forav1

type AcceptableRestriction struct {

	// Which axis (same enum as Restriction.kind): FUNCTION / GEOGRAPHY /
	// USER_TYPE / OTHER.
	Axis RestrictionKind `protobuf:"varint,1,opt,name=axis,proto3,enum=fora.v1.RestrictionKind" json:"axis,omitempty"`
	// The values the query operates within on this axis — same token vocabulary
	// as the terms (e.g. FUNCTION ["ai-train"], GEOGRAPHY ["US", "EU"]).
	Values []string `protobuf:"bytes,2,rep,name=values,proto3" json:"values,omitempty"`
	// contains filtered or unexported fields
}

type AccountRegistration struct {

	// JSON Schema (draft 2020-12) describing the RegisterRequest.registration_data
	// object this Exchange expects. This field is the single home of the
	// enforce/pass-through contract, and publishing it IS the enforcement switch.
	// Present: this Exchange validates registration_data against the schema and
	// refuses a non-conforming payload with
	// REGISTRATION_FAILURE_REASON_INVALID_REGISTRATION_DATA, naming the offending
	// members in RegistrationFailure.field_errors. Absent: registration_data is
	// passed through to the system of record uninspected, so an Exchange that
	// publishes no schema needs no change to stay conformant.
	//
	// The gate above runs on ACCOUNT CREATION ONLY. A repeat registration, for an
	// agent that already holds an account, is answered from the stored record and
	// runs no schema check at all — it discards registration_data rather than
	// validating it. That exception is stated here rather than left to the section
	// above, because this field calls itself the single home of the contract and a
	// reader who comes here for the whole rule would otherwise leave with the wrong
	// one. See "Repeat registration" in the Agent Account Registration section for
	// why, and for the other gates it applies to.
	//
	// Absent means the field carries no bytes, or only JSON whitespace — space, tab,
	// carriage return and line feed, RFC 8259's four and no others. Nothing else
	// counts, and the distinction is load-bearing rather than pedantic: this is the
	// enforcement switch, so a byte sequence read as absent is one that turns
	// validation OFF. A consumer that asked its own language what "blank" means got
	// three different answers to the same document — U+00A0 and U+3000 are whitespace
	// to some runtimes and not others, and a decoder that strips a byte order mark
	// makes a mark followed by a space look like nothing at all. A document that is
	// not empty and not JSON is malformed, which is a refusal; it is never silence.
	//
	// Safety rules, because a consumer reads this schema out of a THIRD PARTY's
	// manifest and validates against it before any signature has been checked. A
	// publisher MUST satisfy every rule below and a consumer MUST refuse a schema
	// that does not. The bounds are stated here as numbers rather than left to each
	// implementation on purpose: a schema is validated at both ends of the same
	// registration, and a limit chosen privately by one side refuses payloads the
	// other accepts.
	//
	//	Self-contained. Every $ref, $dynamicRef and $recursiveRef MUST be a
	//	same-document reference — it begins with "#". A consumer MUST NOT resolve a
	//	reference that leaves the document: doing so turns every reader into an
	//	SSRF vector aimed at a URL the schema's author chose.
	//
	//	One dialect. $schema, wherever it appears in the document, MUST name
	//	https://json-schema.org/draft/2020-12/schema (an empty fragment on the end
	//	is the same value). A document declaring none is read as that dialect. An
	//	older draft is refused rather than validated under semantics its author did
	//	not intend.
	//
	//	Data is not schema. `const`, `enum`, `default` and `examples` hold arbitrary
	//	JSON VALUES, and their contents are never read as keywords: a `const` whose
	//	value happens to carry a "$ref" or "$schema" member states a value a payload
	//	may equal, not a reference to resolve or a dialect to honour. Both rules
	//	above therefore stop at those four keywords, and so does the pattern
	//	alphabet. Their nesting still counts against the depth cap. Likewise the
	//	child keys of `properties`, `patternProperties`, `$defs`, `definitions` and
	//	`dependentSchemas` are NAMES rather than keywords, so a property called
	//	"$ref" is a property.
	//
	//	Bounded size: 16KB, measured as the UTF-8 bytes of this member AS SERVED in
	//	fora.json.
	//
	//	One encoding. The bytes MUST be well-formed UTF-8 (RFC 8259 requires it for
	//	interchange) and MUST NOT begin with a byte order mark. RFC 8259 forbids
	//	ADDING a mark and lets a parser ignore one, so both policies conform and the
	//	choice is made here rather than left to each implementation: parsers differ,
	//	and one that strips a mark validates a different document — and counts three
	//	bytes against the size cap that the schema does not contain. A consumer MUST
	//	NOT repair ill-formed bytes either; substituting U+FFFD silently enforces a
	//	schema nobody published. A mark is in any case only valid at the start of a
	//	JSON text, and this is a member inside one.
	//
	//	Bounded depth: 32 nested JSON containers, counting the schema itself as the
	//	first.
	//
	//	Bounded WORK: 10000 evaluations, counted statically over the SCHEMA — each
	//	anyOf/oneOf/allOf branch and prefixItems entry costs its own subschema, and a
	//	$ref costs its target. It is the cost of applying the schema at ONE location
	//	in a payload, not of a whole payload: a subschema under `items` is counted
	//	once here and evaluated once per element at runtime. The size and depth caps
	//	do not bound it and are not a substitute for it: branches multiply along a
	//	reference chain, so a 1.6KB schema five containers deep can cost tens of
	//	millions of evaluations and tens of seconds against a two-member payload. A
	//	definition nobody references costs nothing, so a document may carry a library
	//	of them.
	//
