innerwallv1

type AckStatus int32

type AddressGroup struct {
	Id   string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// CIDR notation.
	Cidrs []string `protobuf:"bytes,3,rep,name=cidrs,proto3" json:"cidrs,omitempty"`
	// contains filtered or unexported fields
}

type AgentInfo struct {
	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
	// Feature capabilities the agent supports, as opaque strings. Lets the
	// control plane vary behavior across agent versions without a schema change.
	Capabilities []string `protobuf:"bytes,2,rep,name=capabilities,proto3" json:"capabilities,omitempty"`
	// contains filtered or unexported fields
}

type AgentServiceClient interface {
	// The desired-state sync stream. Lifecycle:
	//  1. Agent connects and sends Hello (agent info, host facts, last
	//     applied policy version — 0 if none).
	//  2. Server replies HelloAck (sync configuration), then unconditionally
	//     sends a PolicySnapshot. Deltas are only ever sent within a live
	//     stream, after the snapshot; reconnection always restarts from a
	//     snapshot. This trades a few kilobytes on reconnect for the
	//     elimination of cross-session divergence as a failure class.
	//  3. Server pipelines PolicyUpdates without waiting for acks. The agent
	//     applies updates strictly in order and acks each one. Apply is
	//     atomic: on failure the agent remains on its last good version and
	//     acks FAILED, and the server's recovery move is a fresh snapshot,
	//     never a retried delta.
	//
	// Low-volume control traffic only. Flow telemetry is deliberately a
	// separate RPC so that reporting volume can never head-of-line-block a
	// policy update.
	Sync(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[SyncRequest, SyncResponse], error)
	// High-volume, loss-tolerant flow telemetry. The agent aggregates flows
	// over the window configured in SyncConfig and uploads batches. The
	// response is returned when the client closes the stream.
	ReportFlows(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[ReportFlowsRequest, ReportFlowsResponse], error)
	// Rotate the workload credential before expiry. Authenticated by the
	// current credential; the renewed credential binds the same identity.
	RenewCredential(ctx context.Context, in *RenewCredentialRequest, opts ...grpc.CallOption) (*RenewCredentialResponse, error)
}

type AgentServiceServer interface {
	// The desired-state sync stream. Lifecycle:
	//  1. Agent connects and sends Hello (agent info, host facts, last
	//     applied policy version — 0 if none).
	//  2. Server replies HelloAck (sync configuration), then unconditionally
	//     sends a PolicySnapshot. Deltas are only ever sent within a live
	//     stream, after the snapshot; reconnection always restarts from a
	//     snapshot. This trades a few kilobytes on reconnect for the
	//     elimination of cross-session divergence as a failure class.
	//  3. Server pipelines PolicyUpdates without waiting for acks. The agent
	//     applies updates strictly in order and acks each one. Apply is
	//     atomic: on failure the agent remains on its last good version and
	//     acks FAILED, and the server's recovery move is a fresh snapshot,
	//     never a retried delta.
	//
	// Low-volume control traffic only. Flow telemetry is deliberately a
	// separate RPC so that reporting volume can never head-of-line-block a
	// policy update.
	Sync(grpc.BidiStreamingServer[SyncRequest, SyncResponse]) error
	// High-volume, loss-tolerant flow telemetry. The agent aggregates flows
	// over the window configured in SyncConfig and uploads batches. The
	// response is returned when the client closes the stream.
	ReportFlows(grpc.ClientStreamingServer[ReportFlowsRequest, ReportFlowsResponse]) error
	// Rotate the workload credential before expiry. Authenticated by the
	// current credential; the renewed credential binds the same identity.
	RenewCredential(context.Context, *RenewCredentialRequest) (*RenewCredentialResponse, error)
	// contains filtered or unexported methods
}

type AgentService_ReportFlowsClient = grpc.ClientStreamingClient[ReportFlowsRequest, ReportFlowsResponse]

type AgentService_ReportFlowsServer = grpc.ClientStreamingServer[ReportFlowsRequest, ReportFlowsResponse]

