@structured-id/ui-core 0.1.5

package/src/generated/sid/v1/admin/security.ts

@@ -0,0 +1,4086 @@
+// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
+// @generated from protobuf file "sid/v1/admin/security.proto" (package "sid.v1.admin", syntax proto3)
+// tslint:disable
+import { ServiceType } from "@protobuf-ts/runtime-rpc";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+import { Timestamp } from "../../../google/protobuf/timestamp";
+// ══════════════════════════════════════════════════════════════════════════
+// Empty request messages (buf lint: no google.protobuf.Empty as request)
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * @generated from protobuf message sid.v1.admin.GetPasswordPolicyRequest
+ */
+export interface GetPasswordPolicyRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.GetBruteForceConfigRequest
+ */
+export interface GetBruteForceConfigRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.GetSecurityHeadersRequest
+ */
+export interface GetSecurityHeadersRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.GetRateLimitConfigRequest
+ */
+export interface GetRateLimitConfigRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.GetRateLimitDashboardRequest
+ */
+export interface GetRateLimitDashboardRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.ListAnomalyRulesRequest
+ */
+export interface ListAnomalyRulesRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.GetCaptchaConfigRequest
+ */
+export interface GetCaptchaConfigRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.GetSecurityPolicyRequest
+ */
+export interface GetSecurityPolicyRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.ListApplicationOverridesRequest
+ */
+export interface ListApplicationOverridesRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.GetNetworkPolicyRequest
+ */
+export interface GetNetworkPolicyRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.GetBreachDetectionConfigRequest
+ */
+export interface GetBreachDetectionConfigRequest {
+}
+/**
+ * @generated from protobuf message sid.v1.admin.ListIpAllowlistEntriesRequest
+ */
+export interface ListIpAllowlistEntriesRequest {
+}
+// ══════════════════════════════════════════════════════════════════════════
+// Password Policy
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * @generated from protobuf message sid.v1.admin.PasswordPolicy
+ */
+export interface PasswordPolicy {
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.PasswordPolicyRule rules = 1
+     */
+    rules: PasswordPolicyRule[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.PasswordPolicyRule
+ */
+export interface PasswordPolicyRule {
+    /**
+     * @generated from protobuf field: sid.v1.admin.PasswordPolicyRuleType type = 1
+     */
+    type: PasswordPolicyRuleType;
+    /**
+     * @generated from protobuf field: int32 value = 2
+     */
+    value: number; // Meaning depends on type
+    /**
+     * @generated from protobuf field: string pattern = 3
+     */
+    pattern: string; // For REGEX type
+}
+// ══════════════════════════════════════════════════════════════════════════
+// Brute Force Protection
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * @generated from protobuf message sid.v1.admin.BruteForceConfig
+ */
+export interface BruteForceConfig {
+    /**
+     * @generated from protobuf field: bool enabled = 1
+     */
+    enabled: boolean;
+    /**
+     * @generated from protobuf field: sid.v1.admin.BruteForceLockoutMode mode = 2
+     */
+    mode: BruteForceLockoutMode;
+    /**
+     * @generated from protobuf field: int32 max_login_failures = 3
+     */
+    maxLoginFailures: number;
+    /**
+     * @generated from protobuf field: int32 lockout_duration_seconds = 4
+     */
+    lockoutDurationSeconds: number;
+    /**
+     * @generated from protobuf field: int32 max_lockout_duration_seconds = 5
+     */
+    maxLockoutDurationSeconds: number;
+    /**
+     * @generated from protobuf field: int32 failure_reset_seconds = 6
+     */
+    failureResetSeconds: number;
+    /**
+     * @generated from protobuf field: int32 quick_login_check_ms = 7
+     */
+    quickLoginCheckMs: number;
+}
+// ══════════════════════════════════════════════════════════════════════════
+// Security Headers
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * @generated from protobuf message sid.v1.admin.SecurityHeaders
+ */
+export interface SecurityHeaders {
+    /**
+     * @generated from protobuf field: string x_frame_options = 1
+     */
+    xFrameOptions: string; // DENY, SAMEORIGIN, ALLOW-FROM
+    /**
+     * @generated from protobuf field: string content_security_policy = 2
+     */
+    contentSecurityPolicy: string;
+    /**
+     * @generated from protobuf field: bool x_content_type_options_nosniff = 3
+     */
+    xContentTypeOptionsNosniff: boolean;
+    /**
+     * @generated from protobuf field: int32 hsts_max_age = 4
+     */
+    hstsMaxAge: number;
+    /**
+     * @generated from protobuf field: bool hsts_include_subdomains = 5
+     */
+    hstsIncludeSubdomains: boolean;
+    /**
+     * @generated from protobuf field: bool hsts_preload = 6
+     */
+    hstsPreload: boolean;
+    /**
+     * @generated from protobuf field: bool x_xss_protection = 7
+     */
+    xXssProtection: boolean;
+    /**
+     * @generated from protobuf field: string referrer_policy = 8
+     */
+    referrerPolicy: string;
+}
+// ══════════════════════════════════════════════════════════════════════════
+// Rate Limits
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * @generated from protobuf message sid.v1.admin.RateLimitConfig
+ */
+export interface RateLimitConfig {
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.RateLimitRule rules = 1
+     */
+    rules: RateLimitRule[];
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.RateLimitOverride overrides = 2
+     */
+    overrides: RateLimitOverride[];
+    /**
+     * @generated from protobuf field: repeated string ip_allowlist = 3
+     */
+    ipAllowlist: string[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.RateLimitRule
+ */
+export interface RateLimitRule {
+    /**
+     * @generated from protobuf field: string endpoint = 1
+     */
+    endpoint: string; // "login", "register", "token", etc.
+    /**
+     * @generated from protobuf field: int32 max_requests = 2
+     */
+    maxRequests: number;
+    /**
+     * @generated from protobuf field: int32 window_seconds = 3
+     */
+    windowSeconds: number;
+    /**
+     * @generated from protobuf field: string scope = 4
+     */
+    scope: string; // "ip", "user", "global"
+}
+/**
+ * @generated from protobuf message sid.v1.admin.RateLimitOverride
+ */
+export interface RateLimitOverride {
+    /**
+     * @generated from protobuf field: string id = 1
+     */
+    id: string;
+    /**
+     * @generated from protobuf field: string target_type = 2
+     */
+    targetType: string; // "ip", "cidr", "application"
+    /**
+     * @generated from protobuf field: string target = 3
+     */
+    target: string;
+    /**
+     * @generated from protobuf field: int32 max_requests = 4
+     */
+    maxRequests: number;
+    /**
+     * @generated from protobuf field: int32 window_seconds = 5
+     */
+    windowSeconds: number;
+}
+/**
+ * @generated from protobuf message sid.v1.admin.RateLimitDashboard
+ */
+export interface RateLimitDashboard {
+    /**
+     * @generated from protobuf field: int32 total_blocked_last_hour = 1
+     */
+    totalBlockedLastHour: number;
+    /**
+     * @generated from protobuf field: int32 total_blocked_last_day = 2
+     */
+    totalBlockedLastDay: number;
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.RateLimitTopEntry top_blocked_ips = 3
+     */
+    topBlockedIps: RateLimitTopEntry[];
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.RateLimitTopEntry top_blocked_endpoints = 4
+     */
+    topBlockedEndpoints: RateLimitTopEntry[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.RateLimitTopEntry
+ */
+export interface RateLimitTopEntry {
+    /**
+     * @generated from protobuf field: string key = 1
+     */
+    key: string;
+    /**
+     * @generated from protobuf field: int32 count = 2
+     */
+    count: number;
+}
+// ══════════════════════════════════════════════════════════════════════════
+// Anomaly Rules
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * @generated from protobuf message sid.v1.admin.AnomalyRule
+ */
+export interface AnomalyRule {
+    /**
+     * @generated from protobuf field: string id = 1
+     */
+    id: string;
+    /**
+     * @generated from protobuf field: string name = 2
+     */
+    name: string;
+    /**
+     * @generated from protobuf field: string description = 3
+     */
+    description: string;
+    /**
+     * @generated from protobuf field: sid.v1.admin.AnomalyRuleType type = 4
+     */
+    type: AnomalyRuleType;
+    /**
+     * @generated from protobuf field: bool enabled = 5
+     */
+    enabled: boolean;
+    /**
+     * @generated from protobuf field: int32 weight = 6
+     */
+    weight: number; // CE: fixed, EE: configurable
+    /**
+     * @generated from protobuf field: string tier = 7
+     */
+    tier: string; // "ce" or "ee"
+}
+/**
+ * @generated from protobuf message sid.v1.admin.ListAnomalyRulesResponse
+ */
+export interface ListAnomalyRulesResponse {
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.AnomalyRule rules = 1
+     */
+    rules: AnomalyRule[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.GetAnomalyEventLogRequest
+ */
+export interface GetAnomalyEventLogRequest {
+    /**
+     * @generated from protobuf field: int32 page_size = 1
+     */
+    pageSize: number;
+    /**
+     * @generated from protobuf field: string page_token = 2
+     */
+    pageToken: string;
+    /**
+     * @generated from protobuf field: optional string rule_id = 3
+     */
+    ruleId?: string;
+}
+/**
+ * @generated from protobuf message sid.v1.admin.AnomalyEventLog
+ */
+export interface AnomalyEventLog {
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.AnomalyEvent events = 1
+     */
+    events: AnomalyEvent[];
+    /**
+     * @generated from protobuf field: string next_page_token = 2
+     */
+    nextPageToken: string;
+}
+/**
+ * @generated from protobuf message sid.v1.admin.AnomalyEvent
+ */
+export interface AnomalyEvent {
+    /**
+     * @generated from protobuf field: string id = 1
+     */
+    id: string;
+    /**
+     * @generated from protobuf field: string rule_id = 2
+     */
+    ruleId: string;
+    /**
+     * @generated from protobuf field: string profile_id = 3
+     */
+    profileId: string;
+    /**
+     * @generated from protobuf field: string ip_address = 4
+     */
+    ipAddress: string;
+    /**
+     * @generated from protobuf field: string description = 5
+     */
+    description: string;
+    /**
+     * @generated from protobuf field: int32 risk_score = 6
+     */
+    riskScore: number;
+    /**
+     * @generated from protobuf field: google.protobuf.Timestamp timestamp = 7
+     */
+    timestamp?: Timestamp;
+}
+// ══════════════════════════════════════════════════════════════════════════
+// CAPTCHA
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * @generated from protobuf message sid.v1.admin.CaptchaConfig
+ */
+export interface CaptchaConfig {
+    /**
+     * @generated from protobuf field: bool enabled = 1
+     */
+    enabled: boolean;
+    /**
+     * @generated from protobuf field: sid.v1.admin.CaptchaProvider provider = 2
+     */
+    provider: CaptchaProvider;
+    /**
+     * @generated from protobuf field: string site_key = 3
+     */
+    siteKey: string;
+    /**
+     * @generated from protobuf field: string secret_key = 4
+     */
+    secretKey: string; // Write-only, masked in responses
+    /**
+     * @generated from protobuf field: double score_threshold = 5
+     */
+    scoreThreshold: number; // For reCAPTCHA v3 / Turnstile
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.CaptchaTrigger triggers = 6
+     */
+    triggers: CaptchaTrigger[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.TestCaptchaProviderRequest
+ */
+export interface TestCaptchaProviderRequest {
+    /**
+     * @generated from protobuf field: sid.v1.admin.CaptchaProvider provider = 1
+     */
+    provider: CaptchaProvider;
+    /**
+     * @generated from protobuf field: string site_key = 2
+     */
+    siteKey: string;
+    /**
+     * @generated from protobuf field: string secret_key = 3
+     */
+    secretKey: string;
+}
+/**
+ * @generated from protobuf message sid.v1.admin.TestCaptchaProviderResponse
+ */
+export interface TestCaptchaProviderResponse {
+    /**
+     * @generated from protobuf field: bool success = 1
+     */
+    success: boolean;
+    /**
+     * @generated from protobuf field: string error = 2
+     */
+    error: string;
+}
+// ══════════════════════════════════════════════════════════════════════════
+// Security Policy
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Full org-level security policy response.