	//	Bounded reference chains: 100 hops, counted as the longest path of $ref hops
	//	rather than as the number of references the document contains. This is a
	//	THIRD axis, and a flat chain of definitions shows why it has to be: each one
	//	referring to the next is three JSON containers deep however long it is, so
	//	the depth cap never sees it, and it costs one evaluation per link, so the
	//	work cap does not either. What it does reach is the recursion a validator
	//	performs while resolving the chain — a chain of a few hundred exhausted one
	//	implementation's stack outright, on a document every other rule had passed.
	//	A schema describing a business entity chains one or two references.
	//
	//	No reference cycles. A $ref chain MUST NOT return to a schema already on it.
	//	The construct is legal JSON Schema and is how a recursive structure is
	//	written, but its evaluation cost has no static bound and it is what makes a
	//	validator recurse until it aborts. Registration data describes a business
	//	entity, which is not a recursive shape.
	//
	//	A portable `pattern` alphabet, stated as what a pattern MAY contain rather
	//	than as what it may not. A group MUST open with "(" or "(?:" and nothing
	//	else; only the escapes \$, \(, \), \*, \+, \., \/, \?, \D, \W, \[, \\, \],
	//	\^, \d, \f, \n, \r, \t, \v, \w, \{, \| and \} MAY appear, together with \xHH
	//	carrying exactly two hexadecimal digits (spelled out rather than ranged, so a
	//	conformance guard can check the set character by character); a counted repeat
	//	MUST NOT exceed 1000 and MUST state its first bound, so "a{2,}" is admitted
	//	and "a{,5}" is not; a "}" outside a bracket expression MUST close a counted
	//	repeat, so a literal brace is written "\}"; "[:" MUST NOT appear inside a
	//	bracket expression; a bracket expression MUST close and MUST NOT open with
	//	"]"; and a range endpoint MUST NOT be one of the shorthand classes ("[\w-x]").
	//
	//	The two brace rules are there for the same reason as the bracket ones, and
	//	were found the same way. "a{,5}" is five literal characters to RE2 and a
	//	repeat of zero to five to Python, so both engines compile it and then
	//	disagree about which payloads match — the silent kind. An unmatched "}" is a
	//	literal to RE2 and to Python and a syntax error to ECMA-262 under the `u`
	//	flag, which is the loud kind, and exactly what the unmatched "]" rule above
	//	already refuses.
	//
	//	The direction of that rule is the rule. Draft 2020-12 patterns are ECMA-262,
	//	but the engines implementations run do not agree on it, and the set they
	//	disagree about has no end: it grows with every dialect and every library
	//	version, so a list of forbidden escapes needs a new entry each time somebody
	//	finds one, and until then the gap is open. The portable set is small and
	//	closed, and an author who wants a construct outside it writes the characters
	//	out instead.
	//
	//	Some of the disagreement is loud — RE2 refuses the lookaround, atomic groups
	//	and backreferences ECMA allows, so a schema using them compiles for one
	//	implementation and fails for another. The rest is SILENT, and is why this is
	//	a MUST rather than a SHOULD: inline flags, Unicode property classes, text
	//	anchors and POSIX bracket names are accepted by one engine and either refused
	//	or read DIFFERENTLY by the next, so two conformant validators both compile
	//	the pattern and then disagree about which payloads match it, with nothing
	//	logged. `\s` and `\B` are the plainest examples — RE2 reads `\s` as
	//	[\t\n\f\r ], Python adds the vertical tab, and ECMA-262 adds that plus every
	//	Unicode space separator; `\B` finds no word boundary in the empty string for
	//	RE2 and ECMA-262 and finds one for Python. An explicit character class says
	//	what was meant and means it everywhere.
	//
	//	Where a pattern may appear. `pattern` states its regex as a value and
	//	`patternProperties` states its regexes as KEYS; both are patterns and both
	//	are held to the alphabet above. They are the only two keywords in the dialect
	//	that carry one — `propertyNames` reaches the rule through the subschema it
	//	applies.
	//
	//	No nested quantifiers. A quantified group MUST NOT have a body that can
	//	itself repeat or branch: `(a+)+`, `(a|a)*` and `([a-z]+)*` are refused, while
	//	`(?:ab)+` is admitted. This is the denial-of-service half of the pattern
	//	rule, and it is deliberately SEPARATE from the alphabet above, because
	//	excluding lookaround and backreferences does not cover it — catastrophic
	//	backtracking needs neither. It has to be a publishing rule rather than a
	//	runtime bound: a regex spin holds its interpreter, so a consumer cannot
	//	reliably interrupt one it has already started.
	//
	//	Annotations stay annotations. A consumer MUST NOT assert format,
	//	contentEncoding or contentMediaType. Libraries default differently on each,
	//	and a schema whose verdict depends on which library read it has no single
	//	answer.
	//
	// The value MUST be a JSON object. Draft 2020-12 also admits a bare boolean as a
	// schema, but this field is a Struct and cannot carry one.
	//
	// A consumer that finds a schema breaking any of these MUST refuse it, and MUST
	// then SKIP its local pre-check rather than repair or truncate the schema —
	// leaving the Exchange's own enforcement the deciding check, exactly as when no
	// schema is published. Refusing locally and declining to send would turn a rule
	// about reading a third party's document into a denial of service against the
	// consumer's own user. That is the CLIENT side. An Exchange that cannot compile
	// its OWN configured schema is looking at a misconfiguration of its deployment,
	// and MUST NOT advertise a schema it is not itself enforcing.
	DataSchema *structpb.Struct `protobuf:"bytes,1,opt,name=data_schema,json=dataSchema,proto3" json:"data_schema,omitempty"`
	// contains filtered or unexported fields
}

