api

package
v0.1.0-alpha.8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 1, 2026 License: Apache-2.0 Imports: 17 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// MaxAgentIDLen bounds an agent identifier, matching the DNS name limit it
	// is shaped after.
	MaxAgentIDLen = 253

	// MaxAgentLabelLen bounds one dot-separated label of an agent identifier.
	MaxAgentLabelLen = 63
)
View Source 
const (
	// FactExpiration defines the token expiration time.
	// Contains: biscuit.Date(expirationTime)
	// Example Datalog: check if time($time), expiration($exp), $time <= $exp
	FactExpiration = "expiration"

	// FactNode defines the PeerID of the node that this token belongs to.
	// Contains: biscuit.String(nodePeerID)
	// Example Datalog: allow if node("12D3KooWP2G8nJCLASp1Kb4TmQS4wCpMH2vpSUz8ug8DYEJiuf1i")
	FactNode = "node"

	// FactAgent defines the agent on whose behalf a request is made. Unlike
	// FactNode it does not identify a host: it is appended to the token when an
	// agent is admitted, and the same identifier is asserted again wherever that
	// agent is next resumed. See api/agent.go for the identifier rules.
	// Contains: biscuit.String(agentID)
	// Example Datalog: allow if agent("reviewer-7.prod.acme.example")
	FactAgent = "agent"

	// FactClientPeerID defines the client PeerID performing the request, used for replay defense.
	// Contains: biscuit.String(clientPeerID)
	// Example Datalog: check if client_peer_id($id), connection_peer_id($id)
	FactClientPeerID = "client_peer_id"

	// FactGroup defines the group claim extracted from the OIDC token.
	// Contains: biscuit.String(groupName)
	// Example Datalog: allow if group("data-science")
	FactGroup = "group"

	// FactRole defines a custom SAM role assigned to the user or node.
	// Contains: biscuit.String(roleName)
	// Example Datalog: allow if role("mesh-member")
	FactRole = "role"

	// FactRight defines the cryptographically signed capability/right.
	// Contains: biscuit.String(rightName)
	// Example Datalog: allow if right("relay")
	FactRight = "right"

	// RightRelay defines the transport relaying/bridging right.
	RightRelay = "relay"

	// RightServiceInvoke defines the edge service invocation right.
	RightServiceInvoke = "service:invoke"

	// Standard role values
	RoleRouter = "sam:role:router"
	RoleNode   = "sam:role:node"
	RoleSamBox = "sam:role:sambox"

	// FactUser defines the subject (username/userID) claim extracted from the OIDC token.
	// Contains: biscuit.String(username)
	// Example Datalog: allow if user("alice")
	FactUser = "user"

	// FactEmail defines the email claim extracted from the OIDC token.
	// Contains: biscuit.String(emailAddress)
	// Example Datalog: allow if email("bob@example.com")
	FactEmail = "email"

	// FactGrantedServiceAllTypes allows access to all service types (e.g., mcp, inference) and all targets.
	// Contains: (no terms)
	// Example Datalog: allow if granted_service_all_types()
	FactGrantedServiceAllTypes = "granted_service_all_types"

	// FactGrantedServiceAll allows access to all targets under a specific service type.
	// Contains: biscuit.String(serviceType) (e.g., "mcp")
	// Example Datalog: allow if service("mcp", $target), granted_service_all("mcp")
	FactGrantedServiceAll = "granted_service_all"

	// FactGrantedServiceSuffix allows access to services matching a suffix pattern (e.g. *.service.local).
	// Contains: biscuit.String(serviceType), biscuit.String(suffixPattern)
	FactGrantedServiceSuffix = "granted_service_suffix"

	// FactGrantedServicePrefix allows access to services matching a prefix pattern (e.g. calculator.*).
	// Contains: biscuit.String(serviceType), biscuit.String(prefixPattern)
	FactGrantedServicePrefix = "granted_service_prefix"

	// FactGrantedServiceExact allows access to a specific service type and target.
	// Contains: biscuit.String(serviceType), biscuit.String(targetName)
	// Example Datalog: allow if service("mcp", "calculator"), granted_service_exact("mcp", "calculator")
	FactGrantedServiceExact = "granted_service_exact"

	// FactGrantedServiceSet allows access to a Set of exact service names under a specific service
	// type. This lets many exact grants for the same type be carried as a single Datalog fact instead
	// of one fact per entry, which keeps token/world fact counts flat regardless of list length.
	// Contains: biscuit.String(serviceType), biscuit.Set of biscuit.String(serviceName)
	// Example Datalog: allow if service("mcp", "calculator"), granted_service_set("mcp", $set), $set.contains("calculator")
	FactGrantedServiceSet = "granted_service_set"

	// FactGrantedTargetAllTypes allows target access to all network targets (unrestricted).
	// Contains: (no terms)
	FactGrantedTargetAllTypes = "granted_target_all_types"

	// FactGrantedTargetAll allows target access to all values of a specific fact.
	// Contains: biscuit.String(factName) (e.g., "group")
	FactGrantedTargetAll = "granted_target_all"

	// FactGrantedTargetSuffix allows target access to values matching a suffix pattern.
	// Contains: biscuit.String(factName), biscuit.String(suffixPattern)
	FactGrantedTargetSuffix = "granted_target_suffix"

	// FactGrantedTargetPrefix allows target access to values matching a prefix pattern.
	// Contains: biscuit.String(factName), biscuit.String(prefixPattern)
	FactGrantedTargetPrefix = "granted_target_prefix"

	// FactGrantedTargetExact allows target access to a specific fact name and value combination.
	// Contains: biscuit.String(factName), biscuit.String(factValue)
	// Example Datalog: allow_network_target("group", "backend") <- target_fact("group", "backend"), granted_target_exact("group", "backend")
	FactGrantedTargetExact = "granted_target_exact"

	// FactGrantedTargetAllFacts allows target access to any fact name and value combination.
	// Contains: (no terms)
	FactGrantedTargetAllFacts = "granted_target_all_facts"

	// FactGrantedTargetSet allows target access to a Set of exact values for a specific fact name.
	// This lets many exact target grants for the same fact name be carried as a single Datalog fact
	// instead of one fact per entry, which keeps token/world fact counts flat regardless of list length.
	// Contains: biscuit.String(factName), biscuit.Set of biscuit.String(factValue)
	FactGrantedTargetSet = "granted_target_set"

	// FactGrantedAgentExact allows the holder to act for one exact agent id.
	// Contains: biscuit.String(agentID)
	FactGrantedAgentExact = "granted_agent_exact"

	// FactGrantedAgentSet allows the holder to act for a Set of exact agent ids,
	// so many exact grants cost one fact instead of one fact each.
	// Contains: biscuit.Set of biscuit.String(agentID)
	FactGrantedAgentSet = "granted_agent_set"

	// FactGrantedAgentPrefix allows the holder to act for any agent id starting
	// with the prefix, e.g. "reviewer.*" -> "reviewer.".
	// Contains: biscuit.String(prefix)
	FactGrantedAgentPrefix = "granted_agent_prefix"

	// FactGrantedAgentSuffix allows the holder to act for any agent id ending
	// with the suffix, e.g. "*.prod.acme.example" -> ".prod.acme.example". The
	// leading dot is kept so the wildcard lands on a label boundary and
	// "evil-acme.example" cannot match "*.acme.example".
	// Contains: biscuit.String(suffix)
	FactGrantedAgentSuffix = "granted_agent_suffix"

	// FactGrantedAgentAll allows the holder to act for any agent at all.
	// Contains: (no terms)
	FactGrantedAgentAll = "granted_agent_all"

	// FactAgentAuthorized is derived when an agent claim falls inside one of the
	// holder's granted_agent_* namespaces.
	// Contains: (no terms)
	FactAgentAuthorized = "agent_authorized"

	// FactConnectionPeerID defines the actual PeerID of the remote peer making the connection.
	// Contains: biscuit.String(connectionPeerID)
	// Example Datalog: check if client_peer_id($id), connection_peer_id($id)
	FactConnectionPeerID = "connection_peer_id"

	// FactTargetFact normalizes identity assertions (claims, node, user) to a standardized target.
	// Contains: biscuit.String(factName), biscuit.String(factValue)
	// Example Datalog: target_fact("group", $val) <- group($val)
	FactTargetFact = "target_fact"

	// FactAllowNetworkTarget evaluates whether a target assertion meets the token access grants.
	// Contains: biscuit.String(factName), biscuit.String(factValue)
	// Example Datalog: allow_network_target("group", "backend")
	FactAllowNetworkTarget = "allow_network_target"

	// FactTargetUnrestricted indicates that target authorization checks are bypassed.
	// Contains: (no terms)
	// Example Datalog: check if allow_network_target($fact, $val) or target_unrestricted()
	FactTargetUnrestricted = "target_unrestricted"

	// FactTargetRestricted indicates that target authorization checks must be enforced.
	// Contains: (no terms)
	FactTargetRestricted = "target_restricted"

	// FactService represents the service target that a node is requesting access to.
	// Contains: biscuit.String(serviceType), biscuit.String(serviceName)
	// Example Datalog: service("mcp", "calculator")
	FactService = "service"

	// FactLabel is a control-plane-attested key=value label on the token's
	// node (see api/labels.go). The control plane mints one fact per
	// declared label, so a requirement is a single exact match: a node
	// attested with region="us-east-1" carries label("region", "us-east-1"),
	// satisfying `check if label("region", "us-east-1")` only — composition
	// across values is left entirely to the operator (attest as many labels
	// as needed). Distinct from the unauthenticated gossip routing hint
	// carried in ServiceAnnounce.labels.
	// Contains: biscuit.String(key), biscuit.String(value)
	// Example Datalog: check if label("region", "us-east-1")
	FactLabel = "label"

	// FactTime defines the current system time injected during evaluation.
	// Contains: biscuit.Date(currentTime)
	// Example Datalog: check if time($time)
	FactTime = "time"
)

Biscuit fact names represent the Datalog predicates used in auth tokens and policy evaluation.

View Source 
const (
	// MeshZone is the DNS suffix under which mesh services are addressed from
	// inside a sandbox.
	//
	// ".alt" is the pseudo-top-level domain reserved by RFC 9476 for namespaces
	// that are explicitly NOT resolved through the DNS. That is precisely this
	// case: these names are resolved by the mesh (service discovery over
	// libp2p), never by a resolver. Using it guarantees the zone can never
	// collide with a delegated gTLD, and guarantees a name that leaks out of a
	// sandbox fails closed instead of resolving to somebody else's host.
	MeshZone = "sam.alt"

	// MeshEntrypointHost is the reserved name an agent uses to reach the mesh
	// services its gateway offers it: inference and tools, with the provider
	// chosen by policy.
	//
	// It deliberately does not name the node. A sam-node's sidecar API is a
	// local, operator-facing surface — it can register services, drive the raw
	// egress proxy and read node internals — and an agent has no business
	// reaching any of it. The gateway consumes the node; the agent consumes the
	// mesh through the gateway, and the two must not be the same address.
	MeshEntrypointHost = "mesh." + MeshZone
)
View Source 
const (
	// EnrollProtocolID is the libp2p protocol identifier for node enrollment.
	EnrollProtocolID protocol.ID = "/sam/enroll/1.0.0"

	// MCPProtocolID is the libp2p protocol identifier for Model Context Protocol streams.
	MCPProtocolID protocol.ID = "/sam/mcp/1.0.0"

	// AuthProtocolID is the libp2p protocol identifier for the zero-trust auth handshake.
	AuthProtocolID protocol.ID = "/sam/auth/1.0.0"

	// GossipEvents is the GossipSub topic used to broadcast mesh event updates (e.g., node bans).
	GossipEvents = "/sam/mesh/events/v1"

	// GossipControlPlaneSync is the GossipSub topic used by the control plane to sync cluster state.
	GossipControlPlaneSync = "/sam/control-plane/sync/v1"

