@githolon/dsl 0.108.6 → 0.110.0

package/dart_types/lib/src/proto/nomos/runtime/v2/identity_desk.pb.dart

@@ -0,0 +1,845 @@
+// This is a generated file - do not edit.
+//
+// Generated from nomos/runtime/v2/identity_desk.proto.
+
+// @dart = 3.3
+
+// ignore_for_file: annotate_overrides, camel_case_types, comment_references
+// ignore_for_file: constant_identifier_names
+// ignore_for_file: curly_braces_in_flow_control_structures
+// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
+// ignore_for_file: non_constant_identifier_names
+
+import 'dart:core' as $core;
+
+import 'package:fixnum/fixnum.dart' as $fixnum;
+import 'package:protobuf/protobuf.dart' as $pb;
+
+import '../../kernel/v1/kernel.pb.dart' as $0;
+
+export 'package:protobuf/protobuf.dart' show GeneratedMessageGenericExtensions;
+
+/// Typed RFC 7517 material published by one identity-provider-root workspace.
+/// These are closed protocol values, not a JSON document or generic map.
+class IdentityProviderKey extends $pb.GeneratedMessage {
+  factory IdentityProviderKey({
+    $fixnum.Int64? ordinal,
+    $core.String? kty,
+    $core.String? kid,
+    $core.String? alg,
+    $core.String? use,
+    $core.String? crv,
+    $core.String? x,
+    $core.String? y,
+    $core.String? n,
+    $core.String? e,
+    $core.Iterable<$core.String>? keyOps,
+  }) {
+    final result = create();
+    if (ordinal != null) result.ordinal = ordinal;
+    if (kty != null) result.kty = kty;
+    if (kid != null) result.kid = kid;
+    if (alg != null) result.alg = alg;
+    if (use != null) result.use = use;
+    if (crv != null) result.crv = crv;
+    if (x != null) result.x = x;
+    if (y != null) result.y = y;
+    if (n != null) result.n = n;
+    if (e != null) result.e = e;
+    if (keyOps != null) result.keyOps.addAll(keyOps);
+    return result;
+  }
+
+  IdentityProviderKey._();
+
+  factory IdentityProviderKey.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory IdentityProviderKey.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'IdentityProviderKey',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.runtime.v2'),
+      createEmptyInstance: create)
+    ..a<$fixnum.Int64>(1, _omitFieldNames ? '' : 'ordinal', $pb.PbFieldType.OU6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..aOS(2, _omitFieldNames ? '' : 'kty')
+    ..aOS(3, _omitFieldNames ? '' : 'kid')
+    ..aOS(4, _omitFieldNames ? '' : 'alg')
+    ..aOS(5, _omitFieldNames ? '' : 'use')
+    ..aOS(6, _omitFieldNames ? '' : 'crv')
+    ..aOS(7, _omitFieldNames ? '' : 'x')
+    ..aOS(8, _omitFieldNames ? '' : 'y')
+    ..aOS(9, _omitFieldNames ? '' : 'n')
+    ..aOS(10, _omitFieldNames ? '' : 'e')
+    ..pPS(11, _omitFieldNames ? '' : 'keyOps')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderKey clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderKey copyWith(void Function(IdentityProviderKey) updates) =>
+      super.copyWith((message) => updates(message as IdentityProviderKey))
+          as IdentityProviderKey;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderKey create() => IdentityProviderKey._();
+  @$core.override
+  IdentityProviderKey createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderKey getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<IdentityProviderKey>(create);
+  static IdentityProviderKey? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $fixnum.Int64 get ordinal => $_getI64(0);
+  @$pb.TagNumber(1)
+  set ordinal($fixnum.Int64 value) => $_setInt64(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasOrdinal() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearOrdinal() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get kty => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set kty($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasKty() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearKty() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.String get kid => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set kid($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasKid() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearKid() => $_clearField(3);
+
+  @$pb.TagNumber(4)
+  $core.String get alg => $_getSZ(3);
+  @$pb.TagNumber(4)
+  set alg($core.String value) => $_setString(3, value);
+  @$pb.TagNumber(4)
+  $core.bool hasAlg() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearAlg() => $_clearField(4);
+
+  @$pb.TagNumber(5)
+  $core.String get use => $_getSZ(4);
+  @$pb.TagNumber(5)
+  set use($core.String value) => $_setString(4, value);
+  @$pb.TagNumber(5)
