v1

type AdminServiceClient interface {
	// FirewallInit brings the firewall stack (Envoy + CoreDNS) up. BPF
	// programs are loaded once at CP startup; this RPC is the idempotent
	// stack-up signal from the CLI. Global — no container_id.
	FirewallInit(ctx context.Context, in *FirewallInitRequest, opts ...grpc.CallOption) (*FirewallInitResult, error)
	// FirewallRemove is global teardown — stops Envoy + CoreDNS, detaches
	// all BPF programs, and flushes all eBPF state plus pending timers.
	FirewallRemove(ctx context.Context, in *FirewallRemoveRequest, opts ...grpc.CallOption) (*FirewallRemoveResult, error)
	// FirewallEnable enrolls a container into the global container_map
	// routing. Idempotent. The CP resolves the container's cgroup path
	// internally via Docker API with drift guard (INV-B2-016) — callers
	// send only container_id.
	FirewallEnable(ctx context.Context, in *FirewallEnableRequest, opts ...grpc.CallOption) (*FirewallEnableResult, error)
	// FirewallDisable removes a container from container_map. BPF links
	// remain attached so re-enable is cheap. BPF fast path exits to bypass
	// on lookup miss.
	FirewallDisable(ctx context.Context, in *FirewallDisableRequest, opts ...grpc.CallOption) (*FirewallDisableResult, error)
	// FirewallBypass = timed Disable + CP-side dead-man timer that calls
	// Enable on expiry. Drift guard inherited from the Enable path.
	FirewallBypass(ctx context.Context, in *FirewallBypassRequest, opts ...grpc.CallOption) (*FirewallBypassResult, error)
	// FirewallAddRules adds egress rules to the store and hot-reloads the
	// stack. Synchronous: returns after the stack is healthy again.
	FirewallAddRules(ctx context.Context, in *FirewallAddRulesRequest, opts ...grpc.CallOption) (*FirewallAddRulesResult, error)
	// FirewallRemoveRule removes a single egress rule by (dst, proto, port)
	// and hot-reloads the stack. Returns NOT_FOUND (sentinel
	// RULE_NOT_FOUND) when no rule matches the key — typos and malformed
	// hostnames both land here, since anything that can't match an
	// existing rule key is a miss.
	FirewallRemoveRule(ctx context.Context, in *FirewallRemoveRuleRequest, opts ...grpc.CallOption) (*FirewallRemoveRuleResult, error)
	// FirewallListRules returns the current normalized/deduplicated rule
	// set from the store. Read-only.
	FirewallListRules(ctx context.Context, in *FirewallListRulesRequest, opts ...grpc.CallOption) (*FirewallListRulesResult, error)
	// FirewallReload regenerates configs and restarts Envoy + CoreDNS from
	// the current rules store state without mutating rules.
	FirewallReload(ctx context.Context, in *FirewallReloadRequest, opts ...grpc.CallOption) (*FirewallReloadResult, error)
	// FirewallStatus is the firewall-domain health snapshot (stack running,
	// Envoy/CoreDNS health, rule count, network topology).
	FirewallStatus(ctx context.Context, in *FirewallStatusRequest, opts ...grpc.CallOption) (*FirewallStatusResult, error)
	// FirewallRotateCA regenerates the MITM CA + per-domain certs. Restarts
	// Envoy so the new chain is picked up.
	FirewallRotateCA(ctx context.Context, in *FirewallRotateCARequest, opts ...grpc.CallOption) (*FirewallRotateCAResult, error)
	// FirewallSyncRoutes atomically replaces the global route_map.
	FirewallSyncRoutes(ctx context.Context, in *FirewallSyncRoutesRequest, opts ...grpc.CallOption) (*FirewallSyncRoutesResult, error)
	// FirewallResolveHostname performs a DNS lookup from inside the CP's
	// network namespace — used to resolve host.docker.internal during
	// per-container enroll.
	FirewallResolveHostname(ctx context.Context, in *FirewallResolveHostnameRequest, opts ...grpc.CallOption) (*FirewallResolveHostnameResult, error)
	// ListAgents returns a snapshot of every agent currently registered
	// with the control plane. Used by `clawker controlplane agents` and
	// diagnostic tooling. Read-only; uniform admin scope.
	ListAgents(ctx context.Context, in *ListAgentsRequest, opts ...grpc.CallOption) (*ListAgentsResult, error)
}