	// DiscoveryTopicPrefix is the GossipSub topic namespace for interest-scoped
	// service announcements (ServiceAnnounce messages). Full topics are built
	// with DiscoveryTopic; the version segment allows wire evolution.
	DiscoveryTopicPrefix = "/sam/discovery/v1"

	// DefaultAudience is the default audience string used in OIDC token validation.
	DefaultAudience = "sam-mesh-audience"
)
View Source 
const (
	// BiscuitTokenTTL is the strict cryptographically enforced lifespan
	// of a minted Biscuit token (24 hours).
	// This is verified locally by each peer on every connection.
	BiscuitTokenTTL = 24 * time.Hour

	// OIDCSessionTTL is the maximum database-enforced lifespan of a node's OIDC
	// interactive enrollment session (90 days). After this period, the node
	// must re-authenticate with the OIDC provider to establish a new session.
	OIDCSessionTTL = 90 * 24 * time.Hour

	// TokenRefreshCheckInterval is the frequency at which the node daemon and router check
	// if their current Biscuit token is close to expiration and needs to be proactively refreshed.
	TokenRefreshCheckInterval = 10 * time.Minute
)
View Source 
const (
	// HeaderSamBiscuit is the custom HTTP header used to carry the base64-encoded
	// Biscuit token containing the node's identity credentials when forwarding requests
	// over libp2p HTTP between nodes in the mesh.
	//
	// This header is internal to the SAM mesh datapath and is stripped before requests
	// are forwarded to backend services.
	HeaderSamBiscuit = "X-Sam-Biscuit"

	// HeaderPeerID carries the authenticated libp2p peer ID of the caller.
	// The mesh ingress handler stamps it after authorization succeeds,
	// overwriting any inbound value, so backend services get verified caller
	// attribution without parsing biscuits. The inference facade sets it the
	// same way for locally served requests.
	HeaderPeerID = "X-Peer-Id"

	// HeaderSamAgent names the agent a request is made on behalf of, as a
	// canonical agent identifier (see api/agent.go). It is set by the sandbox
	// gateway on the node's local API socket, and honoured by the node only
	// there: arriving on that socket is proof the caller is the gateway, which
	// is the only party that knows which agent a flow belongs to.
	//
	// A sandboxed agent can never set it. The gateway overwrites the header on
	// every request it forwards, so a value an agent supplies is replaced by
	// the identity the platform bound to its channel, never merged with it.
	HeaderSamAgent = "X-Sam-Agent"

	// HeaderSamAuthentication is the custom HTTP header used to authenticate a local
	// process to this node's sidecar API (the shared secret configured via
	// "--api-token-path" or the SAM_API_TOKEN environment variable). Using a
	// SAM-specific header name — instead of the standard
	// "Authorization" header — leaves "Authorization" free to always mean what
	// every HTTP client expects: the credential for the destination being called.
	// The sidecar strips this header before forwarding any request off-node, so
	// it never leaks to a remote peer or backend service.
	//
	// For compatibility with MCP clients that only support a plain "Authorization"
	// header, purely-local endpoints (that never forward it anywhere) also accept
	// "Authorization" as an alias. The egress/inference proxy does NOT: there,
	// "Authorization" is reserved exclusively for the destination's credential.
	HeaderSamAuthentication = "X-Sam-Authentication"

	// HeaderSamNoTrailingSlash is the custom HTTP header set by the ingress handler
	// to indicate that the original request had no trailing slash.
	//
	// This helps backward-compatibility with services that strictly distinguish
	// between a root path "/" and an empty path "".
	HeaderSamNoTrailingSlash = "X-Sam-No-Trailing-Slash"

	// HeaderSamRequiredLabels constrains an inference request on the sidecar's
	// OpenAI-compatible endpoints (/v1/*) to providers attested with any of a
	// comma-separated list of "key=value" label requirements (see
	// api/labels.go and LabelCheck); invalid entries are rejected with HTTP
	// 400. It can only narrow what mesh policy allows, never widen it. Absent
	// means any provider permitted by policy.
	//
	// Reserved as part of the sidecar contract; enforced by the provider
	// scorer. Label declarations are routing hints until attested via the
	// node's Biscuit (see api/labels.go).
	HeaderSamRequiredLabels = "X-Sam-Required-Labels"
)
View Source 
const (
	// SystemNamespace is the namespace reserved for built-in mesh services and protocols.
	SystemNamespace = "sam:system"

	// CatalogTarget is the special system service name used to retrieve tool catalogs.
	// In policy rules, it must be referred to explicitly as: system://sam.catalog
	CatalogTarget = "sam.catalog"

	// MCPServicePrefix is the scheme prefix for Model Context Protocol services.
	// Fully qualified MCP services use the URI format: mcp://<service-name>
	MCPServicePrefix = "mcp://"

	// InferenceServicePrefix is the scheme prefix for LLM Inference services.
	// Fully qualified inference services use the URI format: inference://<service-name>
	InferenceServicePrefix = "inference://"
)
View Source 
const (
	// ServiceTypeStringMCP is the string identifier for MCP services.
	ServiceTypeStringMCP = "mcp"

	// ServiceTypeStringInference is the string identifier for Inference services.
	ServiceTypeStringInference = "inference"
)
View Source 
const (
	MaxAnnounceKeys      = 64
	MaxAnnounceLabels    = 16
	MaxAnnounceStringLen = 256
)

Caps for ServiceAnnounce fields: announcements are unsolicited gossip, so receivers bound every dimension before processing.

View Source 
const NodeConfigVersionV1Alpha1 = "v1alpha1"

NodeConfigVersionV1Alpha1 is the only node config schema this build understands. A file omitting the version is read as this one, since it predates the check.

View Source 
const (
	// SystemAuthenticated is a special member string representing any authenticated user.
	SystemAuthenticated = "sam:system:authenticated"
)

Variables

View Source 
var (
	// BaselinePolicies are the pre-compiled authorization policies for the node middleware.
	BaselinePolicies []biscuit.Policy

	// BaselineRules are the pre-compiled target evaluation rules for the node middleware.
	BaselineRules []biscuit.Rule

	// BaselineReplayCheck verifies that the client peer ID matches the connection peer ID.
	BaselineReplayCheck biscuit.Check

	// BaselineTargetCheck verifies that the target matches one of the allowed network targets.
	BaselineTargetCheck biscuit.Check

	// BaselineAgentRules derive agent_authorized from the holder's granted_agent_* facts.
	BaselineAgentRules []biscuit.Rule

	// BaselineAgentCheck verifies that the holder may speak for the agent it named.
	// Only added when a request carries an agent claim; see node.SamNode.Authorize.
	BaselineAgentCheck biscuit.Check

	// TargetFactRules maps node and OIDC claims to target_fact datalog facts.
	TargetFactRules []biscuit.Rule

	// ControlPlaneStaticTimeCheck is the standard check for verifying a Biscuit's
	// own expiration() fact. Every path that admits a token must add it together
	// with a FactTime fact; see identity.EnforceExpiration.
	ControlPlaneStaticTimeCheck biscuit.Check

	// AllowIfTruePolicy is the static policy "allow if true" used during token verification.
	AllowIfTruePolicy biscuit.Policy
)
View Source 
var (
	EnrollmentStatus_name = map[int32]string{
		0: "ENROLLMENT_STATUS_UNSPECIFIED",
		1: "ENROLLMENT_STATUS_PENDING",
		2: "ENROLLMENT_STATUS_APPROVED",
		3: "ENROLLMENT_STATUS_REJECTED",
	}
	EnrollmentStatus_value = map[string]int32{
		"ENROLLMENT_STATUS_UNSPECIFIED": 0,
		"ENROLLMENT_STATUS_PENDING":     1,
		"ENROLLMENT_STATUS_APPROVED":    2,
		"ENROLLMENT_STATUS_REJECTED":    3,
	}
)

Enum value maps for EnrollmentStatus.

View Source 
var (
	ServiceType_name = map[int32]string{
		0: "SERVICE_TYPE_UNSPECIFIED",
		1: "SERVICE_TYPE_MCP",
		2: "SERVICE_TYPE_INFERENCE",
	}
	ServiceType_value = map[string]int32{
		"SERVICE_TYPE_UNSPECIFIED": 0,
		"SERVICE_TYPE_MCP":         1,
		"SERVICE_TYPE_INFERENCE":   2,
	}
)

Enum value maps for ServiceType.

View Source 
var (
	MeshEvent_Type_name = map[int32]string{
		0: "BANNED",
		1: "KEY_ROTATION",
		2: "POLICY_UPDATE",
	}
	MeshEvent_Type_value = map[string]int32{
		"BANNED":        0,
		"KEY_ROTATION":  1,
		"POLICY_UPDATE": 2,
	}
)

Enum value maps for MeshEvent_Type.

View Source 
var File_api_sam_proto protoreflect.FileDescriptor
View Source 
var SupportedNodeConfigVersions = map[string]bool{
	"":                        true,
	NodeConfigVersionV1Alpha1: true,
}

SupportedNodeConfigVersions gates LoadNodeConfig. A node must refuse a schema it does not know rather than parse it as this one: silently reinterpreting a future config would silently reinterpret its attenuation rules. Adding a version means adding it here and decoding it into the same internal type, so the rest of the node stays version-agnostic.

View Source 
var (
	// ValidMemberPrefixes defines the allowed identity prefixes in policy configuration.
	ValidMemberPrefixes = map[string]struct{}{
		FactUser:  {},
		FactGroup: {},
		FactEmail: {},
		FactNode:  {},
		FactAgent: {},
	}
)

Functions

func AgentMember 

func AgentMember(id string) (string, error)

AgentMember renders an agent identifier as a policy member or target, the form used in allowed_targets and role bindings.

func BuildAgentDatalogFact 

func BuildAgentDatalogFact(pattern string) biscuit.Fact

BuildAgentDatalogFact translates one agent namespace pattern into a Datalog fact. Patterns are the agent id shapes of §8.8: "*", "*.suffix", "prefix.*" or an exact id.

func BuildAgentDatalogFacts 

func BuildAgentDatalogFacts(patterns []string) []biscuit.Fact

BuildAgentDatalogFacts translates a list of agent namespace patterns into a minimal set of facts, merging exact ids into one granted_agent_set so a role naming many agents still costs one fact.

func BuildServiceDatalogFact 

func BuildServiceDatalogFact(serviceStr string) biscuit.Fact

BuildServiceDatalogFact translates a service pattern string into a Datalog Fact.

func BuildServiceDatalogFacts 

func BuildServiceDatalogFacts(services []string) []biscuit.Fact

BuildServiceDatalogFacts translates a list of service patterns into a minimal set of Datalog facts. Exact-match entries are grouped by service type into a single granted_service_set fact each, so token/world fact counts stay flat regardless of how many exact services a role grants. Wildcard, prefix and suffix entries keep their existing one-fact-per-entry representation via BuildServiceDatalogFact, since those already collapse to a single fact per entry.

func BuildTargetDatalogFact 

func BuildTargetDatalogFact(targetStr string) biscuit.Fact

BuildTargetDatalogFact translates a target pattern string into a Datalog Fact.

func BuildTargetDatalogFacts 

func BuildTargetDatalogFacts(targets []string) []biscuit.Fact

BuildTargetDatalogFacts translates a list of target patterns into a minimal set of Datalog facts. Exact-match entries are grouped by fact name into a single granted_target_set fact each, so token/world fact counts stay flat regardless of how many exact targets a role grants. Wildcard, prefix and suffix entries keep their existing one-fact-per-entry representation via BuildTargetDatalogFact, since those already collapse to a single fact per entry.

func DiscoveryTopic 

func DiscoveryTopic(t ServiceType, key string) (string, error)