+  $core.bool hasUse() => $_has(4);
+  @$pb.TagNumber(5)
+  void clearUse() => $_clearField(5);
+
+  @$pb.TagNumber(6)
+  $core.String get crv => $_getSZ(5);
+  @$pb.TagNumber(6)
+  set crv($core.String value) => $_setString(5, value);
+  @$pb.TagNumber(6)
+  $core.bool hasCrv() => $_has(5);
+  @$pb.TagNumber(6)
+  void clearCrv() => $_clearField(6);
+
+  @$pb.TagNumber(7)
+  $core.String get x => $_getSZ(6);
+  @$pb.TagNumber(7)
+  set x($core.String value) => $_setString(6, value);
+  @$pb.TagNumber(7)
+  $core.bool hasX() => $_has(6);
+  @$pb.TagNumber(7)
+  void clearX() => $_clearField(7);
+
+  @$pb.TagNumber(8)
+  $core.String get y => $_getSZ(7);
+  @$pb.TagNumber(8)
+  set y($core.String value) => $_setString(7, value);
+  @$pb.TagNumber(8)
+  $core.bool hasY() => $_has(7);
+  @$pb.TagNumber(8)
+  void clearY() => $_clearField(8);
+
+  @$pb.TagNumber(9)
+  $core.String get n => $_getSZ(8);
+  @$pb.TagNumber(9)
+  set n($core.String value) => $_setString(8, value);
+  @$pb.TagNumber(9)
+  $core.bool hasN() => $_has(8);
+  @$pb.TagNumber(9)
+  void clearN() => $_clearField(9);
+
+  @$pb.TagNumber(10)
+  $core.String get e => $_getSZ(9);
+  @$pb.TagNumber(10)
+  set e($core.String value) => $_setString(9, value);
+  @$pb.TagNumber(10)
+  $core.bool hasE() => $_has(9);
+  @$pb.TagNumber(10)
+  void clearE() => $_clearField(10);
+
+  @$pb.TagNumber(11)
+  $pb.PbList<$core.String> get keyOps => $_getList(10);
+}
+
+class IdentityProviderCertificate extends $pb.GeneratedMessage {
+  factory IdentityProviderCertificate({
+    $fixnum.Int64? keyOrdinal,
+    $fixnum.Int64? certificateOrdinal,
+    $core.List<$core.int>? der,
+  }) {
+    final result = create();
+    if (keyOrdinal != null) result.keyOrdinal = keyOrdinal;
+    if (certificateOrdinal != null)
+      result.certificateOrdinal = certificateOrdinal;
+    if (der != null) result.der = der;
+    return result;
+  }
+
+  IdentityProviderCertificate._();
+
+  factory IdentityProviderCertificate.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory IdentityProviderCertificate.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'IdentityProviderCertificate',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.runtime.v2'),
+      createEmptyInstance: create)
+    ..a<$fixnum.Int64>(
+        1, _omitFieldNames ? '' : 'keyOrdinal', $pb.PbFieldType.OU6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..a<$fixnum.Int64>(
+        2, _omitFieldNames ? '' : 'certificateOrdinal', $pb.PbFieldType.OU6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..a<$core.List<$core.int>>(
+        3, _omitFieldNames ? '' : 'der', $pb.PbFieldType.OY)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderCertificate clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderCertificate copyWith(
+          void Function(IdentityProviderCertificate) updates) =>
+      super.copyWith(
+              (message) => updates(message as IdentityProviderCertificate))
+          as IdentityProviderCertificate;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderCertificate create() =>
+      IdentityProviderCertificate._();
+  @$core.override
+  IdentityProviderCertificate createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderCertificate getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<IdentityProviderCertificate>(create);
+  static IdentityProviderCertificate? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $fixnum.Int64 get keyOrdinal => $_getI64(0);
+  @$pb.TagNumber(1)
+  set keyOrdinal($fixnum.Int64 value) => $_setInt64(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasKeyOrdinal() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearKeyOrdinal() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $fixnum.Int64 get certificateOrdinal => $_getI64(1);
+  @$pb.TagNumber(2)
+  set certificateOrdinal($fixnum.Int64 value) => $_setInt64(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasCertificateOrdinal() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearCertificateOrdinal() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.List<$core.int> get der => $_getN(2);
+  @$pb.TagNumber(3)
+  set der($core.List<$core.int> value) => $_setBytes(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasDer() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearDer() => $_clearField(3);
+}
+
+/// One immutable, portable set of declared reads from an identity-provider-root
+/// workspace. It changes no state. A consumer must carry `attestations` on an
+/// ordinary adoption OfferRequest and pass that workspace's offer gate.
