@agentmesh-p2p/sdk 0.0.0-stage → 0.1.0

package/dist/gen/agentmesh_pb.d.ts

@@ -0,0 +1,2740 @@
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { Duration, Timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file agentmesh.proto.
+ */
+export declare const file_agentmesh: GenFile;
+/**
+ * @generated from message agentmesh.v1.AuthFrame
+ */
+export type AuthFrame = Message<"agentmesh.v1.AuthFrame"> & {
+    /**
+     * @generated from field: bytes biscuit = 1;
+     */
+    biscuit: Uint8Array;
+    /**
+     * Optional: specific service requested
+     *
+     * @generated from field: string target_service = 2;
+     */
+    targetService: string;
+};
+/**
+ * Describes the message agentmesh.v1.AuthFrame.
+ * Use `create(AuthFrameSchema)` to create a new message.
+ */
+export declare const AuthFrameSchema: GenMessage<AuthFrame>;
+/**
+ * @generated from message agentmesh.v1.AuthResponse
+ */
+export type AuthResponse = Message<"agentmesh.v1.AuthResponse"> & {
+    /**
+     * @generated from field: bool success = 1;
+     */
+    success: boolean;
+    /**
+     * populated only if success is false
+     *
+     * @generated from field: string error = 2;
+     */
+    error: string;
+    /**
+     * The server's own Biscuit token (for mutual auth)
+     *
+     * @generated from field: bytes biscuit = 3;
+     */
+    biscuit: Uint8Array;
+};
+/**
+ * Describes the message agentmesh.v1.AuthResponse.
+ * Use `create(AuthResponseSchema)` to create a new message.
+ */
+export declare const AuthResponseSchema: GenMessage<AuthResponse>;
+/**
+ * RouterGoAway is what a router sends, on GoAwayProtocolID, to a member it
+ * will no longer hold: it is stopping, or it holds more members than it is
+ * sized for. The member attaches to another router and does not come back
+ * to this one before retry_after has passed. A member that does not speak
+ * the protocol sees its connection close instead.
+ *
+ * @generated from message agentmesh.v1.RouterGoAway
+ */
+export type RouterGoAway = Message<"agentmesh.v1.RouterGoAway"> & {
+    /**
+     * @generated from field: agentmesh.v1.RouterGoAway.Reason reason = 1;
+     */
+    reason: RouterGoAway_Reason;
+    /**
+     * @generated from field: google.protobuf.Duration retry_after = 2;
+     */
+    retryAfter?: Duration | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.RouterGoAway.
+ * Use `create(RouterGoAwaySchema)` to create a new message.
+ */
+export declare const RouterGoAwaySchema: GenMessage<RouterGoAway>;
+/**
+ * @generated from enum agentmesh.v1.RouterGoAway.Reason
+ */
+export declare enum RouterGoAway_Reason {
+    /**
+     * @generated from enum value: REASON_UNSPECIFIED = 0;
+     */
+    REASON_UNSPECIFIED = 0,
+    /**
+     * the router is shutting down
+     *
+     * @generated from enum value: DRAINING = 1;
+     */
+    DRAINING = 1,
+    /**
+     * the router is above its high watermark
+     *
+     * @generated from enum value: OVERLOADED = 2;
+     */
+    OVERLOADED = 2
+}
+/**
+ * Describes the enum agentmesh.v1.RouterGoAway.Reason.
+ */
+export declare const RouterGoAway_ReasonSchema: GenEnum<RouterGoAway_Reason>;
+/**
+ * @generated from message agentmesh.v1.MeshEvent
+ */
+export type MeshEvent = Message<"agentmesh.v1.MeshEvent"> & {
+    /**
+     * @generated from field: agentmesh.v1.MeshEvent.Type type = 1;
+     */
+    type: MeshEvent_Type;
+    /**
+     * @generated from field: string peer_id = 2;
+     */
+    peerId: string;
+    /**
+     * When the control plane recorded the event. Receivers ignore an event
+     * further than a few minutes from their clock and, for bans, one older
+     * than the last they applied for the peer.
+     *
+     * @generated from field: google.protobuf.Timestamp event_time = 3;
+     */
+    eventTime?: Timestamp | undefined;
+    /**
+     * @generated from field: bytes new_public_key = 4;
+     */
+    newPublicKey: Uint8Array;
+    /**
+     * @generated from field: bytes signature = 5;
+     */
+    signature: Uint8Array;
+};
+/**
+ * Describes the message agentmesh.v1.MeshEvent.
+ * Use `create(MeshEventSchema)` to create a new message.
+ */
+export declare const MeshEventSchema: GenMessage<MeshEvent>;
+/**
+ * @generated from enum agentmesh.v1.MeshEvent.Type
+ */
+export declare enum MeshEvent_Type {
+    /**
+     * @generated from enum value: BANNED = 0;
+     */
+    BANNED = 0,
+    /**
+     * @generated from enum value: KEY_ROTATION = 1;
+     */
+    KEY_ROTATION = 1,
+    /**
+     * @generated from enum value: POLICY_UPDATE = 2;
+     */
+    POLICY_UPDATE = 2
+}
+/**
+ * Describes the enum agentmesh.v1.MeshEvent.Type.
+ */
+export declare const MeshEvent_TypeSchema: GenEnum<MeshEvent_Type>;
+/**
+ * @generated from message agentmesh.v1.EnrollRequest
+ */
+export type EnrollRequest = Message<"agentmesh.v1.EnrollRequest"> & {
+    /**
+     * @generated from field: string jwt = 1;
+     */
+    jwt: string;
+    /**
+     * @generated from field: string peer_id = 2;
+     */
+    peerId: string;
+    /**
+     * @generated from field: bytes public_key = 3;
+     */
+    publicKey: Uint8Array;
+    /**
+     * @generated from field: string requested_role = 4;
+     */
+    requestedRole: string;
+    /**
+     * Operator-declared labels (e.g. key "region", see api/labels.go).
+     * Validated fail-closed by the control plane and, once attested by the
+     * enrollment flow's gates, minted as signed label() facts in the
+     * biscuit. Empty means no claims.
+     *
+     * @generated from field: map<string, string> labels = 5;
+     */
+    labels: {
+        [key: string]: string;
+    };
+    /**
+     * Proof of possession of public_key's private half: challenge_unix_ms is
+     * the caller's clock in unix milliseconds and challenge_signature signs
+     * the UTF-8 bytes of "mesh:register:<peer_id>:<challenge_unix_ms>". It is
+     * an int64 because it is the number in the signed text, not an instant
+     * for display. Required, and peer_id must be derived from public_key.
+     * The JWT proves who is asking; this proves they hold the key they are
+     * asking to bind, so an identity cannot register (and overwrite) another
+     * node's peer_id.
+     *
+     * @generated from field: int64 challenge_unix_ms = 6;
+     */
+    challengeUnixMs: bigint;
+    /**
+     * @generated from field: bytes challenge_signature = 7;
+     */
+    challengeSignature: Uint8Array;
+};
+/**
+ * Describes the message agentmesh.v1.EnrollRequest.
+ * Use `create(EnrollRequestSchema)` to create a new message.
+ */
+export declare const EnrollRequestSchema: GenMessage<EnrollRequest>;
+/**
+ * @generated from message agentmesh.v1.EnrollResponse
+ */
+export type EnrollResponse = Message<"agentmesh.v1.EnrollResponse"> & {
+    /**
+     * @generated from field: bytes biscuit_token = 1;
+     */
+    biscuitToken: Uint8Array;
+    /**
+     * @generated from field: string error_message = 2;
+     */
+    errorMessage: string;
+    /**
+     * @generated from field: bytes control_plane_public_key = 3;
+     */
+    controlPlanePublicKey: Uint8Array;
+    /**
+     * @generated from field: repeated string router_addresses = 4;
+     */
+    routerAddresses: string[];
+    /**
+     * @generated from field: google.protobuf.Timestamp expire_time = 5;
+     */
+    expireTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.EnrollResponse.
+ * Use `create(EnrollResponseSchema)` to create a new message.
+ */
+export declare const EnrollResponseSchema: GenMessage<EnrollResponse>;
+/**
+ * @generated from message agentmesh.v1.BootstrapEnrollRequest
+ */
+export type BootstrapEnrollRequest = Message<"agentmesh.v1.BootstrapEnrollRequest"> & {
+    /**
+     * @generated from field: string bootstrap_token = 1;
+     */
+    bootstrapToken: string;
+    /**
+     * @generated from field: string peer_id = 2;
+     */
+    peerId: string;
+    /**
+     * @generated from field: bytes public_key = 3;
+     */
+    publicKey: Uint8Array;
+    /**
+     * @generated from field: string requested_role = 4;
+     */
+    requestedRole: string;
+    /**
+     * Operator-declared labels; the admin approving the enrollment attests
+     * them (see EnrollRequest.labels).
+     *
+     * @generated from field: map<string, string> labels = 5;
+     */
+    labels: {
+        [key: string]: string;
+    };
+    /**
+     * Proof of possession of public_key's private half: challenge_unix_ms is
+     * the caller's clock in unix milliseconds and challenge_signature signs
+     * the UTF-8 bytes of "mesh:enroll:<peer_id>:<challenge_unix_ms>". Required,
+     * and peer_id must be derived from public_key: this is what entitles a
+     * repeated POST /enroll to re-fetch an existing enrollment's biscuit, so
+     * a bootstrap token alone must never satisfy it.
+     *
+     * @generated from field: int64 challenge_unix_ms = 6;
+     */
+    challengeUnixMs: bigint;
+    /**
+     * @generated from field: bytes challenge_signature = 7;
+     */
+    challengeSignature: Uint8Array;
+};
+/**
+ * Describes the message agentmesh.v1.BootstrapEnrollRequest.
+ * Use `create(BootstrapEnrollRequestSchema)` to create a new message.
+ */
+export declare const BootstrapEnrollRequestSchema: GenMessage<BootstrapEnrollRequest>;
+/**
+ * BootstrapEnrollResponse answers POST /enroll and GET /enroll/status.
+ * Polling GET /enroll/status requires proof of possession of the key
+ * submitted at /enroll: alongside the `peer_id` query parameter, the caller
+ * sends the X-Mesh-Challenge-Ts header (unix milliseconds) and the
+ * X-Mesh-Challenge-Sig header (unpadded base64url signature over the UTF-8
+ * bytes of "mesh:enroll-status:<peer_id>:<ts>").
+ *
+ * @generated from message agentmesh.v1.BootstrapEnrollResponse
+ */
+export type BootstrapEnrollResponse = Message<"agentmesh.v1.BootstrapEnrollResponse"> & {
+    /**
+     * @generated from field: agentmesh.v1.EnrollmentStatus status = 1;
+     */
+    status: EnrollmentStatus;
+    /**
+     * Populated only if APPROVED
+     *
+     * @generated from field: bytes biscuit_token = 2;
+     */
+    biscuitToken: Uint8Array;
+    /**
+     * Recommended polling wait time
+     *
+     * @generated from field: int32 poll_interval_seconds = 3;
+     */
+    pollIntervalSeconds: number;
+    /**
+     * @generated from field: string error_message = 4;
+     */
+    errorMessage: string;
+    /**
+     * Populated only if APPROVED
+     *
+     * @generated from field: bytes control_plane_public_key = 5;
+     */
+    controlPlanePublicKey: Uint8Array;
+    /**
+     * Populated only if APPROVED
+     *
+     * @generated from field: repeated string router_addresses = 6;
+     */
+    routerAddresses: string[];
+    /**
+     * Populated only if APPROVED
+     *
+     * @generated from field: google.protobuf.Timestamp expire_time = 7;
+     */
+    expireTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.BootstrapEnrollResponse.
+ * Use `create(BootstrapEnrollResponseSchema)` to create a new message.