DiscoveryTopic returns the GossipSub topic for announcements about one routing key (a model ID for inference, a tool name for MCP). Keys are hashed so topic names stay bounded; consumers match exact keys from the ServiceAnnounce payload, so hash collisions only merge announcement streams, never routing decisions.

func IsMeshEntrypointHost 

func IsMeshEntrypointHost(host string) bool

IsMeshEntrypointHost reports whether host addresses the gateway's own agent-facing surface.

func IsMeshHost 

func IsMeshHost(host string) bool

IsMeshHost reports whether host falls inside the mesh zone. It does not validate the name beyond the suffix: use ParseMeshHost for that.

func LabelCheck 

func LabelCheck(required map[string]string) (biscuit.Check, error)

LabelCheck compiles a required label set (canonical, pre-validated with ValidateLabels) into a single fail-closed check satisfied when the token carries any of them: `check if label("region", "us-east-1") or label("team", "platform")`.

func LabelFacts 

func LabelFacts(labels map[string]string) []biscuit.Fact

LabelFacts materializes a label set as one Datalog fact per key=value pair (see FactLabel). Keys are sorted for deterministic fact ordering. An empty set returns nil.

func LabelPatternsAllow 

func LabelPatternsAllow(patterns []string, labels map[string]string) error

LabelPatternsAllow reports whether patterns permit every declared label, naming the first one they do not. Keys are visited in order so the error for a given input is stable.

func MeshHost 

func MeshHost(t ServiceType, serviceName string) (string, error)

MeshHost is the inverse of ParseMeshHost: it renders the hostname a sandboxed agent should connect to in order to reach the given service.

func NormalizeMeshHost 

func NormalizeMeshHost(host string) string

NormalizeMeshHost canonicalizes a hostname taken off the sandbox boundary: it drops a trailing root dot and lowercases the name. DNS names are case-insensitive, so a mesh name only ever addresses a lowercase service name; services registered with uppercase characters are reachable by URI but not by hostname.

func OIDCClaimToFact 

func OIDCClaimToFact() map[string]string

OIDCClaimToFact returns a copy of the OIDC claims to Biscuit facts map. This ensures that the global map is immutable and thread-safe for concurrent readers.

func ParseMeshHost 

func ParseMeshHost(host string) (serviceURI string, err error)

ParseMeshHost translates a mesh hostname into its canonical service URI. 

openrouter.inference.sam.alt -> inference://openrouter
code-reviewer.mcp.sam.alt    -> mcp://code-reviewer

The service type is the label immediately left of the zone; everything to its left is the service name, which may itself contain dots (service names are validated as DNS names, not as single labels). MeshEntrypointHost is not a service and is rejected here; callers must test it with IsMeshEntrypointHost first.

Names are not resolved to a provider: which peer serves the returned URI is a discovery decision, and deliberately not encoded in the name. If pinning to one provider is ever needed, the natural extension is a longer form carrying the peer — mirroring the internal libp2p://<peer>/<type>/<name> URL — but it requires settling on a DNS-safe peer encoding first, because a base58 peer ID is case-sensitive and DNS labels are not (IPFS solves the same problem in subdomain gateways by using lowercase base36 CIDs).

func ParseServiceTarget 

func ParseServiceTarget(target string) (svcType, svcName string)

ParseServiceTarget parses a service target string into its type (scheme) and name components.

Expected formats:

  • Hierarchical service URIs: "scheme://name" (e.g., "mcp://my_service") or "scheme://name/path" (e.g., "mcp://my_service/tool").
  • Target facts: "fact:value" (e.g., "group:backend" or "user:bob").
  • Wildcards: "*" (maps type to "*" and name to "*").

If no scheme/colon is present, it returns an empty string for the type and the full target as the name. No fallback namespace is applied; callers must be explicit.

func ServiceTypeToString 

func ServiceTypeToString(t ServiceType) (string, error)

ServiceTypeToString converts a ServiceType protobuf enum back to its standard string identifier.

func SplitToolName 

func SplitToolName(toolName string) (targetService, originalToolName string, err error)

SplitToolName splits a fully qualified MCP tool name into its target service URI and the original tool name.

Expected format: "scheme://service/tool" (e.g., "mcp://my-service/my-tool"). If the input is empty or invalid, it returns an error. No default fallback is applied.

func TargetFactNames 

func TargetFactNames() []string

TargetFactNames returns the fact names an allowed_targets entry can use.

It is derived from the same source as TargetFactRules, which is the point: a target naming any other fact mints a granted_target_* fact that no target_fact will ever match, so the grant silently denies instead of failing at config time. Deriving both from one place keeps them from drifting apart.

func ValidateAgentID 

func ValidateAgentID(id string) error

ValidateAgentID checks an agent identifier: the value part of an "agent:" member or target, without the prefix.

The rules exist to keep prefix and suffix policy safe and unambiguous: lowercase because the shape is DNS-shaped and DNS is case-insensitive, so two identifiers differing only in case must not be two principals; at least two labels because the rightmost labels are the authority that keeps identifiers from colliding across tenants; and no wildcards, because a wildcard is a policy pattern and never an identity.

func ValidateAgentPattern 

func ValidateAgentPattern(pattern string) error

ValidateAgentPattern checks one entry of a role's allowed_agents: an agent namespace the holder can act for. Unlike ValidateAgentID it allows the wildcard forms, because a namespace grant is a pattern.

A bare "*" is accepted and means any agent, which lets every holder of the role name any agent in the mesh. Some meshes have a single tenant, so it stays expressible, but callers should warn when they see it.

func ValidateLabelKey 

func ValidateLabelKey(key string) error

ValidateLabelKey checks that a label key is well-formed: 1-63 characters from [a-zA-Z0-9_.-].

func ValidateLabelPattern 

func ValidateLabelPattern(pattern string) error

ValidateLabelPattern checks one entry of a role's allowed_labels. The forms are "*" for any label at all, "key=*" for any value of a key, and "key=value" for one exact pair.

func ValidateLabelValue 

func ValidateLabelValue(value string) error

ValidateLabelValue checks that a label value is well-formed: non-empty, bounded length, and free of characters that collide with the wire-format separators (comma-separated key=value pairs) or control characters.

func ValidateLabels 

func ValidateLabels(labels map[string]string) error

ValidateLabels checks every key and value in a label set. Keys are visited in lexicographic order, so the error returned for a given input is deterministic and stable across runs (Go's map iteration is randomized).

func ValidateServiceAnnounce 

func ValidateServiceAnnounce(a *ServiceAnnounce) error

ValidateServiceAnnounce bounds and sanity-checks a gossiped announcement. Origin authenticity and freshness are the receiver's responsibility.

func ValidateServiceFormat 

func ValidateServiceFormat(svc string) error

ValidateServiceFormat ensures the service string follows the explicit URI format.

func ValidateTargetFormat 

func ValidateTargetFormat(target string) error

ValidateTargetFormat ensures the target string follows the explicit fact:value format.

Types

type AgentAttachRequest 

type AgentAttachRequest struct {
	Bundle *AgentBundle `protobuf:"bytes,1,opt,name=bundle,proto3" json:"bundle,omitempty"`
	// contains filtered or unexported fields
}

AgentAttachRequest admits an agent. It is idempotent on agent_id: resuming after a crash or a migration is another Attach, not a distinct operation.

func (*AgentAttachRequest) Descriptor deprecated 

func (*AgentAttachRequest) Descriptor() ([]byte, []int)

Deprecated: Use AgentAttachRequest.ProtoReflect.Descriptor instead.

func (*AgentAttachRequest) GetBundle 

func (x *AgentAttachRequest) GetBundle() *AgentBundle

func (*AgentAttachRequest) ProtoMessage 

func (*AgentAttachRequest) ProtoMessage()

func (*AgentAttachRequest) ProtoReflect 

func (x *AgentAttachRequest) ProtoReflect() protoreflect.Message

func (*AgentAttachRequest) Reset 

func (x *AgentAttachRequest) Reset()

func (*AgentAttachRequest) String 

func (x *AgentAttachRequest) String() string

type AgentAttachResponse 

type AgentAttachResponse struct {

	// Sandbox boundary endpoints to wire into the sandbox: SOCKS5 for guest to
	// host, and a reverse channel for host to guest that is empty when the
	// bundle declares no ingress.
	EgressSocket  string `protobuf:"bytes,1,opt,name=egress_socket,json=egressSocket,proto3" json:"egress_socket,omitempty"`
	IngressSocket string `protobuf:"bytes,2,opt,name=ingress_socket,json=ingressSocket,proto3" json:"ingress_socket,omitempty"`
	Error         string `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentAttachResponse) Descriptor deprecated 

func (*AgentAttachResponse) Descriptor() ([]byte, []int)

Deprecated: Use AgentAttachResponse.ProtoReflect.Descriptor instead.

func (*AgentAttachResponse) GetEgressSocket 

func (x *AgentAttachResponse) GetEgressSocket() string

func (*AgentAttachResponse) GetError 

func (x *AgentAttachResponse) GetError() string

func (*AgentAttachResponse) GetIngressSocket 

func (x *AgentAttachResponse) GetIngressSocket() string

func (*AgentAttachResponse) ProtoMessage 

func (*AgentAttachResponse) ProtoMessage()

func (*AgentAttachResponse) ProtoReflect 

func (x *AgentAttachResponse) ProtoReflect() protoreflect.Message

func (*AgentAttachResponse) Reset 

func (x *AgentAttachResponse) Reset()

func (*AgentAttachResponse) String 

func (x *AgentAttachResponse) String() string

type AgentBundle 

type AgentBundle struct {
	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
	// Canonical mesh identifier, without the "agent:" prefix. Dot-separated and
	// DNS-shaped; see api/agent.go for the rules and why they exist.
	AgentId string `protobuf:"bytes,2,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	// The platform's own identifier, verbatim, kept for audit because the
	// translation into agent_id is not always reversible.
	ExternalId string `protobuf:"bytes,3,opt,name=external_id,json=externalId,proto3" json:"external_id,omitempty"`
	// Path to the workload credential the platform already issues: a projected
	// Kubernetes service-account token, a pod certificate, or an SVID. It is
	// verified at admission against the platform's issuer and then translated
	// into agent facts, the same way OIDC claims are translated at node
	// enrollment. The scheduler needs no mesh credential of its own.
	CredentialPath string          `protobuf:"bytes,4,opt,name=credential_path,json=credentialPath,proto3" json:"credential_path,omitempty"`
	Egress         *AgentEgress    `protobuf:"bytes,5,opt,name=egress,proto3" json:"egress,omitempty"`
	Ingress        []*AgentIngress `protobuf:"bytes,6,rep,name=ingress,proto3" json:"ingress,omitempty"`
	// contains filtered or unexported fields
}

AgentBundle is everything the platform declares about one agent. Its canonical form is a YAML file in the agent's own state directory, so that a suspend/resume onto another host carries it with no extra machinery; this message is the transport mirror of that file.

func (*AgentBundle) Descriptor deprecated 

func (*AgentBundle) Descriptor() ([]byte, []int)

Deprecated: Use AgentBundle.ProtoReflect.Descriptor instead.

func (*AgentBundle) GetAgentId 

func (x *AgentBundle) GetAgentId() string

func (*AgentBundle) GetCredentialPath 

func (x *AgentBundle) GetCredentialPath() string

func (*AgentBundle) GetEgress 

func (x *AgentBundle) GetEgress() *AgentEgress

func (*AgentBundle) GetExternalId 

func (x *AgentBundle) GetExternalId() string

func (*AgentBundle) GetIngress 

func (x *AgentBundle) GetIngress() []*AgentIngress

func (*AgentBundle) GetVersion 

func (x *AgentBundle) GetVersion() string

func (*AgentBundle) ProtoMessage 

func (*AgentBundle) ProtoMessage()

func (*AgentBundle) ProtoReflect 

func (x *AgentBundle) ProtoReflect() protoreflect.Message

func (*AgentBundle) Reset 

func (x *AgentBundle) Reset()

func (*AgentBundle) String 

func (x *AgentBundle) String() string

type AgentDetachRequest 

type AgentDetachRequest struct {
	AgentId string `protobuf:"bytes,1,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	// contains filtered or unexported fields
}