+class IdentityProviderWitnessOffer extends $pb.GeneratedMessage {
+  factory IdentityProviderWitnessOffer({
+    $core.int? formatVersion,
+    $core.String? sourceWorkspace,
+    $core.String? sourceGenesis,
+    $core.String? sourceHead,
+    $fixnum.Int64? epoch,
+    $core.List<$core.int>? predecessorSha256,
+    $core.String? issuer,
+    $core.String? audience,
+    $core.String? principalClaim,
+    $core.String? deviceBindingClaim,
+    $core.bool? requireDeviceBinding,
+    $core.Iterable<IdentityProviderKey>? keys,
+    $core.Iterable<IdentityProviderCertificate>? certificates,
+    $core.List<$core.int>? materialSha256,
+    $core.Iterable<$0.AttestedRead>? attestations,
+  }) {
+    final result = create();
+    if (formatVersion != null) result.formatVersion = formatVersion;
+    if (sourceWorkspace != null) result.sourceWorkspace = sourceWorkspace;
+    if (sourceGenesis != null) result.sourceGenesis = sourceGenesis;
+    if (sourceHead != null) result.sourceHead = sourceHead;
+    if (epoch != null) result.epoch = epoch;
+    if (predecessorSha256 != null) result.predecessorSha256 = predecessorSha256;
+    if (issuer != null) result.issuer = issuer;
+    if (audience != null) result.audience = audience;
+    if (principalClaim != null) result.principalClaim = principalClaim;
+    if (deviceBindingClaim != null)
+      result.deviceBindingClaim = deviceBindingClaim;
+    if (requireDeviceBinding != null)
+      result.requireDeviceBinding = requireDeviceBinding;
+    if (keys != null) result.keys.addAll(keys);
+    if (certificates != null) result.certificates.addAll(certificates);
+    if (materialSha256 != null) result.materialSha256 = materialSha256;
+    if (attestations != null) result.attestations.addAll(attestations);
+    return result;
+  }
+
+  IdentityProviderWitnessOffer._();
+
+  factory IdentityProviderWitnessOffer.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory IdentityProviderWitnessOffer.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'IdentityProviderWitnessOffer',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.runtime.v2'),
+      createEmptyInstance: create)
+    ..aI(1, _omitFieldNames ? '' : 'formatVersion',
+        fieldType: $pb.PbFieldType.OU3)
+    ..aOS(2, _omitFieldNames ? '' : 'sourceWorkspace')
+    ..aOS(3, _omitFieldNames ? '' : 'sourceGenesis')
+    ..aOS(4, _omitFieldNames ? '' : 'sourceHead')
+    ..a<$fixnum.Int64>(5, _omitFieldNames ? '' : 'epoch', $pb.PbFieldType.OU6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..a<$core.List<$core.int>>(
+        6, _omitFieldNames ? '' : 'predecessorSha256', $pb.PbFieldType.OY)
+    ..aOS(7, _omitFieldNames ? '' : 'issuer')
+    ..aOS(8, _omitFieldNames ? '' : 'audience')
+    ..aOS(9, _omitFieldNames ? '' : 'principalClaim')
+    ..aOS(10, _omitFieldNames ? '' : 'deviceBindingClaim')
+    ..aOB(11, _omitFieldNames ? '' : 'requireDeviceBinding')
+    ..pPM<IdentityProviderKey>(12, _omitFieldNames ? '' : 'keys',
+        subBuilder: IdentityProviderKey.create)
+    ..pPM<IdentityProviderCertificate>(
+        13, _omitFieldNames ? '' : 'certificates',
+        subBuilder: IdentityProviderCertificate.create)
+    ..a<$core.List<$core.int>>(
+        14, _omitFieldNames ? '' : 'materialSha256', $pb.PbFieldType.OY)
+    ..pPM<$0.AttestedRead>(16, _omitFieldNames ? '' : 'attestations',
+        subBuilder: $0.AttestedRead.create)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderWitnessOffer clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderWitnessOffer copyWith(
+          void Function(IdentityProviderWitnessOffer) updates) =>
+      super.copyWith(
+              (message) => updates(message as IdentityProviderWitnessOffer))
+          as IdentityProviderWitnessOffer;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderWitnessOffer create() =>
+      IdentityProviderWitnessOffer._();
+  @$core.override
