agentpb

type AgentInfo struct {
	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
	Commit  string `protobuf:"bytes,2,opt,name=commit,proto3" json:"commit,omitempty"`
	Os      string `protobuf:"bytes,3,opt,name=os,proto3" json:"os,omitempty"`
	Arch    string `protobuf:"bytes,4,opt,name=arch,proto3" json:"arch,omitempty"`
	// contains filtered or unexported fields
}

type AgentMessage struct {

	// Types that are valid to be assigned to Payload:
	//
	//	*AgentMessage_Response
	//	*AgentMessage_Event
	//	*AgentMessage_ExecOutput
	//	*AgentMessage_ExecCredit
	//	*AgentMessage_BuildOutput
	//	*AgentMessage_BuildCredit
	//	*AgentMessage_Heartbeat
	//	*AgentMessage_GpuReport
	//	*AgentMessage_Hello
	//	*AgentMessage_HostReport
	Payload isAgentMessage_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type AgentMessage_BuildCredit struct {
	// BuildCredit here refunds the control plane's build-context window:
	// the agent has consumed that many BuildInput frames.
	BuildCredit *BuildCredit `protobuf:"bytes,6,opt,name=build_credit,json=buildCredit,proto3,oneof"`
}

type AgentMessage_BuildOutput struct {
	BuildOutput *BuildOutput `protobuf:"bytes,5,opt,name=build_output,json=buildOutput,proto3,oneof"`
}

type AgentMessage_Event struct {
	Event *ProxiedEvent `protobuf:"bytes,2,opt,name=event,proto3,oneof"`
}

type AgentMessage_ExecCredit struct {
	// ExecCredit here refunds the control plane's stdin window: the
	// agent has consumed that many ExecInput frames.
	ExecCredit *ExecCredit `protobuf:"bytes,4,opt,name=exec_credit,json=execCredit,proto3,oneof"`
}

type AgentMessage_ExecOutput struct {
	ExecOutput *ExecOutput `protobuf:"bytes,3,opt,name=exec_output,json=execOutput,proto3,oneof"`
}

type AgentMessage_GpuReport struct {
	GpuReport *GPUReport `protobuf:"bytes,8,opt,name=gpu_report,json=gpuReport,proto3,oneof"`
}

type AgentMessage_Heartbeat struct {
	// Heartbeat is an unprompted liveness signal the agent sends up this
	// stream at a fixed interval, on its own initiative, independent of
	// any AgentRequest/AgentResponse traffic. This is deliberately a real
	// application-level message, not inferred from the stream merely
	// staying open: internal/agent.Server only refreshes a node's
	// last_seen_at when this frame actually arrives, so a frozen agent
	// process (hung, deadlocked, or stopped without exiting) whose TCP/TLS
	// connection is still technically established stops advancing
	// last_seen_at the moment it stops actually running, rather than
	// looking healthy for as long as the transport happens to stay up.
	Heartbeat *Heartbeat `protobuf:"bytes,7,opt,name=heartbeat,proto3,oneof"`
}

type AgentMessage_Hello struct {
	// Hello is sent once, first, on every Session. Control planes that
	// predate it ignore the frame.
	Hello *AgentInfo `protobuf:"bytes,9,opt,name=hello,proto3,oneof"`
}

type AgentMessage_HostReport struct {
	// HostReport is the agent's host memory split, sent periodically.
	// Control planes that predate it ignore the frame.
	HostReport *HostReport `protobuf:"bytes,10,opt,name=host_report,json=hostReport,proto3,oneof"`
}

type AgentMessage_Response struct {
	Response *AgentResponse `protobuf:"bytes,1,opt,name=response,proto3,oneof"`
}

type AgentRequest struct {
	RequestId string `protobuf:"bytes,1,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	// Types that are valid to be assigned to Op:
	//
	//	*AgentRequest_InspectByName
	//	*AgentRequest_Create
	//	*AgentRequest_Start
	//	*AgentRequest_Stop
	//	*AgentRequest_Remove
	//	*AgentRequest_ListImages
	//	*AgentRequest_ListByPrefix
	//	*AgentRequest_EnsureVolume
	//	*AgentRequest_WatchEvents
	//	*AgentRequest_UpdateResources
	//	*AgentRequest_EnsureNetwork
	//	*AgentRequest_RemoveNetwork
	//	*AgentRequest_ListNetworksByPrefix
	//	*AgentRequest_Exec
	//	*AgentRequest_Build
	//	*AgentRequest_InspectExitState
	//	*AgentRequest_ApplyMesh
	//	*AgentRequest_RotateMeshKey
	//	*AgentRequest_NetworkConnect
	//	*AgentRequest_NetworkDisconnect
	//	*AgentRequest_Stats
	//	*AgentRequest_MeshStatus
	Op isAgentRequest_Op `protobuf_oneof:"op"`
	// contains filtered or unexported fields
}