AgentDetachRequest stops an agent: ingress is unregistered, channels are closed and credentials dropped. It must leave no residual advertisement.

func (*AgentDetachRequest) Descriptor deprecated 

func (*AgentDetachRequest) Descriptor() ([]byte, []int)

Deprecated: Use AgentDetachRequest.ProtoReflect.Descriptor instead.

func (*AgentDetachRequest) GetAgentId 

func (x *AgentDetachRequest) GetAgentId() string

func (*AgentDetachRequest) ProtoMessage 

func (*AgentDetachRequest) ProtoMessage()

func (*AgentDetachRequest) ProtoReflect 

func (x *AgentDetachRequest) ProtoReflect() protoreflect.Message

func (*AgentDetachRequest) Reset 

func (x *AgentDetachRequest) Reset()

func (*AgentDetachRequest) String 

func (x *AgentDetachRequest) String() string

type AgentDetachResponse 

type AgentDetachResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentDetachResponse) Descriptor deprecated 

func (*AgentDetachResponse) Descriptor() ([]byte, []int)

Deprecated: Use AgentDetachResponse.ProtoReflect.Descriptor instead.

func (*AgentDetachResponse) GetError 

func (x *AgentDetachResponse) GetError() string

func (*AgentDetachResponse) GetSuccess 

func (x *AgentDetachResponse) GetSuccess() bool

func (*AgentDetachResponse) ProtoMessage 

func (*AgentDetachResponse) ProtoMessage()

func (*AgentDetachResponse) ProtoReflect 

func (x *AgentDetachResponse) ProtoReflect() protoreflect.Message

func (*AgentDetachResponse) Reset 

func (x *AgentDetachResponse) Reset()

func (*AgentDetachResponse) String 

func (x *AgentDetachResponse) String() string

type AgentEgress 

type AgentEgress struct {
	Allow   []string       `protobuf:"bytes,1,rep,name=allow,proto3" json:"allow,omitempty"`
	Secrets []*AgentSecret `protobuf:"bytes,2,rep,name=secrets,proto3" json:"secrets,omitempty"`
	// contains filtered or unexported fields
}

AgentEgress is deny-by-default. Patterns are matched against the destination name taken from the sandbox boundary, never against a resolved address.

func (*AgentEgress) Descriptor deprecated 

func (*AgentEgress) Descriptor() ([]byte, []int)

Deprecated: Use AgentEgress.ProtoReflect.Descriptor instead.

func (*AgentEgress) GetAllow 

func (x *AgentEgress) GetAllow() []string

func (*AgentEgress) GetSecrets 

func (x *AgentEgress) GetSecrets() []*AgentSecret

func (*AgentEgress) ProtoMessage 

func (*AgentEgress) ProtoMessage()

func (*AgentEgress) ProtoReflect 

func (x *AgentEgress) ProtoReflect() protoreflect.Message

func (*AgentEgress) Reset 

func (x *AgentEgress) Reset()

func (*AgentEgress) String 

func (x *AgentEgress) String() string

type AgentIngress 

type AgentIngress struct {
	Type        ServiceType `protobuf:"varint,1,opt,name=type,proto3,enum=sam.v1.ServiceType" json:"type,omitempty"`
	Name        string      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Port        uint32      `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	Description string      `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
	// contains filtered or unexported fields
}

AgentIngress declares that the agent serves a mesh service. The name is the service half of the mesh host the rest of the mesh dials (see api/names.go); port is where the agent listens inside its sandbox.

func (*AgentIngress) Descriptor deprecated 

func (*AgentIngress) Descriptor() ([]byte, []int)

Deprecated: Use AgentIngress.ProtoReflect.Descriptor instead.

func (*AgentIngress) GetDescription 

func (x *AgentIngress) GetDescription() string

func (*AgentIngress) GetName 

func (x *AgentIngress) GetName() string

func (*AgentIngress) GetPort 

func (x *AgentIngress) GetPort() uint32

func (*AgentIngress) GetType 

func (x *AgentIngress) GetType() ServiceType

func (*AgentIngress) ProtoMessage 

func (*AgentIngress) ProtoMessage()

func (*AgentIngress) ProtoReflect 

func (x *AgentIngress) ProtoReflect() protoreflect.Message

func (*AgentIngress) Reset 

func (x *AgentIngress) Reset()

func (*AgentIngress) String 

func (x *AgentIngress) String() string

type AgentRefreshRequest 

type AgentRefreshRequest struct {
	AgentId        string `protobuf:"bytes,1,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	CredentialPath string `protobuf:"bytes,2,opt,name=credential_path,json=credentialPath,proto3" json:"credential_path,omitempty"`
	// contains filtered or unexported fields
}

AgentRefreshRequest hands in a rotated workload credential. Platforms rotate these on their own schedule, which is what bounds how long a stale admission stays usable.

func (*AgentRefreshRequest) Descriptor deprecated 

func (*AgentRefreshRequest) Descriptor() ([]byte, []int)

Deprecated: Use AgentRefreshRequest.ProtoReflect.Descriptor instead.

func (*AgentRefreshRequest) GetAgentId 

func (x *AgentRefreshRequest) GetAgentId() string

func (*AgentRefreshRequest) GetCredentialPath 

func (x *AgentRefreshRequest) GetCredentialPath() string

func (*AgentRefreshRequest) ProtoMessage 

func (*AgentRefreshRequest) ProtoMessage()

func (*AgentRefreshRequest) ProtoReflect 

func (x *AgentRefreshRequest) ProtoReflect() protoreflect.Message

func (*AgentRefreshRequest) Reset 

func (x *AgentRefreshRequest) Reset()

func (*AgentRefreshRequest) String 

func (x *AgentRefreshRequest) String() string

type AgentRefreshResponse 

type AgentRefreshResponse struct {
	Success   bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error     string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	ExpiresAt int64  `protobuf:"varint,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentRefreshResponse) Descriptor deprecated 

func (*AgentRefreshResponse) Descriptor() ([]byte, []int)

Deprecated: Use AgentRefreshResponse.ProtoReflect.Descriptor instead.

func (*AgentRefreshResponse) GetError 

func (x *AgentRefreshResponse) GetError() string

func (*AgentRefreshResponse) GetExpiresAt 

func (x *AgentRefreshResponse) GetExpiresAt() int64

func (*AgentRefreshResponse) GetSuccess 

func (x *AgentRefreshResponse) GetSuccess() bool

func (*AgentRefreshResponse) ProtoMessage 

func (*AgentRefreshResponse) ProtoMessage()

func (*AgentRefreshResponse) ProtoReflect 

func (x *AgentRefreshResponse) ProtoReflect() protoreflect.Message

func (*AgentRefreshResponse) Reset 

func (x *AgentRefreshResponse) Reset()

func (*AgentRefreshResponse) String 

func (x *AgentRefreshResponse) String() string

type AgentSecret 

type AgentSecret struct {
	Host       string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Kind       string `protobuf:"bytes,2,opt,name=kind,proto3" json:"kind,omitempty"`                               // bearer | basicauth | customheader
	HeaderName string `protobuf:"bytes,3,opt,name=header_name,json=headerName,proto3" json:"header_name,omitempty"` // customheader only
	ValuePath  string `protobuf:"bytes,4,opt,name=value_path,json=valuePath,proto3" json:"value_path,omitempty"`
	// contains filtered or unexported fields
}

AgentSecret configures credential injection for one destination. It carries a path, never a value: secret material must not travel through this API.

func (*AgentSecret) Descriptor deprecated 

func (*AgentSecret) Descriptor() ([]byte, []int)

Deprecated: Use AgentSecret.ProtoReflect.Descriptor instead.

func (*AgentSecret) GetHeaderName 

func (x *AgentSecret) GetHeaderName() string

func (*AgentSecret) GetHost 

func (x *AgentSecret) GetHost() string

func (*AgentSecret) GetKind 

func (x *AgentSecret) GetKind() string

func (*AgentSecret) GetValuePath 

func (x *AgentSecret) GetValuePath() string

func (*AgentSecret) ProtoMessage 

func (*AgentSecret) ProtoMessage()

func (*AgentSecret) ProtoReflect 

func (x *AgentSecret) ProtoReflect() protoreflect.Message

func (*AgentSecret) Reset 

func (x *AgentSecret) Reset()

func (*AgentSecret) String 

func (x *AgentSecret) String() string

type AgentStatus 

type AgentStatus struct {
	AgentId             string          `protobuf:"bytes,1,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	Attached            bool            `protobuf:"varint,2,opt,name=attached,proto3" json:"attached,omitempty"`
	Ingress             []*AgentIngress `protobuf:"bytes,3,rep,name=ingress,proto3" json:"ingress,omitempty"`
	CredentialExpiresAt int64           `protobuf:"varint,4,opt,name=credential_expires_at,json=credentialExpiresAt,proto3" json:"credential_expires_at,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentStatus) Descriptor deprecated 

func (*AgentStatus) Descriptor() ([]byte, []int)

Deprecated: Use AgentStatus.ProtoReflect.Descriptor instead.

func (*AgentStatus) GetAgentId 

func (x *AgentStatus) GetAgentId() string

func (*AgentStatus) GetAttached 

func (x *AgentStatus) GetAttached() bool

func (*AgentStatus) GetCredentialExpiresAt 

func (x *AgentStatus) GetCredentialExpiresAt() int64

func (*AgentStatus) GetIngress 

func (x *AgentStatus) GetIngress() []*AgentIngress

func (*AgentStatus) ProtoMessage 

func (*AgentStatus) ProtoMessage()

func (*AgentStatus) ProtoReflect 

func (x *AgentStatus) ProtoReflect() protoreflect.Message

func (*AgentStatus) Reset 

func (x *AgentStatus) Reset()

func (*AgentStatus) String 

func (x *AgentStatus) String() string

type AgentStatusRequest 

type AgentStatusRequest struct {
	AgentId string `protobuf:"bytes,1,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	// contains filtered or unexported fields
}

AgentStatusRequest reports on one agent, or on all of them when agent_id is empty, for a scheduler's reconcile loop.

func (*AgentStatusRequest) Descriptor deprecated 

func (*AgentStatusRequest) Descriptor() ([]byte, []int)

Deprecated: Use AgentStatusRequest.ProtoReflect.Descriptor instead.

func (*AgentStatusRequest) GetAgentId 

func (x *AgentStatusRequest) GetAgentId() string

func (*AgentStatusRequest) ProtoMessage 

func (*AgentStatusRequest) ProtoMessage()

func (*AgentStatusRequest) ProtoReflect 

func (x *AgentStatusRequest) ProtoReflect() protoreflect.Message

func (*AgentStatusRequest) Reset 

func (x *AgentStatusRequest) Reset()

func (*AgentStatusRequest) String 

func (x *AgentStatusRequest) String() string

type AgentStatusResponse 

type AgentStatusResponse struct {
	Agents []*AgentStatus `protobuf:"bytes,1,rep,name=agents,proto3" json:"agents,omitempty"`
	Error  string         `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentStatusResponse) Descriptor deprecated 

func (*AgentStatusResponse) Descriptor() ([]byte, []int)

Deprecated: Use AgentStatusResponse.ProtoReflect.Descriptor instead.