+  IdentityProviderWitnessOffer createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderWitnessOffer getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<IdentityProviderWitnessOffer>(create);
+  static IdentityProviderWitnessOffer? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.int get formatVersion => $_getIZ(0);
+  @$pb.TagNumber(1)
+  set formatVersion($core.int value) => $_setUnsignedInt32(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasFormatVersion() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearFormatVersion() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get sourceWorkspace => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set sourceWorkspace($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasSourceWorkspace() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearSourceWorkspace() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.String get sourceGenesis => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set sourceGenesis($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasSourceGenesis() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearSourceGenesis() => $_clearField(3);
+
+  @$pb.TagNumber(4)
+  $core.String get sourceHead => $_getSZ(3);
+  @$pb.TagNumber(4)
+  set sourceHead($core.String value) => $_setString(3, value);
+  @$pb.TagNumber(4)
+  $core.bool hasSourceHead() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearSourceHead() => $_clearField(4);
+
+  @$pb.TagNumber(5)
+  $fixnum.Int64 get epoch => $_getI64(4);
+  @$pb.TagNumber(5)
+  set epoch($fixnum.Int64 value) => $_setInt64(4, value);
+  @$pb.TagNumber(5)
+  $core.bool hasEpoch() => $_has(4);
+  @$pb.TagNumber(5)
+  void clearEpoch() => $_clearField(5);
+
+  @$pb.TagNumber(6)
+  $core.List<$core.int> get predecessorSha256 => $_getN(5);
+  @$pb.TagNumber(6)
+  set predecessorSha256($core.List<$core.int> value) => $_setBytes(5, value);
+  @$pb.TagNumber(6)
+  $core.bool hasPredecessorSha256() => $_has(5);
+  @$pb.TagNumber(6)
+  void clearPredecessorSha256() => $_clearField(6);
+
+  @$pb.TagNumber(7)
+  $core.String get issuer => $_getSZ(6);
+  @$pb.TagNumber(7)
+  set issuer($core.String value) => $_setString(6, value);
+  @$pb.TagNumber(7)
+  $core.bool hasIssuer() => $_has(6);
+  @$pb.TagNumber(7)
+  void clearIssuer() => $_clearField(7);
+
+  @$pb.TagNumber(8)
+  $core.String get audience => $_getSZ(7);
+  @$pb.TagNumber(8)
+  set audience($core.String value) => $_setString(7, value);
+  @$pb.TagNumber(8)
+  $core.bool hasAudience() => $_has(7);
+  @$pb.TagNumber(8)
+  void clearAudience() => $_clearField(8);
+
+  @$pb.TagNumber(9)
+  $core.String get principalClaim => $_getSZ(8);
+  @$pb.TagNumber(9)
+  set principalClaim($core.String value) => $_setString(8, value);
+  @$pb.TagNumber(9)
+  $core.bool hasPrincipalClaim() => $_has(8);
+  @$pb.TagNumber(9)
+  void clearPrincipalClaim() => $_clearField(9);
+
+  @$pb.TagNumber(10)
+  $core.String get deviceBindingClaim => $_getSZ(9);
+  @$pb.TagNumber(10)
+  set deviceBindingClaim($core.String value) => $_setString(9, value);
+  @$pb.TagNumber(10)
+  $core.bool hasDeviceBindingClaim() => $_has(9);
+  @$pb.TagNumber(10)
+  void clearDeviceBindingClaim() => $_clearField(10);
+
+  @$pb.TagNumber(11)
+  $core.bool get requireDeviceBinding => $_getBF(10);
+  @$pb.TagNumber(11)
+  set requireDeviceBinding($core.bool value) => $_setBool(10, value);
+  @$pb.TagNumber(11)
+  $core.bool hasRequireDeviceBinding() => $_has(10);
+  @$pb.TagNumber(11)
+  void clearRequireDeviceBinding() => $_clearField(11);
+
+  @$pb.TagNumber(12)
+  $pb.PbList<IdentityProviderKey> get keys => $_getList(11);
+
+  @$pb.TagNumber(13)
+  $pb.PbList<IdentityProviderCertificate> get certificates => $_getList(12);
+
+  @$pb.TagNumber(14)
+  $core.List<$core.int> get materialSha256 => $_getN(13);
+  @$pb.TagNumber(14)
+  set materialSha256($core.List<$core.int> value) => $_setBytes(13, value);
