResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12\x94\x01\n" +
	"\x1cExchangeProviderSubjectToken\x121.openshell.v1.ExchangeProviderSubjectTokenRequest\x1a2.openshell.v1.ExchangeProviderSubjectTokenResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12}\n" +
	"\x0eGetSandboxLogs\x12#.openshell.v1.GetSandboxLogsRequest\x1a$.openshell.v1.GetSandboxLogsResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12o\n" +
	"\x0fPushSandboxLogs\x12$.openshell.v1.PushSandboxLogsRequest\x1a%.openshell.v1.PushSandboxLogsResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox(\x01\x12e\n" +
	"\x11ConnectSupervisor\x12\x1f.openshell.v1.SupervisorMessage\x1a\x1c.openshell.v1.GatewayMessage\"\r\x82\xb5\x18\t\n" +
	"\asandbox(\x010\x01\x12\x7f\n" +
	"\x15ReportMainProcessExit\x12*.openshell.v1.ReportMainProcessExitRequest\x1a+.openshell.v1.ReportMainProcessExitResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12\x85\x01\n" +
	"\x17FinalizeMainProcessExit\x12,.openshell.v1.FinalizeMainProcessExitRequest\x1a-.openshell.v1.FinalizeMainProcessExitResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12T\n" +
	"\vRelayStream\x12\x18.openshell.v1.RelayFrame\x1a\x18.openshell.v1.RelayFrame\"\r\x82\xb5\x18\t\n" +
	"\asandbox(\x010\x01\x12W\n" +
	"\tPeerRelay\x12\x1c.openshell.v1.PeerRelayFrame\x1a\x1c.openshell.v1.PeerRelayFrame\"\n" +
	"\x82\xb5\x18\x06\n" +
	"\x04peer(\x010\x01\x12\x86\x01\n" +
	"\x1bPeerReportProviderReadiness\x12,.openshell.v1.ReportProviderReadinessRequest\x1a-.openshell.v1.ReportProviderReadinessResponse\"\n" +
	"\x82\xb5\x18\x06\n" +
	"\x04peer\x12}\n" +
	"\x18PeerReportEndpointStatus\x12).openshell.v1.ReportEndpointStatusRequest\x1a*.openshell.v1.ReportEndpointStatusResponse\"\n" +
	"\x82\xb5\x18\x06\n" +
	"\x04peer\x12\x89\x01\n" +
	"\x1cPeerGetSandboxProviderStatus\x12-.openshell.v1.GetSandboxProviderStatusRequest\x1a..openshell.v1.GetSandboxProviderStatusResponse\"\n" +
	"\x82\xb5\x18\x06\n" +
	"\x04peer\x12w\n" +
	"\fWatchSandbox\x12!.openshell.v1.WatchSandboxRequest\x1a .openshell.v1.SandboxStreamEvent\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read0\x01\x12|\n" +
	"\x14SubmitPolicyAnalysis\x12).openshell.v1.SubmitPolicyAnalysisRequest\x1a*.openshell.v1.SubmitPolicyAnalysisResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12z\n" +
	"\x0eGetDraftPolicy\x12#.openshell.v1.GetDraftPolicyRequest\x1a$.openshell.v1.GetDraftPolicyResponse\"\x1d\x82\xb5\x18\x19\n" +
	"\x04dual\x12\x04user\"\vconfig:read\x12\x87\x01\n" +
	"\x11ApproveDraftChunk\x12&.openshell.v1.ApproveDraftChunkRequest\x1a'.openshell.v1.ApproveDraftChunkResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12\x84\x01\n" +
	"\x10RejectDraftChunk\x12%.openshell.v1.RejectDraftChunkRequest\x1a&.openshell.v1.RejectDraftChunkResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12\x93\x01\n" +
	"\x15ApproveAllDraftChunks\x12*.openshell.v1.ApproveAllDraftChunksRequest\x1a+.openshell.v1.ApproveAllDraftChunksResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12~\n" +
	"\x0eEditDraftChunk\x12#.openshell.v1.EditDraftChunkRequest\x1a$.openshell.v1.EditDraftChunkResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12~\n" +
	"\x0eUndoDraftChunk\x12#.openshell.v1.UndoDraftChunkRequest\x1a$.openshell.v1.UndoDraftChunkResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12\x84\x01\n" +
	"\x10ClearDraftChunks\x12%.openshell.v1.ClearDraftChunksRequest\x1a&.openshell.v1.ClearDraftChunksResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12\x7f\n" +
	"\x0fGetDraftHistory\x12$.openshell.v1.GetDraftHistoryRequest\x1a%.openshell.v1.GetDraftHistoryResponse\"\x1f\x82\xb5\x18\x1b\n" +
	"\x06bearer\x12\x04user\"\vconfig:read\x12s\n" +
	"\x11IssueSandboxToken\x12&.openshell.v1.IssueSandboxTokenRequest\x1a'.openshell.v1.IssueSandboxTokenResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12y\n" +
	"\x13RefreshSandboxToken\x12(.openshell.v1.RefreshSandboxTokenRequest\x1a).openshell.v1.RefreshSandboxTokenResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12\x8d\x01\n" +
	"\x0fCreateWorkspace\x12$.openshell.v1.CreateWorkspaceRequest\x1a%.openshell.v1.CreateWorkspaceResponse\"-\x82\xb5\x18)\n" +
	"\x06bearer\x1a\x0eplatform_admin\"\x0fworkspace:write\x12y\n" +
	"\fGetWorkspace\x12!.openshell.v1.GetWorkspaceRequest\x1a\".openshell.v1.GetWorkspaceResponse\"\"\x82\xb5\x18\x1e\n" +
	"\x06bearer\x12\x04user\"\x0eworkspace:read\x12\x7f\n" +
	"\x0eListWorkspaces\x12#.openshell.v1.ListWorkspacesRequest\x1a$.openshell.v1.ListWorkspacesResponse\"\"\x82\xb5\x18\x1e\n" +
	"\x06bearer\x12\x04user\"\x0eworkspace:read\x12\x8d\x01\n" +
	"\x0fDeleteWorkspace\x12$.openshell.v1.DeleteWorkspaceRequest\x1a%.openshell.v1.DeleteWorkspaceResponse\"-\x82\xb5\x18)\n" +
	"\x06bearer\x1a\x0eplatform_admin\"\x0fworkspace:write\x12\x8d\x01\n" +
	"\x12AddWorkspaceMember\x12'.openshell.v1.AddWorkspaceMemberRequest\x1a(.openshell.v1.AddWorkspaceMemberResponse\"$\x82\xb5\x18 \n" +
	"\x06bearer\x12\x05admin\"\x0fworkspace:write\x12\x96\x01\n" +
	"\x15RemoveWorkspaceMember\x12*.openshell.v1.RemoveWorkspaceMemberRequest\x1a+.openshell.v1.RemoveWorkspaceMemberResponse\"$\x82\xb5\x18 \n" +
	"\x06bearer\x12\x05admin\"\x0fworkspace:write\x12\x91\x01\n" +
	"\x14ListWorkspaceMembers\x12).openshell.v1.ListWorkspaceMembersRequest\x1a*.openshell.v1.ListWorkspaceMembersResponse\"\"\x82\xb5\x18\x1e\n" +
	"\x06bearer\x12\x04user\"\x0eworkspace:readb\x06proto3"

var (
	file_openshell_proto_rawDescOnce sync.Once
	file_openshell_proto_rawDescData []byte
)

func file_openshell_proto_rawDescGZIP() []byte {
	file_openshell_proto_rawDescOnce.Do(func() {
		file_openshell_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)))
	})
	return file_openshell_proto_rawDescData
}

var file_openshell_proto_enumTypes = make([]protoimpl.EnumInfo, 18)
var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 253)
var file_openshell_proto_goTypes = []any{
	(ExtensionKind)(0),                                   // 0: openshell.v1.ExtensionKind
	(SandboxPhase)(0),                                    // 1: openshell.v1.SandboxPhase
	(ProviderMutationKind)(0),                            // 2: openshell.v1.ProviderMutationKind
	(ProviderReadinessState)(0),                          // 3: openshell.v1.ProviderReadinessState
	(ProviderReadinessReason)(0),                         // 4: openshell.v1.ProviderReadinessReason
	(ConfigComponent)(0),                                 // 5: openshell.v1.ConfigComponent
	(ConfigApplyOutcome)(0),                              // 6: openshell.v1.ConfigApplyOutcome
	(ConfigUpdateOperationState)(0),                      // 7: openshell.v1.ConfigUpdateOperationState
	(ProviderCredentialTokenGrantType)(0),                // 8: openshell.v1.ProviderCredentialTokenGrantType
	(ProviderCredentialRefreshStrategy)(0),               // 9: openshell.v1.ProviderCredentialRefreshStrategy
	(ProviderProfileCategory)(0),                         // 10: openshell.v1.ProviderProfileCategory
	(ConfigurationAdmissionState)(0),                     // 11: openshell.v1.ConfigurationAdmissionState
	(PolicyStatus)(0),                                    // 12: openshell.v1.PolicyStatus
	(ServiceStatus)(0),                                   // 13: openshell.v1.ServiceStatus
	(WorkspaceRole)(0),                                   // 14: openshell.v1.WorkspaceRole
	(ProviderCredentialRefreshRecoveryAction)(0),         // 15: openshell.v1.ProviderCredentialRefreshRecoveryAction
	(DeletionOutcome)(0),                                 // 16: openshell.v1.DeletionOutcome
	(EndpointResult)(0),                                  // 17: openshell.v1.EndpointResult
	(*IssueSandboxTokenRequest)(nil),                     // 18: openshell.v1.IssueSandboxTokenRequest
	(*IssueSandboxTokenResponse)(nil),                    // 19: openshell.v1.IssueSandboxTokenResponse
	(*RefreshSandboxTokenRequest)(nil),                   // 20: openshell.v1.RefreshSandboxTokenRequest
	(*RefreshSandboxTokenResponse)(nil),                  // 21: openshell.v1.RefreshSandboxTokenResponse
	(*HealthRequest)(nil),                                // 22: openshell.v1.HealthRequest
	(*HealthResponse)(nil),                               // 23: openshell.v1.HealthResponse
	(*GetCurrentUserRequest)(nil),                        // 24: openshell.v1.GetCurrentUserRequest
	(*GetCurrentUserResponse)(nil),                       // 25: openshell.v1.GetCurrentUserResponse
	(*GetGatewayInfoRequest)(nil),                        // 26: openshell.v1.GetGatewayInfoRequest
	(*GetGatewayInfoResponse)(nil),                       // 27: openshell.v1.GetGatewayInfoResponse
	(*NegotiatedExtensionInfo)(nil),                      // 28: openshell.v1.NegotiatedExtensionInfo
	(*ComputeDriverInfo)(nil),                            // 29: openshell.v1.ComputeDriverInfo
	(*ComputeDriverCapabilities)(nil),                    // 30: openshell.v1.ComputeDriverCapabilities
	(*ResourceCapabilities)(nil),                         // 31: openshell.v1.ResourceCapabilities
	(*CpuResourceCapabilities)(nil),                      // 32: openshell.v1.CpuResourceCapabilities
	(*MemoryResourceCapabilities)(nil),                   // 33: openshell.v1.MemoryResourceCapabilities