func (*AgentStatusResponse) GetAgents 

func (x *AgentStatusResponse) GetAgents() []*AgentStatus

func (*AgentStatusResponse) GetError 

func (x *AgentStatusResponse) GetError() string

func (*AgentStatusResponse) ProtoMessage 

func (*AgentStatusResponse) ProtoMessage()

func (*AgentStatusResponse) ProtoReflect 

func (x *AgentStatusResponse) ProtoReflect() protoreflect.Message

func (*AgentStatusResponse) Reset 

func (x *AgentStatusResponse) Reset()

func (*AgentStatusResponse) String 

func (x *AgentStatusResponse) String() string

type Attenuation 

type Attenuation struct {
	Policies []string `yaml:"policies"`
	Checks   []string `yaml:"checks"`
	Rules    []string `yaml:"rules"`
}

type AuthFrame 

type AuthFrame struct {
	Biscuit       []byte `protobuf:"bytes,1,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	TargetService string `protobuf:"bytes,2,opt,name=target_service,json=targetService,proto3" json:"target_service,omitempty"` // Optional: specific service requested
	// The agent this request is made for, as a canonical agent identifier (see
	// api/agent.go). It is the calling node's claim, carried beside the token
	// because Biscuit hides an appended block's facts from the authorizer; the
	// HTTP datapath carries the same claim in HeaderSamAgent.
	Agent string `protobuf:"bytes,3,opt,name=agent,proto3" json:"agent,omitempty"`
	// contains filtered or unexported fields
}

func (*AuthFrame) Descriptor deprecated 

func (*AuthFrame) Descriptor() ([]byte, []int)

Deprecated: Use AuthFrame.ProtoReflect.Descriptor instead.

func (*AuthFrame) GetAgent 

func (x *AuthFrame) GetAgent() string

func (*AuthFrame) GetBiscuit 

func (x *AuthFrame) GetBiscuit() []byte

func (*AuthFrame) GetTargetService 

func (x *AuthFrame) GetTargetService() string

func (*AuthFrame) ProtoMessage 

func (*AuthFrame) ProtoMessage()

func (*AuthFrame) ProtoReflect 

func (x *AuthFrame) ProtoReflect() protoreflect.Message

func (*AuthFrame) Reset 

func (x *AuthFrame) Reset()

func (*AuthFrame) String 

func (x *AuthFrame) String() string

type AuthResponse 

type AuthResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`     // populated only if success is false
	Biscuit []byte `protobuf:"bytes,3,opt,name=biscuit,proto3" json:"biscuit,omitempty"` // The server's own Biscuit token (for mutual auth)
	// contains filtered or unexported fields
}

func (*AuthResponse) Descriptor deprecated 

func (*AuthResponse) Descriptor() ([]byte, []int)

Deprecated: Use AuthResponse.ProtoReflect.Descriptor instead.

func (*AuthResponse) GetBiscuit 

func (x *AuthResponse) GetBiscuit() []byte

func (*AuthResponse) GetError 

func (x *AuthResponse) GetError() string

func (*AuthResponse) GetSuccess 

func (x *AuthResponse) GetSuccess() bool

func (*AuthResponse) ProtoMessage 

func (*AuthResponse) ProtoMessage()

func (*AuthResponse) ProtoReflect 

func (x *AuthResponse) ProtoReflect() protoreflect.Message

func (*AuthResponse) Reset 

func (x *AuthResponse) Reset()

func (*AuthResponse) String 

func (x *AuthResponse) String() string

type BootstrapEnrollRequest 

type BootstrapEnrollRequest struct {
	BootstrapToken string `protobuf:"bytes,1,opt,name=bootstrap_token,json=bootstrapToken,proto3" json:"bootstrap_token,omitempty"`
	PeerId         string `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	PublicKey      []byte `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	RequestedRole  string `protobuf:"bytes,4,opt,name=requested_role,json=requestedRole,proto3" json:"requested_role,omitempty"`
	// Operator-declared labels; the admin approving the enrollment attests
	// them (see EnrollRequest.labels).
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// contains filtered or unexported fields
}

func (*BootstrapEnrollRequest) Descriptor deprecated 

func (*BootstrapEnrollRequest) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapEnrollRequest.ProtoReflect.Descriptor instead.

func (*BootstrapEnrollRequest) GetBootstrapToken 

func (x *BootstrapEnrollRequest) GetBootstrapToken() string

func (*BootstrapEnrollRequest) GetLabels 

func (x *BootstrapEnrollRequest) GetLabels() map[string]string

func (*BootstrapEnrollRequest) GetPeerId 

func (x *BootstrapEnrollRequest) GetPeerId() string

func (*BootstrapEnrollRequest) GetPublicKey 

func (x *BootstrapEnrollRequest) GetPublicKey() []byte

func (*BootstrapEnrollRequest) GetRequestedRole 

func (x *BootstrapEnrollRequest) GetRequestedRole() string

func (*BootstrapEnrollRequest) ProtoMessage 

func (*BootstrapEnrollRequest) ProtoMessage()

func (*BootstrapEnrollRequest) ProtoReflect 

func (x *BootstrapEnrollRequest) ProtoReflect() protoreflect.Message

func (*BootstrapEnrollRequest) Reset 

func (x *BootstrapEnrollRequest) Reset()

func (*BootstrapEnrollRequest) String 

func (x *BootstrapEnrollRequest) String() string

type BootstrapEnrollResponse 

type BootstrapEnrollResponse struct {
	Status                EnrollmentStatus `protobuf:"varint,1,opt,name=status,proto3,enum=sam.v1.EnrollmentStatus" json:"status,omitempty"`
	BiscuitToken          []byte           `protobuf:"bytes,2,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`                         // Populated only if APPROVED
	PollIntervalSeconds   int32            `protobuf:"varint,3,opt,name=poll_interval_seconds,json=pollIntervalSeconds,proto3" json:"poll_interval_seconds,omitempty"` // Recommended polling wait time
	ErrorMessage          string           `protobuf:"bytes,4,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
	ControlPlanePublicKey []byte           `` // Populated only if APPROVED
	/* 128-byte string literal not displayed */
	RouterAddresses []string `protobuf:"bytes,6,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"` // Populated only if APPROVED
	Expiration      int64    `protobuf:"varint,7,opt,name=expiration,proto3" json:"expiration,omitempty"`                                 // Populated only if APPROVED
	// contains filtered or unexported fields
}

func (*BootstrapEnrollResponse) Descriptor deprecated 

func (*BootstrapEnrollResponse) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapEnrollResponse.ProtoReflect.Descriptor instead.

func (*BootstrapEnrollResponse) GetBiscuitToken 

func (x *BootstrapEnrollResponse) GetBiscuitToken() []byte

func (*BootstrapEnrollResponse) GetControlPlanePublicKey 

func (x *BootstrapEnrollResponse) GetControlPlanePublicKey() []byte

func (*BootstrapEnrollResponse) GetErrorMessage 

func (x *BootstrapEnrollResponse) GetErrorMessage() string

func (*BootstrapEnrollResponse) GetExpiration 

func (x *BootstrapEnrollResponse) GetExpiration() int64

func (*BootstrapEnrollResponse) GetPollIntervalSeconds 

func (x *BootstrapEnrollResponse) GetPollIntervalSeconds() int32

func (*BootstrapEnrollResponse) GetRouterAddresses 

func (x *BootstrapEnrollResponse) GetRouterAddresses() []string

func (*BootstrapEnrollResponse) GetStatus 

func (x *BootstrapEnrollResponse) GetStatus() EnrollmentStatus

func (*BootstrapEnrollResponse) ProtoMessage 

func (*BootstrapEnrollResponse) ProtoMessage()

func (*BootstrapEnrollResponse) ProtoReflect 

func (x *BootstrapEnrollResponse) ProtoReflect() protoreflect.Message

func (*BootstrapEnrollResponse) Reset 

func (x *BootstrapEnrollResponse) Reset()

func (*BootstrapEnrollResponse) String 

func (x *BootstrapEnrollResponse) String() string

type CommandBackend 

type CommandBackend struct {
	Command []string          `protobuf:"bytes,1,rep,name=command,proto3" json:"command,omitempty"`
	Env     map[string]string `` /* 133-byte string literal not displayed */
	// contains filtered or unexported fields
}

func (*CommandBackend) Descriptor deprecated 

func (*CommandBackend) Descriptor() ([]byte, []int)

Deprecated: Use CommandBackend.ProtoReflect.Descriptor instead.

func (*CommandBackend) GetCommand 

func (x *CommandBackend) GetCommand() []string

func (*CommandBackend) GetEnv 

func (x *CommandBackend) GetEnv() map[string]string

func (*CommandBackend) ProtoMessage 

func (*CommandBackend) ProtoMessage()

func (*CommandBackend) ProtoReflect 

func (x *CommandBackend) ProtoReflect() protoreflect.Message

func (*CommandBackend) Reset 

func (x *CommandBackend) Reset()

func (*CommandBackend) String 

func (x *CommandBackend) String() string

type ControlPlaneInfoResponse 

type ControlPlaneInfoResponse struct {
	OidcIssuer      string   `protobuf:"bytes,1,opt,name=oidc_issuer,json=oidcIssuer,proto3" json:"oidc_issuer,omitempty"`
	ClientId        string   `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	Audience        string   `protobuf:"bytes,3,opt,name=audience,proto3" json:"audience,omitempty"`
	RouterAddresses []string `protobuf:"bytes,4,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"`
	// contains filtered or unexported fields
}

func (*ControlPlaneInfoResponse) Descriptor deprecated 

func (*ControlPlaneInfoResponse) Descriptor() ([]byte, []int)

Deprecated: Use ControlPlaneInfoResponse.ProtoReflect.Descriptor instead.

func (*ControlPlaneInfoResponse) GetAudience 

func (x *ControlPlaneInfoResponse) GetAudience() string

func (*ControlPlaneInfoResponse) GetClientId 

func (x *ControlPlaneInfoResponse) GetClientId() string

func (*ControlPlaneInfoResponse) GetOidcIssuer 

func (x *ControlPlaneInfoResponse) GetOidcIssuer() string

func (*ControlPlaneInfoResponse) GetRouterAddresses 

func (x *ControlPlaneInfoResponse) GetRouterAddresses() []string

func (*ControlPlaneInfoResponse) ProtoMessage 

func (*ControlPlaneInfoResponse) ProtoMessage()

func (*ControlPlaneInfoResponse) ProtoReflect 

func (x *ControlPlaneInfoResponse) ProtoReflect() protoreflect.Message

func (*ControlPlaneInfoResponse) Reset 

func (x *ControlPlaneInfoResponse) Reset()

func (*ControlPlaneInfoResponse) String 

func (x *ControlPlaneInfoResponse) String() string

type DiscoveredProvider 

type DiscoveredProvider struct {
	PeerId         string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	LocalProxyUrl  string `protobuf:"bytes,2,opt,name=local_proxy_url,json=localProxyUrl,proto3" json:"local_proxy_url,omitempty"`
	SrvName        string `protobuf:"bytes,3,opt,name=srv_name,json=srvName,proto3" json:"srv_name,omitempty"`
	SrvDescription string `protobuf:"bytes,4,opt,name=srv_description,json=srvDescription,proto3" json:"srv_description,omitempty"`
	// contains filtered or unexported fields
}

func (*DiscoveredProvider) Descriptor deprecated 

func (*DiscoveredProvider) Descriptor() ([]byte, []int)

Deprecated: Use DiscoveredProvider.ProtoReflect.Descriptor instead.