type AgentRequest_ApplyMesh struct {
	// ApplyMesh and RotateMeshKey are dispatched directly by the agent's
	// own serveSession loop (internal/agent/client.go), not through
	// Execute: see internal/network.ConfigSink's own doc comment for why
	// this op exists (the gRPC arm that doc comment says is "deliberately
	// not in this change" landing here, as its own reviewed diff against
	// this wire contract) and MeshApplier for the agent-side contract it
	// is dispatched against. Both carry this node's own mesh identity
	// only: the private key behind that identity never crosses this wire
	// in either direction (DeviceConfig.private_key is always unset on
	// the way down, and there is no field for one on the way back).
	ApplyMesh *ApplyMeshRequest `protobuf:"bytes,18,opt,name=apply_mesh,json=applyMesh,proto3,oneof"`
}

type AgentRequest_Build struct {
	Build *BuildRequest `protobuf:"bytes,16,opt,name=build,proto3,oneof"`
}

type AgentRequest_Create struct {
	Create *CreateRequest `protobuf:"bytes,3,opt,name=create,proto3,oneof"`
}

type AgentRequest_EnsureNetwork struct {
	EnsureNetwork *EnsureNetworkRequest `protobuf:"bytes,12,opt,name=ensure_network,json=ensureNetwork,proto3,oneof"`
}

type AgentRequest_EnsureVolume struct {
	EnsureVolume *EnsureVolumeRequest `protobuf:"bytes,9,opt,name=ensure_volume,json=ensureVolume,proto3,oneof"`
}

type AgentRequest_Exec struct {
	Exec *ExecRequest `protobuf:"bytes,15,opt,name=exec,proto3,oneof"`
}

type AgentRequest_InspectByName struct {
	InspectByName *InspectByNameRequest `protobuf:"bytes,2,opt,name=inspect_by_name,json=inspectByName,proto3,oneof"`
}

type AgentRequest_InspectExitState struct {
	InspectExitState *InspectExitStateRequest `protobuf:"bytes,17,opt,name=inspect_exit_state,json=inspectExitState,proto3,oneof"`
}

type AgentRequest_ListByPrefix struct {
	ListByPrefix *ListByPrefixRequest `protobuf:"bytes,8,opt,name=list_by_prefix,json=listByPrefix,proto3,oneof"`
}

type AgentRequest_ListImages struct {
	ListImages *ListImagesRequest `protobuf:"bytes,7,opt,name=list_images,json=listImages,proto3,oneof"`
}

type AgentRequest_ListNetworksByPrefix struct {
	ListNetworksByPrefix *ListNetworksByPrefixRequest `protobuf:"bytes,14,opt,name=list_networks_by_prefix,json=listNetworksByPrefix,proto3,oneof"`
}

type AgentRequest_MeshStatus struct {
	// MeshStatus asks for the node's own WireGuard view of its peers, for
	// node-pair connectivity diagnostics.
	MeshStatus *MeshStatusRequest `protobuf:"bytes,23,opt,name=mesh_status,json=meshStatus,proto3,oneof"`
}

type AgentRequest_NetworkConnect struct {
	NetworkConnect *NetworkConnectRequest `protobuf:"bytes,20,opt,name=network_connect,json=networkConnect,proto3,oneof"`
}

type AgentRequest_NetworkDisconnect struct {
	NetworkDisconnect *NetworkDisconnectRequest `protobuf:"bytes,21,opt,name=network_disconnect,json=networkDisconnect,proto3,oneof"`
}

type AgentRequest_Remove struct {
	Remove *RemoveRequest `protobuf:"bytes,6,opt,name=remove,proto3,oneof"`
}

type AgentRequest_RemoveNetwork struct {
	RemoveNetwork *RemoveNetworkRequest `protobuf:"bytes,13,opt,name=remove_network,json=removeNetwork,proto3,oneof"`
}

type AgentRequest_RotateMeshKey struct {
	RotateMeshKey *RotateMeshKeyRequest `protobuf:"bytes,19,opt,name=rotate_mesh_key,json=rotateMeshKey,proto3,oneof"`
}

type AgentRequest_Start struct {
	Start *StartRequest `protobuf:"bytes,4,opt,name=start,proto3,oneof"`
}

type AgentRequest_Stats struct {
	// Stats asks for one point-in-time resource-usage snapshot
	// (internal/docker.Client.Stats), the remote-node half of ADR 008's
	// federated query: the control plane polls this on an interval per
	// placed container, the same way it already polls its own local
	// Docker socket, instead of the agent keeping its own store.
	Stats *StatsRequest `protobuf:"bytes,22,opt,name=stats,proto3,oneof"`
}