	(*GpuResourceCapabilities)(nil),                      // 34: openshell.v1.GpuResourceCapabilities
	(*Sandbox)(nil),                                      // 35: openshell.v1.Sandbox
	(*SandboxSpec)(nil),                                  // 36: openshell.v1.SandboxSpec
	(*ResourceRequirements)(nil),                         // 37: openshell.v1.ResourceRequirements
	(*GpuResourceRequirements)(nil),                      // 38: openshell.v1.GpuResourceRequirements
	(*SandboxTemplate)(nil),                              // 39: openshell.v1.SandboxTemplate
	(*SandboxWorkloadTemplate)(nil),                      // 40: openshell.v1.SandboxWorkloadTemplate
	(*SandboxWorkloadTemplateSpec)(nil),                  // 41: openshell.v1.SandboxWorkloadTemplateSpec
	(*SandboxWorkloadConfig)(nil),                        // 42: openshell.v1.SandboxWorkloadConfig
	(*SandboxResources)(nil),                             // 43: openshell.v1.SandboxResources
	(*SandboxServiceLevel)(nil),                          // 44: openshell.v1.SandboxServiceLevel
	(*SandboxStartup)(nil),                               // 45: openshell.v1.SandboxStartup
	(*SandboxWorkloadTemplateProvenance)(nil),            // 46: openshell.v1.SandboxWorkloadTemplateProvenance
	(*SandboxStatus)(nil),                                // 47: openshell.v1.SandboxStatus
	(*SandboxCondition)(nil),                             // 48: openshell.v1.SandboxCondition
	(*PlatformEvent)(nil),                                // 49: openshell.v1.PlatformEvent
	(*CreateSandboxRequest)(nil),                         // 50: openshell.v1.CreateSandboxRequest
	(*CreateSandboxTemplateRequest)(nil),                 // 51: openshell.v1.CreateSandboxTemplateRequest
	(*GetSandboxTemplateRequest)(nil),                    // 52: openshell.v1.GetSandboxTemplateRequest
	(*ListSandboxTemplatesRequest)(nil),                  // 53: openshell.v1.ListSandboxTemplatesRequest
	(*DeleteSandboxTemplateRequest)(nil),                 // 54: openshell.v1.DeleteSandboxTemplateRequest
	(*SandboxTemplateResponse)(nil),                      // 55: openshell.v1.SandboxTemplateResponse
	(*ListSandboxTemplatesResponse)(nil),                 // 56: openshell.v1.ListSandboxTemplatesResponse
	(*DeleteSandboxTemplateResponse)(nil),                // 57: openshell.v1.DeleteSandboxTemplateResponse
	(*BeginRootfsTarStagingRequest)(nil),                 // 58: openshell.v1.BeginRootfsTarStagingRequest
	(*BeginRootfsTarStagingResponse)(nil),                // 59: openshell.v1.BeginRootfsTarStagingResponse
	(*GetSandboxRequest)(nil),                            // 60: openshell.v1.GetSandboxRequest
	(*ListSandboxesRequest)(nil),                         // 61: openshell.v1.ListSandboxesRequest
	(*ListSandboxProvidersRequest)(nil),                  // 62: openshell.v1.ListSandboxProvidersRequest
	(*AttachSandboxProviderRequest)(nil),                 // 63: openshell.v1.AttachSandboxProviderRequest
	(*DetachSandboxProviderRequest)(nil),                 // 64: openshell.v1.DetachSandboxProviderRequest
	(*DeleteSandboxRequest)(nil),                         // 65: openshell.v1.DeleteSandboxRequest
	(*StopSandboxRequest)(nil),                           // 66: openshell.v1.StopSandboxRequest
	(*StartSandboxRequest)(nil),                          // 67: openshell.v1.StartSandboxRequest
	(*SandboxResponse)(nil),                              // 68: openshell.v1.SandboxResponse
	(*ListSandboxesResponse)(nil),                        // 69: openshell.v1.ListSandboxesResponse
	(*ListSandboxProvidersResponse)(nil),                 // 70: openshell.v1.ListSandboxProvidersResponse
	(*AttachSandboxProviderResponse)(nil),                // 71: openshell.v1.AttachSandboxProviderResponse
	(*DetachSandboxProviderResponse)(nil),                // 72: openshell.v1.DetachSandboxProviderResponse
	(*ProviderDesiredIdentity)(nil),                      // 73: openshell.v1.ProviderDesiredIdentity
	(*ConfigSnapshotRevision)(nil),                       // 74: openshell.v1.ConfigSnapshotRevision
	(*SandboxConfigRevision)(nil),                        // 75: openshell.v1.SandboxConfigRevision
	(*ConfigUpdateOperation)(nil),                        // 76: openshell.v1.ConfigUpdateOperation
	(*ProviderMutationReceipt)(nil),                      // 77: openshell.v1.ProviderMutationReceipt
	(*ProviderReadinessObservation)(nil),                 // 78: openshell.v1.ProviderReadinessObservation
	(*ProviderReadinessStatus)(nil),                      // 79: openshell.v1.ProviderReadinessStatus
	(*GetSandboxProviderStatusRequest)(nil),              // 80: openshell.v1.GetSandboxProviderStatusRequest
	(*GetSandboxProviderStatusResponse)(nil),             // 81: openshell.v1.GetSandboxProviderStatusResponse
	(*ReportProviderReadinessRequest)(nil),               // 82: openshell.v1.ReportProviderReadinessRequest
	(*ReportProviderReadinessResponse)(nil),              // 83: openshell.v1.ReportProviderReadinessResponse
	(*DeleteSandboxResponse)(nil),                        // 84: openshell.v1.DeleteSandboxResponse
	(*CreateSshSessionRequest)(nil),                      // 85: openshell.v1.CreateSshSessionRequest
	(*CreateSshSessionResponse)(nil),                     // 86: openshell.v1.CreateSshSessionResponse
	(*ExposeServiceRequest)(nil),                         // 87: openshell.v1.ExposeServiceRequest
	(*GetServiceRequest)(nil),                            // 88: openshell.v1.GetServiceRequest
	(*ListServicesRequest)(nil),                          // 89: openshell.v1.ListServicesRequest
	(*ListServicesResponse)(nil),                         // 90: openshell.v1.ListServicesResponse
	(*DeleteServiceRequest)(nil),                         // 91: openshell.v1.DeleteServiceRequest
	(*DeleteServiceResponse)(nil),                        // 92: openshell.v1.DeleteServiceResponse
	(*ServiceEndpoint)(nil),                              // 93: openshell.v1.ServiceEndpoint
	(*ServiceEndpointResponse)(nil),                      // 94: openshell.v1.ServiceEndpointResponse
	(*RevokeSshSessionRequest)(nil),                      // 95: openshell.v1.RevokeSshSessionRequest
	(*RevokeSshSessionResponse)(nil),                     // 96: openshell.v1.RevokeSshSessionResponse
	(*ExecSandboxRequest)(nil),                           // 97: openshell.v1.ExecSandboxRequest
	(*ExecSandboxStdout)(nil),                            // 98: openshell.v1.ExecSandboxStdout
	(*ExecSandboxStderr)(nil),                            // 99: openshell.v1.ExecSandboxStderr
	(*ExecSandboxExit)(nil),                              // 100: openshell.v1.ExecSandboxExit
	(*ExecSandboxEvent)(nil),                             // 101: openshell.v1.ExecSandboxEvent
	(*TcpForwardInit)(nil),                               // 102: openshell.v1.TcpForwardInit
	(*TcpForwardFrame)(nil),                              // 103: openshell.v1.TcpForwardFrame
	(*ExecSandboxInput)(nil),                             // 104: openshell.v1.ExecSandboxInput
	(*ExecSandboxWindowResize)(nil),                      // 105: openshell.v1.ExecSandboxWindowResize
	(*SshSession)(nil),                                   // 106: openshell.v1.SshSession
	(*WatchSandboxRequest)(nil),                          // 107: openshell.v1.WatchSandboxRequest
	(*SandboxStreamEvent)(nil),                           // 108: openshell.v1.SandboxStreamEvent
	(*SandboxLogLine)(nil),                               // 109: openshell.v1.SandboxLogLine
	(*SandboxStreamWarning)(nil),                         // 110: openshell.v1.SandboxStreamWarning
	(*CreateProviderRequest)(nil),                        // 111: openshell.v1.CreateProviderRequest
	(*GetProviderRequest)(nil),                           // 112: openshell.v1.GetProviderRequest
	(*ListProvidersRequest)(nil),                         // 113: openshell.v1.ListProvidersRequest
	(*UpdateProviderRequest)(nil),                        // 114: openshell.v1.UpdateProviderRequest
	(*DeleteProviderRequest)(nil),                        // 115: openshell.v1.DeleteProviderRequest
	(*ProviderResponse)(nil),                             // 116: openshell.v1.ProviderResponse
	(*ListProvidersResponse)(nil),                        // 117: openshell.v1.ListProvidersResponse
	(*ListProviderProfilesRequest)(nil),                  // 118: openshell.v1.ListProviderProfilesRequest
	(*GetProviderProfileRequest)(nil),                    // 119: openshell.v1.GetProviderProfileRequest
	(*ProviderProfileImportItem)(nil),                    // 120: openshell.v1.ProviderProfileImportItem
	(*ProviderProfileDiagnostic)(nil),                    // 121: openshell.v1.ProviderProfileDiagnostic
	(*ProviderCredentialTokenGrantAudienceOverride)(nil), // 122: openshell.v1.ProviderCredentialTokenGrantAudienceOverride
	(*ProviderCredentialTokenGrantSubjectToken)(nil),     // 123: openshell.v1.ProviderCredentialTokenGrantSubjectToken
	(*ProviderCredentialTokenGrant)(nil),                 // 124: openshell.v1.ProviderCredentialTokenGrant
	(*ProviderProfileCredential)(nil),                    // 125: openshell.v1.ProviderProfileCredential
	(*ProviderCredentialRefreshMaterial)(nil),            // 126: openshell.v1.ProviderCredentialRefreshMaterial