type AgentService_SyncClient = grpc.BidiStreamingClient[SyncRequest, SyncResponse]

type AgentService_SyncServer = grpc.BidiStreamingServer[SyncRequest, SyncResponse]

type DeltaChange struct {

	// Types that are valid to be assigned to Change:
	//
	//	*DeltaChange_UpsertRule
	//	*DeltaChange_RemoveRuleId
	//	*DeltaChange_AddPeers
	//	*DeltaChange_RemovePeers
	//	*DeltaChange_SetMode
	Change isDeltaChange_Change `protobuf_oneof:"change"`
	// contains filtered or unexported fields
}

type DeltaChange_AddPeers struct {
	// Add peers to an existing resolved rule's peer set.
	AddPeers *PeerChange `protobuf:"bytes,3,opt,name=add_peers,json=addPeers,proto3,oneof"`
}

type DeltaChange_RemovePeers struct {
	// Remove peers from an existing resolved rule's peer set.
	RemovePeers *PeerChange `protobuf:"bytes,4,opt,name=remove_peers,json=removePeers,proto3,oneof"`
}

type DeltaChange_RemoveRuleId struct {
	// Remove a resolved rule by its id (see ResolvedRule.rule_id).
	RemoveRuleId string `protobuf:"bytes,2,opt,name=remove_rule_id,json=removeRuleId,proto3,oneof"`
}

type DeltaChange_SetMode struct {
	// Change the workload's enforcement mode.
	SetMode EnforcementMode `protobuf:"varint,5,opt,name=set_mode,json=setMode,proto3,enum=innerwall.v1.EnforcementMode,oneof"`
}

type DeltaChange_UpsertRule struct {
	// Add a new resolved rule, or replace an existing one wholesale.
	UpsertRule *ResolvedRule `protobuf:"bytes,1,opt,name=upsert_rule,json=upsertRule,proto3,oneof"`
}

type Direction int32

type Directive struct {

	// Types that are valid to be assigned to Directive:
	//
	//	*Directive_Reconnect
	//	*Directive_Reenroll
	Directive isDirective_Directive `protobuf_oneof:"directive"`
	// contains filtered or unexported fields
}

type Directive_Reconnect struct {
	// Tear down and re-establish the sync stream (which restarts from a
	// snapshot by the stream lifecycle rules).
	Reconnect *Reconnect `protobuf:"bytes,1,opt,name=reconnect,proto3,oneof"`
}

type Directive_Reenroll struct {
	// Never sent; deprecated and reserved-unused. The control plane does
	// not direct re-enrollment: a workload whose credential is past the
	// renewal grace is refused, with a reason naming re-enrollment, at
	// renewal and at stream open, and its agent keeps enforcing from disk
	// and retrying until the operator enrolls the host again with a new
	// provisioning token. The field stays so its number is never reassigned,
	// and agents keep handling it for wire compatibility (ADR-0015 as
	// amended).
	Reenroll *Reenroll `protobuf:"bytes,2,opt,name=reenroll,proto3,oneof"`
}

type EnforcementMode int32

type EnrollRequest struct {

	// Provisioning token. Tokens are scoped, not single-use: a token minted for
	// a label set can enroll many workloads (baked into an image or provisioning
	// pipeline), and the control plane assigns that label set at enrollment.
	ProvisioningToken string `protobuf:"bytes,1,opt,name=provisioning_token,json=provisioningToken,proto3" json:"provisioning_token,omitempty"`
	// PKCS#10 certificate signing request, PEM-encoded. The private key never
	// leaves the host.
	CsrPem []byte `protobuf:"bytes,2,opt,name=csr_pem,json=csrPem,proto3" json:"csr_pem,omitempty"`
	// Host facts observed at enrollment time. Descriptive only — facts never
	// influence identity or authorization (ADR-0004).
	Facts *HostFacts `protobuf:"bytes,3,opt,name=facts,proto3" json:"facts,omitempty"`
	// contains filtered or unexported fields
}