+  @$pb.TagNumber(14)
+  $core.bool hasMaterialSha256() => $_has(13);
+  @$pb.TagNumber(14)
+  void clearMaterialSha256() => $_clearField(14);
+
+  @$pb.TagNumber(16)
+  $pb.PbList<$0.AttestedRead> get attestations => $_getList(14);
+}
+
+/// Consumer-side resolution. The root is a Nomos workspace address. The
+/// required kid is a demand signal only; a successful read returns the root's
+/// whole current epoch so every dependent local workspace can reuse it.
+class ResolveIdentityProviderWitness extends $pb.GeneratedMessage {
+  factory ResolveIdentityProviderWitness({
+    $core.String? consumerSession,
+    $core.String? rootWorkspace,
+    $core.String? requiredKid,
+    $core.List<$core.int>? knownWitnessSha256,
+  }) {
+    final result = create();
+    if (consumerSession != null) result.consumerSession = consumerSession;
+    if (rootWorkspace != null) result.rootWorkspace = rootWorkspace;
+    if (requiredKid != null) result.requiredKid = requiredKid;
+    if (knownWitnessSha256 != null)
+      result.knownWitnessSha256 = knownWitnessSha256;
+    return result;
+  }
+
+  ResolveIdentityProviderWitness._();
+
+  factory ResolveIdentityProviderWitness.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ResolveIdentityProviderWitness.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ResolveIdentityProviderWitness',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.runtime.v2'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'consumerSession')
+    ..aOS(2, _omitFieldNames ? '' : 'rootWorkspace')
+    ..aOS(3, _omitFieldNames ? '' : 'requiredKid')
+    ..a<$core.List<$core.int>>(
+        4, _omitFieldNames ? '' : 'knownWitnessSha256', $pb.PbFieldType.OY)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ResolveIdentityProviderWitness clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ResolveIdentityProviderWitness copyWith(
+          void Function(ResolveIdentityProviderWitness) updates) =>
+      super.copyWith(
+              (message) => updates(message as ResolveIdentityProviderWitness))
+          as ResolveIdentityProviderWitness;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static ResolveIdentityProviderWitness create() =>
+      ResolveIdentityProviderWitness._();
+  @$core.override
+  ResolveIdentityProviderWitness createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static ResolveIdentityProviderWitness getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ResolveIdentityProviderWitness>(create);
+  static ResolveIdentityProviderWitness? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get consumerSession => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set consumerSession($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasConsumerSession() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearConsumerSession() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get rootWorkspace => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set rootWorkspace($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasRootWorkspace() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearRootWorkspace() => $_clearField(2);
+
+  @$pb.TagNumber(3)
+  $core.String get requiredKid => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set requiredKid($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasRequiredKid() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearRequiredKid() => $_clearField(3);
+
+  @$pb.TagNumber(4)
+  $core.List<$core.int> get knownWitnessSha256 => $_getN(3);
+  @$pb.TagNumber(4)
+  set knownWitnessSha256($core.List<$core.int> value) => $_setBytes(3, value);
+  @$pb.TagNumber(4)
+  $core.bool hasKnownWitnessSha256() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearKnownWitnessSha256() => $_clearField(4);
+}
+
+/// Source-side read, used by another peer's single-flight correspondence. It
+/// reads one root workspace and never contacts an external identity provider.