type AdminServiceServer interface {
	// FirewallInit brings the firewall stack (Envoy + CoreDNS) up. BPF
	// programs are loaded once at CP startup; this RPC is the idempotent
	// stack-up signal from the CLI. Global — no container_id.
	FirewallInit(context.Context, *FirewallInitRequest) (*FirewallInitResult, error)
	// FirewallRemove is global teardown — stops Envoy + CoreDNS, detaches
	// all BPF programs, and flushes all eBPF state plus pending timers.
	FirewallRemove(context.Context, *FirewallRemoveRequest) (*FirewallRemoveResult, error)
	// FirewallEnable enrolls a container into the global container_map
	// routing. Idempotent. The CP resolves the container's cgroup path
	// internally via Docker API with drift guard (INV-B2-016) — callers
	// send only container_id.
	FirewallEnable(context.Context, *FirewallEnableRequest) (*FirewallEnableResult, error)
	// FirewallDisable removes a container from container_map. BPF links
	// remain attached so re-enable is cheap. BPF fast path exits to bypass
	// on lookup miss.
	FirewallDisable(context.Context, *FirewallDisableRequest) (*FirewallDisableResult, error)
	// FirewallBypass = timed Disable + CP-side dead-man timer that calls
	// Enable on expiry. Drift guard inherited from the Enable path.
	FirewallBypass(context.Context, *FirewallBypassRequest) (*FirewallBypassResult, error)
	// FirewallAddRules adds egress rules to the store and hot-reloads the
	// stack. Synchronous: returns after the stack is healthy again.
	FirewallAddRules(context.Context, *FirewallAddRulesRequest) (*FirewallAddRulesResult, error)
	// FirewallRemoveRule removes a single egress rule by (dst, proto, port)
	// and hot-reloads the stack. Returns NOT_FOUND (sentinel
	// RULE_NOT_FOUND) when no rule matches the key — typos and malformed
	// hostnames both land here, since anything that can't match an
	// existing rule key is a miss.
	FirewallRemoveRule(context.Context, *FirewallRemoveRuleRequest) (*FirewallRemoveRuleResult, error)
	// FirewallListRules returns the current normalized/deduplicated rule
	// set from the store. Read-only.
	FirewallListRules(context.Context, *FirewallListRulesRequest) (*FirewallListRulesResult, error)
	// FirewallReload regenerates configs and restarts Envoy + CoreDNS from
	// the current rules store state without mutating rules.
	FirewallReload(context.Context, *FirewallReloadRequest) (*FirewallReloadResult, error)
	// FirewallStatus is the firewall-domain health snapshot (stack running,
	// Envoy/CoreDNS health, rule count, network topology).
	FirewallStatus(context.Context, *FirewallStatusRequest) (*FirewallStatusResult, error)
	// FirewallRotateCA regenerates the MITM CA + per-domain certs. Restarts
	// Envoy so the new chain is picked up.
	FirewallRotateCA(context.Context, *FirewallRotateCARequest) (*FirewallRotateCAResult, error)
	// FirewallSyncRoutes atomically replaces the global route_map.
	FirewallSyncRoutes(context.Context, *FirewallSyncRoutesRequest) (*FirewallSyncRoutesResult, error)
	// FirewallResolveHostname performs a DNS lookup from inside the CP's
	// network namespace — used to resolve host.docker.internal during
	// per-container enroll.
	FirewallResolveHostname(context.Context, *FirewallResolveHostnameRequest) (*FirewallResolveHostnameResult, error)
	// ListAgents returns a snapshot of every agent currently registered
	// with the control plane. Used by `clawker controlplane agents` and
	// diagnostic tooling. Read-only; uniform admin scope.
	ListAgents(context.Context, *ListAgentsRequest) (*ListAgentsResult, error)
	// contains filtered or unexported methods
}