type AgentRequest_Stop struct {
	Stop *StopRequest `protobuf:"bytes,5,opt,name=stop,proto3,oneof"`
}

type AgentRequest_UpdateResources struct {
	UpdateResources *UpdateResourcesRequest `protobuf:"bytes,11,opt,name=update_resources,json=updateResources,proto3,oneof"`
}

type AgentRequest_WatchEvents struct {
	WatchEvents *WatchEventsRequest `protobuf:"bytes,10,opt,name=watch_events,json=watchEvents,proto3,oneof"`
}

type AgentResponse struct {
	RequestId string `protobuf:"bytes,1,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
	// Error is set (and every field below unset) when the underlying
	// internal/docker.Runtime call itself returned an error: the
	// multiplexer surfaces this as a real Go error to the caller, never
	// silently treated as a zero-value success.
	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// Types that are valid to be assigned to Result:
	//
	//	*AgentResponse_InspectByName
	//	*AgentResponse_Create
	//	*AgentResponse_ListImages
	//	*AgentResponse_ListByPrefix
	//	*AgentResponse_Empty
	//	*AgentResponse_EnsureNetwork
	//	*AgentResponse_ListNetworksByPrefix
	//	*AgentResponse_InspectExitState
	//	*AgentResponse_ApplyMesh
	//	*AgentResponse_RotateMeshKey
	//	*AgentResponse_Stats
	//	*AgentResponse_MeshStatus
	Result isAgentResponse_Result `protobuf_oneof:"result"`
	// contains filtered or unexported fields
}

type AgentResponse_ApplyMesh struct {
	ApplyMesh *ApplyMeshResponse `protobuf:"bytes,11,opt,name=apply_mesh,json=applyMesh,proto3,oneof"`
}

type AgentResponse_Create struct {
	Create *CreateResponse `protobuf:"bytes,4,opt,name=create,proto3,oneof"`
}

type AgentResponse_Empty struct {
	// Start, Stop, Remove, EnsureVolume, RemoveNetwork, and the
	// WatchEvents acknowledgment all return nothing but success/Error
	// above, so none of them needs its own response message.
	Empty *Empty `protobuf:"bytes,7,opt,name=empty,proto3,oneof"`
}

type AgentResponse_EnsureNetwork struct {
	EnsureNetwork *EnsureNetworkResponse `protobuf:"bytes,8,opt,name=ensure_network,json=ensureNetwork,proto3,oneof"`
}

type AgentResponse_InspectByName struct {
	InspectByName *InspectByNameResponse `protobuf:"bytes,3,opt,name=inspect_by_name,json=inspectByName,proto3,oneof"`
}

type AgentResponse_InspectExitState struct {
	InspectExitState *InspectExitStateResponse `protobuf:"bytes,10,opt,name=inspect_exit_state,json=inspectExitState,proto3,oneof"`
}

type AgentResponse_ListByPrefix struct {
	ListByPrefix *ListByPrefixResponse `protobuf:"bytes,6,opt,name=list_by_prefix,json=listByPrefix,proto3,oneof"`
}

type AgentResponse_ListImages struct {
	ListImages *ListImagesResponse `protobuf:"bytes,5,opt,name=list_images,json=listImages,proto3,oneof"`
}

type AgentResponse_ListNetworksByPrefix struct {
	ListNetworksByPrefix *ListNetworksByPrefixResponse `protobuf:"bytes,9,opt,name=list_networks_by_prefix,json=listNetworksByPrefix,proto3,oneof"`
}

type AgentResponse_MeshStatus struct {
	MeshStatus *MeshStatusResponse `protobuf:"bytes,14,opt,name=mesh_status,json=meshStatus,proto3,oneof"`
}

type AgentResponse_RotateMeshKey struct {
	RotateMeshKey *RotateMeshKeyResponse `protobuf:"bytes,12,opt,name=rotate_mesh_key,json=rotateMeshKey,proto3,oneof"`
}

type AgentResponse_Stats struct {
	Stats *StatsResponse `protobuf:"bytes,13,opt,name=stats,proto3,oneof"`
}