	(*ProviderCredentialRefreshOutput)(nil),              // 127: openshell.v1.ProviderCredentialRefreshOutput
	(*ProviderCredentialRefresh)(nil),                    // 128: openshell.v1.ProviderCredentialRefresh
	(*ProviderCredentialRefreshStatus)(nil),              // 129: openshell.v1.ProviderCredentialRefreshStatus
	(*ProviderProfileDiscovery)(nil),                     // 130: openshell.v1.ProviderProfileDiscovery
	(*GetProviderRefreshStatusRequest)(nil),              // 131: openshell.v1.GetProviderRefreshStatusRequest
	(*GetProviderRefreshStatusResponse)(nil),             // 132: openshell.v1.GetProviderRefreshStatusResponse
	(*ConfigureProviderRefreshRequest)(nil),              // 133: openshell.v1.ConfigureProviderRefreshRequest
	(*ConfigureProviderRefreshResponse)(nil),             // 134: openshell.v1.ConfigureProviderRefreshResponse
	(*RotateProviderCredentialRequest)(nil),              // 135: openshell.v1.RotateProviderCredentialRequest
	(*RotateProviderCredentialResponse)(nil),             // 136: openshell.v1.RotateProviderCredentialResponse
	(*DeleteProviderRefreshRequest)(nil),                 // 137: openshell.v1.DeleteProviderRefreshRequest
	(*DeleteProviderRefreshResponse)(nil),                // 138: openshell.v1.DeleteProviderRefreshResponse
	(*ProviderProfile)(nil),                              // 139: openshell.v1.ProviderProfile
	(*ProviderProfileResponse)(nil),                      // 140: openshell.v1.ProviderProfileResponse
	(*ListProviderProfilesResponse)(nil),                 // 141: openshell.v1.ListProviderProfilesResponse
	(*ImportProviderProfilesRequest)(nil),                // 142: openshell.v1.ImportProviderProfilesRequest
	(*ImportProviderProfilesResponse)(nil),               // 143: openshell.v1.ImportProviderProfilesResponse
	(*UpdateProviderProfilesRequest)(nil),                // 144: openshell.v1.UpdateProviderProfilesRequest
	(*UpdateProviderProfilesResponse)(nil),               // 145: openshell.v1.UpdateProviderProfilesResponse
	(*LintProviderProfilesRequest)(nil),                  // 146: openshell.v1.LintProviderProfilesRequest
	(*LintProviderProfilesResponse)(nil),                 // 147: openshell.v1.LintProviderProfilesResponse
	(*DeleteProviderResponse)(nil),                       // 148: openshell.v1.DeleteProviderResponse
	(*DeleteProviderProfileRequest)(nil),                 // 149: openshell.v1.DeleteProviderProfileRequest
	(*DeleteProviderProfileResponse)(nil),                // 150: openshell.v1.DeleteProviderProfileResponse
	(*GetSandboxProviderEnvironmentRequest)(nil),         // 151: openshell.v1.GetSandboxProviderEnvironmentRequest
	(*StaticCredentialEndpointBinding)(nil),              // 152: openshell.v1.StaticCredentialEndpointBinding
	(*StaticCredentialBinding)(nil),                      // 153: openshell.v1.StaticCredentialBinding
	(*GetSandboxProviderEnvironmentResponse)(nil),        // 154: openshell.v1.GetSandboxProviderEnvironmentResponse
	(*ExchangeProviderSubjectTokenRequest)(nil),          // 155: openshell.v1.ExchangeProviderSubjectTokenRequest
	(*ExchangeProviderSubjectTokenResponse)(nil),         // 156: openshell.v1.ExchangeProviderSubjectTokenResponse
	(*UpdateConfigRequest)(nil),                          // 157: openshell.v1.UpdateConfigRequest
	(*PolicyMergeOperation)(nil),                         // 158: openshell.v1.PolicyMergeOperation
	(*AddNetworkRule)(nil),                               // 159: openshell.v1.AddNetworkRule
	(*RemoveNetworkEndpoint)(nil),                        // 160: openshell.v1.RemoveNetworkEndpoint
	(*RemoveNetworkRule)(nil),                            // 161: openshell.v1.RemoveNetworkRule
	(*L7RuleTarget)(nil),                                 // 162: openshell.v1.L7RuleTarget
	(*AddDenyRules)(nil),                                 // 163: openshell.v1.AddDenyRules
	(*AddAllowRules)(nil),                                // 164: openshell.v1.AddAllowRules
	(*RemoveNetworkBinary)(nil),                          // 165: openshell.v1.RemoveNetworkBinary
	(*UpdateConfigResponse)(nil),                         // 166: openshell.v1.UpdateConfigResponse
	(*GetSandboxPolicyStatusRequest)(nil),                // 167: openshell.v1.GetSandboxPolicyStatusRequest
	(*GetSandboxPolicyStatusResponse)(nil),               // 168: openshell.v1.GetSandboxPolicyStatusResponse
	(*ListSandboxPoliciesRequest)(nil),                   // 169: openshell.v1.ListSandboxPoliciesRequest
	(*ListSandboxPoliciesResponse)(nil),                  // 170: openshell.v1.ListSandboxPoliciesResponse
	(*ReportPolicyStatusRequest)(nil),                    // 171: openshell.v1.ReportPolicyStatusRequest
	(*ReportPolicyStatusResponse)(nil),                   // 172: openshell.v1.ReportPolicyStatusResponse
	(*SandboxConfigurationAdmission)(nil),                // 173: openshell.v1.SandboxConfigurationAdmission
	(*ReportSandboxConfigurationRequest)(nil),            // 174: openshell.v1.ReportSandboxConfigurationRequest
	(*ReportSandboxConfigurationResponse)(nil),           // 175: openshell.v1.ReportSandboxConfigurationResponse
	(*SandboxPolicyRevision)(nil),                        // 176: openshell.v1.SandboxPolicyRevision
	(*GetSandboxLogsRequest)(nil),                        // 177: openshell.v1.GetSandboxLogsRequest
	(*PushSandboxLogsRequest)(nil),                       // 178: openshell.v1.PushSandboxLogsRequest
	(*PushSandboxLogsResponse)(nil),                      // 179: openshell.v1.PushSandboxLogsResponse
	(*GetSandboxLogsResponse)(nil),                       // 180: openshell.v1.GetSandboxLogsResponse
	(*SupervisorMessage)(nil),                            // 181: openshell.v1.SupervisorMessage
	(*GatewayMessage)(nil),                               // 182: openshell.v1.GatewayMessage
	(*SupervisorHello)(nil),                              // 183: openshell.v1.SupervisorHello
	(*SessionAccepted)(nil),                              // 184: openshell.v1.SessionAccepted
	(*SessionRejected)(nil),                              // 185: openshell.v1.SessionRejected
	(*SupervisorHeartbeat)(nil),                          // 186: openshell.v1.SupervisorHeartbeat
	(*GatewayHeartbeat)(nil),                             // 187: openshell.v1.GatewayHeartbeat
	(*ReportMainProcessExitRequest)(nil),                 // 188: openshell.v1.ReportMainProcessExitRequest
	(*ReportMainProcessExitResponse)(nil),                // 189: openshell.v1.ReportMainProcessExitResponse
	(*FinalizeMainProcessExitRequest)(nil),               // 190: openshell.v1.FinalizeMainProcessExitRequest
	(*FinalizeMainProcessExitResponse)(nil),              // 191: openshell.v1.FinalizeMainProcessExitResponse
	(*RelayOpen)(nil),                                    // 192: openshell.v1.RelayOpen
	(*SshRelayTarget)(nil),                               // 193: openshell.v1.SshRelayTarget
	(*TcpRelayTarget)(nil),                               // 194: openshell.v1.TcpRelayTarget
	(*RelayInit)(nil),                                    // 195: openshell.v1.RelayInit
	(*RelayFrame)(nil),                                   // 196: openshell.v1.RelayFrame
	(*PeerRelayInit)(nil),                                // 197: openshell.v1.PeerRelayInit
	(*PeerRelayFrame)(nil),                               // 198: openshell.v1.PeerRelayFrame
	(*RelayOpenResult)(nil),                              // 199: openshell.v1.RelayOpenResult
	(*RelayClose)(nil),                                   // 200: openshell.v1.RelayClose
	(*L7RequestSample)(nil),                              // 201: openshell.v1.L7RequestSample
	(*DenialSummary)(nil),                                // 202: openshell.v1.DenialSummary
	(*DenialGroupCount)(nil),                             // 203: openshell.v1.DenialGroupCount
	(*NetworkActivitySummary)(nil),                       // 204: openshell.v1.NetworkActivitySummary
	(*PolicyChunk)(nil),                                  // 205: openshell.v1.PolicyChunk
	(*DraftPolicyUpdate)(nil),                            // 206: openshell.v1.DraftPolicyUpdate
	(*SubmitPolicyAnalysisRequest)(nil),                  // 207: openshell.v1.SubmitPolicyAnalysisRequest
	(*SubmitPolicyAnalysisResponse)(nil),                 // 208: openshell.v1.SubmitPolicyAnalysisResponse
	(*GetDraftPolicyRequest)(nil),                        // 209: openshell.v1.GetDraftPolicyRequest
	(*GetDraftPolicyResponse)(nil),                       // 210: openshell.v1.GetDraftPolicyResponse
	(*ApproveDraftChunkRequest)(nil),                     // 211: openshell.v1.ApproveDraftChunkRequest
	(*ApproveDraftChunkResponse)(nil),                    // 212: openshell.v1.ApproveDraftChunkResponse
	(*RejectDraftChunkRequest)(nil),                      // 213: openshell.v1.RejectDraftChunkRequest
	(*RejectDraftChunkResponse)(nil),                     // 214: openshell.v1.RejectDraftChunkResponse
	(*DraftChunkApproval)(nil),                           // 215: openshell.v1.DraftChunkApproval
	(*ApproveAllDraftChunksRequest)(nil),                 // 216: openshell.v1.ApproveAllDraftChunksRequest
	(*ApproveAllDraftChunksResponse)(nil),                // 217: openshell.v1.ApproveAllDraftChunksResponse
	(*EditDraftChunkRequest)(nil),                        // 218: openshell.v1.EditDraftChunkRequest