+ */
+export declare const BootstrapEnrollResponseSchema: GenMessage<BootstrapEnrollResponse>;
+/**
+ * @generated from message agentmesh.v1.ServiceInfo
+ */
+export type ServiceInfo = Message<"agentmesh.v1.ServiceInfo"> & {
+    /**
+     * @generated from field: agentmesh.v1.ServiceType type = 1;
+     */
+    type: ServiceType;
+    /**
+     * @generated from field: string name = 2;
+     */
+    name: string;
+    /**
+     * @generated from field: string description = 3;
+     */
+    description: string;
+};
+/**
+ * Describes the message agentmesh.v1.ServiceInfo.
+ * Use `create(ServiceInfoSchema)` to create a new message.
+ */
+export declare const ServiceInfoSchema: GenMessage<ServiceInfo>;
+/**
+ * @generated from message agentmesh.v1.CommandBackend
+ */
+export type CommandBackend = Message<"agentmesh.v1.CommandBackend"> & {
+    /**
+     * @generated from field: repeated string command = 1;
+     */
+    command: string[];
+    /**
+     * @generated from field: map<string, string> env = 2;
+     */
+    env: {
+        [key: string]: string;
+    };
+};
+/**
+ * Describes the message agentmesh.v1.CommandBackend.
+ * Use `create(CommandBackendSchema)` to create a new message.
+ */
+export declare const CommandBackendSchema: GenMessage<CommandBackend>;
+/**
+ * @generated from message agentmesh.v1.RegisterServiceRequest
+ */
+export type RegisterServiceRequest = Message<"agentmesh.v1.RegisterServiceRequest"> & {
+    /**
+     * @generated from field: agentmesh.v1.ServiceInfo service = 1;
+     */
+    service?: ServiceInfo | undefined;
+    /**
+     * @generated from oneof agentmesh.v1.RegisterServiceRequest.backend
+     */
+    backend: {
+        /**
+         * @generated from field: string target_url = 2;
+         */
+        value: string;
+        case: "targetUrl";
+    } | {
+        /**
+         * @generated from field: agentmesh.v1.CommandBackend command = 3;
+         */
+        value: CommandBackend;
+        case: "command";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message agentmesh.v1.RegisterServiceRequest.
+ * Use `create(RegisterServiceRequestSchema)` to create a new message.
+ */
+export declare const RegisterServiceRequestSchema: GenMessage<RegisterServiceRequest>;
+/**
+ * @generated from message agentmesh.v1.DiscoveredProvider
+ */
+export type DiscoveredProvider = Message<"agentmesh.v1.DiscoveredProvider"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+    /**
+     * @generated from field: string local_proxy_url = 2;
+     */
+    localProxyUrl: string;
+    /**
+     * @generated from field: string srv_name = 3;
+     */
+    srvName: string;
+    /**
+     * @generated from field: string srv_description = 4;
+     */
+    srvDescription: string;
+};
+/**
+ * Describes the message agentmesh.v1.DiscoveredProvider.
+ * Use `create(DiscoveredProviderSchema)` to create a new message.
+ */
+export declare const DiscoveredProviderSchema: GenMessage<DiscoveredProvider>;
+/**
+ * @generated from message agentmesh.v1.ControlPlaneInfoResponse
+ */
+export type ControlPlaneInfoResponse = Message<"agentmesh.v1.ControlPlaneInfoResponse"> & {
+    /**
+     * @generated from field: string oidc_issuer = 1;
+     */
+    oidcIssuer: string;
+    /**
+     * @generated from field: string client_id = 2;
+     */
+    clientId: string;
+    /**
+     * @generated from field: string audience = 3;
+     */
+    audience: string;
+    /**
+     * The addresses of every router with a live lease, one multiaddr per
+     * address, each ending in the router's peer ID. The same routers as
+     * routers, flattened; kept for members that only need something to dial.
+     *
+     * @generated from field: repeated string router_addresses = 4;
+     */
+    routerAddresses: string[];
+    /**
+     * The complete set of currently banned peer IDs. Consumers reconcile their
+     * local blocklist against this list rather than merging into it, so that a
+     * peer the control plane no longer bans is unbanned everywhere without
+     * needing an event of its own. MeshEvent_BANNED stays the fast path for
+     * sub-second eviction; this is how a node that restarted or was offline
+     * when the event was published catches up.
+     *
+     * @generated from field: repeated string banned_peer_ids = 5;
+     */
+    bannedPeerIds: string[];
+    /**
+     * Every router with a live lease, with what a member needs to choose
+     * among them: its attested labels, to select or prefer routers by
+     * placement, and its load as of its last lease, to prefer the ones with
+     * room.
+     *
+     * @generated from field: repeated agentmesh.v1.RouterInfo routers = 6;
+     */
+    routers: RouterInfo[];
+    /**
+     * How the mesh keeps its directory. Members and routers read these here
+     * and nowhere else, so they agree without configuration of their own; a
+     * control plane that leaves it unset leaves them on the defaults the
+     * api package names.
+     *
+     * @generated from field: agentmesh.v1.DirectoryParameters directory = 7;
+     */
+    directory?: DirectoryParameters | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.ControlPlaneInfoResponse.
+ * Use `create(ControlPlaneInfoResponseSchema)` to create a new message.
+ */
+export declare const ControlPlaneInfoResponseSchema: GenMessage<ControlPlaneInfoResponse>;
+/**
+ * DirectoryParameters are the settings of the DHT the routers serve, set
+ * once per mesh on the control plane (agentmesh-control-plane
+ * --dht-replication, --dht-reprovide-interval) and published on /info.
+ *
+ * @generated from message agentmesh.v1.DirectoryParameters
+ */
+export type DirectoryParameters = Message<"agentmesh.v1.DirectoryParameters"> & {
+    /**
+     * How many routers each record a member announces is placed on, the
+     * closest to its key, besides the router that took the announcement.
+     * Routers read it; a member asks the routers it holds.
+     *
+     * @generated from field: int32 replication = 1;
+     */
+    replication: number;
+    /**
+     * How often a member re-announces each service it publishes.
+     *
+     * @generated from field: google.protobuf.Duration reprovide_interval = 2;
+     */
+    reprovideInterval?: Duration | undefined;
+    /**
+     * How long a router keeps a record after its last announcement: three
+     * reprovide intervals, so a provider that stopped without unpublishing
+     * leaves within it and two missed announcements do not unlist one that
+     * did not.
+     *
+     * @generated from field: google.protobuf.Duration record_ttl = 3;
+     */
+    recordTtl?: Duration | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.DirectoryParameters.
+ * Use `create(DirectoryParametersSchema)` to create a new message.
+ */
+export declare const DirectoryParametersSchema: GenMessage<DirectoryParameters>;
+/**
+ * DirectoryRequest is what a member asks a router it is attached to over
+ * /mesh/directory/1.0.0: one request per stream, answered with one
+ * DirectoryResponse. The member keeps no DHT of its own; the router keeps
+ * its records, places them on the routers closest to each key, and answers
+ * a lookup from its own records and those routers'. A router sends the
+ * same message to another router to place a member's record, or its
+ * withdrawal, on it.
+ *
+ * @generated from message agentmesh.v1.DirectoryRequest
+ */
+export type DirectoryRequest = Message<"agentmesh.v1.DirectoryRequest"> & {
+    /**
+     * @generated from oneof agentmesh.v1.DirectoryRequest.request
+     */
+    request: {
+        /**
+         * @generated from field: agentmesh.v1.DirectoryProvide provide = 1;
+         */
+        value: DirectoryProvide;
+        case: "provide";
+    } | {
+        /**
+         * @generated from field: agentmesh.v1.DirectoryFindProviders find_providers = 2;
+         */
+        value: DirectoryFindProviders;
+        case: "findProviders";
+    } | {
+        /**
+         * @generated from field: agentmesh.v1.DirectoryFindPeer find_peer = 3;
+         */
+        value: DirectoryFindPeer;
+        case: "findPeer";
+    } | {
+        /**
+         * @generated from field: agentmesh.v1.DirectoryWithdraw withdraw = 4;
+         */
+        value: DirectoryWithdraw;
+        case: "withdraw";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message agentmesh.v1.DirectoryRequest.
+ * Use `create(DirectoryRequestSchema)` to create a new message.
+ */
+export declare const DirectoryRequestSchema: GenMessage<DirectoryRequest>;
+/**
+ * DirectoryProvide announces the sender as a provider of key, reached at
+ * addrs. A key is a sha256 multihash: of "mesh:service:<type>[:<name>]" for
+ * a service, of "mesh:peer:<peer_id>" for the member itself. A record lives
+ * for the mesh's record TTL after its last announcement; announcing it
+ * again replaces its addresses. service names the service a record is
+ * about, "<type>://<name>", and the router refuses a key that is not that
+ * service's by name or by type; a record naming no service is the
+ * member's own, under its peer key. provider is set only between routers,
+ * by the router that holds the member, and refused from anyone else: a
+ * member can only announce itself.
+ *
+ * @generated from message agentmesh.v1.DirectoryProvide
+ */
+export type DirectoryProvide = Message<"agentmesh.v1.DirectoryProvide"> & {
+    /**
+     * @generated from field: bytes key = 1;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: repeated string addrs = 2;
+     */
+    addrs: string[];
+    /**
+     * @generated from field: string provider = 3;
+     */
+    provider: string;
+    /**
+     * @generated from field: string service = 4;
+     */
+    service: string;
+};
+/**
+ * Describes the message agentmesh.v1.DirectoryProvide.
+ * Use `create(DirectoryProvideSchema)` to create a new message.
+ */
+export declare const DirectoryProvideSchema: GenMessage<DirectoryProvide>;
+/**
+ * DirectoryWithdraw removes the sender's record under key, from the router
+ * asked and from the routers closest to the key: what a member sends when
+ * it stops a service or leaves the mesh, so that callers do not find it
+ * until the record would have expired. provider is as in DirectoryProvide.
+ *
+ * @generated from message agentmesh.v1.DirectoryWithdraw
+ */
+export type DirectoryWithdraw = Message<"agentmesh.v1.DirectoryWithdraw"> & {
+    /**
+     * @generated from field: bytes key = 1;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: string provider = 2;
+     */
+    provider: string;
+};
+/**
+ * Describes the message agentmesh.v1.DirectoryWithdraw.
+ * Use `create(DirectoryWithdrawSchema)` to create a new message.
+ */
+export declare const DirectoryWithdrawSchema: GenMessage<DirectoryWithdraw>;
+/**
+ * DirectoryFindProviders asks for up to limit providers of key.
+ *
+ * @generated from message agentmesh.v1.DirectoryFindProviders
+ */
+export type DirectoryFindProviders = Message<"agentmesh.v1.DirectoryFindProviders"> & {
+    /**
+     * @generated from field: bytes key = 1;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: uint32 limit = 2;
+     */
+    limit: number;
+};
+/**
+ * Describes the message agentmesh.v1.DirectoryFindProviders.
+ * Use `create(DirectoryFindProvidersSchema)` to create a new message.
+ */
+export declare const DirectoryFindProvidersSchema: GenMessage<DirectoryFindProviders>;
+/**
+ * DirectoryFindPeer asks where peer_id is reached.
+ *
+ * @generated from message agentmesh.v1.DirectoryFindPeer
+ */
+export type DirectoryFindPeer = Message<"agentmesh.v1.DirectoryFindPeer"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+};
+/**
+ * Describes the message agentmesh.v1.DirectoryFindPeer.
+ * Use `create(DirectoryFindPeerSchema)` to create a new message.
+ */
+export declare const DirectoryFindPeerSchema: GenMessage<DirectoryFindPeer>;
+/**
+ * DirectoryResponse answers one DirectoryRequest. providers answers
+ * find_providers; peer answers find_peer, unset when nobody knows the
+ * peer; error is set when the router could not run the request.