+ * CE: returns hardcoded values (read-only).
+ * EE: returns configurable stored policy.
+ *
+ * @generated from protobuf message sid.v1.admin.SecurityPolicyResponse
+ */
+export interface SecurityPolicyResponse {
+    /**
+     * Overall enforcement mode.
+     *
+     * @generated from protobuf field: string enforcement_mode = 1
+     */
+    enforcementMode: string; // "hard", "soft", "audit"
+    /**
+     * Sub-policy toggles.
+     *
+     * @generated from protobuf field: bool rate_limits_enabled = 2
+     */
+    rateLimitsEnabled: boolean;
+    /**
+     * @generated from protobuf field: bool anomaly_detection_enabled = 3
+     */
+    anomalyDetectionEnabled: boolean;
+    /**
+     * @generated from protobuf field: bool captcha_enabled = 4
+     */
+    captchaEnabled: boolean;
+    /**
+     * @generated from protobuf field: bool breach_detection_enabled = 5
+     */
+    breachDetectionEnabled: boolean;
+    /**
+     * @generated from protobuf field: bool enrollment_enabled = 6
+     */
+    enrollmentEnabled: boolean;
+    /**
+     * Auth requirements.
+     *
+     * @generated from protobuf field: string min_auth_level = 7
+     */
+    minAuthLevel: string; // "basic", "standard", "elevated", "critical"
+    /**
+     * @generated from protobuf field: string mfa_enforcement = 8
+     */
+    mfaEnforcement: string; // "optional", "required", "adaptive"
+    /**
+     * @generated from protobuf field: repeated string allowed_mfa_methods = 9
+     */
+    allowedMfaMethods: string[];
+    /**
+     * @generated from protobuf field: bool require_phishing_resistant = 10
+     */
+    requirePhishingResistant: boolean;
+    /**
+     * Password requirements.
+     *
+     * @generated from protobuf field: int32 password_min_length = 11
+     */
+    passwordMinLength: number;
+    /**
+     * @generated from protobuf field: int32 password_max_age_days = 12
+     */
+    passwordMaxAgeDays: number;
+    /**
+     * Session requirements.
+     *
+     * @generated from protobuf field: int32 session_max_lifetime_hours = 13
+     */
+    sessionMaxLifetimeHours: number;
+    /**
+     * @generated from protobuf field: int32 session_idle_timeout_hours = 14
+     */
+    sessionIdleTimeoutHours: number;
+    /**
+     * @generated from protobuf field: int32 session_max_concurrent = 15
+     */
+    sessionMaxConcurrent: number;
+    /**
+     * Network restrictions.
+     *
+     * @generated from protobuf field: sid.v1.admin.NetworkPolicy network = 16
+     */
+    network?: NetworkPolicy;
+    /**
+     * Whether policy is configurable (false for CE).
+     *
+     * @generated from protobuf field: bool read_only = 17
+     */
+    readOnly: boolean;
+    /**
+     * Whether a single passkey with user verification satisfies MFA requirement.
+     * When true (default): passkey login grants standard assurance (no second factor needed).
+     * When false: passkey login grants basic assurance only.
+     *
+     * @generated from protobuf field: bool passkey_satisfies_mfa = 18
+     */
+    passkeySatisfiesMfa: boolean;
+}
+/**
+ * @generated from protobuf message sid.v1.admin.ApplicationOverride
+ */
+export interface ApplicationOverride {
+    /**
+     * @generated from protobuf field: string application_id = 1
+     */
+    applicationId: string;
+    /**
+     * @generated from protobuf field: string application_name = 2
+     */
+    applicationName: string;
+    /**
+     * @generated from protobuf field: optional string min_auth_level = 3
+     */
+    minAuthLevel?: string;
+    /**
+     * @generated from protobuf field: optional string enforcement_mode = 4
+     */
+    enforcementMode?: string;
+    /**
+     * @generated from protobuf field: repeated string required_amr = 5
+     */
+    requiredAmr: string[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.ListApplicationOverridesResponse
+ */
+export interface ListApplicationOverridesResponse {
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.ApplicationOverride overrides = 1
+     */
+    overrides: ApplicationOverride[];
+}
+/**
+ * Request for effective policy on a specific application.
+ *
+ * @generated from protobuf message sid.v1.admin.GetEffectivePolicyRequest
+ */
+export interface GetEffectivePolicyRequest {
+    /**
+     * @generated from protobuf field: string client_id = 1
+     */
+    clientId: string;
+}
+/**
+ * Request for enforcement evaluation.
+ *
+ * @generated from protobuf message sid.v1.admin.EvaluateEnforcementRequest
+ */
+export interface EvaluateEnforcementRequest {
+    /**
+     * @generated from protobuf field: string profile_id = 1
+     */
+    profileId: string;
+    /**
+     * @generated from protobuf field: string client_id = 2
+     */
+    clientId: string; // Which application
+}
+/**
+ * @generated from protobuf message sid.v1.admin.EvaluateEnforcementResponse
+ */
+export interface EvaluateEnforcementResponse {
+    /**
+     * @generated from protobuf field: sid.v1.admin.EnforcementAction action = 1
+     */
+    action: EnforcementAction;
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.PolicyViolation violations = 2
+     */
+    violations: PolicyViolation[];
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.PolicyRequiredAction required_actions = 3
+     */
+    requiredActions: PolicyRequiredAction[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.PolicyViolation
+ */
+export interface PolicyViolation {
+    /**
+     * @generated from protobuf field: string requirement = 1
+     */
+    requirement: string; // "mfa_required", "min_auth_level", etc.
+    /**
+     * @generated from protobuf field: string current = 2
+     */
+    current: string; // Current user state
+    /**
+     * @generated from protobuf field: string required = 3
+     */
+    required: string; // Required by policy
+}
+/**
+ * @generated from protobuf message sid.v1.admin.PolicyRequiredAction
+ */
+export interface PolicyRequiredAction {
+    /**
+     * @generated from protobuf field: string action_type = 1
+     */
+    actionType: string; // "enroll_mfa", "step_up_auth", "change_password", etc.
+    /**
+     * @generated from protobuf field: string description = 2
+     */
+    description: string;
+}
+// ══════════════════════════════════════════════════════════════════════════
+// Breach Detection
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * @generated from protobuf message sid.v1.admin.BreachDetectionConfig
+ */
+export interface BreachDetectionConfig {
+    /**
+     * @generated from protobuf field: bool enabled = 1
+     */
+    enabled: boolean;
+    /**
+     * @generated from protobuf field: bool check_on_login = 2
+     */
+    checkOnLogin: boolean;
+    /**
+     * @generated from protobuf field: bool check_on_password_change = 3
+     */
+    checkOnPasswordChange: boolean;
+    /**
+     * @generated from protobuf field: bool force_password_change_on_breach = 4
+     */
+    forcePasswordChangeOnBreach: boolean;
+    /**
+     * @generated from protobuf field: string provider = 5
+     */
+    provider: string; // "hibp" (Have I Been Pwned k-anonymity API)
+}
+// ══════════════════════════════════════════════════════════════════════════
+// Network Policy
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Network restrictions — country blocking, Tor/datacenter IP filtering.
+ * Sub-policy of SecurityPolicy. Enforced at login via anomaly detection rules
+ * (country_restriction, tor_exit_node, datacenter_ip).
+ *
+ * @generated from protobuf message sid.v1.admin.NetworkPolicy
+ */
+export interface NetworkPolicy {
+    /**
+     * Country allow-list (ISO 3166-1 alpha-2). Empty = all countries allowed.
+     * When non-empty, ONLY listed countries are permitted (allow-list mode).
+     * Mutually exclusive with blocked_countries.
+     *
+     * @generated from protobuf field: repeated string allowed_countries = 1
+     */
+    allowedCountries: string[];
+    /**
+     * Country block-list (ISO 3166-1 alpha-2). Empty = no countries blocked.
+     * Mutually exclusive with allowed_countries.
+     *
+     * @generated from protobuf field: repeated string blocked_countries = 2
+     */
+    blockedCountries: string[];
+    /**
+     * Block logins from known Tor exit nodes.
+     * Uses auto-updated CDN blocklist.
+     *
+     * @generated from protobuf field: bool block_tor = 3
+     */
+    blockTor: boolean;
+    /**
+     * Block logins from datacenter/hosting provider IPs
+     * (AWS, GCP, Azure, DigitalOcean, etc.) via MaxMind ASN database.
+     *
+     * @generated from protobuf field: bool block_datacenter_ips = 4
+     */
+    blockDatacenterIps: boolean;
+    /**
+     * Reaction for network policy violations.
+     *
+     * @generated from protobuf field: sid.v1.admin.NetworkViolationReaction violation_reaction = 5
+     */
+    violationReaction: NetworkViolationReaction;
+}
+// ══════════════════════════════════════════════════════════════════════════
+// Data Integrity
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * @generated from protobuf message sid.v1.admin.RunIntegrityCheckRequest
+ */
+export interface RunIntegrityCheckRequest {
+    /**
+     * Which layers to check (empty = all available).
+     * CE: "audit_chain", "graph_consistency". Others return pass with 0 entities.