type Agent struct {

	// agent_name is the short agent name as the user types it on the CLI
	// (e.g. "dev"). The canonical "clawker.project.agent" form is composed
	// CP-side from (NamePrefix, project, agent_name) — kept off the wire to
	// avoid duplication and parsing.
	AgentName string `protobuf:"bytes,1,opt,name=agent_name,json=agentName,proto3" json:"agent_name,omitempty"`
	// container_id is the long Docker container ID the agent runs in.
	ContainerId string `protobuf:"bytes,2,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
	// cert_thumbprint is the lowercase-hex SHA-256 over the agent's mTLS
	// cert DER — the channel-bound identity key.
	CertThumbprint string `protobuf:"bytes,3,opt,name=cert_thumbprint,json=certThumbprint,proto3" json:"cert_thumbprint,omitempty"`
	// registered_at_unix is the wall-clock timestamp at AgentService.Connect.
	RegisteredAtUnix int64 `protobuf:"varint,4,opt,name=registered_at_unix,json=registeredAtUnix,proto3" json:"registered_at_unix,omitempty"`
	// last_seen_unix is updated on every successful per-agent RPC. Equal
	// to registered_at_unix for B4 because Connect is the only per-agent
	// RPC.
	LastSeenUnix int64 `protobuf:"varint,5,opt,name=last_seen_unix,json=lastSeenUnix,proto3" json:"last_seen_unix,omitempty"`
	// project is the clawker project slug the agent registered under (empty
	// for 2-segment naming). Composite with agent_name when callers need a
	// unique key across projects.
	Project string `protobuf:"bytes,6,opt,name=project,proto3" json:"project,omitempty"`
	// contains filtered or unexported fields
}

type EgressRule struct {
	Dst         string      `protobuf:"bytes,1,opt,name=dst,proto3" json:"dst,omitempty"`
	Proto       string      `protobuf:"bytes,2,opt,name=proto,proto3" json:"proto,omitempty"` // "tls" | "tcp" | "http" | "ssh" | "ip" | "cidr"
	Port        uint32      `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	Action      string      `protobuf:"bytes,4,opt,name=action,proto3" json:"action,omitempty"` // "allow" | "deny"
	PathRules   []*PathRule `protobuf:"bytes,5,rep,name=path_rules,json=pathRules,proto3" json:"path_rules,omitempty"`
	PathDefault string      `protobuf:"bytes,6,opt,name=path_default,json=pathDefault,proto3" json:"path_default,omitempty"`
	// contains filtered or unexported fields
}

type FirewallAddRulesRequest struct {
	Rules []*EgressRule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
	// contains filtered or unexported fields
}

type FirewallAddRulesResult struct {
	AddedCount int32 `protobuf:"varint,1,opt,name=added_count,json=addedCount,proto3" json:"added_count,omitempty"`
	// stack_restarted is true when the live stack was reloaded; false when
	// the stack was down at queue-time and only the on-disk rule change
	// applied. In both cases err==nil — the rule is durable.
	StackRestarted bool `protobuf:"varint,2,opt,name=stack_restarted,json=stackRestarted,proto3" json:"stack_restarted,omitempty"`
	// contains filtered or unexported fields
}

type FirewallBypassRequest struct {
	ContainerId    string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
	TimeoutSeconds uint32 `protobuf:"varint,2,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"`
	// contains filtered or unexported fields
}

type FirewallBypassResult struct {
	// contains filtered or unexported fields
}

type FirewallDisableRequest struct {
	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
	// contains filtered or unexported fields
}

type FirewallDisableResult struct {
	// contains filtered or unexported fields
}

type FirewallEnableRequest struct {
	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
	// contains filtered or unexported fields
}

type FirewallEnableResult struct {
	// contains filtered or unexported fields
}

type FirewallInitRequest struct {
	// contains filtered or unexported fields
}

type FirewallInitResult struct {
	EnvoyIp   string `protobuf:"bytes,1,opt,name=envoy_ip,json=envoyIp,proto3" json:"envoy_ip,omitempty"`
	CorednsIp string `protobuf:"bytes,2,opt,name=coredns_ip,json=corednsIp,proto3" json:"coredns_ip,omitempty"`
	NetworkId string `protobuf:"bytes,3,opt,name=network_id,json=networkId,proto3" json:"network_id,omitempty"`
	// contains filtered or unexported fields
}

type FirewallListRulesRequest struct {
	// contains filtered or unexported fields
}

type FirewallListRulesResult struct {
	Rules []*EgressRule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
	// contains filtered or unexported fields
}

type FirewallReloadRequest struct {
	// contains filtered or unexported fields
}

type FirewallReloadResult struct {
	StackRestarted bool `protobuf:"varint,1,opt,name=stack_restarted,json=stackRestarted,proto3" json:"stack_restarted,omitempty"`
	// contains filtered or unexported fields
}

type FirewallRemoveRequest struct {
	// contains filtered or unexported fields
}

type FirewallRemoveResult struct {
	// contains filtered or unexported fields
}

type FirewallRemoveRuleRequest struct {
	Dst   string `protobuf:"bytes,1,opt,name=dst,proto3" json:"dst,omitempty"`
	Proto string `protobuf:"bytes,2,opt,name=proto,proto3" json:"proto,omitempty"` // "tls" | "tcp" | "http" | "ssh" | "ip" | "cidr"
	Port  uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	// contains filtered or unexported fields
}