type EnrollResponse struct {

	// The identity granted to this workload. Also bound into the issued
	// credential; from this point on, identity is always taken from the
	// connection credential, and this field exists for agent-side logging
	// and diagnostics only.
	WorkloadId string `protobuf:"bytes,1,opt,name=workload_id,json=workloadId,proto3" json:"workload_id,omitempty"`
	// Signed client certificate, PEM-encoded.
	CertificatePem []byte `protobuf:"bytes,2,opt,name=certificate_pem,json=certificatePem,proto3" json:"certificate_pem,omitempty"`
	// CA bundle for verifying the control plane, PEM-encoded.
	CaBundlePem []byte `protobuf:"bytes,3,opt,name=ca_bundle_pem,json=caBundlePem,proto3" json:"ca_bundle_pem,omitempty"`
	// Labels assigned from the provisioning token's scope.
	AssignedLabels []*Label `protobuf:"bytes,4,rep,name=assigned_labels,json=assignedLabels,proto3" json:"assigned_labels,omitempty"`
	// contains filtered or unexported fields
}

type EnrollmentServiceClient interface {
	// Exchange a provisioning token and a certificate signing request for a
	// workload identity and signed credential.
	Enroll(ctx context.Context, in *EnrollRequest, opts ...grpc.CallOption) (*EnrollResponse, error)
}

type EnrollmentServiceServer interface {
	// Exchange a provisioning token and a certificate signing request for a
	// workload identity and signed credential.
	Enroll(context.Context, *EnrollRequest) (*EnrollResponse, error)
	// contains filtered or unexported methods
}

type EvidenceGap struct {
	Kind EvidenceGapKind `protobuf:"varint,1,opt,name=kind,proto3,enum=innerwall.v1.EvidenceGapKind" json:"kind,omitempty"`
	// The source that lost the evidence; unspecified for a loss that is not
	// one source's (a buffer overflow drops records of every source).
	Source EvidenceSource         `protobuf:"varint,2,opt,name=source,proto3,enum=innerwall.v1.EvidenceSource" json:"source,omitempty"`
	From   *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=from,proto3" json:"from,omitempty"`
	To     *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=to,proto3" json:"to,omitempty"`
	// How many records, table entries, or observations were lost, when that
	// is known: for a buffer overflow, a truncated dump, a window overflow,
	// and a rejected window. A kernel-side loss has no count.
	Count *uint64 `protobuf:"varint,5,opt,name=count,proto3,oneof" json:"count,omitempty"`
	// contains filtered or unexported fields
}

type EvidenceGapKind int32

type EvidenceSource int32

type FlowRecord struct {
	SrcAddress string   `protobuf:"bytes,1,opt,name=src_address,json=srcAddress,proto3" json:"src_address,omitempty"`
	DstAddress string   `protobuf:"bytes,2,opt,name=dst_address,json=dstAddress,proto3" json:"dst_address,omitempty"`
	DstPort    uint32   `protobuf:"varint,3,opt,name=dst_port,json=dstPort,proto3" json:"dst_port,omitempty"`
	Protocol   Protocol `protobuf:"varint,4,opt,name=protocol,proto3,enum=innerwall.v1.Protocol" json:"protocol,omitempty"`
	// Direction relative to the reporting workload. Only DIRECTION_INBOUND is
	// produced in v1 (ADR-0010); the field exists so records are
	// self-describing when outbound observation lands.
	Direction Direction      `protobuf:"varint,5,opt,name=direction,proto3,enum=innerwall.v1.Direction" json:"direction,omitempty"`
	Decision  PolicyDecision `protobuf:"varint,6,opt,name=decision,proto3,enum=innerwall.v1.PolicyDecision" json:"decision,omitempty"`
	// The rendered rule that matched, when a policy evaluation occurred.
	// Empty for OBSERVED records and for flows no rule matched.
	MatchedRuleId string `protobuf:"bytes,7,opt,name=matched_rule_id,json=matchedRuleId,proto3" json:"matched_rule_id,omitempty"`
	// Connections opened, or found live when the source subscribed, in the
	// window. A connection that predates the source's subscription (at agent
	// start, or after the source restarted) is counted once, first seen at
	// the subscription; one whose close is the first the source saw of it is
	// counted at its close.
	ConnectionCount uint64                 `protobuf:"varint,8,opt,name=connection_count,json=connectionCount,proto3" json:"connection_count,omitempty"`
	ByteCount       uint64                 `protobuf:"varint,9,opt,name=byte_count,json=byteCount,proto3" json:"byte_count,omitempty"`
	FirstSeen       *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=first_seen,json=firstSeen,proto3" json:"first_seen,omitempty"`
	LastSeen        *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=last_seen,json=lastSeen,proto3" json:"last_seen,omitempty"`
	// Best-effort process attribution on the reporting host.
	ProcessName string `protobuf:"bytes,12,opt,name=process_name,json=processName,proto3" json:"process_name,omitempty"`
	// contains filtered or unexported fields
}