func (*DiscoveredProvider) GetLocalProxyUrl 

func (x *DiscoveredProvider) GetLocalProxyUrl() string

func (*DiscoveredProvider) GetPeerId 

func (x *DiscoveredProvider) GetPeerId() string

func (*DiscoveredProvider) GetSrvDescription 

func (x *DiscoveredProvider) GetSrvDescription() string

func (*DiscoveredProvider) GetSrvName 

func (x *DiscoveredProvider) GetSrvName() string

func (*DiscoveredProvider) ProtoMessage 

func (*DiscoveredProvider) ProtoMessage()

func (*DiscoveredProvider) ProtoReflect 

func (x *DiscoveredProvider) ProtoReflect() protoreflect.Message

func (*DiscoveredProvider) Reset 

func (x *DiscoveredProvider) Reset()

func (*DiscoveredProvider) String 

func (x *DiscoveredProvider) String() string

type EnrollRequest 

type EnrollRequest struct {
	Jwt           string `protobuf:"bytes,1,opt,name=jwt,proto3" json:"jwt,omitempty"`
	PeerId        string `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	PublicKey     []byte `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	RequestedRole string `protobuf:"bytes,4,opt,name=requested_role,json=requestedRole,proto3" json:"requested_role,omitempty"`
	// Operator-declared labels (e.g. key "region", see api/labels.go).
	// Validated fail-closed by the control plane and, once attested by the
	// enrollment flow's gates, minted as signed label() facts in the
	// biscuit. Empty means no claims.
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// contains filtered or unexported fields
}

func (*EnrollRequest) Descriptor deprecated 

func (*EnrollRequest) Descriptor() ([]byte, []int)

Deprecated: Use EnrollRequest.ProtoReflect.Descriptor instead.

func (*EnrollRequest) GetJwt 

func (x *EnrollRequest) GetJwt() string

func (*EnrollRequest) GetLabels 

func (x *EnrollRequest) GetLabels() map[string]string

func (*EnrollRequest) GetPeerId 

func (x *EnrollRequest) GetPeerId() string

func (*EnrollRequest) GetPublicKey 

func (x *EnrollRequest) GetPublicKey() []byte

func (*EnrollRequest) GetRequestedRole 

func (x *EnrollRequest) GetRequestedRole() string

func (*EnrollRequest) ProtoMessage 

func (*EnrollRequest) ProtoMessage()

func (*EnrollRequest) ProtoReflect 

func (x *EnrollRequest) ProtoReflect() protoreflect.Message

func (*EnrollRequest) Reset 

func (x *EnrollRequest) Reset()

func (*EnrollRequest) String 

func (x *EnrollRequest) String() string

type EnrollResponse 

type EnrollResponse struct {
	BiscuitToken          []byte   `protobuf:"bytes,1,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`
	ErrorMessage          string   `protobuf:"bytes,2,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
	ControlPlanePublicKey []byte   `` /* 128-byte string literal not displayed */
	RouterAddresses       []string `protobuf:"bytes,4,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"`
	Expiration            int64    `protobuf:"varint,5,opt,name=expiration,proto3" json:"expiration,omitempty"`
	// contains filtered or unexported fields
}

func (*EnrollResponse) Descriptor deprecated 

func (*EnrollResponse) Descriptor() ([]byte, []int)

Deprecated: Use EnrollResponse.ProtoReflect.Descriptor instead.

func (*EnrollResponse) GetBiscuitToken 

func (x *EnrollResponse) GetBiscuitToken() []byte

func (*EnrollResponse) GetControlPlanePublicKey 

func (x *EnrollResponse) GetControlPlanePublicKey() []byte

func (*EnrollResponse) GetErrorMessage 

func (x *EnrollResponse) GetErrorMessage() string

func (*EnrollResponse) GetExpiration 

func (x *EnrollResponse) GetExpiration() int64

func (*EnrollResponse) GetRouterAddresses 

func (x *EnrollResponse) GetRouterAddresses() []string

func (*EnrollResponse) ProtoMessage 

func (*EnrollResponse) ProtoMessage()

func (*EnrollResponse) ProtoReflect 

func (x *EnrollResponse) ProtoReflect() protoreflect.Message

func (*EnrollResponse) Reset 

func (x *EnrollResponse) Reset()

func (*EnrollResponse) String 

func (x *EnrollResponse) String() string

type EnrollmentStatus 

type EnrollmentStatus int32
const (
	EnrollmentStatus_ENROLLMENT_STATUS_UNSPECIFIED EnrollmentStatus = 0
	EnrollmentStatus_ENROLLMENT_STATUS_PENDING     EnrollmentStatus = 1
	EnrollmentStatus_ENROLLMENT_STATUS_APPROVED    EnrollmentStatus = 2
	EnrollmentStatus_ENROLLMENT_STATUS_REJECTED    EnrollmentStatus = 3
)

func (EnrollmentStatus) Descriptor 

func (EnrollmentStatus) Descriptor() protoreflect.EnumDescriptor

func (EnrollmentStatus) Enum 

func (x EnrollmentStatus) Enum() *EnrollmentStatus

func (EnrollmentStatus) EnumDescriptor deprecated 

func (EnrollmentStatus) EnumDescriptor() ([]byte, []int)

Deprecated: Use EnrollmentStatus.Descriptor instead.

func (EnrollmentStatus) Number 

func (x EnrollmentStatus) Number() protoreflect.EnumNumber

func (EnrollmentStatus) String 

func (x EnrollmentStatus) String() string

func (EnrollmentStatus) Type 

func (EnrollmentStatus) Type() protoreflect.EnumType

type IdentityEvidenceResponse 

type IdentityEvidenceResponse struct {
	PeerId                  string   `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Biscuit                 []byte   `protobuf:"bytes,2,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	BiscuitExpiresAt        int64    `protobuf:"varint,3,opt,name=biscuit_expires_at,json=biscuitExpiresAt,proto3" json:"biscuit_expires_at,omitempty"`
	ControlPlaneUrl         string   `protobuf:"bytes,4,opt,name=control_plane_url,json=controlPlaneUrl,proto3" json:"control_plane_url,omitempty"`
	TrustedControlPlaneKeys [][]byte `` // Ed25519 SPKI DER
	/* 134-byte string literal not displayed */
	CheckedAt int64 `protobuf:"varint,6,opt,name=checked_at,json=checkedAt,proto3" json:"checked_at,omitempty"`
	// contains filtered or unexported fields
}

func (*IdentityEvidenceResponse) Descriptor deprecated 

func (*IdentityEvidenceResponse) Descriptor() ([]byte, []int)

Deprecated: Use IdentityEvidenceResponse.ProtoReflect.Descriptor instead.

func (*IdentityEvidenceResponse) GetBiscuit 

func (x *IdentityEvidenceResponse) GetBiscuit() []byte

func (*IdentityEvidenceResponse) GetBiscuitExpiresAt 

func (x *IdentityEvidenceResponse) GetBiscuitExpiresAt() int64

func (*IdentityEvidenceResponse) GetCheckedAt 

func (x *IdentityEvidenceResponse) GetCheckedAt() int64

func (*IdentityEvidenceResponse) GetControlPlaneUrl 

func (x *IdentityEvidenceResponse) GetControlPlaneUrl() string

func (*IdentityEvidenceResponse) GetPeerId 

func (x *IdentityEvidenceResponse) GetPeerId() string

func (*IdentityEvidenceResponse) GetTrustedControlPlaneKeys 

func (x *IdentityEvidenceResponse) GetTrustedControlPlaneKeys() [][]byte

func (*IdentityEvidenceResponse) ProtoMessage 

func (*IdentityEvidenceResponse) ProtoMessage()

func (*IdentityEvidenceResponse) ProtoReflect 

func (x *IdentityEvidenceResponse) ProtoReflect() protoreflect.Message

func (*IdentityEvidenceResponse) Reset 

func (x *IdentityEvidenceResponse) Reset()

func (*IdentityEvidenceResponse) String 

func (x *IdentityEvidenceResponse) String() string

type KeysResponse 

type KeysResponse struct {
	PublicKeys [][]byte `protobuf:"bytes,1,rep,name=public_keys,json=publicKeys,proto3" json:"public_keys,omitempty"`
	// contains filtered or unexported fields
}

func (*KeysResponse) Descriptor deprecated 

func (*KeysResponse) Descriptor() ([]byte, []int)

Deprecated: Use KeysResponse.ProtoReflect.Descriptor instead.

func (*KeysResponse) GetPublicKeys 

func (x *KeysResponse) GetPublicKeys() [][]byte

func (*KeysResponse) ProtoMessage 

func (*KeysResponse) ProtoMessage()

func (*KeysResponse) ProtoReflect 

func (x *KeysResponse) ProtoReflect() protoreflect.Message

func (*KeysResponse) Reset 

func (x *KeysResponse) Reset()

func (*KeysResponse) String 

func (x *KeysResponse) String() string

type MeshEvent 

type MeshEvent struct {
	Type         MeshEvent_Type `protobuf:"varint,1,opt,name=type,proto3,enum=sam.v1.MeshEvent_Type" json:"type,omitempty"`
	PeerId       string         `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Timestamp    int64          `protobuf:"varint,3,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
	NewPublicKey []byte         `protobuf:"bytes,4,opt,name=new_public_key,json=newPublicKey,proto3" json:"new_public_key,omitempty"`
	Signature    []byte         `protobuf:"bytes,5,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

func (*MeshEvent) Descriptor deprecated 

func (*MeshEvent) Descriptor() ([]byte, []int)

Deprecated: Use MeshEvent.ProtoReflect.Descriptor instead.

func (*MeshEvent) GetNewPublicKey 

func (x *MeshEvent) GetNewPublicKey() []byte

func (*MeshEvent) GetPeerId 

func (x *MeshEvent) GetPeerId() string

func (*MeshEvent) GetSignature 

func (x *MeshEvent) GetSignature() []byte

func (*MeshEvent) GetTimestamp 

func (x *MeshEvent) GetTimestamp() int64

func (*MeshEvent) GetType 

func (x *MeshEvent) GetType() MeshEvent_Type

func (*MeshEvent) ProtoMessage 

func (*MeshEvent) ProtoMessage()

func (*MeshEvent) ProtoReflect 

func (x *MeshEvent) ProtoReflect() protoreflect.Message

func (*MeshEvent) Reset 

func (x *MeshEvent) Reset()

func (*MeshEvent) String 

func (x *MeshEvent) String() string

type MeshEvent_Type 

type MeshEvent_Type int32
const (
	MeshEvent_BANNED        MeshEvent_Type = 0
	MeshEvent_KEY_ROTATION  MeshEvent_Type = 1
	MeshEvent_POLICY_UPDATE MeshEvent_Type = 2
)

func (MeshEvent_Type) Descriptor 

func (MeshEvent_Type) Descriptor() protoreflect.EnumDescriptor

func (MeshEvent_Type) Enum 

func (x MeshEvent_Type) Enum() *MeshEvent_Type

func (MeshEvent_Type) EnumDescriptor deprecated 

func (MeshEvent_Type) EnumDescriptor() ([]byte, []int)

Deprecated: Use MeshEvent_Type.Descriptor instead.

func (MeshEvent_Type) Number 

func (x MeshEvent_Type) Number() protoreflect.EnumNumber

func (MeshEvent_Type) String 

func (x MeshEvent_Type) String() string

func (MeshEvent_Type) Type 

func (MeshEvent_Type) Type() protoreflect.EnumType

type NodeConfig 

type NodeConfig struct {
	Version     string          `yaml:"version"`
	Attenuation Attenuation     `yaml:"attenuation"`
	Services    []ServiceConfig `yaml:"services"`
}

NodeConfig defines the optional attenuation rules and static services for a specific SAM Node.

type PeerEvidenceResponse 

type PeerEvidenceResponse struct {
	PeerId        string            `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Biscuit       []byte            `protobuf:"bytes,2,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	VerifyingKey  []byte            `protobuf:"bytes,3,opt,name=verifying_key,json=verifyingKey,proto3" json:"verifying_key,omitempty"` // Ed25519 SPKI DER, member of the trusted set
	Roles         []string          `protobuf:"bytes,4,rep,name=roles,proto3" json:"roles,omitempty"`
	Labels        map[string]string `` /* 139-byte string literal not displayed */
	Expiration    int64             `protobuf:"varint,6,opt,name=expiration,proto3" json:"expiration,omitempty"`
	RevocationIds []string          `protobuf:"bytes,7,rep,name=revocation_ids,json=revocationIds,proto3" json:"revocation_ids,omitempty"` // hex
	CheckedAt     int64             `protobuf:"varint,8,opt,name=checked_at,json=checkedAt,proto3" json:"checked_at,omitempty"`
	// contains filtered or unexported fields
}

func (*PeerEvidenceResponse) Descriptor deprecated 

func (*PeerEvidenceResponse) Descriptor() ([]byte, []int)