+ *
+ * @generated from message agentmesh.v1.DirectoryResponse
+ */
+export type DirectoryResponse = Message<"agentmesh.v1.DirectoryResponse"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.PeerRecord providers = 1;
+     */
+    providers: PeerRecord[];
+    /**
+     * @generated from field: agentmesh.v1.PeerRecord peer = 2;
+     */
+    peer?: PeerRecord | undefined;
+    /**
+     * @generated from field: string error = 3;
+     */
+    error: string;
+};
+/**
+ * Describes the message agentmesh.v1.DirectoryResponse.
+ * Use `create(DirectoryResponseSchema)` to create a new message.
+ */
+export declare const DirectoryResponseSchema: GenMessage<DirectoryResponse>;
+/**
+ * PeerRecord is a peer and the addresses it is reached at, relayed ones
+ * included, each ending in its peer ID.
+ *
+ * @generated from message agentmesh.v1.PeerRecord
+ */
+export type PeerRecord = Message<"agentmesh.v1.PeerRecord"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+    /**
+     * @generated from field: repeated string addrs = 2;
+     */
+    addrs: string[];
+};
+/**
+ * Describes the message agentmesh.v1.PeerRecord.
+ * Use `create(PeerRecordSchema)` to create a new message.
+ */
+export declare const PeerRecordSchema: GenMessage<PeerRecord>;
+/**
+ * RouterInfo is one router as the control plane lists it on /info.
+ *
+ * @generated from message agentmesh.v1.RouterInfo
+ */
+export type RouterInfo = Message<"agentmesh.v1.RouterInfo"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+    /**
+     * The router's announced addresses, each ending in its peer ID.
+     *
+     * @generated from field: repeated string addresses = 2;
+     */
+    addresses: string[];
+    /**
+     * The router's labels, the same labels as a node's: declared at
+     * enrollment (agentmesh-router --label), signed by the control plane only
+     * if the router's role allows them (PolicyRole.allowed_labels), and
+     * carried as label() facts in the router's credential, where a member
+     * verifies them at the handshake. A member selects routers by them
+     * (--router-selector, every pair must match) or prefers routers by them
+     * (--router-prefer). They place a router; they grant it nothing.
+     *
+     * @generated from field: map<string, string> labels = 3;
+     */
+    labels: {
+        [key: string]: string;
+    };
+    /**
+     * Connections the router held when it last renewed its lease, and the
+     * number it accepts (its high watermark). A member attaches to the
+     * routers with the most room; connection_limit of zero means unknown.
+     *
+     * @generated from field: int32 connections = 4;
+     */
+    connections: number;
+    /**
+     * @generated from field: int32 connection_limit = 5;
+     */
+    connectionLimit: number;
+};
+/**
+ * Describes the message agentmesh.v1.RouterInfo.
+ * Use `create(RouterInfoSchema)` to create a new message.
+ */
+export declare const RouterInfoSchema: GenMessage<RouterInfo>;
+/**
+ * @generated from message agentmesh.v1.RouterLeaseRequest
+ */
+export type RouterLeaseRequest = Message<"agentmesh.v1.RouterLeaseRequest"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+    /**
+     * @generated from field: repeated string addresses = 2;
+     */
+    addresses: string[];
+    /**
+     * @generated from field: bytes biscuit = 3;
+     */
+    biscuit: Uint8Array;
+    /**
+     * @generated from field: repeated string connected_peers = 4;
+     */
+    connectedPeers: string[];
+    /**
+     * @generated from field: int32 dht_size = 5;
+     */
+    dhtSize: number;
+    /**
+     * Proof of possession of the router's enrolled key: challenge_unix_ms is
+     * the caller's clock in unix milliseconds and challenge_signature signs
+     * the UTF-8 bytes of "mesh:routers-lease:<peer_id>:<challenge_unix_ms>"
+     * with the key the router enrolled with. Required. The biscuit alone is
+     * not proof: routers hand theirs to every peer they authenticate.
+     *
+     * @generated from field: int64 challenge_unix_ms = 6;
+     */
+    challengeUnixMs: bigint;
+    /**
+     * @generated from field: bytes challenge_signature = 7;
+     */
+    challengeSignature: Uint8Array;
+    /**
+     * How long this lease stays valid. Unset means the control plane's lease
+     * duration. A router may shorten its lease, never lengthen it: on its last
+     * renewal before stopping it sets the time it expects to be away, zero to
+     * be withdrawn at once, so a joiner is not handed a router that is gone
+     * and a router back within that time is still listed.
+     *
+     * @generated from field: google.protobuf.Duration ttl = 8;
+     */
+    ttl?: Duration | undefined;
+    /**
+     * The router's load, listed for it on /info (RouterInfo): its open
+     * inbound connections and the number it accepts.
+     *
+     * @generated from field: int32 connections = 9;
+     */
+    connections: number;
+    /**
+     * @generated from field: int32 connection_limit = 10;
+     */
+    connectionLimit: number;
+};
+/**
+ * Describes the message agentmesh.v1.RouterLeaseRequest.
+ * Use `create(RouterLeaseRequestSchema)` to create a new message.
+ */
+export declare const RouterLeaseRequestSchema: GenMessage<RouterLeaseRequest>;
+/**
+ * @generated from message agentmesh.v1.RouterLeaseResponse
+ */
+export type RouterLeaseResponse = Message<"agentmesh.v1.RouterLeaseResponse"> & {
+    /**
+     * @generated from field: bool success = 1;
+     */
+    success: boolean;
+    /**
+     * @generated from field: string error = 2;
+     */
+    error: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp expire_time = 3;
+     */
+    expireTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.RouterLeaseResponse.
+ * Use `create(RouterLeaseResponseSchema)` to create a new message.
+ */
+export declare const RouterLeaseResponseSchema: GenMessage<RouterLeaseResponse>;
+/**
+ * @generated from message agentmesh.v1.PolicyRole
+ */
+export type PolicyRole = Message<"agentmesh.v1.PolicyRole"> & {
+    /**
+     * @generated from field: string name = 1;
+     */
+    name: string;
+    /**
+     * @generated from field: repeated string allowed_targets = 2;
+     */
+    allowedTargets: string[];
+    /**
+     * @generated from field: repeated string allowed_services = 3;
+     */
+    allowedServices: string[];
+    /**
+     * @generated from field: repeated string custom_datalog = 4;
+     */
+    customDatalog: string[];
+    /**
+     * Labels a node with this role may declare at enrollment, as "*", "key=*"
+     * or "key=value". A node declares its own labels, so this is what turns a
+     * declaration into something the control plane is willing to sign.
+     *
+     * @generated from field: repeated string allowed_labels = 5;
+     */
+    allowedLabels: string[];
+    /**
+     * HTTP narrowing of allowed_services entries; see HTTPGrant.
+     *
+     * @generated from field: repeated agentmesh.v1.HTTPGrant http = 6;
+     */
+    http: HTTPGrant[];
+    /**
+     * Services a member with this role may serve, in the syntax of
+     * allowed_services ("mcp://calc", "inference://*", "*"). A role serves
+     * nothing it is not granted here: a router keeps a member's record only
+     * for a service its credential grants, and a caller sends a request to
+     * a provider it found by name only when the provider's credential does.
+     * An egress destination needs no entry: served_by grants it to the
+     * nodes it selects.
+     *
+     * @generated from field: repeated string allowed_publish = 7;
+     */
+    allowedPublish: string[];
+};
+/**
+ * Describes the message agentmesh.v1.PolicyRole.
+ * Use `create(PolicyRoleSchema)` to create a new message.
+ */
+export declare const PolicyRoleSchema: GenMessage<PolicyRole>;
+/**
+ * HTTPGrant narrows one allowed_services entry to HTTP methods and paths.
+ * The control plane compiles it into granted_method and granted_path_* facts
+ * in the holder's credential and withholds the plain service grant for that
+ * entry. The baseline rules derive the service grant only for a request
+ * whose method($m) and path($p) facts match, so a request that carries no
+ * HTTP method (a tunnel, a non-HTTP stream) does not match a narrowed entry.
+ *
+ * @generated from message agentmesh.v1.HTTPGrant
+ */
+export type HTTPGrant = Message<"agentmesh.v1.HTTPGrant"> & {
+    /**
+     * One of the role's allowed_services entries, written identically.
+     *
+     * @generated from field: string service = 1;
+     */
+    service: string;
+    /**
+     * Methods the holder may use, e.g. "GET", "HEAD". Empty means any method.
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+    /**
+     * Paths the holder may request, as the backend sees them: "/user" matches
+     * that path only, "/v2/public/*" matches every path under the prefix.
+     * Empty means any path. At least one of methods and paths must be set.
+     *
+     * @generated from field: repeated string paths = 3;
+     */
+    paths: string[];
+};
+/**
+ * Describes the message agentmesh.v1.HTTPGrant.
+ * Use `create(HTTPGrantSchema)` to create a new message.
+ */
+export declare const HTTPGrantSchema: GenMessage<HTTPGrant>;
+/**
+ * EgressDestination is a destination outside the mesh that selected nodes
+ * serve as egress://<name>. It is part of the policy document the admin
+ * writes; a node receives the destinations that select it at GET /egress
+ * and serves them without configuration of its own.
+ *
+ * @generated from message agentmesh.v1.EgressDestination
+ */
+export type EgressDestination = Message<"agentmesh.v1.EgressDestination"> & {
+    /**
+     * The destination hostname, lowercase, without a port or a path. It is the
+     * service name in grants (egress://<name>) and the DHT key.
+     *
+     * @generated from field: string name = 1;
+     */
+    name: string;
+    /**
+     * Where the serving node forwards requests. Optional; https://<name> when
+     * empty. Must not carry a credential.
+     *
+     * @generated from field: string target_url = 2;
+     */
+    targetUrl: string;
+    /**
+     * Name of the credential the serving node presents upstream, resolved by
+     * the node from its secrets directory. Shorthand for broker.static_secret.
+     * Never a value: secret material does not travel through this API.
+     *
+     * @generated from field: string credential = 3;
+     */
+    credential: string;
+    /**
+     * Role names or key=value labels selecting the nodes that serve this
+     * destination. A node matches when any entry names one of its roles or
+     * labels. The control plane also grants the destination to the selected
+     * nodes, so the serving node authorizes local requests with its own
+     * credential; other callers need the grant on their own role.
+     *
+     * @generated from field: repeated string served_by = 4;
+     */
+    servedBy: string[];
+    /**
+     * Pluggable credential broker for the destination.
+     *
+     * @generated from field: agentmesh.v1.CredentialBroker broker = 5;
+     */
+    broker?: CredentialBroker | undefined;
+    /**
+     * Content inspection the egress node applies. Destination policy: a TAR
+     * cannot disable it or choose another inspector.
+     *
+     * @generated from field: agentmesh.v1.Inspection inspection = 6;
+     */
+    inspection?: Inspection | undefined;
+    /**
+     * HTTP (default): the node terminates TLS, brokers the credential and
+     * inspects. TCP: a named CONNECT tunnel, L4 policy only.
+     *
+     * @generated from field: agentmesh.v1.EgressMode mode = 7;
+     */
+    mode: EgressMode;
+    /**
+     * TCP mode: destination ports a tunnel may open. Empty denies every tunnel.
+     *
+     * @generated from field: repeated uint32 ports = 8;
+     */
+    ports: number[];
+    /**
+     * Keep the destination hostname in Host when target_url is an operator
+     * inspection chain that forwards to the real host.
+     *
+     * @generated from field: bool preserve_host = 9;
+     */
+    preserveHost: boolean;
+    /**
+     * Forward X-Mesh-Principal, X-Mesh-Roles and X-Mesh-Task to target_url.
+     * Only for an operator chain; the node strips them for a real destination.
+     *
+     * @generated from field: bool forward_context = 10;
+     */
+    forwardContext: boolean;
+};
+/**
+ * Describes the message agentmesh.v1.EgressDestination.
+ * Use `create(EgressDestinationSchema)` to create a new message.
+ */
+export declare const EgressDestinationSchema: GenMessage<EgressDestination>;
+/**
+ * Inspection lists the inspectors the egress node runs, in order; the first
+ * block wins. Inspectors run before the broker injects the destination
+ * credential, so a processor never sees it.