type AgentServiceClient interface {
	// Enroll exchanges a one-time join token (internal/store.NodeJoinToken)
	// for a signed client certificate, over a connection
	// that does not yet present a client cert (the token itself is the
	// credential for this one call). Called once per node, before Session
	// is ever called.
	Enroll(ctx context.Context, in *EnrollRequest, opts ...grpc.CallOption) (*EnrollResponse, error)
	// Session is the agent's one persistent connection, opened only after
	// Enroll (using the certificate Enroll returned for mTLS). The agent
	// never initiates a logical request on this stream, only responds to
	// AgentRequest messages arriving from the control plane, plus sending
	// ProxiedEvent messages unprompted (the streaming Docker-event
	// relay ADR 003 calls out: "the agent streams Docker events up to
	// the control plane rather than the control plane polling down").
	Session(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[AgentMessage, ControlMessage], error)
	// Renew issues a fresh certificate for a CSR, authenticated by the
	// caller's current mTLS certificate (or its previous one inside the
	// overlap window). See ADR 021.
	Renew(ctx context.Context, in *RenewRequest, opts ...grpc.CallOption) (*RenewResponse, error)
	// Reenroll exchanges a one-time re-enrollment token bound to an existing
	// node for a new certificate, keeping the node's identity and history.
	// Like Enroll, it is called without a client certificate.
	Reenroll(ctx context.Context, in *ReenrollRequest, opts ...grpc.CallOption) (*ReenrollResponse, error)
	// CheckIdentity confirms the presented client certificate is accepted
	// for its node, without opening a Session. The agent uses it to test a
	// renewed certificate before discarding the old one.
	CheckIdentity(ctx context.Context, in *CheckIdentityRequest, opts ...grpc.CallOption) (*CheckIdentityResponse, error)
}

type AgentServiceServer interface {
	// Enroll exchanges a one-time join token (internal/store.NodeJoinToken)
	// for a signed client certificate, over a connection
	// that does not yet present a client cert (the token itself is the
	// credential for this one call). Called once per node, before Session
	// is ever called.
	Enroll(context.Context, *EnrollRequest) (*EnrollResponse, error)
	// Session is the agent's one persistent connection, opened only after
	// Enroll (using the certificate Enroll returned for mTLS). The agent
	// never initiates a logical request on this stream, only responds to
	// AgentRequest messages arriving from the control plane, plus sending
	// ProxiedEvent messages unprompted (the streaming Docker-event
	// relay ADR 003 calls out: "the agent streams Docker events up to
	// the control plane rather than the control plane polling down").
	Session(grpc.BidiStreamingServer[AgentMessage, ControlMessage]) error
	// Renew issues a fresh certificate for a CSR, authenticated by the
	// caller's current mTLS certificate (or its previous one inside the
	// overlap window). See ADR 021.
	Renew(context.Context, *RenewRequest) (*RenewResponse, error)
	// Reenroll exchanges a one-time re-enrollment token bound to an existing
	// node for a new certificate, keeping the node's identity and history.
	// Like Enroll, it is called without a client certificate.
	Reenroll(context.Context, *ReenrollRequest) (*ReenrollResponse, error)
	// CheckIdentity confirms the presented client certificate is accepted
	// for its node, without opening a Session. The agent uses it to test a
	// renewed certificate before discarding the old one.
	CheckIdentity(context.Context, *CheckIdentityRequest) (*CheckIdentityResponse, error)
	// contains filtered or unexported methods
}

type AgentService_SessionClient = grpc.BidiStreamingClient[AgentMessage, ControlMessage]

type AgentService_SessionServer = grpc.BidiStreamingServer[AgentMessage, ControlMessage]

type ApplyMeshRequest struct {
	Config *DeviceConfig `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
	// contains filtered or unexported fields
}

type ApplyMeshResponse struct {
	Identity *NodeIdentity `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
	// contains filtered or unexported fields
}

type BuildCache struct {
	RegistryRef      string `protobuf:"bytes,1,opt,name=registry_ref,json=registryRef,proto3" json:"registry_ref,omitempty"`
	RegistryInsecure bool   `protobuf:"varint,2,opt,name=registry_insecure,json=registryInsecure,proto3" json:"registry_insecure,omitempty"`
	// contains filtered or unexported fields
}

type BuildCancel struct {
	BuildId string `protobuf:"bytes,1,opt,name=build_id,json=buildId,proto3" json:"build_id,omitempty"`
	// contains filtered or unexported fields
}

type BuildCredit struct {
	BuildId string `protobuf:"bytes,1,opt,name=build_id,json=buildId,proto3" json:"build_id,omitempty"`
	Frames  uint32 `protobuf:"varint,2,opt,name=frames,proto3" json:"frames,omitempty"`
	// contains filtered or unexported fields
}

type BuildDone struct {
	DurationMs       int64             `protobuf:"varint,1,opt,name=duration_ms,json=durationMs,proto3" json:"duration_ms,omitempty"`
	ExporterResponse map[string]string `` /* 183-byte string literal not displayed */
	// contains filtered or unexported fields
}