Deprecated: Use PeerEvidenceResponse.ProtoReflect.Descriptor instead.

func (*PeerEvidenceResponse) GetBiscuit 

func (x *PeerEvidenceResponse) GetBiscuit() []byte

func (*PeerEvidenceResponse) GetCheckedAt 

func (x *PeerEvidenceResponse) GetCheckedAt() int64

func (*PeerEvidenceResponse) GetExpiration 

func (x *PeerEvidenceResponse) GetExpiration() int64

func (*PeerEvidenceResponse) GetLabels 

func (x *PeerEvidenceResponse) GetLabels() map[string]string

func (*PeerEvidenceResponse) GetPeerId 

func (x *PeerEvidenceResponse) GetPeerId() string

func (*PeerEvidenceResponse) GetRevocationIds 

func (x *PeerEvidenceResponse) GetRevocationIds() []string

func (*PeerEvidenceResponse) GetRoles 

func (x *PeerEvidenceResponse) GetRoles() []string

func (*PeerEvidenceResponse) GetVerifyingKey 

func (x *PeerEvidenceResponse) GetVerifyingKey() []byte

func (*PeerEvidenceResponse) ProtoMessage 

func (*PeerEvidenceResponse) ProtoMessage()

func (*PeerEvidenceResponse) ProtoReflect 

func (x *PeerEvidenceResponse) ProtoReflect() protoreflect.Message

func (*PeerEvidenceResponse) Reset 

func (x *PeerEvidenceResponse) Reset()

func (*PeerEvidenceResponse) String 

func (x *PeerEvidenceResponse) String() string

type PolicyBinding 

type PolicyBinding struct {
	Role    string   `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
	Members []string `protobuf:"bytes,2,rep,name=members,proto3" json:"members,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyBinding) Descriptor deprecated 

func (*PolicyBinding) Descriptor() ([]byte, []int)

Deprecated: Use PolicyBinding.ProtoReflect.Descriptor instead.

func (*PolicyBinding) GetMembers 

func (x *PolicyBinding) GetMembers() []string

func (*PolicyBinding) GetRole 

func (x *PolicyBinding) GetRole() string

func (*PolicyBinding) ProtoMessage 

func (*PolicyBinding) ProtoMessage()

func (*PolicyBinding) ProtoReflect 

func (x *PolicyBinding) ProtoReflect() protoreflect.Message

func (*PolicyBinding) Reset 

func (x *PolicyBinding) Reset()

func (*PolicyBinding) String 

func (x *PolicyBinding) String() string

type PolicyConfigGetRequest 

type PolicyConfigGetRequest struct {
	// contains filtered or unexported fields
}

func (*PolicyConfigGetRequest) Descriptor deprecated 

func (*PolicyConfigGetRequest) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigGetRequest.ProtoReflect.Descriptor instead.

func (*PolicyConfigGetRequest) ProtoMessage 

func (*PolicyConfigGetRequest) ProtoMessage()

func (*PolicyConfigGetRequest) ProtoReflect 

func (x *PolicyConfigGetRequest) ProtoReflect() protoreflect.Message

func (*PolicyConfigGetRequest) Reset 

func (x *PolicyConfigGetRequest) Reset()

func (*PolicyConfigGetRequest) String 

func (x *PolicyConfigGetRequest) String() string

type PolicyConfigGetResponse 

type PolicyConfigGetResponse struct {
	Roles    []*PolicyRole    `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
	Bindings []*PolicyBinding `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyConfigGetResponse) Descriptor deprecated 

func (*PolicyConfigGetResponse) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigGetResponse.ProtoReflect.Descriptor instead.

func (*PolicyConfigGetResponse) GetBindings 

func (x *PolicyConfigGetResponse) GetBindings() []*PolicyBinding

func (*PolicyConfigGetResponse) GetRoles 

func (x *PolicyConfigGetResponse) GetRoles() []*PolicyRole

func (*PolicyConfigGetResponse) ProtoMessage 

func (*PolicyConfigGetResponse) ProtoMessage()

func (*PolicyConfigGetResponse) ProtoReflect 

func (x *PolicyConfigGetResponse) ProtoReflect() protoreflect.Message

func (*PolicyConfigGetResponse) Reset 

func (x *PolicyConfigGetResponse) Reset()

func (*PolicyConfigGetResponse) String 

func (x *PolicyConfigGetResponse) String() string

type PolicyConfigUpdateRequest 

type PolicyConfigUpdateRequest struct {
	Roles    []*PolicyRole    `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
	Bindings []*PolicyBinding `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyConfigUpdateRequest) Descriptor deprecated 

func (*PolicyConfigUpdateRequest) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigUpdateRequest.ProtoReflect.Descriptor instead.

func (*PolicyConfigUpdateRequest) GetBindings 

func (x *PolicyConfigUpdateRequest) GetBindings() []*PolicyBinding

func (*PolicyConfigUpdateRequest) GetRoles 

func (x *PolicyConfigUpdateRequest) GetRoles() []*PolicyRole

func (*PolicyConfigUpdateRequest) ProtoMessage 

func (*PolicyConfigUpdateRequest) ProtoMessage()

func (*PolicyConfigUpdateRequest) ProtoReflect 

func (x *PolicyConfigUpdateRequest) ProtoReflect() protoreflect.Message

func (*PolicyConfigUpdateRequest) Reset 

func (x *PolicyConfigUpdateRequest) Reset()

func (*PolicyConfigUpdateRequest) String 

func (x *PolicyConfigUpdateRequest) String() string

type PolicyConfigUpdateResponse 

type PolicyConfigUpdateResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyConfigUpdateResponse) Descriptor deprecated 

func (*PolicyConfigUpdateResponse) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigUpdateResponse.ProtoReflect.Descriptor instead.

func (*PolicyConfigUpdateResponse) GetError 

func (x *PolicyConfigUpdateResponse) GetError() string

func (*PolicyConfigUpdateResponse) GetSuccess 

func (x *PolicyConfigUpdateResponse) GetSuccess() bool

func (*PolicyConfigUpdateResponse) ProtoMessage 

func (*PolicyConfigUpdateResponse) ProtoMessage()

func (*PolicyConfigUpdateResponse) ProtoReflect 

func (x *PolicyConfigUpdateResponse) ProtoReflect() protoreflect.Message

func (*PolicyConfigUpdateResponse) Reset 

func (x *PolicyConfigUpdateResponse) Reset()

func (*PolicyConfigUpdateResponse) String 

func (x *PolicyConfigUpdateResponse) String() string

type PolicyRole 

type PolicyRole struct {
	Name            string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	AllowedTargets  []string `protobuf:"bytes,2,rep,name=allowed_targets,json=allowedTargets,proto3" json:"allowed_targets,omitempty"`
	AllowedServices []string `protobuf:"bytes,3,rep,name=allowed_services,json=allowedServices,proto3" json:"allowed_services,omitempty"`
	CustomDatalog   []string `protobuf:"bytes,4,rep,name=custom_datalog,json=customDatalog,proto3" json:"custom_datalog,omitempty"`
	// Agent namespaces the holder may speak for, e.g. "*.prod.acme.example".
	// An agent claim is the calling node's word, so it is only worth what the
	// control plane attested about that node. Distinct from allowed_targets:
	// being allowed to call an agent is not being allowed to impersonate it.
	AllowedAgents []string `protobuf:"bytes,5,rep,name=allowed_agents,json=allowedAgents,proto3" json:"allowed_agents,omitempty"`
	// Labels a node with this role may declare at enrollment, as "*", "key=*"
	// or "key=value". A node declares its own labels, so this is what turns a
	// declaration into something the control plane is willing to sign.
	AllowedLabels []string `protobuf:"bytes,6,rep,name=allowed_labels,json=allowedLabels,proto3" json:"allowed_labels,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyRole) Descriptor deprecated 

func (*PolicyRole) Descriptor() ([]byte, []int)

Deprecated: Use PolicyRole.ProtoReflect.Descriptor instead.

func (*PolicyRole) GetAllowedAgents 

func (x *PolicyRole) GetAllowedAgents() []string

func (*PolicyRole) GetAllowedLabels 

func (x *PolicyRole) GetAllowedLabels() []string

func (*PolicyRole) GetAllowedServices 

func (x *PolicyRole) GetAllowedServices() []string

func (*PolicyRole) GetAllowedTargets 

func (x *PolicyRole) GetAllowedTargets() []string

func (*PolicyRole) GetCustomDatalog 

func (x *PolicyRole) GetCustomDatalog() []string

func (*PolicyRole) GetName 

func (x *PolicyRole) GetName() string

func (*PolicyRole) ProtoMessage 

func (*PolicyRole) ProtoMessage()

func (*PolicyRole) ProtoReflect 

func (x *PolicyRole) ProtoReflect() protoreflect.Message

func (*PolicyRole) Reset 

func (x *PolicyRole) Reset()

func (*PolicyRole) String 

func (x *PolicyRole) String() string

type RegisterServiceRequest 

type RegisterServiceRequest struct {
	Service *ServiceInfo `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// Types that are valid to be assigned to Backend:
	//
	//	*RegisterServiceRequest_TargetUrl
	//	*RegisterServiceRequest_Command
	Backend isRegisterServiceRequest_Backend `protobuf_oneof:"backend"`
	// contains filtered or unexported fields
}

func (*RegisterServiceRequest) Descriptor deprecated 

func (*RegisterServiceRequest) Descriptor() ([]byte, []int)

Deprecated: Use RegisterServiceRequest.ProtoReflect.Descriptor instead.

func (*RegisterServiceRequest) GetBackend 

func (x *RegisterServiceRequest) GetBackend() isRegisterServiceRequest_Backend

func (*RegisterServiceRequest) GetCommand 

func (x *RegisterServiceRequest) GetCommand() *CommandBackend

func (*RegisterServiceRequest) GetService 

func (x *RegisterServiceRequest) GetService() *ServiceInfo

func (*RegisterServiceRequest) GetTargetUrl 

func (x *RegisterServiceRequest) GetTargetUrl() string

func (*RegisterServiceRequest) ProtoMessage 

func (*RegisterServiceRequest) ProtoMessage()

func (*RegisterServiceRequest) ProtoReflect 

func (x *RegisterServiceRequest) ProtoReflect() protoreflect.Message

func (*RegisterServiceRequest) Reset 

func (x *RegisterServiceRequest) Reset()

func (*RegisterServiceRequest) String 

func (x *RegisterServiceRequest) String() string

type RegisterServiceRequest_Command 

type RegisterServiceRequest_Command struct {
	Command *CommandBackend `protobuf:"bytes,3,opt,name=command,proto3,oneof"`
}

type RegisterServiceRequest_TargetUrl 

type RegisterServiceRequest_TargetUrl struct {
	TargetUrl string `protobuf:"bytes,2,opt,name=target_url,json=targetUrl,proto3,oneof"`
}

type RouterLeaseRequest 

type RouterLeaseRequest struct {
	PeerId         string   `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Addresses      []string `protobuf:"bytes,2,rep,name=addresses,proto3" json:"addresses,omitempty"`
	Biscuit        []byte   `protobuf:"bytes,3,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	ConnectedPeers []string `protobuf:"bytes,4,rep,name=connected_peers,json=connectedPeers,proto3" json:"connected_peers,omitempty"`
	DhtSize        int32    `protobuf:"varint,5,opt,name=dht_size,json=dhtSize,proto3" json:"dht_size,omitempty"`
	// contains filtered or unexported fields
}

func (*RouterLeaseRequest) Descriptor deprecated 

func (*RouterLeaseRequest) Descriptor() ([]byte, []int)