+ *
+ * @generated from message agentmesh.v1.Inspection
+ */
+export type Inspection = Message<"agentmesh.v1.Inspection"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.Inspector inspectors = 1;
+     */
+    inspectors: Inspector[];
+};
+/**
+ * Describes the message agentmesh.v1.Inspection.
+ * Use `create(InspectionSchema)` to create a new message.
+ */
+export declare const InspectionSchema: GenMessage<Inspection>;
+/**
+ * @generated from message agentmesh.v1.Inspector
+ */
+export type Inspector = Message<"agentmesh.v1.Inspector"> & {
+    /**
+     * @generated from oneof agentmesh.v1.Inspector.kind
+     */
+    kind: {
+        /**
+         * @generated from field: agentmesh.v1.ModelArmor model_armor = 1;
+         */
+        value: ModelArmor;
+        case: "modelArmor";
+    } | {
+        /**
+         * @generated from field: agentmesh.v1.ExtProc ext_proc = 2;
+         */
+        value: ExtProc;
+        case: "extProc";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message agentmesh.v1.Inspector.
+ * Use `create(InspectorSchema)` to create a new message.
+ */
+export declare const InspectorSchema: GenMessage<Inspector>;
+/**
+ * ModelArmor calls sanitizeUserPrompt / sanitizeModelResponse directly over
+ * HTTPS. Model Armor is reached as an egress destination with an
+ * oidc_federation broker, so no credential is stored for it.
+ *
+ * @generated from message agentmesh.v1.ModelArmor
+ */
+export type ModelArmor = Message<"agentmesh.v1.ModelArmor"> & {
+    /**
+     * projects/P/locations/L/templates/T. One template per destination; a
+     * destination that needs another template is declared as another
+     * EgressDestination.
+     *
+     * @generated from field: string template = 1;
+     */
+    template: string;
+    /**
+     * BUFFERED: the whole response is inspected before release and may be
+     * rewritten. REQUEST_ONLY: prompts are inspected, responses pass.
+     *
+     * @generated from field: agentmesh.v1.ResponseInspection response = 2;
+     */
+    response: ResponseInspection;
+    /**
+     * Default false: an unreachable Model Armor fails the request.
+     *
+     * @generated from field: bool fail_open = 3;
+     */
+    failOpen: boolean;
+    /**
+     * @generated from field: google.protobuf.Duration timeout = 4;
+     */
+    timeout?: Duration | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.ModelArmor.
+ * Use `create(ModelArmorSchema)` to create a new message.
+ */
+export declare const ModelArmorSchema: GenMessage<ModelArmor>;
+/**
+ * ExtProc runs an Envoy external processor (envoy.service.ext_proc.v3
+ * ExternalProcessor) over one bidirectional gRPC stream per request. Field
+ * names follow Envoy's ext_proc filter configuration so a processor's
+ * settings carry over unchanged.
+ *
+ * @generated from message agentmesh.v1.ExtProc
+ */
+export type ExtProc = Message<"agentmesh.v1.ExtProc"> & {
+    /**
+     * host:port, or unix:/path for a processor on the same host.
+     *
+     * @generated from field: string target = 1;
+     */
+    target: string;
+    /**
+     * Names in the node's secrets directory for mTLS to the processor: the CA
+     * bundle and the client certificate with its key. Never values.
+     *
+     * @generated from field: string ca = 2;
+     */
+    ca: string;
+    /**
+     * @generated from field: string client_certificate = 3;
+     */
+    clientCertificate: string;
+    /**
+     * @generated from field: agentmesh.v1.ExtProcProcessingMode processing_mode = 4;
+     */
+    processingMode?: ExtProcProcessingMode | undefined;
+    /**
+     * Let the processor change the mode mid-request (Envoy allow_mode_override).
+     *
+     * @generated from field: bool allow_mode_override = 5;
+     */
+    allowModeOverride: boolean;
+    /**
+     * Per-message deadline; 200ms when unset, as in Envoy.
+     *
+     * @generated from field: google.protobuf.Duration message_timeout = 6;
+     */
+    messageTimeout?: Duration | undefined;
+    /**
+     * Default false: a processor error fails the request (Envoy failure_mode_allow).
+     *
+     * @generated from field: bool failure_mode_allow = 7;
+     */
+    failureModeAllow: boolean;
+    /**
+     * Upper bound for BUFFERED and BUFFERED_PARTIAL bodies.
+     *
+     * @generated from field: uint32 max_buffered_bytes = 8;
+     */
+    maxBufferedBytes: number;
+};
+/**
+ * Describes the message agentmesh.v1.ExtProc.
+ * Use `create(ExtProcSchema)` to create a new message.
+ */
+export declare const ExtProcSchema: GenMessage<ExtProc>;
+/**
+ * @generated from message agentmesh.v1.ExtProcProcessingMode
+ */
+export type ExtProcProcessingMode = Message<"agentmesh.v1.ExtProcProcessingMode"> & {
+    /**
+     * @generated from field: agentmesh.v1.ExtProcProcessingMode.HeaderMode request_header_mode = 1;
+     */
+    requestHeaderMode: ExtProcProcessingMode_HeaderMode;
+    /**
+     * @generated from field: agentmesh.v1.ExtProcProcessingMode.HeaderMode response_header_mode = 2;
+     */
+    responseHeaderMode: ExtProcProcessingMode_HeaderMode;
+    /**
+     * @generated from field: agentmesh.v1.ExtProcProcessingMode.BodyMode request_body_mode = 3;
+     */
+    requestBodyMode: ExtProcProcessingMode_BodyMode;
+    /**
+     * @generated from field: agentmesh.v1.ExtProcProcessingMode.BodyMode response_body_mode = 4;
+     */
+    responseBodyMode: ExtProcProcessingMode_BodyMode;
+    /**
+     * @generated from field: agentmesh.v1.ExtProcProcessingMode.HeaderMode request_trailer_mode = 5;
+     */
+    requestTrailerMode: ExtProcProcessingMode_HeaderMode;
+    /**
+     * @generated from field: agentmesh.v1.ExtProcProcessingMode.HeaderMode response_trailer_mode = 6;
+     */
+    responseTrailerMode: ExtProcProcessingMode_HeaderMode;
+};
+/**
+ * Describes the message agentmesh.v1.ExtProcProcessingMode.
+ * Use `create(ExtProcProcessingModeSchema)` to create a new message.
+ */
+export declare const ExtProcProcessingModeSchema: GenMessage<ExtProcProcessingMode>;
+/**
+ * @generated from enum agentmesh.v1.ExtProcProcessingMode.HeaderMode
+ */
+export declare enum ExtProcProcessingMode_HeaderMode {
+    /**
+     * @generated from enum value: HEADER_MODE_DEFAULT = 0;
+     */
+    HEADER_MODE_DEFAULT = 0,
+    /**
+     * @generated from enum value: SEND = 1;
+     */
+    SEND = 1,
+    /**
+     * @generated from enum value: SKIP = 2;
+     */
+    SKIP = 2
+}
+/**
+ * Describes the enum agentmesh.v1.ExtProcProcessingMode.HeaderMode.
+ */
+export declare const ExtProcProcessingMode_HeaderModeSchema: GenEnum<ExtProcProcessingMode_HeaderMode>;
+/**
+ * @generated from enum agentmesh.v1.ExtProcProcessingMode.BodyMode
+ */
+export declare enum ExtProcProcessingMode_BodyMode {
+    /**
+     * @generated from enum value: NONE = 0;
+     */
+    NONE = 0,
+    /**
+     * @generated from enum value: STREAMED = 1;
+     */
+    STREAMED = 1,
+    /**
+     * @generated from enum value: BUFFERED = 2;
+     */
+    BUFFERED = 2,
+    /**
+     * @generated from enum value: BUFFERED_PARTIAL = 3;
+     */
+    BUFFERED_PARTIAL = 3,
+    /**
+     * @generated from enum value: FULL_DUPLEX_STREAMED = 4;
+     */
+    FULL_DUPLEX_STREAMED = 4
+}
+/**
+ * Describes the enum agentmesh.v1.ExtProcProcessingMode.BodyMode.
+ */
+export declare const ExtProcProcessingMode_BodyModeSchema: GenEnum<ExtProcProcessingMode_BodyMode>;
+/**
+ * @generated from message agentmesh.v1.CredentialBroker
+ */
+export type CredentialBroker = Message<"agentmesh.v1.CredentialBroker"> & {
+    /**
+     * @generated from oneof agentmesh.v1.CredentialBroker.kind
+     */
+    kind: {
+        /**
+         * Name of a file in the node's secrets directory ("TOKEN" or "user:pass").
+         *
+         * @generated from field: string static_secret = 1;
+         */
+        value: string;
+        case: "staticSecret";
+    } | {
+        /**
+         * @generated from field: agentmesh.v1.OIDCFederation oidc_federation = 2;
+         */
+        value: OIDCFederation;
+        case: "oidcFederation";
+    } | {
+        /**
+         * @generated from field: agentmesh.v1.AWSAssumeRole aws_assume_role = 3;
+         */
+        value: AWSAssumeRole;
+        case: "awsAssumeRole";
+    } | {
+        /**
+         * The node's own platform identity (GKE Workload Identity, instance
+         * metadata). Only for nodes that run inside the provider.
+         *
+         * @generated from field: agentmesh.v1.PlatformIdentity platform_identity = 4;
+         */
+        value: PlatformIdentity;
+        case: "platformIdentity";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message agentmesh.v1.CredentialBroker.
+ * Use `create(CredentialBrokerSchema)` to create a new message.
+ */
+export declare const CredentialBrokerSchema: GenMessage<CredentialBroker>;
+/**
+ * OIDCFederation exchanges the control plane's JWT at a provider STS.
+ *
+ * @generated from message agentmesh.v1.OIDCFederation
+ */
+export type OIDCFederation = Message<"agentmesh.v1.OIDCFederation"> & {
+    /**
+     * Google: https://sts.googleapis.com/v1/token. Other providers: their RFC 8693 endpoint.
+     *
+     * @generated from field: string token_endpoint = 1;
+     */
+    tokenEndpoint: string;
+    /**
+     * The audience the provider expects, e.g. the Google workload or workforce
+     * pool provider resource name. One per destination.
+     *
+     * @generated from field: string audience = 2;
+     */
+    audience: string;
+    /**
+     * Optional service account to impersonate when the API does not accept the
+     * federated principal directly (Google iamcredentials.generateAccessToken).
+     *
+     * @generated from field: string impersonate = 3;
+     */
+    impersonate: string;
+    /**
+     * OAuth scopes requested for the destination credential; the TAR may narrow
+     * them further, never widen them.
+     *
+     * @generated from field: repeated string scopes = 4;
+     */
+    scopes: string[];
+};
+/**
+ * Describes the message agentmesh.v1.OIDCFederation.
+ * Use `create(OIDCFederationSchema)` to create a new message.
+ */
+export declare const OIDCFederationSchema: GenMessage<OIDCFederation>;
+/**
+ * @generated from message agentmesh.v1.AWSAssumeRole
+ */
+export type AWSAssumeRole = Message<"agentmesh.v1.AWSAssumeRole"> & {
+    /**
+     * @generated from field: string role_arn = 1;
+     */
+    roleArn: string;
+    /**
+     * Session policy template; the adapter intersects it with the TAR.
+     *
+     * @generated from field: string session_policy = 2;
+     */
+    sessionPolicy: string;
+};
+/**
+ * Describes the message agentmesh.v1.AWSAssumeRole.
+ * Use `create(AWSAssumeRoleSchema)` to create a new message.
+ */
+export declare const AWSAssumeRoleSchema: GenMessage<AWSAssumeRole>;
+/**
+ * @generated from message agentmesh.v1.PlatformIdentity
+ */
+export type PlatformIdentity = Message<"agentmesh.v1.PlatformIdentity"> & {
+    /**
+     * @generated from field: repeated string scopes = 1;
+     */
+    scopes: string[];
+};
+/**
+ * Describes the message agentmesh.v1.PlatformIdentity.