+class ReadIdentityProviderWitness extends $pb.GeneratedMessage {
+  factory ReadIdentityProviderWitness({
+    $core.String? rootSession,
+    $core.List<$core.int>? knownWitnessSha256,
+  }) {
+    final result = create();
+    if (rootSession != null) result.rootSession = rootSession;
+    if (knownWitnessSha256 != null)
+      result.knownWitnessSha256 = knownWitnessSha256;
+    return result;
+  }
+
+  ReadIdentityProviderWitness._();
+
+  factory ReadIdentityProviderWitness.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory ReadIdentityProviderWitness.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'ReadIdentityProviderWitness',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.runtime.v2'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'rootSession')
+    ..a<$core.List<$core.int>>(
+        2, _omitFieldNames ? '' : 'knownWitnessSha256', $pb.PbFieldType.OY)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ReadIdentityProviderWitness clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  ReadIdentityProviderWitness copyWith(
+          void Function(ReadIdentityProviderWitness) updates) =>
+      super.copyWith(
+              (message) => updates(message as ReadIdentityProviderWitness))
+          as ReadIdentityProviderWitness;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static ReadIdentityProviderWitness create() =>
+      ReadIdentityProviderWitness._();
+  @$core.override
+  ReadIdentityProviderWitness createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static ReadIdentityProviderWitness getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<ReadIdentityProviderWitness>(create);
+  static ReadIdentityProviderWitness? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get rootSession => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set rootSession($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasRootSession() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearRootSession() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.List<$core.int> get knownWitnessSha256 => $_getN(1);
+  @$pb.TagNumber(2)
+  set knownWitnessSha256($core.List<$core.int> value) => $_setBytes(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasKnownWitnessSha256() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearKnownWitnessSha256() => $_clearField(2);
+}
+
+enum IdentityProviderWitnessRequest_Operation { resolve, read, notSet }
+
+class IdentityProviderWitnessRequest extends $pb.GeneratedMessage {
+  factory IdentityProviderWitnessRequest({
+    ResolveIdentityProviderWitness? resolve,
+    ReadIdentityProviderWitness? read,
+  }) {
+    final result = create();
+    if (resolve != null) result.resolve = resolve;
+    if (read != null) result.read = read;
+    return result;
+  }
+
+  IdentityProviderWitnessRequest._();
+
+  factory IdentityProviderWitnessRequest.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory IdentityProviderWitnessRequest.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static const $core.Map<$core.int, IdentityProviderWitnessRequest_Operation>
+      _IdentityProviderWitnessRequest_OperationByTag = {
+    1: IdentityProviderWitnessRequest_Operation.resolve,
+    2: IdentityProviderWitnessRequest_Operation.read,
+    0: IdentityProviderWitnessRequest_Operation.notSet
+  };
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'IdentityProviderWitnessRequest',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.runtime.v2'),
+      createEmptyInstance: create)
+    ..oo(0, [1, 2])
+    ..aOM<ResolveIdentityProviderWitness>(1, _omitFieldNames ? '' : 'resolve',
+        subBuilder: ResolveIdentityProviderWitness.create)
+    ..aOM<ReadIdentityProviderWitness>(2, _omitFieldNames ? '' : 'read',
+        subBuilder: ReadIdentityProviderWitness.create)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderWitnessRequest clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderWitnessRequest copyWith(
+          void Function(IdentityProviderWitnessRequest) updates) =>
+      super.copyWith(
+              (message) => updates(message as IdentityProviderWitnessRequest))