Deprecated: Use RouterLeaseRequest.ProtoReflect.Descriptor instead.

func (*RouterLeaseRequest) GetAddresses 

func (x *RouterLeaseRequest) GetAddresses() []string

func (*RouterLeaseRequest) GetBiscuit 

func (x *RouterLeaseRequest) GetBiscuit() []byte

func (*RouterLeaseRequest) GetConnectedPeers 

func (x *RouterLeaseRequest) GetConnectedPeers() []string

func (*RouterLeaseRequest) GetDhtSize 

func (x *RouterLeaseRequest) GetDhtSize() int32

func (*RouterLeaseRequest) GetPeerId 

func (x *RouterLeaseRequest) GetPeerId() string

func (*RouterLeaseRequest) ProtoMessage 

func (*RouterLeaseRequest) ProtoMessage()

func (*RouterLeaseRequest) ProtoReflect 

func (x *RouterLeaseRequest) ProtoReflect() protoreflect.Message

func (*RouterLeaseRequest) Reset 

func (x *RouterLeaseRequest) Reset()

func (*RouterLeaseRequest) String 

func (x *RouterLeaseRequest) String() string

type RouterLeaseResponse 

type RouterLeaseResponse struct {
	Success   bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error     string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	ExpiresAt int64  `protobuf:"varint,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	// contains filtered or unexported fields
}

func (*RouterLeaseResponse) Descriptor deprecated 

func (*RouterLeaseResponse) Descriptor() ([]byte, []int)

Deprecated: Use RouterLeaseResponse.ProtoReflect.Descriptor instead.

func (*RouterLeaseResponse) GetError 

func (x *RouterLeaseResponse) GetError() string

func (*RouterLeaseResponse) GetExpiresAt 

func (x *RouterLeaseResponse) GetExpiresAt() int64

func (*RouterLeaseResponse) GetSuccess 

func (x *RouterLeaseResponse) GetSuccess() bool

func (*RouterLeaseResponse) ProtoMessage 

func (*RouterLeaseResponse) ProtoMessage()

func (*RouterLeaseResponse) ProtoReflect 

func (x *RouterLeaseResponse) ProtoReflect() protoreflect.Message

func (*RouterLeaseResponse) Reset 

func (x *RouterLeaseResponse) Reset()

func (*RouterLeaseResponse) String 

func (x *RouterLeaseResponse) String() string

type ServiceAnnounce 

type ServiceAnnounce struct {
	PeerId      string      `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Type        ServiceType `protobuf:"varint,2,opt,name=type,proto3,enum=sam.v1.ServiceType" json:"type,omitempty"`
	ServiceName string      `protobuf:"bytes,3,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
	// Routing keys served by this service: model IDs for inference,
	// tool names for MCP.
	Keys []string `protobuf:"bytes,4,rep,name=keys,proto3" json:"keys,omitempty"`
	// Operator-declared labels (e.g. "region"). Operator claims always
	// take precedence over runtime-derived values.
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// Runtime load hints; zero values mean unknown.
	ActiveRequests uint32  `protobuf:"varint,6,opt,name=active_requests,json=activeRequests,proto3" json:"active_requests,omitempty"`
	LatencyEwmaMs  float64 `protobuf:"fixed64,7,opt,name=latency_ewma_ms,json=latencyEwmaMs,proto3" json:"latency_ewma_ms,omitempty"`
	Timestamp      int64   `protobuf:"varint,8,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
	// contains filtered or unexported fields
}

ServiceAnnounce is gossiped by a node on per-key topics (see DiscoveryTopic) while those topics have subscribers. It is a routing hint signed at the pubsub layer by the announcing peer: consumers use it for freshness and load awareness, never for authorization.

func (*ServiceAnnounce) Descriptor deprecated 

func (*ServiceAnnounce) Descriptor() ([]byte, []int)

Deprecated: Use ServiceAnnounce.ProtoReflect.Descriptor instead.

func (*ServiceAnnounce) GetActiveRequests 

func (x *ServiceAnnounce) GetActiveRequests() uint32

func (*ServiceAnnounce) GetKeys 

func (x *ServiceAnnounce) GetKeys() []string

func (*ServiceAnnounce) GetLabels 

func (x *ServiceAnnounce) GetLabels() map[string]string

func (*ServiceAnnounce) GetLatencyEwmaMs 

func (x *ServiceAnnounce) GetLatencyEwmaMs() float64

func (*ServiceAnnounce) GetPeerId 

func (x *ServiceAnnounce) GetPeerId() string

func (*ServiceAnnounce) GetServiceName 

func (x *ServiceAnnounce) GetServiceName() string

func (*ServiceAnnounce) GetTimestamp 

func (x *ServiceAnnounce) GetTimestamp() int64

func (*ServiceAnnounce) GetType 

func (x *ServiceAnnounce) GetType() ServiceType

func (*ServiceAnnounce) ProtoMessage 

func (*ServiceAnnounce) ProtoMessage()

func (*ServiceAnnounce) ProtoReflect 

func (x *ServiceAnnounce) ProtoReflect() protoreflect.Message

func (*ServiceAnnounce) Reset 

func (x *ServiceAnnounce) Reset()

func (*ServiceAnnounce) String 

func (x *ServiceAnnounce) String() string

type ServiceConfig 

type ServiceConfig struct {
	Type        string            `yaml:"type"` // e.g., "mcp", "inference"
	Name        string            `yaml:"name"`
	Description string            `yaml:"description"`
	TargetURL   string            `yaml:"target_url,omitempty"`
	Command     []string          `yaml:"command,omitempty"`
	Env         map[string]string `yaml:"env,omitempty"`
}

type ServiceInfo 

type ServiceInfo struct {
	Type        ServiceType `protobuf:"varint,1,opt,name=type,proto3,enum=sam.v1.ServiceType" json:"type,omitempty"`
	Name        string      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Description string      `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// contains filtered or unexported fields
}

func (*ServiceInfo) Descriptor deprecated 

func (*ServiceInfo) Descriptor() ([]byte, []int)

Deprecated: Use ServiceInfo.ProtoReflect.Descriptor instead.

func (*ServiceInfo) GetDescription 

func (x *ServiceInfo) GetDescription() string

func (*ServiceInfo) GetName 

func (x *ServiceInfo) GetName() string

func (*ServiceInfo) GetType 

func (x *ServiceInfo) GetType() ServiceType

func (*ServiceInfo) ProtoMessage 

func (*ServiceInfo) ProtoMessage()

func (*ServiceInfo) ProtoReflect 

func (x *ServiceInfo) ProtoReflect() protoreflect.Message

func (*ServiceInfo) Reset 

func (x *ServiceInfo) Reset()

func (*ServiceInfo) String 

func (x *ServiceInfo) String() string

type ServiceType 

type ServiceType int32
const (
	ServiceType_SERVICE_TYPE_UNSPECIFIED ServiceType = 0
	ServiceType_SERVICE_TYPE_MCP         ServiceType = 1
	ServiceType_SERVICE_TYPE_INFERENCE   ServiceType = 2
)

func ParseServiceType 

func ParseServiceType(s string) (ServiceType, error)

ParseServiceType converts a string identifier (e.g. from JSON or REST) to the ServiceType protobuf enum.

func (ServiceType) Descriptor 

func (ServiceType) Descriptor() protoreflect.EnumDescriptor

func (ServiceType) Enum 

func (x ServiceType) Enum() *ServiceType

func (ServiceType) EnumDescriptor deprecated 

func (ServiceType) EnumDescriptor() ([]byte, []int)

Deprecated: Use ServiceType.Descriptor instead.

func (ServiceType) Number 

func (x ServiceType) Number() protoreflect.EnumNumber

func (ServiceType) String 

func (x ServiceType) String() string

func (ServiceType) Type 

func (ServiceType) Type() protoreflect.EnumType

type TokenRefreshRequest 

type TokenRefreshRequest struct {
	ChallengeSignature []byte `protobuf:"bytes,1,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	Timestamp          int64  `protobuf:"varint,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRefreshRequest) Descriptor deprecated 

func (*TokenRefreshRequest) Descriptor() ([]byte, []int)

Deprecated: Use TokenRefreshRequest.ProtoReflect.Descriptor instead.

func (*TokenRefreshRequest) GetChallengeSignature 

func (x *TokenRefreshRequest) GetChallengeSignature() []byte

func (*TokenRefreshRequest) GetTimestamp 

func (x *TokenRefreshRequest) GetTimestamp() int64

func (*TokenRefreshRequest) ProtoMessage 

func (*TokenRefreshRequest) ProtoMessage()

func (*TokenRefreshRequest) ProtoReflect 

func (x *TokenRefreshRequest) ProtoReflect() protoreflect.Message

func (*TokenRefreshRequest) Reset 

func (x *TokenRefreshRequest) Reset()

func (*TokenRefreshRequest) String 

func (x *TokenRefreshRequest) String() string

type TokenRefreshResponse 

type TokenRefreshResponse struct {
	BiscuitToken []byte `protobuf:"bytes,1,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`
	ExpiresAt    int64  `protobuf:"varint,2,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	ErrorMessage string `protobuf:"bytes,3,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRefreshResponse) Descriptor deprecated 

func (*TokenRefreshResponse) Descriptor() ([]byte, []int)

Deprecated: Use TokenRefreshResponse.ProtoReflect.Descriptor instead.

func (*TokenRefreshResponse) GetBiscuitToken 

func (x *TokenRefreshResponse) GetBiscuitToken() []byte

func (*TokenRefreshResponse) GetErrorMessage 

func (x *TokenRefreshResponse) GetErrorMessage() string

func (*TokenRefreshResponse) GetExpiresAt 

func (x *TokenRefreshResponse) GetExpiresAt() int64

func (*TokenRefreshResponse) ProtoMessage 

func (*TokenRefreshResponse) ProtoMessage()

func (*TokenRefreshResponse) ProtoReflect 

func (x *TokenRefreshResponse) ProtoReflect() protoreflect.Message

func (*TokenRefreshResponse) Reset 

func (x *TokenRefreshResponse) Reset()

func (*TokenRefreshResponse) String 

func (x *TokenRefreshResponse) String() string

type TokenRevokeRequest 

type TokenRevokeRequest struct {
	PeerId string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRevokeRequest) Descriptor deprecated 

func (*TokenRevokeRequest) Descriptor() ([]byte, []int)

Deprecated: Use TokenRevokeRequest.ProtoReflect.Descriptor instead.

func (*TokenRevokeRequest) GetPeerId 

func (x *TokenRevokeRequest) GetPeerId() string

func (*TokenRevokeRequest) ProtoMessage 

func (*TokenRevokeRequest) ProtoMessage()

func (*TokenRevokeRequest) ProtoReflect 

func (x *TokenRevokeRequest) ProtoReflect() protoreflect.Message

func (*TokenRevokeRequest) Reset 

func (x *TokenRevokeRequest) Reset()

func (*TokenRevokeRequest) String 

func (x *TokenRevokeRequest) String() string

type TokenRevokeResponse 

type TokenRevokeResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRevokeResponse) Descriptor deprecated 

func (*TokenRevokeResponse) Descriptor() ([]byte, []int)

Deprecated: Use TokenRevokeResponse.ProtoReflect.Descriptor instead.

func (*TokenRevokeResponse) GetError 

func (x *TokenRevokeResponse) GetError() string

func (*TokenRevokeResponse) GetSuccess 

func (x *TokenRevokeResponse) GetSuccess() bool

func (*TokenRevokeResponse) ProtoMessage 

func (*TokenRevokeResponse) ProtoMessage()

func (*TokenRevokeResponse) ProtoReflect 

func (x *TokenRevokeResponse) ProtoReflect() protoreflect.Message

func (*TokenRevokeResponse) Reset 

func (x *TokenRevokeResponse) Reset()

func (*TokenRevokeResponse) String 

func (x *TokenRevokeResponse) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.