+     *
+     * @generated from protobuf field: repeated string layers = 1
+     */
+    layers: string[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.IntegrityCheckResponse
+ */
+export interface IntegrityCheckResponse {
+    /**
+     * @generated from protobuf field: bool passed = 1
+     */
+    passed: boolean;
+    /**
+     * @generated from protobuf field: int64 total_entities_checked = 2
+     */
+    totalEntitiesChecked: bigint;
+    /**
+     * @generated from protobuf field: int64 total_issues_found = 3
+     */
+    totalIssuesFound: bigint;
+    /**
+     * @generated from protobuf field: int64 duration_ms = 4
+     */
+    durationMs: bigint;
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.IntegrityLayerResult layers = 5
+     */
+    layers: IntegrityLayerResult[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.IntegrityLayerResult
+ */
+export interface IntegrityLayerResult {
+    /**
+     * @generated from protobuf field: string layer = 1
+     */
+    layer: string; // "audit_chain", "graph_consistency", etc.
+    /**
+     * @generated from protobuf field: int64 entities_checked = 2
+     */
+    entitiesChecked: bigint;
+    /**
+     * @generated from protobuf field: int64 entities_passed = 3
+     */
+    entitiesPassed: bigint;
+    /**
+     * @generated from protobuf field: int64 issues_found = 4
+     */
+    issuesFound: bigint;
+    /**
+     * @generated from protobuf field: int64 duration_ms = 5
+     */
+    durationMs: bigint;
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.IntegrityIssue issues = 6
+     */
+    issues: IntegrityIssue[];
+}
+/**
+ * @generated from protobuf message sid.v1.admin.IntegrityIssue
+ */
+export interface IntegrityIssue {
+    /**
+     * @generated from protobuf field: string layer = 1
+     */
+    layer: string;
+    /**
+     * @generated from protobuf field: string severity = 2
+     */
+    severity: string; // "info", "warning", "error", "critical"
+    /**
+     * @generated from protobuf field: string entity_type = 3
+     */
+    entityType: string;
+    /**
+     * @generated from protobuf field: string entity_id = 4
+     */
+    entityId: string;
+    /**
+     * @generated from protobuf field: string description = 5
+     */
+    description: string;
+    /**
+     * @generated from protobuf field: bool auto_repairable = 6
+     */
+    autoRepairable: boolean;
+}
+// ══════════════════════════════════════════════════════════════════════════
+// IP Allowlist
+// ══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Add an IP address or CIDR range to the global allowlist.
+ * Allowlisted IPs override ALL negative IP intelligence labels (Tor, datacenter, blocklist).
+ *
+ * @generated from protobuf message sid.v1.admin.AddIpAllowlistEntryRequest
+ */
+export interface AddIpAllowlistEntryRequest {
+    /**
+     * IP address or CIDR (e.g., "10.0.0.0/8", "192.168.1.1").
+     *
+     * @generated from protobuf field: string cidr = 1
+     */
+    cidr: string;
+    /**
+     * Optional human-readable description (e.g., "Office VPN", "CI/CD runner").
+     *
+     * @generated from protobuf field: string description = 2
+     */
+    description: string;
+}
+/**
+ * Remove an IP address or CIDR from the global allowlist.
+ *
+ * @generated from protobuf message sid.v1.admin.RemoveIpAllowlistEntryRequest
+ */
+export interface RemoveIpAllowlistEntryRequest {
+    /**
+     * Exact CIDR to remove (must match stored value).
+     *
+     * @generated from protobuf field: string cidr = 1
+     */
+    cidr: string;
+}
+/**
+ * Current state of the IP allowlist.
+ *
+ * @generated from protobuf message sid.v1.admin.IpAllowlistResponse
+ */
+export interface IpAllowlistResponse {
+    /**
+     * @generated from protobuf field: repeated sid.v1.admin.IpAllowlistEntry entries = 1
+     */
+    entries: IpAllowlistEntry[];
+}
+/**
+ * A single IP allowlist entry.
+ *
+ * @generated from protobuf message sid.v1.admin.IpAllowlistEntry
+ */
+export interface IpAllowlistEntry {
+    /**
+     * @generated from protobuf field: string cidr = 1
+     */
+    cidr: string;
+    /**
+     * @generated from protobuf field: string description = 2
+     */
+    description: string;
+    /**
+     * @generated from protobuf field: google.protobuf.Timestamp created_at = 3
+     */
+    createdAt?: Timestamp;
+}
+/**
+ * @generated from protobuf enum sid.v1.admin.PasswordPolicyRuleType
+ */
+export enum PasswordPolicyRuleType {
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_MIN_LENGTH = 1;
+     */
+    MIN_LENGTH = 1,
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_UPPERCASE = 2;
+     */
+    UPPERCASE = 2,
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_LOWERCASE = 3;
+     */
+    LOWERCASE = 3,
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_DIGITS = 4;
+     */
+    DIGITS = 4,
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_SPECIAL_CHARS = 5;
+     */
+    SPECIAL_CHARS = 5,
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_NOT_USERNAME = 6;
+     */
+    NOT_USERNAME = 6,
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_NOT_EMAIL = 7;
+     */
+    NOT_EMAIL = 7,
+    /**
+     * value = last N
+     *
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_PASSWORD_HISTORY = 8;
+     */
+    PASSWORD_HISTORY = 8,
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_REGEX = 9;
+     */
+    REGEX = 9,
+    /**
+     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_MAX_AGE_DAYS = 10;
+     */
+    MAX_AGE_DAYS = 10
+}
+/**
+ * @generated from protobuf enum sid.v1.admin.BruteForceLockoutMode
+ */
+export enum BruteForceLockoutMode {
+    /**
+     * @generated from protobuf enum value: BRUTE_FORCE_LOCKOUT_MODE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from protobuf enum value: BRUTE_FORCE_LOCKOUT_MODE_PERMANENT = 1;
+     */
+    PERMANENT = 1,
+    /**
+     * @generated from protobuf enum value: BRUTE_FORCE_LOCKOUT_MODE_TEMPORARY = 2;
+     */
+    TEMPORARY = 2,
+    /**
+     * @generated from protobuf enum value: BRUTE_FORCE_LOCKOUT_MODE_PROGRESSIVE = 3;
+     */
+    PROGRESSIVE = 3
+}
+/**
+ * @generated from protobuf enum sid.v1.admin.AnomalyRuleType
+ */
+export enum AnomalyRuleType {
+    /**
+     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_IMPOSSIBLE_TRAVEL = 1;
+     */
+    IMPOSSIBLE_TRAVEL = 1,
+    /**
+     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_NEW_DEVICE = 2;
+     */
+    NEW_DEVICE = 2,
+    /**
+     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_NEW_COUNTRY = 3;
+     */
+    NEW_COUNTRY = 3,
+    /**
+     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_CREDENTIAL_STUFFING = 4;
+     */
+    CREDENTIAL_STUFFING = 4,
+    /**
+     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_BRUTE_FORCE = 5;
+     */
+    BRUTE_FORCE = 5,
+    /**
+     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_TOKEN_ABUSE = 6;
+     */
+    TOKEN_ABUSE = 6,
+    /**
+     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_SESSION_ANOMALY = 7;
+     */
+    SESSION_ANOMALY = 7,
+    /**
+     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_CUSTOM = 8;
+     */
+    CUSTOM = 8
+}
+/**
+ * @generated from protobuf enum sid.v1.admin.CaptchaProvider
+ */
+export enum CaptchaProvider {
+    /**
+     * @generated from protobuf enum value: CAPTCHA_PROVIDER_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from protobuf enum value: CAPTCHA_PROVIDER_RECAPTCHA_V2 = 1;
+     */
+    RECAPTCHA_V2 = 1,
+    /**
+     * @generated from protobuf enum value: CAPTCHA_PROVIDER_RECAPTCHA_V3 = 2;
+     */
+    RECAPTCHA_V3 = 2,
+    /**
+     * @generated from protobuf enum value: CAPTCHA_PROVIDER_HCAPTCHA = 3;
+     */
+    HCAPTCHA = 3,
+    /**
+     * @generated from protobuf enum value: CAPTCHA_PROVIDER_TURNSTILE = 4;
+     */
+    TURNSTILE = 4
+}
+/**
+ * @generated from protobuf enum sid.v1.admin.CaptchaTrigger
+ */
+export enum CaptchaTrigger {
+    /**
+     * @generated from protobuf enum value: CAPTCHA_TRIGGER_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from protobuf enum value: CAPTCHA_TRIGGER_LOGIN = 1;
+     */
+    LOGIN = 1,
+    /**
+     * @generated from protobuf enum value: CAPTCHA_TRIGGER_REGISTER = 2;
+     */
+    REGISTER = 2,
+    /**
+     * @generated from protobuf enum value: CAPTCHA_TRIGGER_PASSWORD_RESET = 3;
+     */
+    PASSWORD_RESET = 3,
+    /**
+     * @generated from protobuf enum value: CAPTCHA_TRIGGER_AFTER_FAILURES = 4;
+     */
+    AFTER_FAILURES = 4
+}
+/**
+ * @generated from protobuf enum sid.v1.admin.EnforcementAction
+ */
+export enum EnforcementAction {
+    /**
+     * @generated from protobuf enum value: ENFORCEMENT_ACTION_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from protobuf enum value: ENFORCEMENT_ACTION_ALLOW = 1;
+     */
+    ALLOW = 1,
+    /**
+     * @generated from protobuf enum value: ENFORCEMENT_ACTION_STEP_UP = 2;
+     */
+    STEP_UP = 2,
+    /**
+     * @generated from protobuf enum value: ENFORCEMENT_ACTION_GRACE = 3;
+     */
+    GRACE = 3,
+    /**
+     * @generated from protobuf enum value: ENFORCEMENT_ACTION_BLOCK = 4;
+     */
+    BLOCK = 4
+}
+/**
+ * How to handle network policy violations.
+ *
+ * @generated from protobuf enum sid.v1.admin.NetworkViolationReaction
+ */
+export enum NetworkViolationReaction {
+    /**
+     * @generated from protobuf enum value: NETWORK_VIOLATION_REACTION_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Deny login immediately. Default for CE.
+     *
+     * @generated from protobuf enum value: NETWORK_VIOLATION_REACTION_BLOCK = 1;
+     */
+    BLOCK = 1,
+    /**
+     * Require additional authentication factor.
+     *
+     * @generated from protobuf enum value: NETWORK_VIOLATION_REACTION_STEP_UP = 2;
+     */
+    STEP_UP = 2,
+    /**
+     * Allow but trigger alert to admin (EE, audit mode).