	(*EditDraftChunkResponse)(nil),                       // 219: openshell.v1.EditDraftChunkResponse
	(*UndoDraftChunkRequest)(nil),                        // 220: openshell.v1.UndoDraftChunkRequest
	(*UndoDraftChunkResponse)(nil),                       // 221: openshell.v1.UndoDraftChunkResponse
	(*ClearDraftChunksRequest)(nil),                      // 222: openshell.v1.ClearDraftChunksRequest
	(*ClearDraftChunksResponse)(nil),                     // 223: openshell.v1.ClearDraftChunksResponse
	(*GetDraftHistoryRequest)(nil),                       // 224: openshell.v1.GetDraftHistoryRequest
	(*DraftHistoryEntry)(nil),                            // 225: openshell.v1.DraftHistoryEntry
	(*GetDraftHistoryResponse)(nil),                      // 226: openshell.v1.GetDraftHistoryResponse
	(*CreateWorkspaceRequest)(nil),                       // 227: openshell.v1.CreateWorkspaceRequest
	(*CreateWorkspaceResponse)(nil),                      // 228: openshell.v1.CreateWorkspaceResponse
	(*GetWorkspaceRequest)(nil),                          // 229: openshell.v1.GetWorkspaceRequest
	(*GetWorkspaceResponse)(nil),                         // 230: openshell.v1.GetWorkspaceResponse
	(*ListWorkspacesRequest)(nil),                        // 231: openshell.v1.ListWorkspacesRequest
	(*ListWorkspacesResponse)(nil),                       // 232: openshell.v1.ListWorkspacesResponse
	(*DeleteWorkspaceRequest)(nil),                       // 233: openshell.v1.DeleteWorkspaceRequest
	(*DeleteWorkspaceResponse)(nil),                      // 234: openshell.v1.DeleteWorkspaceResponse
	(*WorkspaceMember)(nil),                              // 235: openshell.v1.WorkspaceMember
	(*AddWorkspaceMemberRequest)(nil),                    // 236: openshell.v1.AddWorkspaceMemberRequest
	(*AddWorkspaceMemberResponse)(nil),                   // 237: openshell.v1.AddWorkspaceMemberResponse
	(*RemoveWorkspaceMemberRequest)(nil),                 // 238: openshell.v1.RemoveWorkspaceMemberRequest
	(*RemoveWorkspaceMemberResponse)(nil),                // 239: openshell.v1.RemoveWorkspaceMemberResponse
	(*ListWorkspaceMembersRequest)(nil),                  // 240: openshell.v1.ListWorkspaceMembersRequest
	(*ListWorkspaceMembersResponse)(nil),                 // 241: openshell.v1.ListWorkspaceMembersResponse
	(*ExtensionServiceCredential)(nil),                   // 242: openshell.v1.ExtensionServiceCredential
	(*EndpointObservation)(nil),                          // 243: openshell.v1.EndpointObservation
	(*ReportEndpointStatusRequest)(nil),                  // 244: openshell.v1.ReportEndpointStatusRequest
	(*ReportEndpointStatusResponse)(nil),                 // 245: openshell.v1.ReportEndpointStatusResponse
	(*EndpointStatus)(nil),                               // 246: openshell.v1.EndpointStatus
	(*SandboxProvisioning)(nil),                          // 247: openshell.v1.SandboxProvisioning
	(*SandboxServiceExposure)(nil),                       // 248: openshell.v1.SandboxServiceExposure
	nil,                                                  // 249: openshell.v1.SandboxSpec.EnvironmentEntry
	nil,                                                  // 250: openshell.v1.SandboxTemplate.LabelsEntry
	nil,                                                  // 251: openshell.v1.SandboxTemplate.AnnotationsEntry
	nil,                                                  // 252: openshell.v1.SandboxTemplate.EnvironmentEntry
	nil,                                                  // 253: openshell.v1.SandboxWorkloadConfig.EnvironmentEntry
	nil,                                                  // 254: openshell.v1.PlatformEvent.MetadataEntry
	nil,                                                  // 255: openshell.v1.CreateSandboxRequest.LabelsEntry
	nil,                                                  // 256: openshell.v1.CreateSandboxRequest.AnnotationsEntry
	nil,                                                  // 257: openshell.v1.SandboxResponse.ServiceUrlsEntry
	nil,                                                  // 258: openshell.v1.ExecSandboxRequest.EnvironmentEntry
	nil,                                                  // 259: openshell.v1.SandboxLogLine.FieldsEntry
	nil,                                                  // 260: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry
	nil,                                                  // 261: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry
	nil,                                                  // 262: openshell.v1.ProviderProfile.AnnotationsEntry
	nil,                                                  // 263: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry
	nil,                                                  // 264: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry
	nil,                                                  // 265: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry
	nil,                                                  // 266: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry
	nil,                                                  // 267: openshell.v1.UpdateConfigRequest.AnnotationsEntry
	nil,                                                  // 268: openshell.v1.UpdateConfigResponse.AnnotationsEntry
	nil,                                                  // 269: openshell.v1.SandboxPolicyRevision.ProvenanceEntry
	nil,                                                  // 270: openshell.v1.CreateWorkspaceRequest.LabelsEntry
	(*timestamppb.Timestamp)(nil),                        // 271: google.protobuf.Timestamp
	(*datamodelv1.ObjectMeta)(nil),                       // 272: openshell.datamodel.v1.ObjectMeta
	(*sandboxv1.SandboxPolicy)(nil),                      // 273: openshell.sandbox.v1.SandboxPolicy
	(*structpb.Struct)(nil),                              // 274: google.protobuf.Struct
	(*durationpb.Duration)(nil),                          // 275: google.protobuf.Duration
	(*datamodelv1.WorkspaceSelector)(nil),                // 276: openshell.datamodel.v1.WorkspaceSelector
	(*datamodelv1.Provider)(nil),                         // 277: openshell.datamodel.v1.Provider
	(sandboxv1.PolicySource)(0),                          // 278: openshell.sandbox.v1.PolicySource
	(*sandboxv1.NetworkEndpoint)(nil),                    // 279: openshell.sandbox.v1.NetworkEndpoint
	(*sandboxv1.NetworkBinary)(nil),                      // 280: openshell.sandbox.v1.NetworkBinary
	(*sandboxv1.SettingValue)(nil),                       // 281: openshell.sandbox.v1.SettingValue
	(*sandboxv1.NetworkPolicyRule)(nil),                  // 282: openshell.sandbox.v1.NetworkPolicyRule
	(*sandboxv1.L7DenyRule)(nil),                         // 283: openshell.sandbox.v1.L7DenyRule
	(*sandboxv1.L7Rule)(nil),                             // 284: openshell.sandbox.v1.L7Rule
	(*datamodelv1.Workspace)(nil),                        // 285: openshell.datamodel.v1.Workspace
	(*sandboxv1.GetSandboxConfigRequest)(nil),            // 286: openshell.sandbox.v1.GetSandboxConfigRequest
	(*sandboxv1.GetGatewayConfigRequest)(nil),            // 287: openshell.sandbox.v1.GetGatewayConfigRequest
	(*sandboxv1.GetSandboxConfigResponse)(nil),           // 288: openshell.sandbox.v1.GetSandboxConfigResponse
	(*sandboxv1.GetGatewayConfigResponse)(nil),           // 289: openshell.sandbox.v1.GetGatewayConfigResponse
}
var file_openshell_proto_depIdxs = []int32{
	271, // 0: openshell.v1.IssueSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp
	271, // 1: openshell.v1.RefreshSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp
	242, // 2: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential
	271, // 3: openshell.v1.RefreshSandboxTokenResponse.sandbox_expiration_time:type_name -> google.protobuf.Timestamp
	13,  // 4: openshell.v1.HealthResponse.status:type_name -> openshell.v1.ServiceStatus
	13,  // 5: openshell.v1.GetGatewayInfoResponse.status:type_name -> openshell.v1.ServiceStatus
	29,  // 6: openshell.v1.GetGatewayInfoResponse.compute_drivers:type_name -> openshell.v1.ComputeDriverInfo
	28,  // 7: openshell.v1.GetGatewayInfoResponse.extensions:type_name -> openshell.v1.NegotiatedExtensionInfo
	0,   // 8: openshell.v1.NegotiatedExtensionInfo.kind:type_name -> openshell.v1.ExtensionKind
	30,  // 9: openshell.v1.ComputeDriverInfo.capabilities:type_name -> openshell.v1.ComputeDriverCapabilities
	31,  // 10: openshell.v1.ComputeDriverCapabilities.resource_capabilities:type_name -> openshell.v1.ResourceCapabilities
	32,  // 11: openshell.v1.ResourceCapabilities.cpu:type_name -> openshell.v1.CpuResourceCapabilities
	33,  // 12: openshell.v1.ResourceCapabilities.memory:type_name -> openshell.v1.MemoryResourceCapabilities
	34,  // 13: openshell.v1.ResourceCapabilities.gpu:type_name -> openshell.v1.GpuResourceCapabilities
	272, // 14: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	36,  // 15: openshell.v1.Sandbox.spec:type_name -> openshell.v1.SandboxSpec
	47,  // 16: openshell.v1.Sandbox.status:type_name -> openshell.v1.SandboxStatus
	46,  // 17: openshell.v1.Sandbox.created_from_workload_template:type_name -> openshell.v1.SandboxWorkloadTemplateProvenance
	249, // 18: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry
	39,  // 19: openshell.v1.SandboxSpec.template:type_name -> openshell.v1.SandboxTemplate