type AgentAcceptance struct {

	// Hex-encoded detached Ed25519 signature over the canonical AgentAcceptancePayload
	// bytes (see the canonical-signing definition on Offer.signature).
	Signature string `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
	// Signature algorithm; "EdDSA" for Ed25519.
	SignatureAlgorithm string `protobuf:"bytes,2,opt,name=signature_algorithm,json=signatureAlgorithm,proto3" json:"signature_algorithm,omitempty"`
	// contains filtered or unexported fields
}

type AgentAcceptancePayload struct {

	// The accepted Offer's signature (Offer.signature). Anchors the whole signed
	// offer without re-serializing its terms/pricing/expiry.
	OfferSig string `protobuf:"bytes,1,opt,name=offer_sig,json=offerSig,proto3" json:"offer_sig,omitempty"`
	// Requester identity (Requester.id) the acceptance is bound to.
	RequesterId string `protobuf:"bytes,2,opt,name=requester_id,json=requesterId,proto3" json:"requester_id,omitempty"`
	// Requester domain (Requester.domain) the acceptance is bound to.
	RequesterDomain string `protobuf:"bytes,3,opt,name=requester_domain,json=requesterDomain,proto3" json:"requester_domain,omitempty"`
	// The transaction's idempotency key — binds the acceptance to a single
	// execute so it cannot be replayed under a different transaction.
	IdempotencyKey string `protobuf:"bytes,4,opt,name=idempotency_key,json=idempotencyKey,proto3" json:"idempotency_key,omitempty"`
	// contains filtered or unexported fields
}

type AgentRequestAcceptance struct {

	// The signed payload is carried because a projected subrequest does not carry
	// offers addressed to other Exchanges and therefore cannot reconstruct the
	// original complete set by itself.
	Payload *AgentRequestAcceptancePayload `protobuf:"bytes,1,opt,name=payload,proto3" json:"payload,omitempty"`
	// Hex-encoded detached Ed25519 signature over the canonical payload bytes.
	Signature string `protobuf:"bytes,2,opt,name=signature,proto3" json:"signature,omitempty"`
	// Signature algorithm; "EdDSA" for Ed25519.
	SignatureAlgorithm string `protobuf:"bytes,3,opt,name=signature_algorithm,json=signatureAlgorithm,proto3" json:"signature_algorithm,omitempty"`
	// contains filtered or unexported fields
}

type AgentRequestAcceptanceItem struct {
	OfferSig string `protobuf:"bytes,1,opt,name=offer_sig,json=offerSig,proto3" json:"offer_sig,omitempty"`
	Exchange string `protobuf:"bytes,2,opt,name=exchange,proto3" json:"exchange,omitempty"`
	// contains filtered or unexported fields
}

type AgentRequestAcceptancePayload struct {

	// Complete original request order, before Broker fan-out. Capped at 256 —
	// the same ceiling a discovery query's uris list carries, so one request
	// can reference at most one offer per queried URI at the query cap. The Go
	// verification helper enforces the same bound itself before doing any
	// canonicalization work, because a verifier may run with wire validation
	// off and the canonical rendering of an unbounded list is the expensive
	// step an unauthenticated caller could otherwise buy for free.
	Items           []*AgentRequestAcceptanceItem `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	RequesterId     string                        `protobuf:"bytes,2,opt,name=requester_id,json=requesterId,proto3" json:"requester_id,omitempty"`
	RequesterDomain string                        `protobuf:"bytes,3,opt,name=requester_domain,json=requesterDomain,proto3" json:"requester_domain,omitempty"`
	IdempotencyKey  string                        `protobuf:"bytes,4,opt,name=idempotency_key,json=idempotencyKey,proto3" json:"idempotency_key,omitempty"`
	// contains filtered or unexported fields
}

type AttributionDetail struct {

	// URL displayed to the user as the attribution link.
	DisplayedUrl *string `protobuf:"bytes,1,opt,name=displayed_url,json=displayedUrl,proto3,oneof" json:"displayed_url,omitempty"`
	// How the citation was presented.
	Format *CitationFormat `protobuf:"varint,2,opt,name=format,proto3,enum=fora.v1.CitationFormat,oneof" json:"format,omitempty"`
	// Whether the attribution was visible to the end user.
	VisibleToUser *bool `protobuf:"varint,3,opt,name=visible_to_user,json=visibleToUser,proto3,oneof" json:"visible_to_user,omitempty"`
	// contains filtered or unexported fields
}