type BuildFailure struct {
	Message             string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	UnsupportedProvider bool   `protobuf:"varint,2,opt,name=unsupported_provider,json=unsupportedProvider,proto3" json:"unsupported_provider,omitempty"`
	Provider            string `protobuf:"bytes,3,opt,name=provider,proto3" json:"provider,omitempty"`
	// contains filtered or unexported fields
}

type BuildInput struct {
	BuildId string `protobuf:"bytes,1,opt,name=build_id,json=buildId,proto3" json:"build_id,omitempty"`
	Chunk   []byte `protobuf:"bytes,2,opt,name=chunk,proto3" json:"chunk,omitempty"`
	Eof     bool   `protobuf:"varint,3,opt,name=eof,proto3" json:"eof,omitempty"`
	Error   string `protobuf:"bytes,4,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type BuildKind int32

type BuildOutput struct {
	BuildId string `protobuf:"bytes,1,opt,name=build_id,json=buildId,proto3" json:"build_id,omitempty"`
	// Types that are valid to be assigned to Frame:
	//
	//	*BuildOutput_Progress
	//	*BuildOutput_ImageChunk
	//	*BuildOutput_Done
	//	*BuildOutput_Failure
	Frame isBuildOutput_Frame `protobuf_oneof:"frame"`
	// contains filtered or unexported fields
}

type BuildOutput_Done struct {
	Done *BuildDone `protobuf:"bytes,4,opt,name=done,proto3,oneof"`
}

type BuildOutput_Failure struct {
	Failure *BuildFailure `protobuf:"bytes,5,opt,name=failure,proto3,oneof"`
}

type BuildOutput_ImageChunk struct {
	ImageChunk []byte `protobuf:"bytes,3,opt,name=image_chunk,json=imageChunk,proto3,oneof"`
}

type BuildOutput_Progress struct {
	Progress *BuildProgress `protobuf:"bytes,2,opt,name=progress,proto3,oneof"`
}

type BuildProgress struct {
	Step      string `protobuf:"bytes,1,opt,name=step,proto3" json:"step,omitempty"`
	Cached    bool   `protobuf:"varint,2,opt,name=cached,proto3" json:"cached,omitempty"`
	Completed bool   `protobuf:"varint,3,opt,name=completed,proto3" json:"completed,omitempty"`
	Error     string `protobuf:"bytes,4,opt,name=error,proto3" json:"error,omitempty"`
	Log       string `protobuf:"bytes,5,opt,name=log,proto3" json:"log,omitempty"`
	Stream    string `protobuf:"bytes,6,opt,name=stream,proto3" json:"stream,omitempty"`
	// contains filtered or unexported fields
}

type BuildRequest struct {
	Kind BuildKind `protobuf:"varint,1,opt,name=kind,proto3,enum=levelrail.agent.v1.BuildKind" json:"kind,omitempty"`
	// Tag is the image reference the built image is exported under.
	Tag string `protobuf:"bytes,2,opt,name=tag,proto3" json:"tag,omitempty"`
	// DockerfilePath is relative to the build context root, since the
	// control plane's own absolute paths mean nothing on this node. Empty
	// means the context root's own Dockerfile.
	DockerfilePath string            `protobuf:"bytes,3,opt,name=dockerfile_path,json=dockerfilePath,proto3" json:"dockerfile_path,omitempty"`
	Target         string            `protobuf:"bytes,4,opt,name=target,proto3" json:"target,omitempty"`
	BuildArgs      map[string]string `` /* 162-byte string literal not displayed */
	NoCache        bool              `protobuf:"varint,6,opt,name=no_cache,json=noCache,proto3" json:"no_cache,omitempty"`
	Cache          *BuildCache       `protobuf:"bytes,7,opt,name=cache,proto3" json:"cache,omitempty"`
	// contains filtered or unexported fields
}

type CPUStatsRaw struct {
	TotalUsageNanos  uint64 `protobuf:"varint,1,opt,name=total_usage_nanos,json=totalUsageNanos,proto3" json:"total_usage_nanos,omitempty"`
	SystemUsageNanos uint64 `protobuf:"varint,2,opt,name=system_usage_nanos,json=systemUsageNanos,proto3" json:"system_usage_nanos,omitempty"`
	OnlineCpus       uint32 `protobuf:"varint,3,opt,name=online_cpus,json=onlineCpus,proto3" json:"online_cpus,omitempty"`
	// contains filtered or unexported fields
}

type CheckIdentityRequest struct {
	// contains filtered or unexported fields
}

type CheckIdentityResponse struct {
	NodeId string `protobuf:"bytes,1,opt,name=node_id,json=nodeId,proto3" json:"node_id,omitempty"`
	// current is false when the presented certificate is the previous one,
	// still accepted inside the overlap window.
	Current bool `protobuf:"varint,2,opt,name=current,proto3" json:"current,omitempty"`
	// contains filtered or unexported fields
}