+     *
+     * @generated from protobuf enum value: NETWORK_VIOLATION_REACTION_ALERT = 3;
+     */
+    ALERT = 3
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class GetPasswordPolicyRequest$Type extends MessageType<GetPasswordPolicyRequest> {
+    constructor() {
+        super("sid.v1.admin.GetPasswordPolicyRequest", []);
+    }
+    create(value?: PartialMessage<GetPasswordPolicyRequest>): GetPasswordPolicyRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetPasswordPolicyRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetPasswordPolicyRequest): GetPasswordPolicyRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetPasswordPolicyRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetPasswordPolicyRequest
+ */
+export const GetPasswordPolicyRequest = new GetPasswordPolicyRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetBruteForceConfigRequest$Type extends MessageType<GetBruteForceConfigRequest> {
+    constructor() {
+        super("sid.v1.admin.GetBruteForceConfigRequest", []);
+    }
+    create(value?: PartialMessage<GetBruteForceConfigRequest>): GetBruteForceConfigRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetBruteForceConfigRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetBruteForceConfigRequest): GetBruteForceConfigRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetBruteForceConfigRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetBruteForceConfigRequest
+ */
+export const GetBruteForceConfigRequest = new GetBruteForceConfigRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetSecurityHeadersRequest$Type extends MessageType<GetSecurityHeadersRequest> {
+    constructor() {
+        super("sid.v1.admin.GetSecurityHeadersRequest", []);
+    }
+    create(value?: PartialMessage<GetSecurityHeadersRequest>): GetSecurityHeadersRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetSecurityHeadersRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetSecurityHeadersRequest): GetSecurityHeadersRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetSecurityHeadersRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetSecurityHeadersRequest
+ */
+export const GetSecurityHeadersRequest = new GetSecurityHeadersRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetRateLimitConfigRequest$Type extends MessageType<GetRateLimitConfigRequest> {
+    constructor() {
+        super("sid.v1.admin.GetRateLimitConfigRequest", []);
+    }
+    create(value?: PartialMessage<GetRateLimitConfigRequest>): GetRateLimitConfigRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetRateLimitConfigRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetRateLimitConfigRequest): GetRateLimitConfigRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetRateLimitConfigRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetRateLimitConfigRequest
+ */
+export const GetRateLimitConfigRequest = new GetRateLimitConfigRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetRateLimitDashboardRequest$Type extends MessageType<GetRateLimitDashboardRequest> {
+    constructor() {
+        super("sid.v1.admin.GetRateLimitDashboardRequest", []);
+    }
+    create(value?: PartialMessage<GetRateLimitDashboardRequest>): GetRateLimitDashboardRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetRateLimitDashboardRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetRateLimitDashboardRequest): GetRateLimitDashboardRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetRateLimitDashboardRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetRateLimitDashboardRequest
+ */
+export const GetRateLimitDashboardRequest = new GetRateLimitDashboardRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListAnomalyRulesRequest$Type extends MessageType<ListAnomalyRulesRequest> {
+    constructor() {
+        super("sid.v1.admin.ListAnomalyRulesRequest", []);
+    }
+    create(value?: PartialMessage<ListAnomalyRulesRequest>): ListAnomalyRulesRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<ListAnomalyRulesRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAnomalyRulesRequest): ListAnomalyRulesRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListAnomalyRulesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.ListAnomalyRulesRequest
+ */
+export const ListAnomalyRulesRequest = new ListAnomalyRulesRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetCaptchaConfigRequest$Type extends MessageType<GetCaptchaConfigRequest> {
+    constructor() {
+        super("sid.v1.admin.GetCaptchaConfigRequest", []);
+    }
+    create(value?: PartialMessage<GetCaptchaConfigRequest>): GetCaptchaConfigRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetCaptchaConfigRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCaptchaConfigRequest): GetCaptchaConfigRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetCaptchaConfigRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetCaptchaConfigRequest
+ */
+export const GetCaptchaConfigRequest = new GetCaptchaConfigRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetSecurityPolicyRequest$Type extends MessageType<GetSecurityPolicyRequest> {
+    constructor() {
+        super("sid.v1.admin.GetSecurityPolicyRequest", []);
+    }
+    create(value?: PartialMessage<GetSecurityPolicyRequest>): GetSecurityPolicyRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetSecurityPolicyRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetSecurityPolicyRequest): GetSecurityPolicyRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetSecurityPolicyRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetSecurityPolicyRequest
+ */
+export const GetSecurityPolicyRequest = new GetSecurityPolicyRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListApplicationOverridesRequest$Type extends MessageType<ListApplicationOverridesRequest> {
+    constructor() {
+        super("sid.v1.admin.ListApplicationOverridesRequest", []);
+    }
+    create(value?: PartialMessage<ListApplicationOverridesRequest>): ListApplicationOverridesRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<ListApplicationOverridesRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListApplicationOverridesRequest): ListApplicationOverridesRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListApplicationOverridesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.ListApplicationOverridesRequest
+ */
+export const ListApplicationOverridesRequest = new ListApplicationOverridesRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetNetworkPolicyRequest$Type extends MessageType<GetNetworkPolicyRequest> {
+    constructor() {
+        super("sid.v1.admin.GetNetworkPolicyRequest", []);
+    }
+    create(value?: PartialMessage<GetNetworkPolicyRequest>): GetNetworkPolicyRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetNetworkPolicyRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetNetworkPolicyRequest): GetNetworkPolicyRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetNetworkPolicyRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetNetworkPolicyRequest
+ */
+export const GetNetworkPolicyRequest = new GetNetworkPolicyRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetBreachDetectionConfigRequest$Type extends MessageType<GetBreachDetectionConfigRequest> {
+    constructor() {
+        super("sid.v1.admin.GetBreachDetectionConfigRequest", []);
+    }
+    create(value?: PartialMessage<GetBreachDetectionConfigRequest>): GetBreachDetectionConfigRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<GetBreachDetectionConfigRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetBreachDetectionConfigRequest): GetBreachDetectionConfigRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetBreachDetectionConfigRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetBreachDetectionConfigRequest
+ */
+export const GetBreachDetectionConfigRequest = new GetBreachDetectionConfigRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListIpAllowlistEntriesRequest$Type extends MessageType<ListIpAllowlistEntriesRequest> {
+    constructor() {
+        super("sid.v1.admin.ListIpAllowlistEntriesRequest", []);
+    }
+    create(value?: PartialMessage<ListIpAllowlistEntriesRequest>): ListIpAllowlistEntriesRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        if (value !== undefined)
+            reflectionMergePartial<ListIpAllowlistEntriesRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListIpAllowlistEntriesRequest): ListIpAllowlistEntriesRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListIpAllowlistEntriesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.ListIpAllowlistEntriesRequest
+ */
+export const ListIpAllowlistEntriesRequest = new ListIpAllowlistEntriesRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class PasswordPolicy$Type extends MessageType<PasswordPolicy> {
+    constructor() {
+        super("sid.v1.admin.PasswordPolicy", [
+            { no: 1, name: "rules", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => PasswordPolicyRule }
+        ]);
+    }
+    create(value?: PartialMessage<PasswordPolicy>): PasswordPolicy {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.rules = [];
+        if (value !== undefined)
+            reflectionMergePartial<PasswordPolicy>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PasswordPolicy): PasswordPolicy {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.admin.PasswordPolicyRule rules */ 1:
+                    message.rules.push(PasswordPolicyRule.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: PasswordPolicy, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.admin.PasswordPolicyRule rules = 1; */
+        for (let i = 0; i < message.rules.length; i++)
+            PasswordPolicyRule.internalBinaryWrite(message.rules[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.PasswordPolicy
+ */
+export const PasswordPolicy = new PasswordPolicy$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class PasswordPolicyRule$Type extends MessageType<PasswordPolicyRule> {
+    constructor() {
+        super("sid.v1.admin.PasswordPolicyRule", [
+            { no: 1, name: "type", kind: "enum", T: () => ["sid.v1.admin.PasswordPolicyRuleType", PasswordPolicyRuleType, "PASSWORD_POLICY_RULE_TYPE_"] },
+            { no: 2, name: "value", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 3, name: "pattern", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<PasswordPolicyRule>): PasswordPolicyRule {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.type = 0;
+        message.value = 0;
+        message.pattern = "";
+        if (value !== undefined)
+            reflectionMergePartial<PasswordPolicyRule>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PasswordPolicyRule): PasswordPolicyRule {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* sid.v1.admin.PasswordPolicyRuleType type */ 1:
+                    message.type = reader.int32();
+                    break;
+                case /* int32 value */ 2:
+                    message.value = reader.int32();
+                    break;
+                case /* string pattern */ 3:
+                    message.pattern = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: PasswordPolicyRule, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* sid.v1.admin.PasswordPolicyRuleType type = 1; */
+        if (message.type !== 0)
+            writer.tag(1, WireType.Varint).int32(message.type);
+        /* int32 value = 2; */
+        if (message.value !== 0)
+            writer.tag(2, WireType.Varint).int32(message.value);
+        /* string pattern = 3; */
+        if (message.pattern !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.pattern);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.PasswordPolicyRule
+ */
+export const PasswordPolicyRule = new PasswordPolicyRule$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class BruteForceConfig$Type extends MessageType<BruteForceConfig> {
+    constructor() {
+        super("sid.v1.admin.BruteForceConfig", [
+            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "mode", kind: "enum", T: () => ["sid.v1.admin.BruteForceLockoutMode", BruteForceLockoutMode, "BRUTE_FORCE_LOCKOUT_MODE_"] },
+            { no: 3, name: "max_login_failures", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 4, name: "lockout_duration_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 5, name: "max_lockout_duration_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 6, name: "failure_reset_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 7, name: "quick_login_check_ms", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
+        ]);
+    }
+    create(value?: PartialMessage<BruteForceConfig>): BruteForceConfig {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.enabled = false;
+        message.mode = 0;
+        message.maxLoginFailures = 0;
+        message.lockoutDurationSeconds = 0;
+        message.maxLockoutDurationSeconds = 0;
+        message.failureResetSeconds = 0;
+        message.quickLoginCheckMs = 0;
+        if (value !== undefined)
+            reflectionMergePartial<BruteForceConfig>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BruteForceConfig): BruteForceConfig {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool enabled */ 1:
+                    message.enabled = reader.bool();
+                    break;
+                case /* sid.v1.admin.BruteForceLockoutMode mode */ 2:
+                    message.mode = reader.int32();
+                    break;
+                case /* int32 max_login_failures */ 3:
+                    message.maxLoginFailures = reader.int32();
+                    break;
+                case /* int32 lockout_duration_seconds */ 4:
+                    message.lockoutDurationSeconds = reader.int32();
+                    break;
+                case /* int32 max_lockout_duration_seconds */ 5:
+                    message.maxLockoutDurationSeconds = reader.int32();
+                    break;
+                case /* int32 failure_reset_seconds */ 6:
+                    message.failureResetSeconds = reader.int32();
+                    break;
+                case /* int32 quick_login_check_ms */ 7:
+                    message.quickLoginCheckMs = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: BruteForceConfig, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool enabled = 1; */
+        if (message.enabled !== false)
+            writer.tag(1, WireType.Varint).bool(message.enabled);
+        /* sid.v1.admin.BruteForceLockoutMode mode = 2; */
+        if (message.mode !== 0)
+            writer.tag(2, WireType.Varint).int32(message.mode);
+        /* int32 max_login_failures = 3; */
+        if (message.maxLoginFailures !== 0)
+            writer.tag(3, WireType.Varint).int32(message.maxLoginFailures);
+        /* int32 lockout_duration_seconds = 4; */
+        if (message.lockoutDurationSeconds !== 0)
+            writer.tag(4, WireType.Varint).int32(message.lockoutDurationSeconds);
+        /* int32 max_lockout_duration_seconds = 5; */
+        if (message.maxLockoutDurationSeconds !== 0)
+            writer.tag(5, WireType.Varint).int32(message.maxLockoutDurationSeconds);
+        /* int32 failure_reset_seconds = 6; */
+        if (message.failureResetSeconds !== 0)
+            writer.tag(6, WireType.Varint).int32(message.failureResetSeconds);
+        /* int32 quick_login_check_ms = 7; */
+        if (message.quickLoginCheckMs !== 0)
+            writer.tag(7, WireType.Varint).int32(message.quickLoginCheckMs);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.BruteForceConfig
+ */
+export const BruteForceConfig = new BruteForceConfig$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class SecurityHeaders$Type extends MessageType<SecurityHeaders> {
+    constructor() {
+        super("sid.v1.admin.SecurityHeaders", [
+            { no: 1, name: "x_frame_options", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "content_security_policy", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "x_content_type_options_nosniff", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 4, name: "hsts_max_age", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 5, name: "hsts_include_subdomains", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 6, name: "hsts_preload", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 7, name: "x_xss_protection", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 8, name: "referrer_policy", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<SecurityHeaders>): SecurityHeaders {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.xFrameOptions = "";
+        message.contentSecurityPolicy = "";
+        message.xContentTypeOptionsNosniff = false;
+        message.hstsMaxAge = 0;
+        message.hstsIncludeSubdomains = false;
+        message.hstsPreload = false;
+        message.xXssProtection = false;
+        message.referrerPolicy = "";
+        if (value !== undefined)
+            reflectionMergePartial<SecurityHeaders>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SecurityHeaders): SecurityHeaders {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string x_frame_options */ 1:
+                    message.xFrameOptions = reader.string();
+                    break;
+                case /* string content_security_policy */ 2:
+                    message.contentSecurityPolicy = reader.string();
+                    break;
+                case /* bool x_content_type_options_nosniff */ 3:
+                    message.xContentTypeOptionsNosniff = reader.bool();
+                    break;
+                case /* int32 hsts_max_age */ 4:
+                    message.hstsMaxAge = reader.int32();
+                    break;
+                case /* bool hsts_include_subdomains */ 5:
+                    message.hstsIncludeSubdomains = reader.bool();
+                    break;
+                case /* bool hsts_preload */ 6:
+                    message.hstsPreload = reader.bool();
+                    break;
+                case /* bool x_xss_protection */ 7:
+                    message.xXssProtection = reader.bool();
+                    break;
+                case /* string referrer_policy */ 8:
+                    message.referrerPolicy = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: SecurityHeaders, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string x_frame_options = 1; */
+        if (message.xFrameOptions !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.xFrameOptions);
+        /* string content_security_policy = 2; */
+        if (message.contentSecurityPolicy !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.contentSecurityPolicy);
+        /* bool x_content_type_options_nosniff = 3; */
+        if (message.xContentTypeOptionsNosniff !== false)
+            writer.tag(3, WireType.Varint).bool(message.xContentTypeOptionsNosniff);
+        /* int32 hsts_max_age = 4; */
+        if (message.hstsMaxAge !== 0)
+            writer.tag(4, WireType.Varint).int32(message.hstsMaxAge);
+        /* bool hsts_include_subdomains = 5; */
+        if (message.hstsIncludeSubdomains !== false)
+            writer.tag(5, WireType.Varint).bool(message.hstsIncludeSubdomains);
+        /* bool hsts_preload = 6; */
+        if (message.hstsPreload !== false)
+            writer.tag(6, WireType.Varint).bool(message.hstsPreload);
+        /* bool x_xss_protection = 7; */
+        if (message.xXssProtection !== false)
+            writer.tag(7, WireType.Varint).bool(message.xXssProtection);
+        /* string referrer_policy = 8; */
+        if (message.referrerPolicy !== "")
+            writer.tag(8, WireType.LengthDelimited).string(message.referrerPolicy);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.SecurityHeaders
+ */
+export const SecurityHeaders = new SecurityHeaders$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RateLimitConfig$Type extends MessageType<RateLimitConfig> {
+    constructor() {
+        super("sid.v1.admin.RateLimitConfig", [
+            { no: 1, name: "rules", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => RateLimitRule },
+            { no: 2, name: "overrides", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => RateLimitOverride },
+            { no: 3, name: "ip_allowlist", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<RateLimitConfig>): RateLimitConfig {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.rules = [];
+        message.overrides = [];
+        message.ipAllowlist = [];
+        if (value !== undefined)
+            reflectionMergePartial<RateLimitConfig>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitConfig): RateLimitConfig {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.admin.RateLimitRule rules */ 1:
+                    message.rules.push(RateLimitRule.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                case /* repeated sid.v1.admin.RateLimitOverride overrides */ 2:
+                    message.overrides.push(RateLimitOverride.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                case /* repeated string ip_allowlist */ 3:
+                    message.ipAllowlist.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RateLimitConfig, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.admin.RateLimitRule rules = 1; */
+        for (let i = 0; i < message.rules.length; i++)
+            RateLimitRule.internalBinaryWrite(message.rules[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* repeated sid.v1.admin.RateLimitOverride overrides = 2; */
+        for (let i = 0; i < message.overrides.length; i++)
+            RateLimitOverride.internalBinaryWrite(message.overrides[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        /* repeated string ip_allowlist = 3; */
+        for (let i = 0; i < message.ipAllowlist.length; i++)
+            writer.tag(3, WireType.LengthDelimited).string(message.ipAllowlist[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.RateLimitConfig
+ */
+export const RateLimitConfig = new RateLimitConfig$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RateLimitRule$Type extends MessageType<RateLimitRule> {
+    constructor() {
+        super("sid.v1.admin.RateLimitRule", [
+            { no: 1, name: "endpoint", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "max_requests", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 3, name: "window_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 4, name: "scope", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<RateLimitRule>): RateLimitRule {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.endpoint = "";
+        message.maxRequests = 0;
+        message.windowSeconds = 0;
+        message.scope = "";
+        if (value !== undefined)
+            reflectionMergePartial<RateLimitRule>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitRule): RateLimitRule {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string endpoint */ 1:
+                    message.endpoint = reader.string();
+                    break;
+                case /* int32 max_requests */ 2:
+                    message.maxRequests = reader.int32();
+                    break;
+                case /* int32 window_seconds */ 3:
+                    message.windowSeconds = reader.int32();
+                    break;
+                case /* string scope */ 4:
+                    message.scope = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RateLimitRule, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string endpoint = 1; */
+        if (message.endpoint !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.endpoint);
+        /* int32 max_requests = 2; */
+        if (message.maxRequests !== 0)
+            writer.tag(2, WireType.Varint).int32(message.maxRequests);
+        /* int32 window_seconds = 3; */
+        if (message.windowSeconds !== 0)
+            writer.tag(3, WireType.Varint).int32(message.windowSeconds);
+        /* string scope = 4; */
+        if (message.scope !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.scope);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.RateLimitRule
+ */
+export const RateLimitRule = new RateLimitRule$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RateLimitOverride$Type extends MessageType<RateLimitOverride> {
+    constructor() {
+        super("sid.v1.admin.RateLimitOverride", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "target_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "target", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "max_requests", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 5, name: "window_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
+        ]);
+    }
+    create(value?: PartialMessage<RateLimitOverride>): RateLimitOverride {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        message.targetType = "";
+        message.target = "";
+        message.maxRequests = 0;
+        message.windowSeconds = 0;
+        if (value !== undefined)
+            reflectionMergePartial<RateLimitOverride>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitOverride): RateLimitOverride {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                case /* string target_type */ 2:
+                    message.targetType = reader.string();
+                    break;
+                case /* string target */ 3:
+                    message.target = reader.string();
+                    break;
+                case /* int32 max_requests */ 4:
+                    message.maxRequests = reader.int32();
+                    break;
+                case /* int32 window_seconds */ 5:
+                    message.windowSeconds = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RateLimitOverride, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        /* string target_type = 2; */
+        if (message.targetType !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.targetType);
+        /* string target = 3; */
+        if (message.target !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.target);
+        /* int32 max_requests = 4; */
+        if (message.maxRequests !== 0)
+            writer.tag(4, WireType.Varint).int32(message.maxRequests);
+        /* int32 window_seconds = 5; */
+        if (message.windowSeconds !== 0)
+            writer.tag(5, WireType.Varint).int32(message.windowSeconds);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.RateLimitOverride
+ */
+export const RateLimitOverride = new RateLimitOverride$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RateLimitDashboard$Type extends MessageType<RateLimitDashboard> {
+    constructor() {
+        super("sid.v1.admin.RateLimitDashboard", [
+            { no: 1, name: "total_blocked_last_hour", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 2, name: "total_blocked_last_day", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 3, name: "top_blocked_ips", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => RateLimitTopEntry },
+            { no: 4, name: "top_blocked_endpoints", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => RateLimitTopEntry }
+        ]);
+    }
+    create(value?: PartialMessage<RateLimitDashboard>): RateLimitDashboard {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.totalBlockedLastHour = 0;
+        message.totalBlockedLastDay = 0;
+        message.topBlockedIps = [];
+        message.topBlockedEndpoints = [];
+        if (value !== undefined)
+            reflectionMergePartial<RateLimitDashboard>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitDashboard): RateLimitDashboard {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* int32 total_blocked_last_hour */ 1:
+                    message.totalBlockedLastHour = reader.int32();
+                    break;
+                case /* int32 total_blocked_last_day */ 2:
+                    message.totalBlockedLastDay = reader.int32();
+                    break;
+                case /* repeated sid.v1.admin.RateLimitTopEntry top_blocked_ips */ 3:
+                    message.topBlockedIps.push(RateLimitTopEntry.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                case /* repeated sid.v1.admin.RateLimitTopEntry top_blocked_endpoints */ 4:
+                    message.topBlockedEndpoints.push(RateLimitTopEntry.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RateLimitDashboard, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* int32 total_blocked_last_hour = 1; */