+          as IdentityProviderWitnessRequest;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderWitnessRequest create() =>
+      IdentityProviderWitnessRequest._();
+  @$core.override
+  IdentityProviderWitnessRequest createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderWitnessRequest getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<IdentityProviderWitnessRequest>(create);
+  static IdentityProviderWitnessRequest? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  @$pb.TagNumber(2)
+  IdentityProviderWitnessRequest_Operation whichOperation() =>
+      _IdentityProviderWitnessRequest_OperationByTag[$_whichOneof(0)]!;
+  @$pb.TagNumber(1)
+  @$pb.TagNumber(2)
+  void clearOperation() => $_clearField($_whichOneof(0));
+
+  @$pb.TagNumber(1)
+  ResolveIdentityProviderWitness get resolve => $_getN(0);
+  @$pb.TagNumber(1)
+  set resolve(ResolveIdentityProviderWitness value) => $_setField(1, value);
+  @$pb.TagNumber(1)
+  $core.bool hasResolve() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearResolve() => $_clearField(1);
+  @$pb.TagNumber(1)
+  ResolveIdentityProviderWitness ensureResolve() => $_ensure(0);
+
+  @$pb.TagNumber(2)
+  ReadIdentityProviderWitness get read => $_getN(1);
+  @$pb.TagNumber(2)
+  set read(ReadIdentityProviderWitness value) => $_setField(2, value);
+  @$pb.TagNumber(2)
+  $core.bool hasRead() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearRead() => $_clearField(2);
+  @$pb.TagNumber(2)
+  ReadIdentityProviderWitness ensureRead() => $_ensure(1);
+}
+
+class IdentityProviderWitnessReady extends $pb.GeneratedMessage {
+  factory IdentityProviderWitnessReady({
+    IdentityProviderWitnessOffer? witness,
+    $core.bool? peerCacheHit,
+  }) {
+    final result = create();
+    if (witness != null) result.witness = witness;
+    if (peerCacheHit != null) result.peerCacheHit = peerCacheHit;
+    return result;
+  }
+
+  IdentityProviderWitnessReady._();
+
+  factory IdentityProviderWitnessReady.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory IdentityProviderWitnessReady.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'IdentityProviderWitnessReady',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.runtime.v2'),
+      createEmptyInstance: create)
+    ..aOM<IdentityProviderWitnessOffer>(1, _omitFieldNames ? '' : 'witness',
+        subBuilder: IdentityProviderWitnessOffer.create)
+    ..aOB(2, _omitFieldNames ? '' : 'peerCacheHit')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderWitnessReady clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IdentityProviderWitnessReady copyWith(
+          void Function(IdentityProviderWitnessReady) updates) =>
+      super.copyWith(
+              (message) => updates(message as IdentityProviderWitnessReady))
+          as IdentityProviderWitnessReady;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderWitnessReady create() =>
+      IdentityProviderWitnessReady._();
+  @$core.override
+  IdentityProviderWitnessReady createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static IdentityProviderWitnessReady getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<IdentityProviderWitnessReady>(create);
+  static IdentityProviderWitnessReady? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  IdentityProviderWitnessOffer get witness => $_getN(0);
+  @$pb.TagNumber(1)
+  set witness(IdentityProviderWitnessOffer value) => $_setField(1, value);
+  @$pb.TagNumber(1)
+  $core.bool hasWitness() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearWitness() => $_clearField(1);
+  @$pb.TagNumber(1)
+  IdentityProviderWitnessOffer ensureWitness() => $_ensure(0);
+
+  @$pb.TagNumber(2)
+  $core.bool get peerCacheHit => $_getBF(1);
+  @$pb.TagNumber(2)
+  set peerCacheHit($core.bool value) => $_setBool(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasPeerCacheHit() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearPeerCacheHit() => $_clearField(2);
+}
+
+const $core.bool _omitFieldNames =
+    $core.bool.fromEnvironment('protobuf.omit_field_names');
+const $core.bool _omitMessageNames =
+    $core.bool.fromEnvironment('protobuf.omit_message_names');