type Heartbeat struct {
	UptimeSeconds uint64 `protobuf:"varint,1,opt,name=uptime_seconds,json=uptimeSeconds,proto3" json:"uptime_seconds,omitempty"`
	// Flow records dropped by the agent since the stream opened (buffer
	// pressure). Non-zero values tell the operator that the flow map is
	// incomplete before they trust it for policy authoring.
	DroppedFlowRecords uint64 `protobuf:"varint,2,opt,name=dropped_flow_records,json=droppedFlowRecords,proto3" json:"dropped_flow_records,omitempty"`
	// The reason the most recent automatic credential renewal failed, or
	// empty when the last attempt succeeded or none has been due yet. A
	// workload that keeps reporting a reason is heading for expiry and
	// re-enrollment; surfacing it here lets the operator act before the
	// credential lapses (ADR-0016).
	CredentialRenewalError string `` /* 129-byte string literal not displayed */
	// Kernel-side overruns of the agent's flow sources since the agent
	// started: each is a moment the kernel dropped events because a source
	// fell behind. Each is also reported as an EvidenceGap with its interval;
	// this is the live counter beside dropped_flow_records.
	SourceOverruns uint64 `protobuf:"varint,4,opt,name=source_overruns,json=sourceOverruns,proto3" json:"source_overruns,omitempty"`
	// Whether the Innerwall-owned firewall table is in the kernel, read when
	// this heartbeat is composed. Everything the agent enforces and observes
	// lives in that table, and the local kill switch removes it without the
	// control plane (ADR-0011), so the version the agent last acknowledged
	// says nothing about whether it is still installed; this does.
	// UNSPECIFIED from an agent that predates the field, from one that has
	// installed nothing yet, or when the read failed.
	OwnedTable OwnedTableState `` /* 126-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Hello struct {
	Agent *AgentInfo `protobuf:"bytes,1,opt,name=agent,proto3" json:"agent,omitempty"`
	// The policy version currently applied on the host; 0 if none. Informs
	// server-side status only — the server always responds with a snapshot
	// regardless of this value.
	AppliedPolicyVersion uint64     `protobuf:"varint,2,opt,name=applied_policy_version,json=appliedPolicyVersion,proto3" json:"applied_policy_version,omitempty"`
	Facts                *HostFacts `protobuf:"bytes,3,opt,name=facts,proto3" json:"facts,omitempty"`
	// contains filtered or unexported fields
}

type HelloAck struct {
	Config *SyncConfig `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
	// contains filtered or unexported fields
}

type HostFacts struct {
	Hostname   string              `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
	Os         *OsInfo             `protobuf:"bytes,2,opt,name=os,proto3" json:"os,omitempty"`
	Interfaces []*NetworkInterface `protobuf:"bytes,3,rep,name=interfaces,proto3" json:"interfaces,omitempty"`
	// contains filtered or unexported fields
}