+        if (message.totalBlockedLastHour !== 0)
+            writer.tag(1, WireType.Varint).int32(message.totalBlockedLastHour);
+        /* int32 total_blocked_last_day = 2; */
+        if (message.totalBlockedLastDay !== 0)
+            writer.tag(2, WireType.Varint).int32(message.totalBlockedLastDay);
+        /* repeated sid.v1.admin.RateLimitTopEntry top_blocked_ips = 3; */
+        for (let i = 0; i < message.topBlockedIps.length; i++)
+            RateLimitTopEntry.internalBinaryWrite(message.topBlockedIps[i], writer.tag(3, WireType.LengthDelimited).fork(), options).join();
+        /* repeated sid.v1.admin.RateLimitTopEntry top_blocked_endpoints = 4; */
+        for (let i = 0; i < message.topBlockedEndpoints.length; i++)
+            RateLimitTopEntry.internalBinaryWrite(message.topBlockedEndpoints[i], writer.tag(4, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.RateLimitDashboard
+ */
+export const RateLimitDashboard = new RateLimitDashboard$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RateLimitTopEntry$Type extends MessageType<RateLimitTopEntry> {
+    constructor() {
+        super("sid.v1.admin.RateLimitTopEntry", [
+            { no: 1, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "count", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
+        ]);
+    }
+    create(value?: PartialMessage<RateLimitTopEntry>): RateLimitTopEntry {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.key = "";
+        message.count = 0;
+        if (value !== undefined)
+            reflectionMergePartial<RateLimitTopEntry>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitTopEntry): RateLimitTopEntry {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string key */ 1:
+                    message.key = reader.string();
+                    break;
+                case /* int32 count */ 2:
+                    message.count = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RateLimitTopEntry, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string key = 1; */
+        if (message.key !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.key);
+        /* int32 count = 2; */
+        if (message.count !== 0)
+            writer.tag(2, WireType.Varint).int32(message.count);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.RateLimitTopEntry
+ */
+export const RateLimitTopEntry = new RateLimitTopEntry$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class AnomalyRule$Type extends MessageType<AnomalyRule> {
+    constructor() {
+        super("sid.v1.admin.AnomalyRule", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "type", kind: "enum", T: () => ["sid.v1.admin.AnomalyRuleType", AnomalyRuleType, "ANOMALY_RULE_TYPE_"] },
+            { no: 5, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 6, name: "weight", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 7, name: "tier", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<AnomalyRule>): AnomalyRule {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        message.name = "";
+        message.description = "";
+        message.type = 0;
+        message.enabled = false;
+        message.weight = 0;
+        message.tier = "";
+        if (value !== undefined)
+            reflectionMergePartial<AnomalyRule>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AnomalyRule): AnomalyRule {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                case /* string name */ 2:
+                    message.name = reader.string();
+                    break;
+                case /* string description */ 3:
+                    message.description = reader.string();
+                    break;
+                case /* sid.v1.admin.AnomalyRuleType type */ 4:
+                    message.type = reader.int32();
+                    break;
+                case /* bool enabled */ 5:
+                    message.enabled = reader.bool();
+                    break;
+                case /* int32 weight */ 6:
+                    message.weight = reader.int32();
+                    break;
+                case /* string tier */ 7:
+                    message.tier = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: AnomalyRule, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        /* string name = 2; */
+        if (message.name !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.name);
+        /* string description = 3; */
+        if (message.description !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.description);
+        /* sid.v1.admin.AnomalyRuleType type = 4; */
+        if (message.type !== 0)
+            writer.tag(4, WireType.Varint).int32(message.type);
+        /* bool enabled = 5; */
+        if (message.enabled !== false)
+            writer.tag(5, WireType.Varint).bool(message.enabled);
+        /* int32 weight = 6; */
+        if (message.weight !== 0)
+            writer.tag(6, WireType.Varint).int32(message.weight);
+        /* string tier = 7; */
+        if (message.tier !== "")
+            writer.tag(7, WireType.LengthDelimited).string(message.tier);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.AnomalyRule
+ */
+export const AnomalyRule = new AnomalyRule$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListAnomalyRulesResponse$Type extends MessageType<ListAnomalyRulesResponse> {
+    constructor() {
+        super("sid.v1.admin.ListAnomalyRulesResponse", [
+            { no: 1, name: "rules", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => AnomalyRule }
+        ]);
+    }
+    create(value?: PartialMessage<ListAnomalyRulesResponse>): ListAnomalyRulesResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.rules = [];
+        if (value !== undefined)
+            reflectionMergePartial<ListAnomalyRulesResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAnomalyRulesResponse): ListAnomalyRulesResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.admin.AnomalyRule rules */ 1:
+                    message.rules.push(AnomalyRule.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListAnomalyRulesResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.admin.AnomalyRule rules = 1; */
+        for (let i = 0; i < message.rules.length; i++)
+            AnomalyRule.internalBinaryWrite(message.rules[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.ListAnomalyRulesResponse
+ */
+export const ListAnomalyRulesResponse = new ListAnomalyRulesResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetAnomalyEventLogRequest$Type extends MessageType<GetAnomalyEventLogRequest> {
+    constructor() {
+        super("sid.v1.admin.GetAnomalyEventLogRequest", [
+            { no: 1, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 2, name: "page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "rule_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetAnomalyEventLogRequest>): GetAnomalyEventLogRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.pageSize = 0;
+        message.pageToken = "";
+        if (value !== undefined)
+            reflectionMergePartial<GetAnomalyEventLogRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAnomalyEventLogRequest): GetAnomalyEventLogRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* int32 page_size */ 1:
+                    message.pageSize = reader.int32();
+                    break;
+                case /* string page_token */ 2:
+                    message.pageToken = reader.string();
+                    break;
+                case /* optional string rule_id */ 3:
+                    message.ruleId = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetAnomalyEventLogRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* int32 page_size = 1; */
+        if (message.pageSize !== 0)
+            writer.tag(1, WireType.Varint).int32(message.pageSize);
+        /* string page_token = 2; */
+        if (message.pageToken !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.pageToken);
+        /* optional string rule_id = 3; */
+        if (message.ruleId !== undefined)
+            writer.tag(3, WireType.LengthDelimited).string(message.ruleId);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetAnomalyEventLogRequest
+ */
+export const GetAnomalyEventLogRequest = new GetAnomalyEventLogRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class AnomalyEventLog$Type extends MessageType<AnomalyEventLog> {
+    constructor() {
+        super("sid.v1.admin.AnomalyEventLog", [
+            { no: 1, name: "events", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => AnomalyEvent },
+            { no: 2, name: "next_page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<AnomalyEventLog>): AnomalyEventLog {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.events = [];
+        message.nextPageToken = "";
+        if (value !== undefined)
+            reflectionMergePartial<AnomalyEventLog>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AnomalyEventLog): AnomalyEventLog {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.admin.AnomalyEvent events */ 1:
+                    message.events.push(AnomalyEvent.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                case /* string next_page_token */ 2:
+                    message.nextPageToken = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: AnomalyEventLog, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.admin.AnomalyEvent events = 1; */
+        for (let i = 0; i < message.events.length; i++)
+            AnomalyEvent.internalBinaryWrite(message.events[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string next_page_token = 2; */
+        if (message.nextPageToken !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.nextPageToken);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.AnomalyEventLog
+ */
+export const AnomalyEventLog = new AnomalyEventLog$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class AnomalyEvent$Type extends MessageType<AnomalyEvent> {
+    constructor() {
+        super("sid.v1.admin.AnomalyEvent", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "rule_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "profile_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "ip_address", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "risk_score", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 7, name: "timestamp", kind: "message", T: () => Timestamp }
+        ]);
+    }
+    create(value?: PartialMessage<AnomalyEvent>): AnomalyEvent {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        message.ruleId = "";
+        message.profileId = "";
+        message.ipAddress = "";
+        message.description = "";
+        message.riskScore = 0;
+        if (value !== undefined)
+            reflectionMergePartial<AnomalyEvent>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AnomalyEvent): AnomalyEvent {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                case /* string rule_id */ 2:
+                    message.ruleId = reader.string();
+                    break;
+                case /* string profile_id */ 3:
+                    message.profileId = reader.string();
+                    break;
+                case /* string ip_address */ 4:
+                    message.ipAddress = reader.string();
+                    break;
+                case /* string description */ 5:
+                    message.description = reader.string();
+                    break;
+                case /* int32 risk_score */ 6:
+                    message.riskScore = reader.int32();
+                    break;
+                case /* google.protobuf.Timestamp timestamp */ 7:
+                    message.timestamp = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.timestamp);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: AnomalyEvent, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        /* string rule_id = 2; */
+        if (message.ruleId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.ruleId);
+        /* string profile_id = 3; */
+        if (message.profileId !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.profileId);
+        /* string ip_address = 4; */
+        if (message.ipAddress !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.ipAddress);
+        /* string description = 5; */
+        if (message.description !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.description);
+        /* int32 risk_score = 6; */
+        if (message.riskScore !== 0)
+            writer.tag(6, WireType.Varint).int32(message.riskScore);
+        /* google.protobuf.Timestamp timestamp = 7; */
+        if (message.timestamp)
+            Timestamp.internalBinaryWrite(message.timestamp, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.AnomalyEvent
+ */
+export const AnomalyEvent = new AnomalyEvent$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class CaptchaConfig$Type extends MessageType<CaptchaConfig> {
+    constructor() {
+        super("sid.v1.admin.CaptchaConfig", [
+            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "provider", kind: "enum", T: () => ["sid.v1.admin.CaptchaProvider", CaptchaProvider, "CAPTCHA_PROVIDER_"] },
+            { no: 3, name: "site_key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "secret_key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "score_threshold", kind: "scalar", T: 1 /*ScalarType.DOUBLE*/ },
+            { no: 6, name: "triggers", kind: "enum", repeat: 1 /*RepeatType.PACKED*/, T: () => ["sid.v1.admin.CaptchaTrigger", CaptchaTrigger, "CAPTCHA_TRIGGER_"] }
+        ]);
+    }
+    create(value?: PartialMessage<CaptchaConfig>): CaptchaConfig {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.enabled = false;
+        message.provider = 0;
+        message.siteKey = "";
+        message.secretKey = "";
+        message.scoreThreshold = 0;
+        message.triggers = [];
+        if (value !== undefined)
+            reflectionMergePartial<CaptchaConfig>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CaptchaConfig): CaptchaConfig {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool enabled */ 1:
+                    message.enabled = reader.bool();
+                    break;