	273, // 20: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
	37,  // 21: openshell.v1.SandboxSpec.resource_requirements:type_name -> openshell.v1.ResourceRequirements
	38,  // 22: openshell.v1.ResourceRequirements.gpu:type_name -> openshell.v1.GpuResourceRequirements
	250, // 23: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry
	251, // 24: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry
	252, // 25: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry
	274, // 26: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct
	274, // 27: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct
	272, // 28: openshell.v1.SandboxWorkloadTemplate.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	41,  // 29: openshell.v1.SandboxWorkloadTemplate.spec:type_name -> openshell.v1.SandboxWorkloadTemplateSpec
	42,  // 30: openshell.v1.SandboxWorkloadTemplateSpec.workload:type_name -> openshell.v1.SandboxWorkloadConfig
	274, // 31: openshell.v1.SandboxWorkloadTemplateSpec.driver_config:type_name -> google.protobuf.Struct
	44,  // 32: openshell.v1.SandboxWorkloadTemplateSpec.desired_service_level:type_name -> openshell.v1.SandboxServiceLevel
	253, // 33: openshell.v1.SandboxWorkloadConfig.environment:type_name -> openshell.v1.SandboxWorkloadConfig.EnvironmentEntry
	43,  // 34: openshell.v1.SandboxWorkloadConfig.resources:type_name -> openshell.v1.SandboxResources
	38,  // 35: openshell.v1.SandboxResources.gpu:type_name -> openshell.v1.GpuResourceRequirements
	45,  // 36: openshell.v1.SandboxServiceLevel.startup:type_name -> openshell.v1.SandboxStartup
	275, // 37: openshell.v1.SandboxStartup.ready_within:type_name -> google.protobuf.Duration
	48,  // 38: openshell.v1.SandboxStatus.conditions:type_name -> openshell.v1.SandboxCondition
	1,   // 39: openshell.v1.SandboxStatus.phase:type_name -> openshell.v1.SandboxPhase
	246, // 40: openshell.v1.SandboxStatus.endpoint_statuses:type_name -> openshell.v1.EndpointStatus
	173, // 41: openshell.v1.SandboxStatus.configuration_admission:type_name -> openshell.v1.SandboxConfigurationAdmission
	247, // 42: openshell.v1.SandboxStatus.provisioning:type_name -> openshell.v1.SandboxProvisioning
	271, // 43: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp
	271, // 44: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp
	254, // 45: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry
	276, // 46: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	36,  // 47: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec
	255, // 48: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry
	256, // 49: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry
	248, // 50: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure
	276, // 51: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	40,  // 52: openshell.v1.CreateSandboxTemplateRequest.template:type_name -> openshell.v1.SandboxWorkloadTemplate
	276, // 53: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 54: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 55: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	40,  // 56: openshell.v1.SandboxTemplateResponse.template:type_name -> openshell.v1.SandboxWorkloadTemplate
	40,  // 57: openshell.v1.ListSandboxTemplatesResponse.templates:type_name -> openshell.v1.SandboxWorkloadTemplate
	16,  // 58: openshell.v1.DeleteSandboxTemplateResponse.outcome:type_name -> openshell.v1.DeletionOutcome
	276, // 59: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	271, // 60: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp
	276, // 61: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 62: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 63: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 64: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 65: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 66: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 67: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 68: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	35,  // 69: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox
	257, // 70: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry
	35,  // 71: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox
	277, // 72: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider
	35,  // 73: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox
	77,  // 74: openshell.v1.AttachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt
	35,  // 75: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox
	77,  // 76: openshell.v1.DetachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt
	75,  // 77: openshell.v1.ConfigSnapshotRevision.sandbox_config:type_name -> openshell.v1.SandboxConfigRevision
	73,  // 78: openshell.v1.ConfigSnapshotRevision.provider_target:type_name -> openshell.v1.ProviderDesiredIdentity
	278, // 79: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource
	5,   // 80: openshell.v1.ConfigUpdateOperation.component:type_name -> openshell.v1.ConfigComponent
	74,  // 81: openshell.v1.ConfigUpdateOperation.target_revision:type_name -> openshell.v1.ConfigSnapshotRevision
	7,   // 82: openshell.v1.ConfigUpdateOperation.state:type_name -> openshell.v1.ConfigUpdateOperationState
	6,   // 83: openshell.v1.ConfigUpdateOperation.outcome:type_name -> openshell.v1.ConfigApplyOutcome
	271, // 84: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp
	271, // 85: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp
	271, // 86: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp
	2,   // 87: openshell.v1.ProviderMutationReceipt.kind:type_name -> openshell.v1.ProviderMutationKind
	73,  // 88: openshell.v1.ProviderMutationReceipt.desired:type_name -> openshell.v1.ProviderDesiredIdentity
	271, // 89: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp
	4,   // 90: openshell.v1.ProviderReadinessObservation.reason:type_name -> openshell.v1.ProviderReadinessReason
	77,  // 91: openshell.v1.ProviderReadinessStatus.receipt:type_name -> openshell.v1.ProviderMutationReceipt
	3,   // 92: openshell.v1.ProviderReadinessStatus.state:type_name -> openshell.v1.ProviderReadinessState
	4,   // 93: openshell.v1.ProviderReadinessStatus.reason:type_name -> openshell.v1.ProviderReadinessReason
	78,  // 94: openshell.v1.ProviderReadinessStatus.observed:type_name -> openshell.v1.ProviderReadinessObservation
	271, // 95: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp
	271, // 96: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp
	76,  // 97: openshell.v1.ProviderReadinessStatus.operation:type_name -> openshell.v1.ConfigUpdateOperation
	276, // 98: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	79,  // 99: openshell.v1.GetSandboxProviderStatusResponse.status:type_name -> openshell.v1.ProviderReadinessStatus
	78,  // 100: openshell.v1.ReportProviderReadinessRequest.observation:type_name -> openshell.v1.ProviderReadinessObservation
	275, // 101: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration
	275, // 102: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration
	16,  // 103: openshell.v1.DeleteSandboxResponse.outcome:type_name -> openshell.v1.DeletionOutcome
	276, // 104: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	271, // 105: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp
	276, // 106: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 107: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 108: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	94,  // 109: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse
	276, // 110: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	16,  // 111: openshell.v1.DeleteServiceResponse.outcome:type_name -> openshell.v1.DeletionOutcome
	272, // 112: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	93,  // 113: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint
	16,  // 114: openshell.v1.RevokeSshSessionResponse.outcome:type_name -> openshell.v1.DeletionOutcome
	276, // 115: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	258, // 116: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry
	275, // 117: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration
	98,  // 118: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout
	99,  // 119: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr
	100, // 120: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit
	193, // 121: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget
	194, // 122: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget
	102, // 123: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit
	97,  // 124: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest
	105, // 125: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize
	272, // 126: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	271, // 127: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp
	276, // 128: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	271, // 129: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp
	35,  // 130: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox
	109, // 131: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine
	49,  // 132: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent
	110, // 133: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning
	206, // 134: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate
	271, // 135: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp
	259, // 136: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry
	276, // 137: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	277, // 138: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider
	276, // 139: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 140: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 141: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	277, // 142: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider
	260, // 143: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry
	276, // 144: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	277, // 145: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider
	77,  // 146: openshell.v1.ProviderResponse.target_receipts:type_name -> openshell.v1.ProviderMutationReceipt
	277, // 147: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider
	276, // 148: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 149: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	139, // 150: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile
	275, // 151: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration
	122, // 152: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride
	8,   // 153: openshell.v1.ProviderCredentialTokenGrant.grant_type:type_name -> openshell.v1.ProviderCredentialTokenGrantType
	123, // 154: openshell.v1.ProviderCredentialTokenGrant.subject_token:type_name -> openshell.v1.ProviderCredentialTokenGrantSubjectToken
	128, // 155: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh
	124, // 156: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant
	9,   // 157: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
	275, // 158: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration
	275, // 159: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration
	126, // 160: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial
	127, // 161: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput
	9,   // 162: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
	271, // 163: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp
	271, // 164: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp
	271, // 165: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp
	15,  // 166: openshell.v1.ProviderCredentialRefreshStatus.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction
	271, // 167: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp
	276, // 168: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	129, // 169: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus
	276, // 170: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	9,   // 171: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
	261, // 172: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry
	271, // 173: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp
	129, // 174: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus
	276, // 175: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	129, // 176: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus
	276, // 177: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	16,  // 178: openshell.v1.DeleteProviderRefreshResponse.outcome:type_name -> openshell.v1.DeletionOutcome
	10,  // 179: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory
	125, // 180: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential
	279, // 181: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint
	280, // 182: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
	130, // 183: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery
	262, // 184: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry
	139, // 185: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile
	139, // 186: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile
	276, // 187: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	120, // 188: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem
	121, // 189: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
	139, // 190: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile
	276, // 191: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	120, // 192: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem
	121, // 193: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
	139, // 194: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile
	276, // 195: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	120, // 196: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem
	121, // 197: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
	16,  // 198: openshell.v1.DeleteProviderResponse.outcome:type_name -> openshell.v1.DeletionOutcome
	276, // 199: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	16,  // 200: openshell.v1.DeleteProviderProfileResponse.outcome:type_name -> openshell.v1.DeletionOutcome
	152, // 201: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding
	263, // 202: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry
	264, // 203: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry
	265, // 204: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry
	266, // 205: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry
	4,   // 206: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason
	275, // 207: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration
	276, // 208: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	273, // 209: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
	281, // 210: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue
	158, // 211: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation
	267, // 212: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry
	159, // 213: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule
	160, // 214: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint
	161, // 215: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule
	163, // 216: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules
	164, // 217: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules
	165, // 218: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary
	282, // 219: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
	280, // 220: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
	283, // 221: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule
	162, // 222: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget
	284, // 223: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule
	162, // 224: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget
	268, // 225: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry
	276, // 226: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	176, // 227: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision
	276, // 228: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	176, // 229: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision
	12,  // 230: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus
	11,  // 231: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState
	173, // 232: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission
	12,  // 233: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus
	271, // 234: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp
	271, // 235: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp
	273, // 236: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
	269, // 237: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry
	276, // 238: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	271, // 239: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp
	109, // 240: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine
	109, // 241: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine
	183, // 242: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello
	186, // 243: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat
	199, // 244: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult
	200, // 245: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose
	184, // 246: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted
	185, // 247: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected
	187, // 248: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat
	192, // 249: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen
	200, // 250: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose
	275, // 251: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration
	193, // 252: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget
	194, // 253: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget
	195, // 254: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit
	192, // 255: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen
	197, // 256: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit
	271, // 257: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp
	271, // 258: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp
	201, // 259: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample
	203, // 260: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount
	282, // 261: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