type InventoryReport struct {
	Facts             *HostFacts          `protobuf:"bytes,1,opt,name=facts,proto3" json:"facts,omitempty"`
	ListeningServices []*ListeningService `protobuf:"bytes,2,rep,name=listening_services,json=listeningServices,proto3" json:"listening_services,omitempty"`
	// contains filtered or unexported fields
}

type Label struct {
	Key   string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
	// contains filtered or unexported fields
}

type LabelMatch struct {
	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	// The label value must equal one of these.
	Values []string `protobuf:"bytes,2,rep,name=values,proto3" json:"values,omitempty"`
	// contains filtered or unexported fields
}

type LabelSelector struct {
	Matches []*LabelMatch `protobuf:"bytes,1,rep,name=matches,proto3" json:"matches,omitempty"`
	// contains filtered or unexported fields
}

type ListeningService struct {
	Protocol    Protocol `protobuf:"varint,1,opt,name=protocol,proto3,enum=innerwall.v1.Protocol" json:"protocol,omitempty"`
	Port        uint32   `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	ProcessName string   `protobuf:"bytes,3,opt,name=process_name,json=processName,proto3" json:"process_name,omitempty"`
	ProcessPath string   `protobuf:"bytes,4,opt,name=process_path,json=processPath,proto3" json:"process_path,omitempty"`
	// contains filtered or unexported fields
}

type NetworkInterface struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Addresses in CIDR notation (e.g. "10.0.4.17/24").
	Addresses  []string `protobuf:"bytes,2,rep,name=addresses,proto3" json:"addresses,omitempty"`
	MacAddress string   `protobuf:"bytes,3,opt,name=mac_address,json=macAddress,proto3" json:"mac_address,omitempty"`
	// contains filtered or unexported fields
}

type OsInfo struct {

	// Broad family, e.g. "linux".
	Family string `protobuf:"bytes,1,opt,name=family,proto3" json:"family,omitempty"`
	// Distribution or product name.
	Name          string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Version       string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
	KernelVersion string `protobuf:"bytes,4,opt,name=kernel_version,json=kernelVersion,proto3" json:"kernel_version,omitempty"`
	Architecture  string `protobuf:"bytes,5,opt,name=architecture,proto3" json:"architecture,omitempty"`
	// contains filtered or unexported fields
}

type OwnedTableState int32

type PeerChange struct {

	// The resolved rule's id (see ResolvedRule.rule_id).
	RuleId    string   `protobuf:"bytes,1,opt,name=rule_id,json=ruleId,proto3" json:"rule_id,omitempty"`
	PeerCidrs []string `protobuf:"bytes,2,rep,name=peer_cidrs,json=peerCidrs,proto3" json:"peer_cidrs,omitempty"`
	// contains filtered or unexported fields
}

type PeerSelector struct {

	// Types that are valid to be assigned to Peer:
	//
	//	*PeerSelector_Workloads
	//	*PeerSelector_AddressGroupId
	//	*PeerSelector_Cidr
	Peer isPeerSelector_Peer `protobuf_oneof:"peer"`
	// contains filtered or unexported fields
}

type PeerSelector_AddressGroupId struct {
	AddressGroupId string `protobuf:"bytes,2,opt,name=address_group_id,json=addressGroupId,proto3,oneof"`
}

type PeerSelector_Cidr struct {
	Cidr string `protobuf:"bytes,3,opt,name=cidr,proto3,oneof"`
}

type PeerSelector_Workloads struct {
	Workloads *LabelSelector `protobuf:"bytes,1,opt,name=workloads,proto3,oneof"`
}

type PolicyAck struct {

	// The to-version of the update being acknowledged.
	Version uint64    `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Status  AckStatus `protobuf:"varint,2,opt,name=status,proto3,enum=innerwall.v1.AckStatus" json:"status,omitempty"`
	// Populated when status is FAILED.
	ErrorDetail string `protobuf:"bytes,3,opt,name=error_detail,json=errorDetail,proto3" json:"error_detail,omitempty"`
	// contains filtered or unexported fields
}