+ * Use `create(PlatformIdentitySchema)` to create a new message.
+ */
+export declare const PlatformIdentitySchema: GenMessage<PlatformIdentity>;
+/**
+ * @generated from message agentmesh.v1.PolicyBinding
+ */
+export type PolicyBinding = Message<"agentmesh.v1.PolicyBinding"> & {
+    /**
+     * @generated from field: string role = 1;
+     */
+    role: string;
+    /**
+     * @generated from field: repeated string members = 2;
+     */
+    members: string[];
+};
+/**
+ * Describes the message agentmesh.v1.PolicyBinding.
+ * Use `create(PolicyBindingSchema)` to create a new message.
+ */
+export declare const PolicyBindingSchema: GenMessage<PolicyBinding>;
+/**
+ * PolicyConfig is the mesh policy as the operator writes it: roles and
+ * bindings. It is the body of POST /policies and the answer of
+ * GET /admin/policy, both protojson. Only the control plane reads it, to
+ * mint tokens and to render PolicyConfigGetResponse.
+ *
+ * @generated from message agentmesh.v1.PolicyConfig
+ */
+export type PolicyConfig = Message<"agentmesh.v1.PolicyConfig"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.PolicyRole roles = 1;
+     */
+    roles: PolicyRole[];
+    /**
+     * @generated from field: repeated agentmesh.v1.PolicyBinding bindings = 2;
+     */
+    bindings: PolicyBinding[];
+    /**
+     * @generated from field: repeated agentmesh.v1.EgressDestination egress = 3;
+     */
+    egress: EgressDestination[];
+};
+/**
+ * Describes the message agentmesh.v1.PolicyConfig.
+ * Use `create(PolicyConfigSchema)` to create a new message.
+ */
+export declare const PolicyConfigSchema: GenMessage<PolicyConfig>;
+/**
+ * @generated from message agentmesh.v1.PolicyConfigGetRequest
+ */
+export type PolicyConfigGetRequest = Message<"agentmesh.v1.PolicyConfigGetRequest"> & {};
+/**
+ * Describes the message agentmesh.v1.PolicyConfigGetRequest.
+ * Use `create(PolicyConfigGetRequestSchema)` to create a new message.
+ */
+export declare const PolicyConfigGetRequestSchema: GenMessage<PolicyConfigGetRequest>;
+/**
+ * PolicyConfigGetResponse answers GET /policies for a mesh member holding a
+ * biscuit. It carries the policy only as Datalog text: this is the contract
+ * every member evaluates, and none derives rules from roles and bindings.
+ *
+ * @generated from message agentmesh.v1.PolicyConfigGetResponse
+ */
+export type PolicyConfigGetResponse = Message<"agentmesh.v1.PolicyConfigGetResponse"> & {
+    /**
+     * One rule per entry, rendered by the control plane with api.BuildPolicyRules.
+     *
+     * @generated from field: repeated string datalog_rules = 1;
+     */
+    datalogRules: string[];
+};
+/**
+ * Describes the message agentmesh.v1.PolicyConfigGetResponse.
+ * Use `create(PolicyConfigGetResponseSchema)` to create a new message.
+ */
+export declare const PolicyConfigGetResponseSchema: GenMessage<PolicyConfigGetResponse>;
+/**
+ * @generated from message agentmesh.v1.PolicyConfigUpdateResponse
+ */
+export type PolicyConfigUpdateResponse = Message<"agentmesh.v1.PolicyConfigUpdateResponse"> & {
+    /**
+     * @generated from field: bool success = 1;
+     */
+    success: boolean;
+    /**
+     * @generated from field: string error = 2;
+     */
+    error: string;
+};
+/**
+ * Describes the message agentmesh.v1.PolicyConfigUpdateResponse.
+ * Use `create(PolicyConfigUpdateResponseSchema)` to create a new message.
+ */
+export declare const PolicyConfigUpdateResponseSchema: GenMessage<PolicyConfigUpdateResponse>;
+/**
+ * @generated from message agentmesh.v1.EgressAssignmentsRequest
+ */
+export type EgressAssignmentsRequest = Message<"agentmesh.v1.EgressAssignmentsRequest"> & {};
+/**
+ * Describes the message agentmesh.v1.EgressAssignmentsRequest.
+ * Use `create(EgressAssignmentsRequestSchema)` to create a new message.
+ */
+export declare const EgressAssignmentsRequestSchema: GenMessage<EgressAssignmentsRequest>;
+/**
+ * EgressAssignmentsResponse answers GET /egress for a mesh member holding a
+ * biscuit: the destinations whose served_by selects that node. It is a
+ * separate endpoint from GET /policies so that a node predating it keeps
+ * syncing rules unchanged.
+ *
+ * @generated from message agentmesh.v1.EgressAssignmentsResponse
+ */
+export type EgressAssignmentsResponse = Message<"agentmesh.v1.EgressAssignmentsResponse"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.EgressDestination egress = 1;
+     */
+    egress: EgressDestination[];
+};
+/**
+ * Describes the message agentmesh.v1.EgressAssignmentsResponse.
+ * Use `create(EgressAssignmentsResponseSchema)` to create a new message.
+ */
+export declare const EgressAssignmentsResponseSchema: GenMessage<EgressAssignmentsResponse>;
+/**
+ * @generated from message agentmesh.v1.KeysResponse
+ */
+export type KeysResponse = Message<"agentmesh.v1.KeysResponse"> & {
+    /**
+     * @generated from field: repeated bytes public_keys = 1;
+     */
+    publicKeys: Uint8Array[];
+    /**
+     * When the set was signed; receivers reject responses outside a short
+     * freshness window so a captured set cannot be replayed.
+     *
+     * @generated from field: google.protobuf.Timestamp sign_time = 2;
+     */
+    signTime?: Timestamp | undefined;
+    /**
+     * One ed25519 signature per entry of public_keys, by that key, over the
+     * deterministic encoding of this message with signatures cleared. A
+     * receiver trusting any key still valid on the control plane can verify
+     * the whole set (see api.VerifyKeysResponse).
+     *
+     * @generated from field: repeated bytes signatures = 3;
+     */
+    signatures: Uint8Array[];
+};
+/**
+ * Describes the message agentmesh.v1.KeysResponse.
+ * Use `create(KeysResponseSchema)` to create a new message.
+ */
+export declare const KeysResponseSchema: GenMessage<KeysResponse>;
+/**
+ * @generated from message agentmesh.v1.TokenRefreshRequest
+ */
+export type TokenRefreshRequest = Message<"agentmesh.v1.TokenRefreshRequest"> & {
+    /**
+     * Signature with the node key over the UTF-8 bytes of
+     * "mesh:refresh:<peer_id>:<challenge_unix_ms>", where peer_id is the one
+     * bound in the presented biscuit. Peer- and endpoint-bound so a captured
+     * signature verifies nowhere else.
+     *
+     * @generated from field: bytes challenge_signature = 1;
+     */
+    challengeSignature: Uint8Array;
+    /**
+     * The caller's clock in unix milliseconds, the number in the signed text.
+     * Must be within the control plane's freshness window.
+     *
+     * @generated from field: int64 challenge_unix_ms = 2;
+     */
+    challengeUnixMs: bigint;
+    /**
+     * The caller's peer ID. Optional: the control plane normally reads it
+     * from the verified biscuit. It is consulted only when the biscuit's
+     * signing key has been retired, so the biscuit cannot be verified: the
+     * control plane then looks up the enrolled node record by this ID and,
+     * if the node was opted in to autonomous recovery, accepts the request
+     * when the presented biscuit is byte-identical to the last one it
+     * issued and the challenge verifies against the stored public key.
+     *
+     * @generated from field: string peer_id = 3;
+     */
+    peerId: string;
+    /**
+     * Optional fresh platform JWT for an OIDC-enrolled node. When set, the
+     * control plane verifies the JWT, confirms that iss|sub matches the
+     * stored enrollment's identity, and renews the stored claims and session
+     * expiry in place before minting the refreshed biscuit.
+     *
+     * @generated from field: string jwt = 4;
+     */
+    jwt: string;
+};
+/**
+ * Describes the message agentmesh.v1.TokenRefreshRequest.
+ * Use `create(TokenRefreshRequestSchema)` to create a new message.
+ */
+export declare const TokenRefreshRequestSchema: GenMessage<TokenRefreshRequest>;
+/**
+ * @generated from message agentmesh.v1.TokenRefreshResponse
+ */
+export type TokenRefreshResponse = Message<"agentmesh.v1.TokenRefreshResponse"> & {
+    /**
+     * @generated from field: bytes biscuit_token = 1;
+     */
+    biscuitToken: Uint8Array;
+    /**
+     * @generated from field: google.protobuf.Timestamp expire_time = 2;
+     */
+    expireTime?: Timestamp | undefined;
+    /**
+     * @generated from field: string error_message = 3;
+     */
+    errorMessage: string;
+};
+/**
+ * Describes the message agentmesh.v1.TokenRefreshResponse.
+ * Use `create(TokenRefreshResponseSchema)` to create a new message.
+ */
+export declare const TokenRefreshResponseSchema: GenMessage<TokenRefreshResponse>;
+/**
+ * NodeCatalogReport is the body of POST /nodes/catalog: a node's
+ * self-reported list of locally registered services. The reporting peer is
+ * taken from the presented biscuit, never from the body, so a node can only
+ * ever describe itself. Display-only; carries no authorization weight.
+ *
+ * @generated from message agentmesh.v1.NodeCatalogReport
+ */
+export type NodeCatalogReport = Message<"agentmesh.v1.NodeCatalogReport"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.ServiceInfo services = 1;
+     */
+    services: ServiceInfo[];
+};
+/**
+ * Describes the message agentmesh.v1.NodeCatalogReport.
+ * Use `create(NodeCatalogReportSchema)` to create a new message.
+ */
+export declare const NodeCatalogReportSchema: GenMessage<NodeCatalogReport>;
+/**
+ * @generated from message agentmesh.v1.TokenRevokeRequest
+ */
+export type TokenRevokeRequest = Message<"agentmesh.v1.TokenRevokeRequest"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+};
+/**
+ * Describes the message agentmesh.v1.TokenRevokeRequest.
+ * Use `create(TokenRevokeRequestSchema)` to create a new message.
+ */
+export declare const TokenRevokeRequestSchema: GenMessage<TokenRevokeRequest>;
+/**
+ * @generated from message agentmesh.v1.TokenRevokeResponse
+ */
+export type TokenRevokeResponse = Message<"agentmesh.v1.TokenRevokeResponse"> & {
+    /**
+     * @generated from field: bool success = 1;
+     */
+    success: boolean;
+    /**
+     * @generated from field: string error = 2;
+     */
+    error: string;
+};
+/**
+ * Describes the message agentmesh.v1.TokenRevokeResponse.
+ * Use `create(TokenRevokeResponseSchema)` to create a new message.
+ */
+export declare const TokenRevokeResponseSchema: GenMessage<TokenRevokeResponse>;
+/**
+ * BootstrapTokenCreateRequest is the body of POST /admin/bootstrap-tokens
+ * (admin bearer) and POST /user/bootstrap-tokens (mesh user).
+ *
+ * @generated from message agentmesh.v1.BootstrapTokenCreateRequest
+ */
+export type BootstrapTokenCreateRequest = Message<"agentmesh.v1.BootstrapTokenCreateRequest"> & {
+    /**
+     * Role the token enrolls into, e.g. "mesh:role:node". Required on the admin
+     * endpoint; the user endpoint defaults it to "mesh:role:node".
+     *
+     * @generated from field: string role = 1;
+     */
+    role: string;
+    /**
+     * User the token is issued on behalf of. Honored by the user endpoint
+     * only, and only for admins; defaults to the caller.