type FirewallRemoveRuleResult struct {

	// stack_restarted is true when the live stack was reloaded; false when
	// the stack was down at queue-time and only the on-disk rule change
	// applied. In both cases err==nil — the rule is durable.
	StackRestarted bool `protobuf:"varint,1,opt,name=stack_restarted,json=stackRestarted,proto3" json:"stack_restarted,omitempty"`
	// contains filtered or unexported fields
}

type FirewallResolveHostnameRequest struct {
	Hostname string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
	// contains filtered or unexported fields
}

type FirewallResolveHostnameResult struct {
	Addresses []string `protobuf:"bytes,1,rep,name=addresses,proto3" json:"addresses,omitempty"`
	// contains filtered or unexported fields
}

type FirewallRotateCARequest struct {
	// contains filtered or unexported fields
}

type FirewallRotateCAResult struct {

	// stack_restarted mirrors the AddRules/Reload distinction: true when
	// the live stack was reloaded with the fresh cert chain; false when
	// regen completed but the stack was down so no restart fired.
	StackRestarted bool `protobuf:"varint,1,opt,name=stack_restarted,json=stackRestarted,proto3" json:"stack_restarted,omitempty"`
	// contains filtered or unexported fields
}

type FirewallStatusRequest struct {
	// contains filtered or unexported fields
}

type FirewallStatusResult struct {
	Running       bool   `protobuf:"varint,1,opt,name=running,proto3" json:"running,omitempty"`
	EnvoyHealth   bool   `protobuf:"varint,2,opt,name=envoy_health,json=envoyHealth,proto3" json:"envoy_health,omitempty"`
	CorednsHealth bool   `protobuf:"varint,3,opt,name=coredns_health,json=corednsHealth,proto3" json:"coredns_health,omitempty"`
	RuleCount     int32  `protobuf:"varint,4,opt,name=rule_count,json=ruleCount,proto3" json:"rule_count,omitempty"`
	EnvoyIp       string `protobuf:"bytes,5,opt,name=envoy_ip,json=envoyIp,proto3" json:"envoy_ip,omitempty"`
	CorednsIp     string `protobuf:"bytes,6,opt,name=coredns_ip,json=corednsIp,proto3" json:"coredns_ip,omitempty"`
	NetworkId     string `protobuf:"bytes,7,opt,name=network_id,json=networkId,proto3" json:"network_id,omitempty"`
	Cidr          string `protobuf:"bytes,8,opt,name=cidr,proto3" json:"cidr,omitempty"`
	// contains filtered or unexported fields
}

type FirewallSyncRoutesRequest struct {

	// routes is retained for wire compatibility but is IGNORED by the
	// server. Post-queue the server rebuilds the route_map from the
	// current rules store — see
	// internal/controlplane/firewall.Handler.FirewallSyncRoutes for the
	// rationale (coalescing with concurrent AddRules/Reload would
	// silently discard a caller's stale route set).
	Routes []*Route `protobuf:"bytes,1,rep,name=routes,proto3" json:"routes,omitempty"`
	// contains filtered or unexported fields
}

type FirewallSyncRoutesResult struct {
	Applied uint32 `protobuf:"varint,1,opt,name=applied,proto3" json:"applied,omitempty"`
	// contains filtered or unexported fields
}

type ListAgentsRequest struct {
	// contains filtered or unexported fields
}

type ListAgentsResult struct {
	Agents []*Agent `protobuf:"bytes,1,rep,name=agents,proto3" json:"agents,omitempty"`
	// contains filtered or unexported fields
}

type PathRule struct {
	Path   string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	Action string `protobuf:"bytes,2,opt,name=action,proto3" json:"action,omitempty"`
	// contains filtered or unexported fields
}

type Route struct {
	DomainHash uint32 `protobuf:"varint,1,opt,name=domain_hash,json=domainHash,proto3" json:"domain_hash,omitempty"`
	DstPort    uint32 `protobuf:"varint,2,opt,name=dst_port,json=dstPort,proto3" json:"dst_port,omitempty"`
	EnvoyPort  uint32 `protobuf:"varint,3,opt,name=envoy_port,json=envoyPort,proto3" json:"envoy_port,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedAdminServiceServer struct{}

type UnsafeAdminServiceServer interface {
	// contains filtered or unexported methods
}