type PolicyDecision int32

type PolicyDelta struct {
	FromVersion uint64         `protobuf:"varint,1,opt,name=from_version,json=fromVersion,proto3" json:"from_version,omitempty"`
	ToVersion   uint64         `protobuf:"varint,2,opt,name=to_version,json=toVersion,proto3" json:"to_version,omitempty"`
	Changes     []*DeltaChange `protobuf:"bytes,3,rep,name=changes,proto3" json:"changes,omitempty"`
	// contains filtered or unexported fields
}

type PolicySnapshot struct {
	Policy *WorkloadPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
	// contains filtered or unexported fields
}

type PolicyUpdate struct {

	// Types that are valid to be assigned to Update:
	//
	//	*PolicyUpdate_Snapshot
	//	*PolicyUpdate_Delta
	Update isPolicyUpdate_Update `protobuf_oneof:"update"`
	// contains filtered or unexported fields
}

type PolicyUpdate_Delta struct {
	Delta *PolicyDelta `protobuf:"bytes,2,opt,name=delta,proto3,oneof"`
}

type PolicyUpdate_Snapshot struct {
	Snapshot *PolicySnapshot `protobuf:"bytes,1,opt,name=snapshot,proto3,oneof"`
}

type PortRange struct {
	Start uint32 `protobuf:"varint,1,opt,name=start,proto3" json:"start,omitempty"`
	End   uint32 `protobuf:"varint,2,opt,name=end,proto3" json:"end,omitempty"`
	// contains filtered or unexported fields
}

type Protocol int32

type Reconnect struct {
	// contains filtered or unexported fields
}

type Reenroll struct {
	// contains filtered or unexported fields
}

type RenewCredentialRequest struct {

	// PKCS#10 certificate signing request, PEM-encoded. The workload being
	// renewed is derived from the connection credential, not from the request.
	CsrPem []byte `protobuf:"bytes,1,opt,name=csr_pem,json=csrPem,proto3" json:"csr_pem,omitempty"`
	// contains filtered or unexported fields
}

type RenewCredentialResponse struct {
	CertificatePem []byte `protobuf:"bytes,1,opt,name=certificate_pem,json=certificatePem,proto3" json:"certificate_pem,omitempty"`
	CaBundlePem    []byte `protobuf:"bytes,2,opt,name=ca_bundle_pem,json=caBundlePem,proto3" json:"ca_bundle_pem,omitempty"`
	// contains filtered or unexported fields
}

type ReportFlowsRequest struct {
	WindowStart *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=window_start,json=windowStart,proto3" json:"window_start,omitempty"`
	WindowEnd   *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=window_end,json=windowEnd,proto3" json:"window_end,omitempty"`
	Records     []*FlowRecord          `protobuf:"bytes,3,rep,name=records,proto3" json:"records,omitempty"`
	// Intervals in which the agent knows its evidence is incomplete, shipped
	// with the next window rather than on a schedule of their own. They are
	// not bounded by the window: a gap is wherever the loss happened. A
	// window may carry gaps and no records. The reporting workload is the
	// connection credential's, as for the records.
	Gaps []*EvidenceGap `protobuf:"bytes,4,rep,name=gaps,proto3" json:"gaps,omitempty"`
	// The agent's clock when it sent this request, stamped on every request
	// immediately before it is sent. The control plane compares it with the
	// instant it received the request to detect an agent whose clock has
	// drifted, which would otherwise misdate every window it reports. The
	// window bounds cannot serve: a window held in the agent's buffer while
	// the control plane was unreachable is delivered late by design, and
	// late delivery is not skew. Unset from an agent that predates the
	// field.
	SentAt *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=sent_at,json=sentAt,proto3" json:"sent_at,omitempty"`
	// contains filtered or unexported fields
}

type ReportFlowsResponse struct {

	// Total records accepted across the stream.
	AcceptedRecords uint64 `protobuf:"varint,1,opt,name=accepted_records,json=acceptedRecords,proto3" json:"accepted_records,omitempty"`
	// contains filtered or unexported fields
}