type AuthMethod int32

type AuthorizedExchange struct {

	// Canonical domain of the Exchange, in the shape "Request recipient" defines
	// in the file header.
	Domain string `protobuf:"bytes,1,opt,name=domain,proto3" json:"domain,omitempty"`
	// FORA ExchangeService endpoint URL.
	Endpoint string `protobuf:"bytes,2,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
	// Relationship type (mirrors ads.txt DIRECT/RESELLER).
	Relationship ProviderRelationship `protobuf:"varint,3,opt,name=relationship,proto3,enum=fora.v1.ProviderRelationship" json:"relationship,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type C2PAStatus int32

type CatalogContributor struct {

	// Canonical domain of the authorized contributor (e.g., "doubleverify.com").
	Domain string `protobuf:"bytes,1,opt,name=domain,proto3" json:"domain,omitempty"`
	// Relationship of this contributor to the provider.
	// Examples: "verifier" (resource intelligence vendor that attests to resource
	// properties), "exchange" (an Exchange that enriches catalog entries).
	Relationship string `protobuf:"bytes,2,opt,name=relationship,proto3" json:"relationship,omitempty"`
	// contains filtered or unexported fields
}

type CatalogRejection struct {

	// The rejection reason (defined-only, non-zero)
	Reason CatalogRejectionReason `protobuf:"varint,1,opt,name=reason,proto3,enum=fora.v1.CatalogRejectionReason" json:"reason,omitempty"`
	// The entry paths the refusal is about. A catalog push is all-or-nothing, so
	// these name which entries failed inside a submission that persisted nothing —
	// they are not a list of what was dropped from an otherwise applied batch.
	RejectedPaths []string `protobuf:"bytes,2,rep,name=rejected_paths,json=rejectedPaths,proto3" json:"rejected_paths,omitempty"`
	// contains filtered or unexported fields
}

type CatalogRejectionReason int32

type CitationFormat int32

type Cost struct {

	// Exact decimal string (not a float), e.g. "19.99". Denominated in `currency`.
	Amount   string  `protobuf:"bytes,1,opt,name=amount,proto3" json:"amount,omitempty"`
	Currency string  `protobuf:"bytes,2,opt,name=currency,proto3" json:"currency,omitempty"`                       // ISO 4217
	UnitCost *string `protobuf:"bytes,3,opt,name=unit_cost,json=unitCost,proto3,oneof" json:"unit_cost,omitempty"` // Effective cost per unit (decimal string)
	// contains filtered or unexported fields
}

type Delegation struct {

	// Who granted this delegation (domain for public key lookup).
	PrincipalDomain string `protobuf:"bytes,1,opt,name=principal_domain,json=principalDomain,proto3" json:"principal_domain,omitempty"`
	// Principal's identifier (e.g., "user@acme.com", "marketdata.example.com").
	PrincipalId string `protobuf:"bytes,2,opt,name=principal_id,json=principalId,proto3" json:"principal_id,omitempty"`
	// Scopes granted by this delegation. MUST be a subset of the
	// principal's own scopes (attenuation — can only narrow, not widen).
	Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// When this delegation expires. Exchange MUST reject expired tokens.
	ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	// Maximum spend in currency minor units (e.g., cents for USD).
	// Exchange tracks cumulative spend against this cap.
	MaxSpendCents *int64 `protobuf:"varint,5,opt,name=max_spend_cents,json=maxSpendCents,proto3,oneof" json:"max_spend_cents,omitempty"`
	// Maximum number of accesses allowed under this delegation.
	// Exchange tracks cumulative access count against this cap.
	// Deny with DENIAL_REASON_QUOTA_EXCEEDED when count >= limit.
	// For subscriptions with "10,000 accesses/month", this carries the ceiling.
	MaxAccesses *int32 `protobuf:"varint,9,opt,name=max_accesses,json=maxAccesses,proto3,oneof" json:"max_accesses,omitempty"`
	// Quota reset period. How often the access/spend counters reset.
	// Example: 30 days for monthly subscriptions — "2592000s" on the wire
	// (proto-JSON encodes Duration as seconds; "720h" is not accepted).
	// When absent, the quota is lifetime (bounded only by expires_at).
	QuotaPeriod *durationpb.Duration `protobuf:"bytes,10,opt,name=quota_period,json=quotaPeriod,proto3,oneof" json:"quota_period,omitempty"`
	// Token bytes. A JWT (base64url-encoded JWS).
	Token []byte `protobuf:"bytes,6,opt,name=token,proto3" json:"token,omitempty"`
	// Token format: "jwt" (default). Empty is treated as "jwt". The field stays
	// open for a future format.
	TokenFormat string `protobuf:"bytes,7,opt,name=token_format,json=tokenFormat,proto3" json:"token_format,omitempty"`
	// Optional: URI for real-time revocation checking.
	// Exchange MAY check this for high-value transactions.
	// Not checked for routine low-value access (performance tradeoff).
	RevocationUri *string `protobuf:"bytes,8,opt,name=revocation_uri,json=revocationUri,proto3,oneof" json:"revocation_uri,omitempty"`
	// Token issuer. OIDC issuer URL or GNAP grant server URL.
	// Exchange uses this for JWT validation (OIDC discovery → JWKS)
	// or GNAP token introspection.
	Issuer *string `protobuf:"bytes,11,opt,name=issuer,proto3,oneof" json:"issuer,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type DeliveryMethod int32