+                case /* sid.v1.admin.CaptchaProvider provider */ 2:
+                    message.provider = reader.int32();
+                    break;
+                case /* string site_key */ 3:
+                    message.siteKey = reader.string();
+                    break;
+                case /* string secret_key */ 4:
+                    message.secretKey = reader.string();
+                    break;
+                case /* double score_threshold */ 5:
+                    message.scoreThreshold = reader.double();
+                    break;
+                case /* repeated sid.v1.admin.CaptchaTrigger triggers */ 6:
+                    if (wireType === WireType.LengthDelimited)
+                        for (let e = reader.int32() + reader.pos; reader.pos < e;)
+                            message.triggers.push(reader.int32());
+                    else
+                        message.triggers.push(reader.int32());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: CaptchaConfig, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool enabled = 1; */
+        if (message.enabled !== false)
+            writer.tag(1, WireType.Varint).bool(message.enabled);
+        /* sid.v1.admin.CaptchaProvider provider = 2; */
+        if (message.provider !== 0)
+            writer.tag(2, WireType.Varint).int32(message.provider);
+        /* string site_key = 3; */
+        if (message.siteKey !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.siteKey);
+        /* string secret_key = 4; */
+        if (message.secretKey !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.secretKey);
+        /* double score_threshold = 5; */
+        if (message.scoreThreshold !== 0)
+            writer.tag(5, WireType.Bit64).double(message.scoreThreshold);
+        /* repeated sid.v1.admin.CaptchaTrigger triggers = 6; */
+        if (message.triggers.length) {
+            writer.tag(6, WireType.LengthDelimited).fork();
+            for (let i = 0; i < message.triggers.length; i++)
+                writer.int32(message.triggers[i]);
+            writer.join();
+        }
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.CaptchaConfig
+ */
+export const CaptchaConfig = new CaptchaConfig$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class TestCaptchaProviderRequest$Type extends MessageType<TestCaptchaProviderRequest> {
+    constructor() {
+        super("sid.v1.admin.TestCaptchaProviderRequest", [
+            { no: 1, name: "provider", kind: "enum", T: () => ["sid.v1.admin.CaptchaProvider", CaptchaProvider, "CAPTCHA_PROVIDER_"] },
+            { no: 2, name: "site_key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "secret_key", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<TestCaptchaProviderRequest>): TestCaptchaProviderRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.provider = 0;
+        message.siteKey = "";
+        message.secretKey = "";
+        if (value !== undefined)
+            reflectionMergePartial<TestCaptchaProviderRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TestCaptchaProviderRequest): TestCaptchaProviderRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* sid.v1.admin.CaptchaProvider provider */ 1:
+                    message.provider = reader.int32();
+                    break;
+                case /* string site_key */ 2:
+                    message.siteKey = reader.string();
+                    break;
+                case /* string secret_key */ 3:
+                    message.secretKey = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: TestCaptchaProviderRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* sid.v1.admin.CaptchaProvider provider = 1; */
+        if (message.provider !== 0)
+            writer.tag(1, WireType.Varint).int32(message.provider);
+        /* string site_key = 2; */
+        if (message.siteKey !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.siteKey);
+        /* string secret_key = 3; */
+        if (message.secretKey !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.secretKey);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.TestCaptchaProviderRequest
+ */
+export const TestCaptchaProviderRequest = new TestCaptchaProviderRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class TestCaptchaProviderResponse$Type extends MessageType<TestCaptchaProviderResponse> {
+    constructor() {
+        super("sid.v1.admin.TestCaptchaProviderResponse", [
+            { no: 1, name: "success", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "error", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<TestCaptchaProviderResponse>): TestCaptchaProviderResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.success = false;
+        message.error = "";
+        if (value !== undefined)
+            reflectionMergePartial<TestCaptchaProviderResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TestCaptchaProviderResponse): TestCaptchaProviderResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool success */ 1:
+                    message.success = reader.bool();
+                    break;
+                case /* string error */ 2:
+                    message.error = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: TestCaptchaProviderResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool success = 1; */
+        if (message.success !== false)
+            writer.tag(1, WireType.Varint).bool(message.success);
+        /* string error = 2; */
+        if (message.error !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.error);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.TestCaptchaProviderResponse
+ */
+export const TestCaptchaProviderResponse = new TestCaptchaProviderResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class SecurityPolicyResponse$Type extends MessageType<SecurityPolicyResponse> {
+    constructor() {
+        super("sid.v1.admin.SecurityPolicyResponse", [
+            { no: 1, name: "enforcement_mode", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "rate_limits_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 3, name: "anomaly_detection_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 4, name: "captcha_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 5, name: "breach_detection_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 6, name: "enrollment_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 7, name: "min_auth_level", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 8, name: "mfa_enforcement", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 9, name: "allowed_mfa_methods", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 10, name: "require_phishing_resistant", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 11, name: "password_min_length", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 12, name: "password_max_age_days", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 13, name: "session_max_lifetime_hours", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 14, name: "session_idle_timeout_hours", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 15, name: "session_max_concurrent", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 16, name: "network", kind: "message", T: () => NetworkPolicy },
+            { no: 17, name: "read_only", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 18, name: "passkey_satisfies_mfa", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+        ]);
+    }
+    create(value?: PartialMessage<SecurityPolicyResponse>): SecurityPolicyResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.enforcementMode = "";
+        message.rateLimitsEnabled = false;
+        message.anomalyDetectionEnabled = false;
+        message.captchaEnabled = false;
+        message.breachDetectionEnabled = false;
+        message.enrollmentEnabled = false;
+        message.minAuthLevel = "";
+        message.mfaEnforcement = "";
+        message.allowedMfaMethods = [];
+        message.requirePhishingResistant = false;
+        message.passwordMinLength = 0;
+        message.passwordMaxAgeDays = 0;
+        message.sessionMaxLifetimeHours = 0;
+        message.sessionIdleTimeoutHours = 0;
+        message.sessionMaxConcurrent = 0;
+        message.readOnly = false;
+        message.passkeySatisfiesMfa = false;
+        if (value !== undefined)
+            reflectionMergePartial<SecurityPolicyResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SecurityPolicyResponse): SecurityPolicyResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string enforcement_mode */ 1:
+                    message.enforcementMode = reader.string();
+                    break;
+                case /* bool rate_limits_enabled */ 2:
+                    message.rateLimitsEnabled = reader.bool();
+                    break;
+                case /* bool anomaly_detection_enabled */ 3:
+                    message.anomalyDetectionEnabled = reader.bool();
+                    break;
+                case /* bool captcha_enabled */ 4:
+                    message.captchaEnabled = reader.bool();
+                    break;
+                case /* bool breach_detection_enabled */ 5:
+                    message.breachDetectionEnabled = reader.bool();
+                    break;
+                case /* bool enrollment_enabled */ 6:
+                    message.enrollmentEnabled = reader.bool();
+                    break;
+                case /* string min_auth_level */ 7:
+                    message.minAuthLevel = reader.string();
+                    break;
+                case /* string mfa_enforcement */ 8:
+                    message.mfaEnforcement = reader.string();
+                    break;
+                case /* repeated string allowed_mfa_methods */ 9:
+                    message.allowedMfaMethods.push(reader.string());
+                    break;
+                case /* bool require_phishing_resistant */ 10:
+                    message.requirePhishingResistant = reader.bool();
+                    break;
+                case /* int32 password_min_length */ 11:
+                    message.passwordMinLength = reader.int32();
+                    break;
+                case /* int32 password_max_age_days */ 12:
+                    message.passwordMaxAgeDays = reader.int32();
+                    break;
+                case /* int32 session_max_lifetime_hours */ 13:
+                    message.sessionMaxLifetimeHours = reader.int32();
+                    break;
+                case /* int32 session_idle_timeout_hours */ 14:
+                    message.sessionIdleTimeoutHours = reader.int32();
+                    break;
+                case /* int32 session_max_concurrent */ 15:
+                    message.sessionMaxConcurrent = reader.int32();
+                    break;
+                case /* sid.v1.admin.NetworkPolicy network */ 16:
+                    message.network = NetworkPolicy.internalBinaryRead(reader, reader.uint32(), options, message.network);
+                    break;
+                case /* bool read_only */ 17:
+                    message.readOnly = reader.bool();
+                    break;
+                case /* bool passkey_satisfies_mfa */ 18:
+                    message.passkeySatisfiesMfa = reader.bool();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: SecurityPolicyResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string enforcement_mode = 1; */
+        if (message.enforcementMode !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.enforcementMode);
+        /* bool rate_limits_enabled = 2; */
+        if (message.rateLimitsEnabled !== false)
+            writer.tag(2, WireType.Varint).bool(message.rateLimitsEnabled);
+        /* bool anomaly_detection_enabled = 3; */
+        if (message.anomalyDetectionEnabled !== false)
+            writer.tag(3, WireType.Varint).bool(message.anomalyDetectionEnabled);
+        /* bool captcha_enabled = 4; */
+        if (message.captchaEnabled !== false)
+            writer.tag(4, WireType.Varint).bool(message.captchaEnabled);
+        /* bool breach_detection_enabled = 5; */
+        if (message.breachDetectionEnabled !== false)
+            writer.tag(5, WireType.Varint).bool(message.breachDetectionEnabled);
+        /* bool enrollment_enabled = 6; */
+        if (message.enrollmentEnabled !== false)
+            writer.tag(6, WireType.Varint).bool(message.enrollmentEnabled);
+        /* string min_auth_level = 7; */
+        if (message.minAuthLevel !== "")
+            writer.tag(7, WireType.LengthDelimited).string(message.minAuthLevel);
+        /* string mfa_enforcement = 8; */
+        if (message.mfaEnforcement !== "")
+            writer.tag(8, WireType.LengthDelimited).string(message.mfaEnforcement);
+        /* repeated string allowed_mfa_methods = 9; */
+        for (let i = 0; i < message.allowedMfaMethods.length; i++)
+            writer.tag(9, WireType.LengthDelimited).string(message.allowedMfaMethods[i]);
+        /* bool require_phishing_resistant = 10; */
+        if (message.requirePhishingResistant !== false)
+            writer.tag(10, WireType.Varint).bool(message.requirePhishingResistant);
+        /* int32 password_min_length = 11; */
+        if (message.passwordMinLength !== 0)
+            writer.tag(11, WireType.Varint).int32(message.passwordMinLength);
+        /* int32 password_max_age_days = 12; */
+        if (message.passwordMaxAgeDays !== 0)
+            writer.tag(12, WireType.Varint).int32(message.passwordMaxAgeDays);
+        /* int32 session_max_lifetime_hours = 13; */
+        if (message.sessionMaxLifetimeHours !== 0)
+            writer.tag(13, WireType.Varint).int32(message.sessionMaxLifetimeHours);
+        /* int32 session_idle_timeout_hours = 14; */
+        if (message.sessionIdleTimeoutHours !== 0)
+            writer.tag(14, WireType.Varint).int32(message.sessionIdleTimeoutHours);
+        /* int32 session_max_concurrent = 15; */
+        if (message.sessionMaxConcurrent !== 0)
+            writer.tag(15, WireType.Varint).int32(message.sessionMaxConcurrent);
+        /* sid.v1.admin.NetworkPolicy network = 16; */
+        if (message.network)
+            NetworkPolicy.internalBinaryWrite(message.network, writer.tag(16, WireType.LengthDelimited).fork(), options).join();