type ResolvedRule struct {

	// The resolved rule's identity: the authored rule id, a slash, and the
	// protocol name in lower case, e.g. "<authored-rule-id>/tcp". An authored
	// rule that permits several protocols renders to one resolved rule per
	// protocol, and deltas address each by this id, so the protocol is part
	// of the identity. Provenance is the part before the slash (ADR-0018).
	RuleId string `protobuf:"bytes,1,opt,name=rule_id,json=ruleId,proto3" json:"rule_id,omitempty"`
	// Concrete peer addresses: managed-workload addresses as host routes
	// (/32 or /128) plus any literal CIDRs from the authored rule.
	PeerCidrs []string     `protobuf:"bytes,2,rep,name=peer_cidrs,json=peerCidrs,proto3" json:"peer_cidrs,omitempty"`
	Protocol  Protocol     `protobuf:"varint,3,opt,name=protocol,proto3,enum=innerwall.v1.Protocol" json:"protocol,omitempty"`
	Ports     []*PortRange `protobuf:"bytes,4,rep,name=ports,proto3" json:"ports,omitempty"`
	// contains filtered or unexported fields
}

type Rule struct {
	Id        string          `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Direction Direction       `protobuf:"varint,2,opt,name=direction,proto3,enum=innerwall.v1.Direction" json:"direction,omitempty"`
	Peers     []*PeerSelector `protobuf:"bytes,3,rep,name=peers,proto3" json:"peers,omitempty"`
	// Services permitted, written inline.
	Services    []*ServiceEntry `protobuf:"bytes,4,rep,name=services,proto3" json:"services,omitempty"`
	Enabled     bool            `protobuf:"varint,5,opt,name=enabled,proto3" json:"enabled,omitempty"`
	Description string          `protobuf:"bytes,6,opt,name=description,proto3" json:"description,omitempty"`
	// Services permitted by reference to ServiceDefinitions, by id. The
	// control plane expands a reference when it renders, so editing a
	// definition re-renders every rule that names it; a reference to a
	// definition that does not exist is rejected at admission. A rule may
	// combine references with inline entries (ADR-0018).
	ServiceIds []string `protobuf:"bytes,7,rep,name=service_ids,json=serviceIds,proto3" json:"service_ids,omitempty"`
	// contains filtered or unexported fields
}

type Ruleset struct {
	Id   string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// The workloads this ruleset applies to (the local end of its rules).
	Scope       *LabelSelector `protobuf:"bytes,3,opt,name=scope,proto3" json:"scope,omitempty"`
	Rules       []*Rule        `protobuf:"bytes,4,rep,name=rules,proto3" json:"rules,omitempty"`
	Enabled     bool           `protobuf:"varint,5,opt,name=enabled,proto3" json:"enabled,omitempty"`
	Description string         `protobuf:"bytes,6,opt,name=description,proto3" json:"description,omitempty"`
	// contains filtered or unexported fields
}

type ServiceDefinition struct {
	Id      string          `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Name    string          `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Entries []*ServiceEntry `protobuf:"bytes,3,rep,name=entries,proto3" json:"entries,omitempty"`
	// contains filtered or unexported fields
}

type ServiceEntry struct {
	Protocol Protocol `protobuf:"varint,1,opt,name=protocol,proto3,enum=innerwall.v1.Protocol" json:"protocol,omitempty"`
	// Empty means all ports for the protocol (e.g. ICMP, which has none).
	Ports []*PortRange `protobuf:"bytes,2,rep,name=ports,proto3" json:"ports,omitempty"`
	// contains filtered or unexported fields
}

type SyncConfig struct {
	HeartbeatIntervalSeconds       uint32 `` /* 136-byte string literal not displayed */
	InventoryReportIntervalSeconds uint32 `` /* 156-byte string literal not displayed */
	FlowAggregationWindowSeconds   uint32 `` /* 150-byte string literal not displayed */
	FlowBatchMaxRecords            uint32 `protobuf:"varint,4,opt,name=flow_batch_max_records,json=flowBatchMaxRecords,proto3" json:"flow_batch_max_records,omitempty"`
	// contains filtered or unexported fields
}