type DenialReason int32

type DiscoveryMethod int32

type DiscoveryRequest struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// Requester identity — who is making this request, what scopes they have.
	// The Broker forwards this to Exchanges in ResourceQuery.requester.
	Requester *Requester `protobuf:"bytes,3,opt,name=requester,proto3" json:"requester,omitempty"`
	// Resource URIs the agent wants. The Broker forwards these to Exchanges in
	// ResourceQuery.uris. Optional when `query` / `search_filters` drive
	// Broker-side discovery instead.
	Uris []string `protobuf:"bytes,8,rep,name=uris,proto3" json:"uris,omitempty"`
	// The limits the agent will operate within, per restriction axis — see
	// AcceptableRestriction. The Broker forwards these to Exchanges in
	// ResourceQuery.acceptable_restrictions. Advisory selection inputs, not
	// enforcement.
	AcceptableRestrictions []*AcceptableRestriction `` /* 127-byte string literal not displayed */
	// Constraints for exchange filtering and offer selection.
	Constraints *RequestConstraints `protobuf:"bytes,4,opt,name=constraints,proto3,oneof" json:"constraints,omitempty"`
	// Domain extension profiles the agent understands.
	//
	// The Broker uses this to:
	//  1. Route queries to Exchanges that support these profiles
	//  2. Forward the profiles in ResourceQuery.supported_profiles
	//  3. Include profile-specific ext fields when returning results
	//
	// Examples: ["fora-academic-v1"] — agent working on literature review
	SupportedProfiles []string `protobuf:"bytes,5,rep,name=supported_profiles,json=supportedProfiles,proto3" json:"supported_profiles,omitempty"`
	// Search query for Broker-side resource discovery.
	// Used when the agent doesn't know specific URIs but wants the Broker
	// to find matching resources across Exchanges.
	// When present, the Broker interprets the query and discovers resources
	// across Exchanges on the agent's behalf. Results returned as Offers
	// in DiscoveryResponse, same as for specific URI requests.
	// Can be used alongside uris (specific URIs + search in one request).
	Query *string `protobuf:"bytes,6,opt,name=query,proto3,oneof" json:"query,omitempty"`
	// Structured search filters (optional, alongside or instead of query).
	// Keys are profile-specific: "academic.topic", "news.category",
	// "legal.jurisdiction", etc. The Broker maps these to Exchange-specific
	// query parameters.
	SearchFilters *structpb.Struct `protobuf:"bytes,7,opt,name=search_filters,json=searchFilters,proto3,oneof" json:"search_filters,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type DiscoveryResponse struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// Offers grouped by requested URI — the sole offer representation in this
	// response. One OfferGroup per URI the agent asked for (echoed in
	// OfferGroup.uri); a group with no offers carries OfferGroup.absence_reason
	// explaining why. Each contained Offer is the full signed Offer the Exchange
	// issued (including Offer.exchange, the execute-routing target), forwarded by
	// the Broker unchanged so the agent can verify the signature end to end.
	OfferGroups []*OfferGroup `protobuf:"bytes,4,rep,name=offer_groups,json=offerGroups,proto3" json:"offer_groups,omitempty"`
	// Why the resolve produced no offers at all. Set (and offer_groups empty) on a
	// successful "no result" answer; unset when offer_groups is non-empty. Same
	// vocabulary DiscoverResources uses for OfferGroup.absence_reason.
	// RESTRICTION_FILTERED may appear here, but Resolve does not surface the
	// per-axis detail: DiscoveryResponse has no restriction_filters companion
	// (unlike OfferGroup). A consumer needing the filtered axes calls
	// DiscoverResources.
	//
	// Existence-oracle note: an authorization-flavored reason (SCOPE_INSUFFICIENT,
	// NOT_AUTHORIZED, NOT_IN_CATALOG, CONTENT_BLOCKED) confirms a resource exists
	// and why access was refused. Resolve surfaces the same oracle at the broker
	// that OfferGroup.absence_reason does at the Exchange, so the same mitigation
	// applies: where existence itself must stay hidden, the Broker MAY omit the
	// reason (leave this unset) rather than reveal it. See the threat model.
	AbsenceReason *OfferAbsenceReason `` /* 140-byte string literal not displayed */
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type DisputeFailure struct {