type ContainerSpec struct {
	Name      string            `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Image     string            `protobuf:"bytes,2,opt,name=image,proto3" json:"image,omitempty"`
	Ports     []*PortBinding    `protobuf:"bytes,3,rep,name=ports,proto3" json:"ports,omitempty"`
	Env       map[string]string ``                                                                        /* 133-byte string literal not displayed */
	Resources *Resources        `protobuf:"bytes,5,opt,name=resources,proto3" json:"resources,omitempty"` // unset means internal/docker.ContainerSpec.Resources == nil
	Volumes   []*VolumeMount    `protobuf:"bytes,6,rep,name=volumes,proto3" json:"volumes,omitempty"`
	// DNS mirrors internal/docker.ContainerSpec.DNS. Empty means Docker's
	// own embedded resolver, unchanged from before this field existed.
	Dns []string `protobuf:"bytes,7,rep,name=dns,proto3" json:"dns,omitempty"`
	// CapAdd mirrors internal/docker.ContainerSpec.CapAdd. Empty means no
	// added capabilities, unchanged from before this field existed.
	CapAdd []string `protobuf:"bytes,8,rep,name=cap_add,json=capAdd,proto3" json:"cap_add,omitempty"`
	// NetworkMode mirrors internal/docker.ContainerSpec.NetworkMode. Empty
	// means Docker's own default networking behavior (the Network field
	// above, or the default bridge network), unchanged from before this
	// field existed.
	NetworkMode string `protobuf:"bytes,9,opt,name=network_mode,json=networkMode,proto3" json:"network_mode,omitempty"`
	// Gpu mirrors internal/docker.ContainerSpec.GPU. Unset means no GPU
	// device request.
	Gpu *GPURequest `protobuf:"bytes,10,opt,name=gpu,proto3" json:"gpu,omitempty"`
	// Command mirrors internal/docker.ContainerSpec.Command. Empty means the
	// image's own default command.
	Command []string `protobuf:"bytes,11,rep,name=command,proto3" json:"command,omitempty"`
	// shm_size_bytes mirrors internal/docker.ContainerSpec.ShmSizeBytes. Zero
	// means Docker's default /dev/shm.
	ShmSizeBytes int64 `protobuf:"varint,12,opt,name=shm_size_bytes,json=shmSizeBytes,proto3" json:"shm_size_bytes,omitempty"`
	// extra_hosts mirrors internal/docker.ContainerSpec.ExtraHosts ("name:ip").
	ExtraHosts []string `protobuf:"bytes,13,rep,name=extra_hosts,json=extraHosts,proto3" json:"extra_hosts,omitempty"`
	// labels, network and entrypoint mirror the same internal/docker.ContainerSpec
	// fields; without them a worker's app never joins its app network.
	Labels       map[string]string `` /* 140-byte string literal not displayed */
	NetworkName  string            `protobuf:"bytes,15,opt,name=network_name,json=networkName,proto3" json:"network_name,omitempty"`
	NetworkAlias string            `protobuf:"bytes,16,opt,name=network_alias,json=networkAlias,proto3" json:"network_alias,omitempty"`
	Entrypoint   []string          `protobuf:"bytes,17,rep,name=entrypoint,proto3" json:"entrypoint,omitempty"`
	// contains filtered or unexported fields
}

type ContainerState struct {
	Id      string         `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Name    string         `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Image   string         `protobuf:"bytes,3,opt,name=image,proto3" json:"image,omitempty"`
	Running bool           `protobuf:"varint,4,opt,name=running,proto3" json:"running,omitempty"`
	Ports   []*PortBinding `protobuf:"bytes,5,rep,name=ports,proto3" json:"ports,omitempty"`
	// contains filtered or unexported fields
}