	271, // 262: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp
	271, // 263: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp
	271, // 264: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp
	271, // 265: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp
	273, // 266: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy
	273, // 267: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy
	276, // 268: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	202, // 269: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary
	205, // 270: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk
	204, // 271: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary
	276, // 272: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	205, // 273: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk
	271, // 274: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp
	276, // 275: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 276: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 277: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	215, // 278: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval
	276, // 279: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	282, // 280: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
	276, // 281: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 282: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	276, // 283: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	271, // 284: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp
	225, // 285: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry
	270, // 286: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry
	285, // 287: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace
	285, // 288: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace
	285, // 289: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace
	16,  // 290: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome
	272, // 291: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	14,  // 292: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole
	276, // 293: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	14,  // 294: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole
	235, // 295: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember
	276, // 296: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	16,  // 297: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome
	276, // 298: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
	235, // 299: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember
	271, // 300: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp
	17,  // 301: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult
	243, // 302: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation
	17,  // 303: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult
	271, // 304: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp
	271, // 305: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp
	271, // 306: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp
	271, // 307: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp
	271, // 308: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp
	271, // 309: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp
	271, // 310: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp
	271, // 311: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp
	271, // 312: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp
	271, // 313: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp
	125, // 314: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential
	153, // 315: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding
	22,  // 316: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest
	24,  // 317: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest
	26,  // 318: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest
	50,  // 319: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest
	58,  // 320: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest
	60,  // 321: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest
	61,  // 322: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest
	51,  // 323: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest
	52,  // 324: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest
	53,  // 325: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest
	54,  // 326: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest
	62,  // 327: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest
	63,  // 328: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest
	64,  // 329: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest
	80,  // 330: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest
	65,  // 331: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest
	66,  // 332: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest
	67,  // 333: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest
	85,  // 334: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest
	87,  // 335: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest
	88,  // 336: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest
	89,  // 337: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest
	91,  // 338: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest
	95,  // 339: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest
	97,  // 340: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest
	103, // 341: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame
	104, // 342: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput
	111, // 343: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest
	112, // 344: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest
	113, // 345: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest
	118, // 346: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest
	119, // 347: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest
	142, // 348: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest
	144, // 349: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest
	146, // 350: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest
	114, // 351: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest
	131, // 352: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest
	133, // 353: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest
	135, // 354: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest
	137, // 355: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest
	115, // 356: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest
	149, // 357: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest
	286, // 358: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest
	287, // 359: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest
	157, // 360: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest
	167, // 361: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest
	169, // 362: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest
	171, // 363: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest
	244, // 364: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest
	82,  // 365: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest
	174, // 366: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest
	151, // 367: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest
	155, // 368: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest
	177, // 369: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest
	178, // 370: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest
	181, // 371: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage
	188, // 372: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest
	190, // 373: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest
	196, // 374: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame
	198, // 375: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame
	82,  // 376: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest
	244, // 377: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest
	80,  // 378: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest
	107, // 379: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest
	207, // 380: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest
	209, // 381: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest
	211, // 382: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest
	213, // 383: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest
	216, // 384: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest
	218, // 385: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest
	220, // 386: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest
	222, // 387: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest
	224, // 388: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest
	18,  // 389: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest
	20,  // 390: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest
	227, // 391: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest
	229, // 392: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest
	231, // 393: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest
	233, // 394: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest
	236, // 395: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest
	238, // 396: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest
	240, // 397: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest
	23,  // 398: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse
	25,  // 399: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse
	27,  // 400: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse
	68,  // 401: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse
	59,  // 402: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse
	68,  // 403: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse
	69,  // 404: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse
	55,  // 405: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse
	55,  // 406: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse
	56,  // 407: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse
	57,  // 408: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse
	70,  // 409: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse
	71,  // 410: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse
	72,  // 411: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse
	81,  // 412: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse
	84,  // 413: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse
	68,  // 414: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse
	68,  // 415: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse
	86,  // 416: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse
	94,  // 417: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse
	94,  // 418: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse
	90,  // 419: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse
	92,  // 420: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse
	96,  // 421: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse
	101, // 422: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent
	103, // 423: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame
	101, // 424: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent
	116, // 425: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse
	116, // 426: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse
	117, // 427: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse
	141, // 428: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse
	140, // 429: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse
	143, // 430: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse
	145, // 431: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse
	147, // 432: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse
	116, // 433: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse
	132, // 434: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse
	134, // 435: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse
	136, // 436: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse
	138, // 437: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse
	148, // 438: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse
	150, // 439: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse
	288, // 440: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse
	289, // 441: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse
	166, // 442: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse
	168, // 443: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse
	170, // 444: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse
	172, // 445: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse
	245, // 446: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse
	83,  // 447: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse
	175, // 448: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse
	154, // 449: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse
	156, // 450: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse
	180, // 451: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse
	179, // 452: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse
	182, // 453: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage
	189, // 454: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse
	191, // 455: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse
	196, // 456: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame
	198, // 457: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame
	83,  // 458: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse
	245, // 459: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse
	81,  // 460: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse
	108, // 461: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent
	208, // 462: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse
	210, // 463: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse
	212, // 464: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse
	214, // 465: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse
	217, // 466: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse
	219, // 467: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse
	221, // 468: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse
	223, // 469: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse
	226, // 470: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse
	19,  // 471: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse
	21,  // 472: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse
	228, // 473: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse
	230, // 474: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse
	232, // 475: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse
	234, // 476: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse
	237, // 477: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse
	239, // 478: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse
	241, // 479: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse
	398, // [398:480] is the sub-list for method output_type
	316, // [316:398] is the sub-list for method input_type
	316, // [316:316] is the sub-list for extension type_name
	316, // [316:316] is the sub-list for extension extendee
	0,   // [0:316] is the sub-list for field type_name
}

func init() { file_openshell_proto_init() }
func file_openshell_proto_init() {
	if File_openshell_proto != nil {
		return
	}
	file_openshell_proto_msgTypes[20].OneofWrappers = []any{}
	file_openshell_proto_msgTypes[21].OneofWrappers = []any{}
	file_openshell_proto_msgTypes[29].OneofWrappers = []any{}
	file_openshell_proto_msgTypes[56].OneofWrappers = []any{
		(*ConfigSnapshotRevision_SandboxConfig)(nil),
		(*ConfigSnapshotRevision_ProviderEnvironment)(nil),
		(*ConfigSnapshotRevision_ProviderTarget)(nil),
	}
	file_openshell_proto_msgTypes[83].OneofWrappers = []any{
		(*ExecSandboxEvent_Stdout)(nil),
		(*ExecSandboxEvent_Stderr)(nil),
		(*ExecSandboxEvent_Exit)(nil),
	}
	file_openshell_proto_msgTypes[84].OneofWrappers = []any{
		(*TcpForwardInit_Ssh)(nil),
		(*TcpForwardInit_Tcp)(nil),
	}
	file_openshell_proto_msgTypes[85].OneofWrappers = []any{
		(*TcpForwardFrame_Init)(nil),
		(*TcpForwardFrame_Data)(nil),
	}
	file_openshell_proto_msgTypes[86].OneofWrappers = []any{
		(*ExecSandboxInput_Start)(nil),
		(*ExecSandboxInput_Stdin)(nil),
		(*ExecSandboxInput_Resize)(nil),
	}
	file_openshell_proto_msgTypes[90].OneofWrappers = []any{
		(*SandboxStreamEvent_Sandbox)(nil),
		(*SandboxStreamEvent_Log)(nil),
		(*SandboxStreamEvent_Event)(nil),
		(*SandboxStreamEvent_Warning)(nil),
		(*SandboxStreamEvent_DraftPolicyUpdate)(nil),
	}
	file_openshell_proto_msgTypes[140].OneofWrappers = []any{
		(*PolicyMergeOperation_AddRule)(nil),
		(*PolicyMergeOperation_RemoveEndpoint)(nil),
		(*PolicyMergeOperation_RemoveRule)(nil),
		(*PolicyMergeOperation_AddDenyRules)(nil),
		(*PolicyMergeOperation_AddAllowRules)(nil),
		(*PolicyMergeOperation_RemoveBinary)(nil),
	}
	file_openshell_proto_msgTypes[144].OneofWrappers = []any{}
	file_openshell_proto_msgTypes[163].OneofWrappers = []any{
		(*SupervisorMessage_Hello)(nil),
		(*SupervisorMessage_Heartbeat)(nil),
		(*SupervisorMessage_RelayOpenResult)(nil),
		(*SupervisorMessage_RelayClose)(nil),
	}
	file_openshell_proto_msgTypes[164].OneofWrappers = []any{
		(*GatewayMessage_SessionAccepted)(nil),
		(*GatewayMessage_SessionRejected)(nil),
		(*GatewayMessage_Heartbeat)(nil),
		(*GatewayMessage_RelayOpen)(nil),
		(*GatewayMessage_RelayClose)(nil),
	}
	file_openshell_proto_msgTypes[174].OneofWrappers = []any{
		(*RelayOpen_Ssh)(nil),
		(*RelayOpen_Tcp)(nil),
	}
	file_openshell_proto_msgTypes[178].OneofWrappers = []any{
		(*RelayFrame_Init)(nil),
		(*RelayFrame_Data)(nil),
	}
	file_openshell_proto_msgTypes[180].OneofWrappers = []any{
		(*PeerRelayFrame_Init)(nil),
		(*PeerRelayFrame_Data)(nil),
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)),
			NumEnums:      18,
			NumMessages:   253,
			NumExtensions: 0,
			NumServices:   1,
		},
		GoTypes:           file_openshell_proto_goTypes,
		DependencyIndexes: file_openshell_proto_depIdxs,
		EnumInfos:         file_openshell_proto_enumTypes,
		MessageInfos:      file_openshell_proto_msgTypes,
	}.Build()
	File_openshell_proto = out.File
	file_openshell_proto_goTypes = nil
	file_openshell_proto_depIdxs = nil
}