	// The failure reason (defined-only, non-zero)
	Reason DisputeFailureReason `protobuf:"varint,1,opt,name=reason,proto3,enum=fora.v1.DisputeFailureReason" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type DisputeFailureReason int32

type DisputeReason int32

type DisputeRequest struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// Idempotency key (REQUIRED). The server MUST dedupe on this so a replayed
	// filing does not open a duplicate case. The dispute's durable identity is the
	// Exchange-assigned dispute_id in DisputeResponse.
	// Uniqueness is scoped to the verified RFC 9421 signer: the server dedupes per
	// (authenticated caller, key), never globally, so a key chosen by one caller
	// cannot collide with another's cached result.
	IdempotencyKey string `protobuf:"bytes,2,opt,name=idempotency_key,json=idempotencyKey,proto3" json:"idempotency_key,omitempty"`
	// Transaction being disputed.
	TransactionId string `protobuf:"bytes,3,opt,name=transaction_id,json=transactionId,proto3" json:"transaction_id,omitempty"`
	// Billing record identifier from the disputed transaction
	// (TransactionResultItem.billing_id).
	BillingId string `protobuf:"bytes,4,opt,name=billing_id,json=billingId,proto3" json:"billing_id,omitempty"`
	// Reason for the dispute.
	Reason DisputeReason `protobuf:"varint,5,opt,name=reason,proto3,enum=fora.v1.DisputeReason" json:"reason,omitempty"`
	// Human-readable description of the issue.
	Description *string `protobuf:"bytes,6,opt,name=description,proto3,oneof" json:"description,omitempty"`
	// Evidence: content hash of what was actually received.
	// Exchange compares against the hash promised in ResourceIdentity.
	ReceivedContentHash *string `` /* 126-byte string literal not displayed */
	// Hash algorithm the agent used
	ReceivedHashMethod *string `protobuf:"bytes,8,opt,name=received_hash_method,json=receivedHashMethod,proto3,oneof" json:"received_hash_method,omitempty"`
	// Must reference a filed UsageReport. The agent MUST file a UsageReport
	// (via ReportUsage RPC) and receive a report_id BEFORE filing a dispute.
	// This prevents fire-and-forget disputes and ensures the Exchange has
	// the complete evidence chain: what was offered, what was transacted,
	// what the agent reported using, and what the agent disputes.
	// The dispute chain: Transaction → UsageReport → Dispute.
	ReportId string `protobuf:"bytes,9,opt,name=report_id,json=reportId,proto3" json:"report_id,omitempty"`
	// REQUIRED. Bare host of the recipient this request is addressed to (e.g.
	// "exchange.example" or "exchange.example:8081"). See "Request recipient" in
	// the file header. The dispute's subject identifiers above cannot stand in for
	// it: transaction_id, billing_id and report_id are opaque and Exchange-scoped,
	// so verifying one means a database lookup, while the recipient check must run
	// before any lookup happens.
	Exchange string `protobuf:"bytes,10,opt,name=exchange,proto3" json:"exchange,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type DisputeResponse struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// Exchange-assigned dispute case identifier.
	DisputeId *string `protobuf:"bytes,2,opt,name=dispute_id,json=disputeId,proto3,oneof" json:"dispute_id,omitempty"`
	// Expected resolution timeline.
	EstimatedResolution *durationpb.Duration `protobuf:"bytes,4,opt,name=estimated_resolution,json=estimatedResolution,proto3,oneof" json:"estimated_resolution,omitempty"`
	// Current lifecycle status of the dispute. Tracks progression through
	// the three-tier resolution process:
	//
	//	Tier 1 (automated, <1s): FILED → AUTO_RESOLVED or EVIDENCE_NEEDED
	//	Tier 2 (rule-based, <24h): UNDER_REVIEW → RESOLVED
	//	Tier 3 (pattern investigation, async): ESCALATED → SETTLED → FINAL
	//
	// Losing party may appeal: RESOLVED → APPEALED → back to UNDER_REVIEW.
	Status DisputeStatus `protobuf:"varint,5,opt,name=status,proto3,enum=fora.v1.DisputeStatus" json:"status,omitempty"`
	// Resolution outcome, populated when the dispute reaches a terminal
	// state (RESOLVED, SETTLED, or FINAL). Absent while dispute is in
	// progress (FILED, UNDER_REVIEW, ESCALATED, etc.).
	Resolution *ResolutionType `protobuf:"varint,6,opt,name=resolution,proto3,enum=fora.v1.ResolutionType,oneof" json:"resolution,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type DisputeStatus int32

type DomainVerificationChallenge struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// Opaque challenge token. Provider must serve this at:
	// https://{domain}/.well-known/fora-verify/{token}
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// When this challenge expires. Provider must confirm before this time.
	ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	// The exact URL the Exchange will fetch to verify.
	VerificationUrl string `protobuf:"bytes,4,opt,name=verification_url,json=verificationUrl,proto3" json:"verification_url,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type DomainVerificationConfirmation struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// The domain being verified.
	Domain string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
	// The challenge token (echoed from DomainVerificationChallenge).
	Token string `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"`
	// Optional: the delivery endpoint's verification key, registered atomically
	// with the domain on successful verification. PUBLIC key material only.
	// The Exchange signs delivery URLs with a private key it holds and never
	// publishes; a delivery endpoint verifies with the public half and holds
	// nothing secret. Where the Exchange has to sign with a key the provider
	// generated -- a CloudFront trusted key group is the provider's own AWS
	// resource -- the private half is provisioned to the Exchange out of band
	// and never travels in this field.
	//
	// Format follows cdn_type: a PEM-encoded RSA public key for "cloudfront", or
	// the base64url-encoded raw Ed25519 public key (the JWK "x" value) for
	// "edge-ed25519".
	SigningKey *string `protobuf:"bytes,4,opt,name=signing_key,json=signingKey,proto3,oneof" json:"signing_key,omitempty"`
	// Which delivery-URL verification scheme this key is for: "edge-ed25519" (a
	// code-capable edge that verifies the Ed25519 URL signature itself) or
	// "cloudfront" (AWS CloudFront trusted key groups, RSA, verified natively by
	// the CDN). One value per Exchange-side tenant signing scheme:
	// "edge-ed25519" is ED25519, "cloudfront" is AWS_CLOUDFRONT_RSA.
	CdnType *string `protobuf:"bytes,5,opt,name=cdn_type,json=cdnType,proto3,oneof" json:"cdn_type,omitempty"`
	// REQUIRED. Bare host of the recipient this request is addressed to (e.g.
	// "exchange.example" or "exchange.example:8081"). See "Request recipient" in
	// the file header. Distinct from `domain` above, which is the provider domain
	// being verified — the subject of the request, not its recipient.
	Exchange string `protobuf:"bytes,6,opt,name=exchange,proto3" json:"exchange,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type DomainVerificationFailure struct {