+     *
+     * @generated from field: string owner_id = 2;
+     */
+    ownerId: string;
+    /**
+     * How long the token stays valid; unset or non-positive means 24.
+     *
+     * @generated from field: int32 ttl_hours = 3;
+     */
+    ttlHours: number;
+    /**
+     * How many enrollments the token admits; unset or non-positive means 1.
+     *
+     * @generated from field: int32 max_usages = 4;
+     */
+    maxUsages: number;
+    /**
+     * Free-form operator note stored with the token.
+     *
+     * @generated from field: string description = 5;
+     */
+    description: string;
+    /**
+     * Copied onto every node the token enrolls: such a node may still refresh
+     * its credential after the control plane's signing key rotated past its
+     * grace period, on proof of possession of its own key alone. Admin-only,
+     * because a node that can always recover holds a credential that never
+     * expires.
+     *
+     * @generated from field: bool autonomous_recovery = 6;
+     */
+    autonomousRecovery: boolean;
+    /**
+     * Copied onto every node the token enrolls: such a node is forgotten
+     * soon after it falls silent (the control plane's
+     * --ephemeral-node-retention, an hour by default) instead of being kept
+     * for --node-retention. For members that come and go: a fleet in a scale
+     * test, a probe, a CI job.
+     *
+     * @generated from field: bool ephemeral = 7;
+     */
+    ephemeral: boolean;
+};
+/**
+ * Describes the message agentmesh.v1.BootstrapTokenCreateRequest.
+ * Use `create(BootstrapTokenCreateRequestSchema)` to create a new message.
+ */
+export declare const BootstrapTokenCreateRequestSchema: GenMessage<BootstrapTokenCreateRequest>;
+/**
+ * BootstrapTokenCreateResponse is returned (201) when a token is minted.
+ * token is the plaintext and is shown exactly once; the control plane keeps
+ * only its hash, which is also the id.
+ *
+ * @generated from message agentmesh.v1.BootstrapTokenCreateResponse
+ */
+export type BootstrapTokenCreateResponse = Message<"agentmesh.v1.BootstrapTokenCreateResponse"> & {
+    /**
+     * @generated from field: string id = 1;
+     */
+    id: string;
+    /**
+     * @generated from field: string token = 2;
+     */
+    token: string;
+    /**
+     * @generated from field: string role = 3;
+     */
+    role: string;
+    /**
+     * @generated from field: string owner_id = 4;
+     */
+    ownerId: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp expire_time = 5;
+     */
+    expireTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.BootstrapTokenCreateResponse.
+ * Use `create(BootstrapTokenCreateResponseSchema)` to create a new message.
+ */
+export declare const BootstrapTokenCreateResponseSchema: GenMessage<BootstrapTokenCreateResponse>;
+/**
+ * BootstrapToken is a minted token as operators list it.
+ *
+ * @generated from message agentmesh.v1.BootstrapToken
+ */
+export type BootstrapToken = Message<"agentmesh.v1.BootstrapToken"> & {
+    /**
+     * @generated from field: string id = 1;
+     */
+    id: string;
+    /**
+     * @generated from field: string role = 2;
+     */
+    role: string;
+    /**
+     * @generated from field: string owner_id = 3;
+     */
+    ownerId: string;
+    /**
+     * @generated from field: int32 max_usages = 4;
+     */
+    maxUsages: number;
+    /**
+     * @generated from field: int32 usages_count = 5;
+     */
+    usagesCount: number;
+    /**
+     * @generated from field: string description = 6;
+     */
+    description: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp create_time = 7;
+     */
+    createTime?: Timestamp | undefined;
+    /**
+     * @generated from field: google.protobuf.Timestamp expire_time = 8;
+     */
+    expireTime?: Timestamp | undefined;
+    /**
+     * Set when an operator revoked the token, which is distinct from expiry
+     * or exhausted usages. Unset means never revoked.
+     *
+     * @generated from field: google.protobuf.Timestamp revoke_time = 9;
+     */
+    revokeTime?: Timestamp | undefined;
+    /**
+     * @generated from field: bool autonomous_recovery = 10;
+     */
+    autonomousRecovery: boolean;
+    /**
+     * @generated from field: bool ephemeral = 11;
+     */
+    ephemeral: boolean;
+};
+/**
+ * Describes the message agentmesh.v1.BootstrapToken.
+ * Use `create(BootstrapTokenSchema)` to create a new message.
+ */
+export declare const BootstrapTokenSchema: GenMessage<BootstrapToken>;
+/**
+ * @generated from message agentmesh.v1.BootstrapTokenListResponse
+ */
+export type BootstrapTokenListResponse = Message<"agentmesh.v1.BootstrapTokenListResponse"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.BootstrapToken tokens = 1;
+     */
+    tokens: BootstrapToken[];
+};
+/**
+ * Describes the message agentmesh.v1.BootstrapTokenListResponse.
+ * Use `create(BootstrapTokenListResponseSchema)` to create a new message.
+ */
+export declare const BootstrapTokenListResponseSchema: GenMessage<BootstrapTokenListResponse>;
+/**
+ * EnrollmentRequest is a bootstrap enrollment awaiting or past an operator
+ * decision (see BootstrapEnrollRequest).
+ *
+ * @generated from message agentmesh.v1.EnrollmentRequest
+ */
+export type EnrollmentRequest = Message<"agentmesh.v1.EnrollmentRequest"> & {
+    /**
+     * @generated from field: string id = 1;
+     */
+    id: string;
+    /**
+     * @generated from field: string peer_id = 2;
+     */
+    peerId: string;
+    /**
+     * The bootstrap token the request was made with.
+     *
+     * @generated from field: string token_id = 3;
+     */
+    tokenId: string;
+    /**
+     * @generated from field: agentmesh.v1.EnrollmentStatus status = 4;
+     */
+    status: EnrollmentStatus;
+    /**
+     * Labels the node declared; approval attests them into its biscuit.
+     *
+     * @generated from field: map<string, string> labels = 5;
+     */
+    labels: {
+        [key: string]: string;
+    };
+    /**
+     * @generated from field: google.protobuf.Timestamp create_time = 6;
+     */
+    createTime?: Timestamp | undefined;
+    /**
+     * Unset while the request is pending.
+     *
+     * @generated from field: google.protobuf.Timestamp resolve_time = 7;
+     */
+    resolveTime?: Timestamp | undefined;
+    /**
+     * @generated from field: string resolved_by = 8;
+     */
+    resolvedBy: string;
+};
+/**
+ * Describes the message agentmesh.v1.EnrollmentRequest.
+ * Use `create(EnrollmentRequestSchema)` to create a new message.
+ */
+export declare const EnrollmentRequestSchema: GenMessage<EnrollmentRequest>;
+/**
+ * @generated from message agentmesh.v1.EnrollmentRequestListResponse
+ */
+export type EnrollmentRequestListResponse = Message<"agentmesh.v1.EnrollmentRequestListResponse"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.EnrollmentRequest requests = 1;
+     */
+    requests: EnrollmentRequest[];
+};
+/**
+ * Describes the message agentmesh.v1.EnrollmentRequestListResponse.
+ * Use `create(EnrollmentRequestListResponseSchema)` to create a new message.
+ */
+export declare const EnrollmentRequestListResponseSchema: GenMessage<EnrollmentRequestListResponse>;
+/**
+ * User is a human identity known to the mesh.
+ *
+ * @generated from message agentmesh.v1.User
+ */
+export type User = Message<"agentmesh.v1.User"> & {
+    /**
+     * The identity provider's subject.
+     *
+     * @generated from field: string id = 1;
+     */
+    id: string;
+    /**
+     * @generated from field: string issuer = 2;
+     */
+    issuer: string;
+    /**
+     * @generated from field: string email = 3;
+     */
+    email: string;
+    /**
+     * "admin" or "user".
+     *
+     * @generated from field: string role = 4;
+     */
+    role: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp create_time = 5;
+     */
+    createTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.User.
+ * Use `create(UserSchema)` to create a new message.
+ */
+export declare const UserSchema: GenMessage<User>;
+/**
+ * EnrolledNode is a member's enrollment record without its credential.
+ *
+ * @generated from message agentmesh.v1.EnrolledNode
+ */
+export type EnrolledNode = Message<"agentmesh.v1.EnrolledNode"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+    /**
+     * @generated from field: string role = 2;
+     */
+    role: string;
+    /**
+     * How the node enrolled, e.g. "oidc" or "bootstrap".
+     *
+     * @generated from field: string enrollment_type = 3;
+     */
+    enrollmentType: string;
+    /**
+     * The identity provider's claims as stored at enrollment. Admin-only.
+     *
+     * @generated from field: string claims_json = 4;
+     */
+    claimsJson: string;
+    /**
+     * @generated from field: string owner_id = 5;
+     */
+    ownerId: string;
+    /**
+     * @generated from field: map<string, string> labels = 6;
+     */
+    labels: {
+        [key: string]: string;
+    };
+    /**
+     * @generated from field: google.protobuf.Timestamp enroll_time = 7;
+     */
+    enrollTime?: Timestamp | undefined;
+    /**
+     * When the enrollment session ends; unset means it does not expire.
+     *
+     * @generated from field: google.protobuf.Timestamp expire_time = 8;
+     */
+    expireTime?: Timestamp | undefined;
+    /**
+     * @generated from field: bool banned = 9;
+     */
+    banned: boolean;
+    /**
+     * @generated from field: bool autonomous_recovery = 10;
+     */
+    autonomousRecovery: boolean;
+    /**
+     * The node was enrolled by an ephemeral token and is forgotten soon after
+     * it falls silent.
+     *
+     * @generated from field: bool ephemeral = 11;
+     */
+    ephemeral: boolean;
+};
+/**
+ * Describes the message agentmesh.v1.EnrolledNode.
+ * Use `create(EnrolledNodeSchema)` to create a new message.
+ */
+export declare const EnrolledNodeSchema: GenMessage<EnrolledNode>;
+/**
+ * RouterLease is a router's current registration with the control plane.
+ *
+ * @generated from message agentmesh.v1.RouterLease
+ */
+export type RouterLease = Message<"agentmesh.v1.RouterLease"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+    /**
+     * Multiaddrs, `/p2p/<peer id>` suffixed.
+     *
+     * @generated from field: repeated string addresses = 2;
+     */
+    addresses: string[];
+    /**
+     * @generated from field: google.protobuf.Timestamp last_renewal_time = 3;
+     */
+    lastRenewalTime?: Timestamp | undefined;
+    /**
+     * @generated from field: google.protobuf.Timestamp expire_time = 4;
+     */
+    expireTime?: Timestamp | undefined;
+    /**
+     * @generated from field: repeated string connected_peers = 5;
+     */
+    connectedPeers: string[];
+    /**
+     * @generated from field: int32 dht_size = 6;
+     */
+    dhtSize: number;
+};
+/**
+ * Describes the message agentmesh.v1.RouterLease.
+ * Use `create(RouterLeaseSchema)` to create a new message.
+ */
+export declare const RouterLeaseSchema: GenMessage<RouterLease>;
+/**
+ * NodeServices is the services one node last reported (see
+ * NodeCatalogReport).
+ *
+ * @generated from message agentmesh.v1.NodeServices
+ */
+export type NodeServices = Message<"agentmesh.v1.NodeServices"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.ServiceInfo services = 1;
+     */
+    services: ServiceInfo[];
+    /**
+     * @generated from field: google.protobuf.Timestamp report_time = 2;
+     */
+    reportTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.NodeServices.
+ * Use `create(NodeServicesSchema)` to create a new message.
+ */
+export declare const NodeServicesSchema: GenMessage<NodeServices>;
+/**
+ * AdminStatusResponse answers GET /admin/status: everything the console
+ * shows an administrator, except expired nodes (see GET /user/nodes).