type ContainerStats struct {
	CpuPercent       float64      `protobuf:"fixed64,1,opt,name=cpu_percent,json=cpuPercent,proto3" json:"cpu_percent,omitempty"`
	CpuRaw           *CPUStatsRaw `protobuf:"bytes,2,opt,name=cpu_raw,json=cpuRaw,proto3" json:"cpu_raw,omitempty"`
	MemoryUsageBytes uint64       `protobuf:"varint,3,opt,name=memory_usage_bytes,json=memoryUsageBytes,proto3" json:"memory_usage_bytes,omitempty"`
	MemoryLimitBytes uint64       `protobuf:"varint,4,opt,name=memory_limit_bytes,json=memoryLimitBytes,proto3" json:"memory_limit_bytes,omitempty"`
	NetworkRxBytes   uint64       `protobuf:"varint,5,opt,name=network_rx_bytes,json=networkRxBytes,proto3" json:"network_rx_bytes,omitempty"`
	NetworkTxBytes   uint64       `protobuf:"varint,6,opt,name=network_tx_bytes,json=networkTxBytes,proto3" json:"network_tx_bytes,omitempty"`
	DiskReadBytes    uint64       `protobuf:"varint,7,opt,name=disk_read_bytes,json=diskReadBytes,proto3" json:"disk_read_bytes,omitempty"`
	DiskWriteBytes   uint64       `protobuf:"varint,8,opt,name=disk_write_bytes,json=diskWriteBytes,proto3" json:"disk_write_bytes,omitempty"`
	// contains filtered or unexported fields
}

type ControlMessage struct {

	// Types that are valid to be assigned to Payload:
	//
	//	*ControlMessage_Request
	//	*ControlMessage_ExecInput
	//	*ControlMessage_ExecCancel
	//	*ControlMessage_ExecCredit
	//	*ControlMessage_BuildInput
	//	*ControlMessage_BuildCancel
	//	*ControlMessage_BuildCredit
	//	*ControlMessage_ExecResize
	//	*ControlMessage_GoAway
	Payload isControlMessage_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type ControlMessage_BuildCancel struct {
	BuildCancel *BuildCancel `protobuf:"bytes,6,opt,name=build_cancel,json=buildCancel,proto3,oneof"`
}

type ControlMessage_BuildCredit struct {
	// BuildCredit here refunds the agent's output window: the control
	// plane has consumed that many BuildOutput frames.
	BuildCredit *BuildCredit `protobuf:"bytes,7,opt,name=build_credit,json=buildCredit,proto3,oneof"`
}

type ControlMessage_BuildInput struct {
	BuildInput *BuildInput `protobuf:"bytes,5,opt,name=build_input,json=buildInput,proto3,oneof"`
}

type ControlMessage_ExecCancel struct {
	ExecCancel *ExecCancel `protobuf:"bytes,3,opt,name=exec_cancel,json=execCancel,proto3,oneof"`
}

type ControlMessage_ExecCredit struct {
	// ExecCredit here refunds the agent's output window: the control
	// plane has consumed that many ExecOutput frames.
	ExecCredit *ExecCredit `protobuf:"bytes,4,opt,name=exec_credit,json=execCredit,proto3,oneof"`
}

type ControlMessage_ExecInput struct {
	ExecInput *ExecInput `protobuf:"bytes,2,opt,name=exec_input,json=execInput,proto3,oneof"`
}

type ControlMessage_ExecResize struct {
	ExecResize *ExecResize `protobuf:"bytes,8,opt,name=exec_resize,json=execResize,proto3,oneof"`
}

type ControlMessage_GoAway struct {
	// GoAway tells the agent the control plane is shutting down this
	// process and will not answer further requests on this stream: the
	// agent should close its end now rather than wait to be cut off by
	// the control plane's own bounded GracefulStop timeout.
	GoAway *GoAway `protobuf:"bytes,9,opt,name=go_away,json=goAway,proto3,oneof"`
}

type ControlMessage_Request struct {
	Request *AgentRequest `protobuf:"bytes,1,opt,name=request,proto3,oneof"`
}

type CreateRequest struct {
	Spec *ContainerSpec `protobuf:"bytes,1,opt,name=spec,proto3" json:"spec,omitempty"`
	// contains filtered or unexported fields
}

type CreateResponse struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type DeviceConfig struct {
	NodeId string `protobuf:"bytes,1,opt,name=node_id,json=nodeId,proto3" json:"node_id,omitempty"`
	// Address is netip.Prefix.String() (e.g. "10.181.0.3/16"), the node's
	// own mesh address with the mesh CIDR's prefix length. Empty means no
	// address assigned yet (network.DeviceConfig.Address's own "invalid
	// until assigned" state).
	Address    string        `protobuf:"bytes,2,opt,name=address,proto3" json:"address,omitempty"`
	ListenPort int32         `protobuf:"varint,3,opt,name=listen_port,json=listenPort,proto3" json:"listen_port,omitempty"`
	Peers      []*PeerConfig `protobuf:"bytes,4,rep,name=peers,proto3" json:"peers,omitempty"`
	// contains filtered or unexported fields
}