	// The failure reason (defined-only, non-zero)
	Reason DomainVerificationFailureReason `protobuf:"varint,1,opt,name=reason,proto3,enum=fora.v1.DomainVerificationFailureReason" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type DomainVerificationFailureReason int32

type DomainVerificationRequest struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// The provider domain to verify (e.g., "techcrunch.com").
	Domain string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
	// Caller identity (registered with the Exchange).
	CallerId *string `protobuf:"bytes,3,opt,name=caller_id,json=callerId,proto3,oneof" json:"caller_id,omitempty"`
	// REQUIRED. Bare host of the recipient this request is addressed to (e.g.
	// "exchange.example" or "exchange.example:8081"). See "Request recipient" in
	// the file header. Distinct from `domain` above, which is the provider domain
	// being verified — the subject of the request, not its recipient.
	Exchange string `protobuf:"bytes,4,opt,name=exchange,proto3" json:"exchange,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type DomainVerificationResult struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// If signing_key was provided: confirmation of key registration.
	KeyId *string `protobuf:"bytes,2,opt,name=key_id,json=keyId,proto3,oneof" json:"key_id,omitempty"`
	// Verification is valid until this time. Provider must re-verify periodically.
	ValidUntil *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=valid_until,json=validUntil,proto3,oneof" json:"valid_until,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type ErrorDetail struct {

	// Developer-facing, NON-authoritative human message. Clients MUST branch on
	// the typed reason below, never on this text. Servers SHOULD NOT place secrets,
	// PII, or existence/authorization detail here that the closed typed reason
	// deliberately withholds: unlike the enum, this free text is unbounded and
	// easily becomes an existence oracle or leak channel (see `metadata`).
	Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	// Stable grouping for the failing surface, e.g. "fora.v1.ExchangeService".
	// Mirrors google.rpc.ErrorInfo.domain so generic tooling can group errors.
	Domain string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
	// Dynamic key/value context that also appears in `message` (ids, limits,
	// axes). Mirrors google.rpc.ErrorInfo.metadata. Strongly-typed context rides
	// in the per-domain reason block below instead. Same leakage rule as `message`:
	// servers SHOULD NOT put secrets, PII, or withheld existence/authorization
	// detail here — it is the same potential side channel as the absence oracle.
	Metadata map[string]string `` /* 143-byte string literal not displayed */
	// Exactly one typed reason block, selected by the failing method. Absent for
	// generic transport-class failures (e.g. INVALID_ARGUMENT, INTERNAL) that
	// carry no domain-specific reason.
	//
	// Types that are valid to be assigned to Reason:
	//
	//	*ErrorDetail_TransactionDenial
	//	*ErrorDetail_CatalogRejection
	//	*ErrorDetail_RegistrationFailure
	//	*ErrorDetail_DisputeFailure
	//	*ErrorDetail_DomainVerificationFailure
	//	*ErrorDetail_RetrievalAuthFailure
	//	*ErrorDetail_UsageReportRejection
	Reason isErrorDetail_Reason `protobuf_oneof:"reason"`
	// contains filtered or unexported fields
}

type ErrorDetail_CatalogRejection struct {
	// `reason` oneof — CatalogService rejection
	CatalogRejection *CatalogRejection `protobuf:"bytes,11,opt,name=catalog_rejection,json=catalogRejection,proto3,oneof"`
}

type ErrorDetail_DisputeFailure struct {
	// `reason` oneof — DisputeTransaction filing refused
	DisputeFailure *DisputeFailure `protobuf:"bytes,13,opt,name=dispute_failure,json=disputeFailure,proto3,oneof"`
}

type ErrorDetail_DomainVerificationFailure struct {
	// `reason` oneof — domain verification failed
	DomainVerificationFailure *DomainVerificationFailure `protobuf:"bytes,14,opt,name=domain_verification_failure,json=domainVerificationFailure,proto3,oneof"`
}

type ErrorDetail_RegistrationFailure struct {
	// `reason` oneof — agent/provider registration refused
	RegistrationFailure *RegistrationFailure `protobuf:"bytes,12,opt,name=registration_failure,json=registrationFailure,proto3,oneof"`
}

type ErrorDetail_RetrievalAuthFailure struct {
	// `reason` oneof — signed-URL / proof-of-possession check failed
	RetrievalAuthFailure *RetrievalAuthFailure `protobuf:"bytes,15,opt,name=retrieval_auth_failure,json=retrievalAuthFailure,proto3,oneof"`
}