+ *
+ * @generated from message agentmesh.v1.AdminStatusResponse
+ */
+export type AdminStatusResponse = Message<"agentmesh.v1.AdminStatusResponse"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.User users = 1;
+     */
+    users: User[];
+    /**
+     * @generated from field: repeated agentmesh.v1.RouterLease active_routers = 2;
+     */
+    activeRouters: RouterLease[];
+    /**
+     * @generated from field: repeated agentmesh.v1.EnrolledNode enrolled_nodes = 3;
+     */
+    enrolledNodes: EnrolledNode[];
+    /**
+     * @generated from field: repeated agentmesh.v1.EnrollmentRequest enrollment_requests = 4;
+     */
+    enrollmentRequests: EnrollmentRequest[];
+    /**
+     * @generated from field: repeated agentmesh.v1.BootstrapToken bootstrap_tokens = 5;
+     */
+    bootstrapTokens: BootstrapToken[];
+    /**
+     * @generated from field: agentmesh.v1.PolicyConfig policy = 6;
+     */
+    policy?: PolicyConfig | undefined;
+    /**
+     * Keyed by the reporting node's peer ID; admitted nodes only.
+     *
+     * @generated from field: map<string, agentmesh.v1.NodeServices> node_catalog = 7;
+     */
+    nodeCatalog: {
+        [key: string]: NodeServices;
+    };
+};
+/**
+ * Describes the message agentmesh.v1.AdminStatusResponse.
+ * Use `create(AdminStatusResponseSchema)` to create a new message.
+ */
+export declare const AdminStatusResponseSchema: GenMessage<AdminStatusResponse>;
+/**
+ * UserStatusResponse answers GET /user/status: the caller and what it owns,
+ * except expired nodes (see GET /user/nodes). The router fleet and the mesh
+ * policy describe the whole mesh and are set for an administrator only.
+ *
+ * @generated from message agentmesh.v1.UserStatusResponse
+ */
+export type UserStatusResponse = Message<"agentmesh.v1.UserStatusResponse"> & {
+    /**
+     * @generated from field: agentmesh.v1.User user = 1;
+     */
+    user?: User | undefined;
+    /**
+     * @generated from field: repeated agentmesh.v1.EnrolledNode enrolled_nodes = 2;
+     */
+    enrolledNodes: EnrolledNode[];
+    /**
+     * @generated from field: repeated agentmesh.v1.BootstrapToken bootstrap_tokens = 3;
+     */
+    bootstrapTokens: BootstrapToken[];
+    /**
+     * @generated from field: repeated agentmesh.v1.RouterLease active_routers = 4;
+     */
+    activeRouters: RouterLease[];
+    /**
+     * @generated from field: agentmesh.v1.PolicyConfig policy = 5;
+     */
+    policy?: PolicyConfig | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.UserStatusResponse.
+ * Use `create(UserStatusResponseSchema)` to create a new message.
+ */
+export declare const UserStatusResponseSchema: GenMessage<UserStatusResponse>;
+/**
+ * NodeListResponse answers GET /user/nodes: enrolled nodes, newest enrollment
+ * first, page_size (default 50, at most 200) at a time. state (admitted,
+ * expired or banned, repeatable) and role narrow the list. An administrator
+ * sees every owner's nodes and may pick one with owner_id; a user sees its own.
+ *
+ * @generated from message agentmesh.v1.NodeListResponse
+ */
+export type NodeListResponse = Message<"agentmesh.v1.NodeListResponse"> & {
+    /**
+     * @generated from field: repeated agentmesh.v1.EnrolledNode nodes = 1;
+     */
+    nodes: EnrolledNode[];
+    /**
+     * Pass as page_token for the next page; empty on the last page.
+     *
+     * @generated from field: string next_page_token = 2;
+     */
+    nextPageToken: string;
+};
+/**
+ * Describes the message agentmesh.v1.NodeListResponse.
+ * Use `create(NodeListResponseSchema)` to create a new message.
+ */
+export declare const NodeListResponseSchema: GenMessage<NodeListResponse>;
+/**
+ * @generated from message agentmesh.v1.IdentityEvidenceResponse
+ */
+export type IdentityEvidenceResponse = Message<"agentmesh.v1.IdentityEvidenceResponse"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+    /**
+     * @generated from field: bytes biscuit = 2;
+     */
+    biscuit: Uint8Array;
+    /**
+     * @generated from field: google.protobuf.Timestamp biscuit_expire_time = 3;
+     */
+    biscuitExpireTime?: Timestamp | undefined;
+    /**
+     * @generated from field: string control_plane_url = 4;
+     */
+    controlPlaneUrl: string;
+    /**
+     * Ed25519 SPKI DER
+     *
+     * @generated from field: repeated bytes trusted_control_plane_keys = 5;
+     */
+    trustedControlPlaneKeys: Uint8Array[];
+    /**
+     * @generated from field: google.protobuf.Timestamp check_time = 6;
+     */
+    checkTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.IdentityEvidenceResponse.
+ * Use `create(IdentityEvidenceResponseSchema)` to create a new message.
+ */
+export declare const IdentityEvidenceResponseSchema: GenMessage<IdentityEvidenceResponse>;
+/**
+ * @generated from message agentmesh.v1.PeerEvidenceResponse
+ */
+export type PeerEvidenceResponse = Message<"agentmesh.v1.PeerEvidenceResponse"> & {
+    /**
+     * @generated from field: string peer_id = 1;
+     */
+    peerId: string;
+    /**
+     * @generated from field: bytes biscuit = 2;
+     */
+    biscuit: Uint8Array;
+    /**
+     * Ed25519 SPKI DER, member of the trusted set
+     *
+     * @generated from field: bytes verifying_key = 3;
+     */
+    verifyingKey: Uint8Array;
+    /**
+     * @generated from field: repeated string roles = 4;
+     */
+    roles: string[];
+    /**
+     * @generated from field: map<string, string> labels = 5;
+     */
+    labels: {
+        [key: string]: string;
+    };
+    /**
+     * @generated from field: google.protobuf.Timestamp expire_time = 6;
+     */
+    expireTime?: Timestamp | undefined;
+    /**
+     * hex
+     *
+     * @generated from field: repeated string revocation_ids = 7;
+     */
+    revocationIds: string[];
+    /**
+     * @generated from field: google.protobuf.Timestamp check_time = 8;
+     */
+    checkTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.PeerEvidenceResponse.
+ * Use `create(PeerEvidenceResponseSchema)` to create a new message.
+ */
+export declare const PeerEvidenceResponseSchema: GenMessage<PeerEvidenceResponse>;
+/**
+ * @generated from message agentmesh.v1.MemberCredential
+ */
+export type MemberCredential = Message<"agentmesh.v1.MemberCredential"> & {
+    /**
+     * Base URL of the control plane that minted the biscuit.
+     *
+     * @generated from field: string control_plane_url = 1;
+     */
+    controlPlaneUrl: string;
+    /**
+     * The member's biscuit.
+     *
+     * @generated from field: bytes biscuit = 2;
+     */
+    biscuit: Uint8Array;
+    /**
+     * When the biscuit expires.
+     *
+     * @generated from field: google.protobuf.Timestamp expire_time = 3;
+     */
+    expireTime?: Timestamp | undefined;
+    /**
+     * Control plane signing keys trusted now; a rotation keeps several valid.
+     *
+     * @generated from field: repeated agentmesh.v1.TrustedSigningKey trusted_keys = 4;
+     */
+    trustedKeys: TrustedSigningKey[];
+    /**
+     * The keys trusted when the biscuit was issued. A key trusted now that is
+     * absent here means a rotation happened since: the biscuit is signed by a
+     * retiring key and must be refreshed before that key leaves its grace
+     * period.
+     *
+     * @generated from field: repeated bytes issued_under_keys = 5;
+     */
+    issuedUnderKeys: Uint8Array[];
+    /**
+     * Router multiaddrs, `/p2p/<peer id>` suffixed.
+     *
+     * @generated from field: repeated string router_addresses = 6;
+     */
+    routerAddresses: string[];
+    /**
+     * The session that renews an identity enrolled through the mesh's
+     * identity provider. Unset for a member enrolled with a bootstrap token.
+     *
+     * @generated from field: agentmesh.v1.OIDCSession oidc_session = 7;
+     */
+    oidcSession?: OIDCSession | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.MemberCredential.
+ * Use `create(MemberCredentialSchema)` to create a new message.
+ */
+export declare const MemberCredentialSchema: GenMessage<MemberCredential>;
+/**
+ * @generated from message agentmesh.v1.TrustedSigningKey
+ */
+export type TrustedSigningKey = Message<"agentmesh.v1.TrustedSigningKey"> & {
+    /**
+     * Raw ed25519 public key.
+     *
+     * @generated from field: bytes public_key = 1;
+     */
+    publicKey: Uint8Array;
+    /**
+     * When the member first learned the key. A key rotated out is dropped a
+     * grace period after this; unset means unknown and is read as now.
+     *
+     * @generated from field: google.protobuf.Timestamp receive_time = 2;
+     */
+    receiveTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.TrustedSigningKey.
+ * Use `create(TrustedSigningKeySchema)` to create a new message.
+ */
+export declare const TrustedSigningKeySchema: GenMessage<TrustedSigningKey>;
+/**
+ * @generated from message agentmesh.v1.OIDCSession
+ */
+export type OIDCSession = Message<"agentmesh.v1.OIDCSession"> & {
+    /**
+     * @generated from field: string issuer = 1;
+     */
+    issuer: string;
+    /**
+     * @generated from field: string client_id = 2;
+     */
+    clientId: string;
+    /**
+     * @generated from field: string audience = 3;
+     */
+    audience: string;
+    /**
+     * @generated from field: string refresh_token = 4;
+     */
+    refreshToken: string;
+};
+/**
+ * Describes the message agentmesh.v1.OIDCSession.
+ * Use `create(OIDCSessionSchema)` to create a new message.
+ */
+export declare const OIDCSessionSchema: GenMessage<OIDCSession>;
+/**
+ * TaskAuthorizationRule narrows a credential's authority for a specific task or
+ * sub-agent hop. Across multiple appended blocks (1..k), semantics are strict
+ * set intersection (logical AND): a request is permitted only if it is allowed
+ * by the standing mesh policy AND is before every block's expire_time AND
+ * matches at least one TaskRule in EVERY appended TaskAuthorizationRule block.
+ *
+ * @generated from message agentmesh.v1.TaskAuthorizationRule
+ */
+export type TaskAuthorizationRule = Message<"agentmesh.v1.TaskAuthorizationRule"> & {
+    /**
+     * @generated from field: string name = 1;
+     */
+    name: string;
+    /**
+     * @generated from field: string display_name = 2;
+     */
+    displayName: string;
+    /**
+     * Positive allow-list of rules for this hop. Empty rules list denies everything.
+     *
+     * @generated from field: repeated agentmesh.v1.TaskRule rules = 3;
+     */
+    rules: TaskRule[];
+    /**
+     * Optional shorter expiration for this task hop. Effective token expiry is
+     * the minimum across the authority block's expiration() fact and every
+     * appended block's expire_time.
+     *
+     * @generated from field: google.protobuf.Timestamp expire_time = 4;
+     */
+    expireTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message agentmesh.v1.TaskAuthorizationRule.
+ * Use `create(TaskAuthorizationRuleSchema)` to create a new message.
+ */
+export declare const TaskAuthorizationRuleSchema: GenMessage<TaskAuthorizationRule>;
+/**
+ * @generated from message agentmesh.v1.TaskRule
+ */
+export type TaskRule = Message<"agentmesh.v1.TaskRule"> & {
+    /**
+     * @generated from field: string description = 1;
+     */
+    description: string;
+    /**
+     * Allowed mesh services (e.g., "mcp://bigquery", "inference://gemini.*",
+     * "egress://bigquery.googleapis.com"). Uses the dot-anchored grammar of
+     * api.ValidateServiceFormat ("*", "<type>://*", "<type>://*.<suffix>",
+     * "<type>://<prefix>.*", "<type>://<exact>"). Required (non-empty).