type SyncRequest struct {

	// Types that are valid to be assigned to Msg:
	//
	//	*SyncRequest_Hello
	//	*SyncRequest_PolicyAck
	//	*SyncRequest_Inventory
	//	*SyncRequest_Heartbeat
	Msg isSyncRequest_Msg `protobuf_oneof:"msg"`
	// contains filtered or unexported fields
}

type SyncRequest_Heartbeat struct {
	Heartbeat *Heartbeat `protobuf:"bytes,4,opt,name=heartbeat,proto3,oneof"`
}

type SyncRequest_Hello struct {
	Hello *Hello `protobuf:"bytes,1,opt,name=hello,proto3,oneof"`
}

type SyncRequest_Inventory struct {
	Inventory *InventoryReport `protobuf:"bytes,3,opt,name=inventory,proto3,oneof"`
}

type SyncRequest_PolicyAck struct {
	PolicyAck *PolicyAck `protobuf:"bytes,2,opt,name=policy_ack,json=policyAck,proto3,oneof"`
}

type SyncResponse struct {

	// Types that are valid to be assigned to Msg:
	//
	//	*SyncResponse_HelloAck
	//	*SyncResponse_PolicyUpdate
	//	*SyncResponse_Directive
	Msg isSyncResponse_Msg `protobuf_oneof:"msg"`
	// contains filtered or unexported fields
}

type SyncResponse_Directive struct {
	Directive *Directive `protobuf:"bytes,3,opt,name=directive,proto3,oneof"`
}

type SyncResponse_HelloAck struct {
	HelloAck *HelloAck `protobuf:"bytes,1,opt,name=hello_ack,json=helloAck,proto3,oneof"`
}

type SyncResponse_PolicyUpdate struct {
	PolicyUpdate *PolicyUpdate `protobuf:"bytes,2,opt,name=policy_update,json=policyUpdate,proto3,oneof"`
}

type SyncState int32

type UnimplementedAgentServiceServer struct{}

type UnimplementedEnrollmentServiceServer struct{}

type UnsafeAgentServiceServer interface {
	// contains filtered or unexported methods
}

type UnsafeEnrollmentServiceServer interface {
	// contains filtered or unexported methods
}

type Workload struct {

	// Stable identity assigned at enrollment and bound into the workload's
	// credential (ADR-0004). Never derived from host facts.
	WorkloadId string                 `protobuf:"bytes,1,opt,name=workload_id,json=workloadId,proto3" json:"workload_id,omitempty"`
	Labels     []*Label               `protobuf:"bytes,2,rep,name=labels,proto3" json:"labels,omitempty"`
	Facts      *HostFacts             `protobuf:"bytes,3,opt,name=facts,proto3" json:"facts,omitempty"`
	Agent      *AgentInfo             `protobuf:"bytes,4,opt,name=agent,proto3" json:"agent,omitempty"`
	Mode       EnforcementMode        `protobuf:"varint,5,opt,name=mode,proto3,enum=innerwall.v1.EnforcementMode" json:"mode,omitempty"`
	SyncState  SyncState              `protobuf:"varint,6,opt,name=sync_state,json=syncState,proto3,enum=innerwall.v1.SyncState" json:"sync_state,omitempty"`
	EnrolledAt *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=enrolled_at,json=enrolledAt,proto3" json:"enrolled_at,omitempty"`
	LastSeen   *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=last_seen,json=lastSeen,proto3" json:"last_seen,omitempty"`
	// contains filtered or unexported fields
}

type WorkloadPolicy struct {
	Version      uint64          `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Mode         EnforcementMode `protobuf:"varint,2,opt,name=mode,proto3,enum=innerwall.v1.EnforcementMode" json:"mode,omitempty"`
	InboundRules []*ResolvedRule `protobuf:"bytes,3,rep,name=inbound_rules,json=inboundRules,proto3" json:"inbound_rules,omitempty"`
	// contains filtered or unexported fields
}