type ErrorDetail_TransactionDenial struct {
	// `reason` oneof — ExecuteTransaction denial
	TransactionDenial *TransactionDenial `protobuf:"bytes,10,opt,name=transaction_denial,json=transactionDenial,proto3,oneof"`
}

type ErrorDetail_UsageReportRejection struct {
	// `reason` oneof — ReportUsage filing rejected
	UsageReportRejection *UsageReportRejection `protobuf:"bytes,16,opt,name=usage_report_rejection,json=usageReportRejection,proto3,oneof"`
}

type GetAccountStatusRequest struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// REQUIRED. Bare host of the recipient this request is addressed to (e.g.
	// "exchange.example" or "exchange.example:8081"). See "Request recipient" in
	// the file header. Accounts are per-Exchange, so "which Exchange am I asking
	// about" is not derivable from anything else in this message.
	Exchange string `protobuf:"bytes,2,opt,name=exchange,proto3" json:"exchange,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type GetAccountStatusResponse struct {

	// FORA protocol version — "1.0". Stamped by the sender from a single
	// constant; advisory on receive. See "Protocol version" in the file header.
	Ver string `protobuf:"bytes,1,opt,name=ver,proto3" json:"ver,omitempty"`
	// The account handle minted at registration (see RegisterResponse.billing_ref).
	// Empty when the calling agent has no account yet.
	BillingRef string `protobuf:"bytes,2,opt,name=billing_ref,json=billingRef,proto3" json:"billing_ref,omitempty"`
	// Whether the account is currently active.
	Active bool `protobuf:"varint,3,opt,name=active,proto3" json:"active,omitempty"`
	// The terms document this account ACCEPTED: the "method:hexdigest" value the
	// agent echoed in RegisterRequest.terms_digest, which the Exchange recorded
	// with the account. This is the read side of that record. Without it the
	// protocol required an Exchange to store the acceptance and named the question
	// the record exists to answer — "which terms did this operator accept" — while
	// giving no way to ask it, so the only party who could check what it had agreed
	// to was the party holding the database.
	//
	// An Exchange that holds a recorded digest for this account MUST return it
	// here. Absence has exactly ONE meaning: no acceptance is recorded. Two
	// situations produce it — the Exchange publishes no terms_digest, so nothing
	// was ever accepted (and per RegisterRequest.terms_digest it MUST NOT record a
	// presented value in that case), or the account was created before the operator
	// began publishing one. It does NOT mean "this account has no terms", and an
	// Exchange MUST NOT withhold a digest it holds: absence is already spoken for,
	// so withholding would make the field state something untrue.
	//
	// The value is what was ACCEPTED, not what is published now. The two differ as
	// soon as the operator revises its terms, and that difference is the point:
	// comparing this against a freshly fetched WellKnownManifest.terms_digest is how
	// an agent discovers that the terms moved under an account it already holds. A
	// repeat Register will not tell it — a repeat is answered from the stored record
	// and runs no gate at all.
	TermsDigest *string `protobuf:"bytes,4,opt,name=terms_digest,json=termsDigest,proto3,oneof" json:"terms_digest,omitempty"`
	// Extension point
	Ext *structpb.Struct `protobuf:"bytes,15,opt,name=ext,proto3" json:"ext,omitempty"`
	// Critical extension keys (COSE crit pattern, RFC 9052).
	// Lists keys within ext that the consumer MUST understand.
	// Unknown keys in this list → reject with UNKNOWN_CRITICAL_EXTENSION.
	// Empty (default) → all ext keys are safe to ignore.
	ExtCritical []string `protobuf:"bytes,90,rep,name=ext_critical,json=extCritical,proto3" json:"ext_critical,omitempty"`
	// contains filtered or unexported fields
}

type IngestionSource int32

type JsonWebKey struct {

	// Key type. FORA v1.0: MUST be "OKP".
	Kty string `protobuf:"bytes,2,opt,name=kty,proto3" json:"kty,omitempty"`
	// Curve. FORA v1.0: MUST be "Ed25519".
	Crv string `protobuf:"bytes,3,opt,name=crv,proto3" json:"crv,omitempty"`
	// Intended key use. FORA v1.0: MUST be "sig".
	Use string `protobuf:"bytes,4,opt,name=use,proto3" json:"use,omitempty"`
	// Signing algorithm. FORA v1.0: MUST be "EdDSA".
	Alg string `protobuf:"bytes,5,opt,name=alg,proto3" json:"alg,omitempty"`
	// base64url-encoded 32-byte Ed25519 public key.
	X string `protobuf:"bytes,6,opt,name=x,proto3" json:"x,omitempty"`
	// RFC3339 timestamp. Key is invalid before this instant.
	NotBefore string `protobuf:"bytes,7,opt,name=not_before,json=notBefore,proto3" json:"not_before,omitempty"`
	// RFC3339 timestamp. Key is invalid at and after this instant
	// (strict upper bound).
	NotAfter string `protobuf:"bytes,8,opt,name=not_after,json=notAfter,proto3" json:"not_after,omitempty"`
	// contains filtered or unexported fields
}