+     *
+     * @generated from field: repeated string allowed_services = 2;
+     */
+    allowedServices: string[];
+    /**
+     * Optional operation-level allow-list. If set, the request must also match
+     * the specified MCP tools, HTTP methods/paths, or cloud permissions.
+     *
+     * @generated from field: agentmesh.v1.TaskOperation operation = 3;
+     */
+    operation?: TaskOperation | undefined;
+    /**
+     * Optional allowed upstream resource names (e.g. CRM resource prefixes
+     * "//bigquery.googleapis.com/projects/my-proj/datasets/sales_2026").
+     * Opaque to the wire PEP; consumed by CloudTokenExchanger at egress.
+     *
+     * @generated from field: repeated string allowed_resources = 4;
+     */
+    allowedResources: string[];
+};
+/**
+ * Describes the message agentmesh.v1.TaskRule.
+ * Use `create(TaskRuleSchema)` to create a new message.
+ */
+export declare const TaskRuleSchema: GenMessage<TaskRule>;
+/**
+ * @generated from message agentmesh.v1.TaskOperation
+ */
+export type TaskOperation = Message<"agentmesh.v1.TaskOperation"> & {
+    /**
+     * Allowed MCP tool names (enforced by the PEP on mcp:// tools/call).
+     *
+     * @generated from field: repeated string allowed_tools = 1;
+     */
+    allowedTools: string[];
+    /**
+     * Allowed HTTP methods (e.g. ["GET", "POST"]), validated with httpMethodSyntax.
+     *
+     * @generated from field: repeated string allowed_methods = 2;
+     */
+    allowedMethods: string[];
+    /**
+     * Allowed HTTP path patterns ("/exact" or "/prefix/*"), validated with
+     * validateHTTPGrantPath.
+     *
+     * @generated from field: repeated string allowed_paths = 3;
+     */
+    allowedPaths: string[];
+    /**
+     * Allowed cloud IAM permissions (e.g. "bigquery.googleapis.com/datasets.get").
+     * Opaque to the wire PEP; consumed by CloudTokenExchanger at egress.
+     *
+     * @generated from field: repeated string allowed_permissions = 4;
+     */
+    allowedPermissions: string[];
+};
+/**
+ * Describes the message agentmesh.v1.TaskOperation.
+ * Use `create(TaskOperationSchema)` to create a new message.
+ */
+export declare const TaskOperationSchema: GenMessage<TaskOperation>;
+/**
+ * TokenExchangeRequest is the body of POST /token/exchange on the control
+ * plane: an enrolled agentmesh-node (authenticated via its own Biscuit in
+ * Authorization: Bearer and proof of possession below) exchanges a caller's
+ * platform JWT (OIDC ID token, K8s projected SA JWT, or SPIFFE JWT-SVID) into
+ * a short-lived Delegated Session Biscuit bound to the calling node's
+ * transport channel (client_peer_id + actor_node, without node()).
+ *
+ * @generated from message agentmesh.v1.TokenExchangeRequest
+ */
+export type TokenExchangeRequest = Message<"agentmesh.v1.TokenExchangeRequest"> & {
+    /**
+     * The subject's platform JWT to verify against the control plane's OIDC
+     * providers and allowed audiences.
+     *
+     * @generated from field: string subject_token = 1;
+     */
+    subjectToken: string;
+    /**
+     * Optional initial task narrowing to append as block 1 on the minted
+     * Biscuit.
+     *
+     * @generated from field: agentmesh.v1.TaskAuthorizationRule task_rule = 2;
+     */
+    taskRule?: TaskAuthorizationRule | undefined;
+    /**
+     * If true, the minted Biscuit is sealed (b.Seal()) before returning so
+     * downstream holders cannot append further blocks.
+     *
+     * @generated from field: bool seal = 3;
+     */
+    seal: boolean;
+    /**
+     * Proof of possession of the calling node's enrolled key:
+     * challenge_unix_ms is the caller's clock in unix milliseconds and
+     * challenge_signature signs the UTF-8 bytes of
+     * "mesh:token-exchange:<peer_id>:<challenge_unix_ms>".
+     *
+     * @generated from field: int64 challenge_unix_ms = 4;
+     */
+    challengeUnixMs: bigint;
+    /**
+     * @generated from field: bytes challenge_signature = 5;
+     */
+    challengeSignature: Uint8Array;
+};
+/**
+ * Describes the message agentmesh.v1.TokenExchangeRequest.
+ * Use `create(TokenExchangeRequestSchema)` to create a new message.
+ */
+export declare const TokenExchangeRequestSchema: GenMessage<TokenExchangeRequest>;
+/**
+ * @generated from message agentmesh.v1.TokenExchangeResponse
+ */
+export type TokenExchangeResponse = Message<"agentmesh.v1.TokenExchangeResponse"> & {
+    /**
+     * @generated from field: bytes biscuit_token = 1;
+     */
+    biscuitToken: Uint8Array;
+    /**
+     * @generated from field: google.protobuf.Timestamp expire_time = 2;
+     */
+    expireTime?: Timestamp | undefined;
+    /**
+     * @generated from field: repeated string roles = 3;
+     */
+    roles: string[];
+    /**
+     * @generated from field: string subject = 4;
+     */
+    subject: string;
+};
+/**
+ * Describes the message agentmesh.v1.TokenExchangeResponse.
+ * Use `create(TokenExchangeResponseSchema)` to create a new message.
+ */
+export declare const TokenExchangeResponseSchema: GenMessage<TokenExchangeResponse>;
+/**
+ * STSTokenRequest is the body of POST /sts/token on the control plane: an
+ * enrolled egress agentmesh-node asks the control plane (acting as OIDC issuer) to
+ * verify a caller's Biscuit and TaskAuthorizationRule chain for an egress
+ * destination and mint a short-lived ES256 border JWT for cloud STS federation.
+ *
+ * @generated from message agentmesh.v1.STSTokenRequest
+ */
+export type STSTokenRequest = Message<"agentmesh.v1.STSTokenRequest"> & {
+    /**
+     * The caller's Biscuit token (authority block + any tar_block chain).
+     *
+     * @generated from field: bytes biscuit = 1;
+     */
+    biscuit: Uint8Array;
+    /**
+     * The egress destination hostname (e.g. "bigquery.googleapis.com").
+     *
+     * @generated from field: string destination = 2;
+     */
+    destination: string;
+    /**
+     * Optional explicit audience for the border JWT when not derived from the
+     * destination's broker configuration.
+     *
+     * @generated from field: string audience = 3;
+     */
+    audience: string;
+    /**
+     * Proof of possession of the calling egress node's enrolled key:
+     * challenge_unix_ms is the caller's clock in unix milliseconds and
+     * challenge_signature signs the UTF-8 bytes of
+     * "mesh:sts-token:<peer_id>:<challenge_unix_ms>".
+     *
+     * @generated from field: int64 challenge_unix_ms = 4;
+     */
+    challengeUnixMs: bigint;
+    /**
+     * @generated from field: bytes challenge_signature = 5;
+     */
+    challengeSignature: Uint8Array;
+};
+/**
+ * Describes the message agentmesh.v1.STSTokenRequest.
+ * Use `create(STSTokenRequestSchema)` to create a new message.
+ */
+export declare const STSTokenRequestSchema: GenMessage<STSTokenRequest>;
+/**
+ * @generated from message agentmesh.v1.STSTokenResponse
+ */
+export type STSTokenResponse = Message<"agentmesh.v1.STSTokenResponse"> & {
+    /**
+     * @generated from field: string jwt = 1;
+     */
+    jwt: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp expire_time = 2;
+     */
+    expireTime?: Timestamp | undefined;
+    /**
+     * @generated from field: string subject = 3;
+     */
+    subject: string;
+    /**
+     * @generated from field: repeated string roles = 4;
+     */
+    roles: string[];
+    /**
+     * @generated from field: string task_name = 5;
+     */
+    taskName: string;
+};
+/**
+ * Describes the message agentmesh.v1.STSTokenResponse.
+ * Use `create(STSTokenResponseSchema)` to create a new message.
+ */
+export declare const STSTokenResponseSchema: GenMessage<STSTokenResponse>;
+/**
+ * RevocationsResponse answers GET /revocations on the control plane: the set of
+ * revoked Biscuit authority revocation IDs (hex-encoded RevocationIds()[0]) and
+ * banned peer IDs.
+ *
+ * @generated from message agentmesh.v1.RevocationsResponse
+ */
+export type RevocationsResponse = Message<"agentmesh.v1.RevocationsResponse"> & {
+    /**
+     * @generated from field: repeated string revocation_ids = 1;
+     */
+    revocationIds: string[];
+    /**
+     * @generated from field: repeated string banned_peer_ids = 2;
+     */
+    bannedPeerIds: string[];
+};
+/**
+ * Describes the message agentmesh.v1.RevocationsResponse.
+ * Use `create(RevocationsResponseSchema)` to create a new message.
+ */
+export declare const RevocationsResponseSchema: GenMessage<RevocationsResponse>;
+/**
+ * @generated from enum agentmesh.v1.EnrollmentStatus
+ */
+export declare enum EnrollmentStatus {
+    /**
+     * @generated from enum value: ENROLLMENT_STATUS_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: ENROLLMENT_STATUS_PENDING = 1;
+     */
+    PENDING = 1,
+    /**
+     * @generated from enum value: ENROLLMENT_STATUS_APPROVED = 2;
+     */
+    APPROVED = 2,
+    /**
+     * @generated from enum value: ENROLLMENT_STATUS_REJECTED = 3;
+     */
+    REJECTED = 3
+}
+/**
+ * Describes the enum agentmesh.v1.EnrollmentStatus.
+ */
+export declare const EnrollmentStatusSchema: GenEnum<EnrollmentStatus>;
+/**
+ * @generated from enum agentmesh.v1.ServiceType
+ */
+export declare enum ServiceType {
+    /**
+     * @generated from enum value: SERVICE_TYPE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: SERVICE_TYPE_MCP = 1;
+     */
+    MCP = 1,
+    /**
+     * @generated from enum value: SERVICE_TYPE_INFERENCE = 2;
+     */
+    INFERENCE = 2,
+    /**
+     * @generated from enum value: SERVICE_TYPE_A2A = 3;
+     */
+    A2A = 3,
+    /**
+     * A destination outside the mesh, reached through a node that enforces
+     * policy on it. The service name is the destination hostname, so a grant
+     * reads egress://api.github.com and the request fact
+     * service("egress", "api.github.com").
+     *
+     * @generated from enum value: SERVICE_TYPE_EGRESS = 4;
+     */
+    EGRESS = 4
+}
+/**
+ * Describes the enum agentmesh.v1.ServiceType.
+ */
+export declare const ServiceTypeSchema: GenEnum<ServiceType>;
+/**
+ * @generated from enum agentmesh.v1.EgressMode
+ */
+export declare enum EgressMode {
+    /**
+     * @generated from enum value: EGRESS_MODE_HTTP = 0;
+     */
+    HTTP = 0,
+    /**
+     * @generated from enum value: EGRESS_MODE_TCP = 1;
+     */
+    TCP = 1
+}
+/**
+ * Describes the enum agentmesh.v1.EgressMode.
+ */
+export declare const EgressModeSchema: GenEnum<EgressMode>;
+/**
+ * @generated from enum agentmesh.v1.ResponseInspection
+ */
+export declare enum ResponseInspection {
+    /**
+     * @generated from enum value: RESPONSE_INSPECTION_BUFFERED = 0;
+     */
+    BUFFERED = 0,
+    /**
+     * @generated from enum value: RESPONSE_INSPECTION_REQUEST_ONLY = 1;
+     */
+    REQUEST_ONLY = 1
+}
+/**
+ * Describes the enum agentmesh.v1.ResponseInspection.
+ */
+export declare const ResponseInspectionSchema: GenEnum<ResponseInspection>;