type Empty struct {
	// contains filtered or unexported fields
}

type EnrollRequest struct {
	JoinToken string `protobuf:"bytes,1,opt,name=join_token,json=joinToken,proto3" json:"join_token,omitempty"`
	// NodeName is what the enrolling node wants to be called
	// (store.Node.Name); the control plane still enforces uniqueness
	// (store.ErrNodeNameTaken) the same way it would for any other
	// SaveNode caller.
	NodeName string `protobuf:"bytes,2,opt,name=node_name,json=nodeName,proto3" json:"node_name,omitempty"`
	// csr_der is a PKCS#10 request for the agent's own key. When set the
	// control plane signs it and never sees the private key; when empty
	// (agents older than ADR 021) the control plane generates the key.
	CsrDer []byte     `protobuf:"bytes,3,opt,name=csr_der,json=csrDer,proto3" json:"csr_der,omitempty"`
	Agent  *AgentInfo `protobuf:"bytes,4,opt,name=agent,proto3" json:"agent,omitempty"`
	// contains filtered or unexported fields
}

type EnrollResponse struct {

	// NodeID is the store.Node.ID the control plane assigned; the agent
	// persists this alongside its certificate so subsequent Session
	// reconnects can identify themselves before the mTLS handshake even
	// completes (the cert's own CommonName already encodes it too, this
	// is the same value spelled out for the agent's own local bookkeeping).
	NodeId string `protobuf:"bytes,1,opt,name=node_id,json=nodeId,proto3" json:"node_id,omitempty"`
	// ClientCertPEM/ClientKeyPEM are this node's new mTLS identity.
	// ClientKeyPEM never leaves this one response: it isn't persisted by
	// the control plane, isn't logged, and isn't retrievable again,
	// matching every other "shown once" credential in this codebase
	// (API tokens, node join tokens themselves).
	ClientCertPem []byte `protobuf:"bytes,2,opt,name=client_cert_pem,json=clientCertPem,proto3" json:"client_cert_pem,omitempty"`
	ClientKeyPem  []byte `protobuf:"bytes,3,opt,name=client_key_pem,json=clientKeyPem,proto3" json:"client_key_pem,omitempty"`
	// CACertPEM is the control plane's own CA certificate, so the agent
	// can verify the control plane's TLS server certificate on every
	// future connection without trusting the system root store (this is
	// a private, self-issued PKI for exactly this one relationship, not a
	// publicly-trusted certificate).
	CaCertPem []byte `protobuf:"bytes,4,opt,name=ca_cert_pem,json=caCertPem,proto3" json:"ca_cert_pem,omitempty"`
	// not_after is the issued certificate's expiry.
	NotAfter *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=not_after,json=notAfter,proto3" json:"not_after,omitempty"`
	// contains filtered or unexported fields
}

type EnsureNetworkRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type EnsureNetworkResponse struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type EnsureVolumeRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type ExecCancel struct {
	ExecId string `protobuf:"bytes,1,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
	// contains filtered or unexported fields
}

type ExecCredit struct {
	ExecId string `protobuf:"bytes,1,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
	Frames uint32 `protobuf:"varint,2,opt,name=frames,proto3" json:"frames,omitempty"`
	// contains filtered or unexported fields
}

type ExecExit struct {
	Cmd       []string `protobuf:"bytes,1,rep,name=cmd,proto3" json:"cmd,omitempty"`
	Container string   `protobuf:"bytes,2,opt,name=container,proto3" json:"container,omitempty"`
	ExitCode  int32    `protobuf:"varint,3,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
	Stderr    string   `protobuf:"bytes,4,opt,name=stderr,proto3" json:"stderr,omitempty"`
	// contains filtered or unexported fields
}

type ExecFailure struct {
	Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	// Exit is set when the failure was the command's own non-zero exit
	// (internal/docker.ExecExitError), so the control plane can rebuild
	// that typed error rather than a flat string: internal/api's exec
	// endpoint branches on it with errors.As to report a real exit code.
	Exit *ExecExit `protobuf:"bytes,2,opt,name=exit,proto3" json:"exit,omitempty"`
	// contains filtered or unexported fields
}

type ExecInput struct {
	ExecId string `protobuf:"bytes,1,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
	Chunk  []byte `protobuf:"bytes,2,opt,name=chunk,proto3" json:"chunk,omitempty"`
	Eof    bool   `protobuf:"varint,3,opt,name=eof,proto3" json:"eof,omitempty"`
	Error  string `protobuf:"bytes,4,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type ExecOutput struct {
	ExecId  string       `protobuf:"bytes,1,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
	Chunk   []byte       `protobuf:"bytes,2,opt,name=chunk,proto3" json:"chunk,omitempty"`
	Eof     bool         `protobuf:"varint,3,opt,name=eof,proto3" json:"eof,omitempty"`
	Failure *ExecFailure `protobuf:"bytes,4,opt,name=failure,proto3" json:"failure,omitempty"`
	// contains filtered or unexported fields
}