+        /* bool read_only = 17; */
+        if (message.readOnly !== false)
+            writer.tag(17, WireType.Varint).bool(message.readOnly);
+        /* bool passkey_satisfies_mfa = 18; */
+        if (message.passkeySatisfiesMfa !== false)
+            writer.tag(18, WireType.Varint).bool(message.passkeySatisfiesMfa);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.SecurityPolicyResponse
+ */
+export const SecurityPolicyResponse = new SecurityPolicyResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ApplicationOverride$Type extends MessageType<ApplicationOverride> {
+    constructor() {
+        super("sid.v1.admin.ApplicationOverride", [
+            { no: 1, name: "application_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "application_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "min_auth_level", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "enforcement_mode", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "required_amr", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ApplicationOverride>): ApplicationOverride {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.applicationId = "";
+        message.applicationName = "";
+        message.requiredAmr = [];
+        if (value !== undefined)
+            reflectionMergePartial<ApplicationOverride>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ApplicationOverride): ApplicationOverride {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string application_id */ 1:
+                    message.applicationId = reader.string();
+                    break;
+                case /* string application_name */ 2:
+                    message.applicationName = reader.string();
+                    break;
+                case /* optional string min_auth_level */ 3:
+                    message.minAuthLevel = reader.string();
+                    break;
+                case /* optional string enforcement_mode */ 4:
+                    message.enforcementMode = reader.string();
+                    break;
+                case /* repeated string required_amr */ 5:
+                    message.requiredAmr.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ApplicationOverride, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string application_id = 1; */
+        if (message.applicationId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.applicationId);
+        /* string application_name = 2; */
+        if (message.applicationName !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.applicationName);
+        /* optional string min_auth_level = 3; */
+        if (message.minAuthLevel !== undefined)
+            writer.tag(3, WireType.LengthDelimited).string(message.minAuthLevel);
+        /* optional string enforcement_mode = 4; */
+        if (message.enforcementMode !== undefined)
+            writer.tag(4, WireType.LengthDelimited).string(message.enforcementMode);
+        /* repeated string required_amr = 5; */
+        for (let i = 0; i < message.requiredAmr.length; i++)
+            writer.tag(5, WireType.LengthDelimited).string(message.requiredAmr[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.ApplicationOverride
+ */
+export const ApplicationOverride = new ApplicationOverride$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListApplicationOverridesResponse$Type extends MessageType<ListApplicationOverridesResponse> {
+    constructor() {
+        super("sid.v1.admin.ListApplicationOverridesResponse", [
+            { no: 1, name: "overrides", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => ApplicationOverride }
+        ]);
+    }
+    create(value?: PartialMessage<ListApplicationOverridesResponse>): ListApplicationOverridesResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.overrides = [];
+        if (value !== undefined)
+            reflectionMergePartial<ListApplicationOverridesResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListApplicationOverridesResponse): ListApplicationOverridesResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.admin.ApplicationOverride overrides */ 1:
+                    message.overrides.push(ApplicationOverride.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListApplicationOverridesResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.admin.ApplicationOverride overrides = 1; */
+        for (let i = 0; i < message.overrides.length; i++)
+            ApplicationOverride.internalBinaryWrite(message.overrides[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.ListApplicationOverridesResponse
+ */
+export const ListApplicationOverridesResponse = new ListApplicationOverridesResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetEffectivePolicyRequest$Type extends MessageType<GetEffectivePolicyRequest> {
+    constructor() {
+        super("sid.v1.admin.GetEffectivePolicyRequest", [
+            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetEffectivePolicyRequest>): GetEffectivePolicyRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.clientId = "";
+        if (value !== undefined)
+            reflectionMergePartial<GetEffectivePolicyRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetEffectivePolicyRequest): GetEffectivePolicyRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string client_id */ 1:
+                    message.clientId = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetEffectivePolicyRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string client_id = 1; */
+        if (message.clientId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.clientId);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.GetEffectivePolicyRequest
+ */
+export const GetEffectivePolicyRequest = new GetEffectivePolicyRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class EvaluateEnforcementRequest$Type extends MessageType<EvaluateEnforcementRequest> {
+    constructor() {
+        super("sid.v1.admin.EvaluateEnforcementRequest", [
+            { no: 1, name: "profile_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<EvaluateEnforcementRequest>): EvaluateEnforcementRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.profileId = "";
+        message.clientId = "";
+        if (value !== undefined)
+            reflectionMergePartial<EvaluateEnforcementRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EvaluateEnforcementRequest): EvaluateEnforcementRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string profile_id */ 1:
+                    message.profileId = reader.string();
+                    break;
+                case /* string client_id */ 2:
+                    message.clientId = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: EvaluateEnforcementRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string profile_id = 1; */
+        if (message.profileId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.profileId);
+        /* string client_id = 2; */
+        if (message.clientId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.clientId);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.EvaluateEnforcementRequest
+ */
+export const EvaluateEnforcementRequest = new EvaluateEnforcementRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class EvaluateEnforcementResponse$Type extends MessageType<EvaluateEnforcementResponse> {
+    constructor() {
+        super("sid.v1.admin.EvaluateEnforcementResponse", [
+            { no: 1, name: "action", kind: "enum", T: () => ["sid.v1.admin.EnforcementAction", EnforcementAction, "ENFORCEMENT_ACTION_"] },
+            { no: 2, name: "violations", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => PolicyViolation },
+            { no: 3, name: "required_actions", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => PolicyRequiredAction }
+        ]);
+    }
+    create(value?: PartialMessage<EvaluateEnforcementResponse>): EvaluateEnforcementResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.action = 0;
+        message.violations = [];
+        message.requiredActions = [];
+        if (value !== undefined)
+            reflectionMergePartial<EvaluateEnforcementResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EvaluateEnforcementResponse): EvaluateEnforcementResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* sid.v1.admin.EnforcementAction action */ 1:
+                    message.action = reader.int32();
+                    break;
+                case /* repeated sid.v1.admin.PolicyViolation violations */ 2:
+                    message.violations.push(PolicyViolation.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                case /* repeated sid.v1.admin.PolicyRequiredAction required_actions */ 3:
+                    message.requiredActions.push(PolicyRequiredAction.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: EvaluateEnforcementResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* sid.v1.admin.EnforcementAction action = 1; */
+        if (message.action !== 0)
+            writer.tag(1, WireType.Varint).int32(message.action);
+        /* repeated sid.v1.admin.PolicyViolation violations = 2; */
+        for (let i = 0; i < message.violations.length; i++)
+            PolicyViolation.internalBinaryWrite(message.violations[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        /* repeated sid.v1.admin.PolicyRequiredAction required_actions = 3; */
+        for (let i = 0; i < message.requiredActions.length; i++)
+            PolicyRequiredAction.internalBinaryWrite(message.requiredActions[i], writer.tag(3, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.EvaluateEnforcementResponse
+ */
+export const EvaluateEnforcementResponse = new EvaluateEnforcementResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class PolicyViolation$Type extends MessageType<PolicyViolation> {
+    constructor() {
+        super("sid.v1.admin.PolicyViolation", [
+            { no: 1, name: "requirement", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "current", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "required", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<PolicyViolation>): PolicyViolation {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.requirement = "";
+        message.current = "";
+        message.required = "";
+        if (value !== undefined)
+            reflectionMergePartial<PolicyViolation>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PolicyViolation): PolicyViolation {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string requirement */ 1:
+                    message.requirement = reader.string();
+                    break;
+                case /* string current */ 2:
+                    message.current = reader.string();
+                    break;
+                case /* string required */ 3:
+                    message.required = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: PolicyViolation, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string requirement = 1; */
+        if (message.requirement !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.requirement);
+        /* string current = 2; */
+        if (message.current !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.current);
+        /* string required = 3; */
+        if (message.required !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.required);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.PolicyViolation
+ */
+export const PolicyViolation = new PolicyViolation$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class PolicyRequiredAction$Type extends MessageType<PolicyRequiredAction> {
+    constructor() {
+        super("sid.v1.admin.PolicyRequiredAction", [
+            { no: 1, name: "action_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<PolicyRequiredAction>): PolicyRequiredAction {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.actionType = "";
+        message.description = "";
+        if (value !== undefined)
+            reflectionMergePartial<PolicyRequiredAction>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PolicyRequiredAction): PolicyRequiredAction {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string action_type */ 1:
+                    message.actionType = reader.string();
+                    break;
+                case /* string description */ 2:
+                    message.description = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: PolicyRequiredAction, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string action_type = 1; */
+        if (message.actionType !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.actionType);
+        /* string description = 2; */
+        if (message.description !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.description);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.PolicyRequiredAction
+ */
+export const PolicyRequiredAction = new PolicyRequiredAction$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class BreachDetectionConfig$Type extends MessageType<BreachDetectionConfig> {
+    constructor() {
+        super("sid.v1.admin.BreachDetectionConfig", [
+            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "check_on_login", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 3, name: "check_on_password_change", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 4, name: "force_password_change_on_breach", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 5, name: "provider", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<BreachDetectionConfig>): BreachDetectionConfig {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.enabled = false;
+        message.checkOnLogin = false;
+        message.checkOnPasswordChange = false;
+        message.forcePasswordChangeOnBreach = false;
+        message.provider = "";
+        if (value !== undefined)
+            reflectionMergePartial<BreachDetectionConfig>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BreachDetectionConfig): BreachDetectionConfig {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool enabled */ 1:
+                    message.enabled = reader.bool();
+                    break;
+                case /* bool check_on_login */ 2:
+                    message.checkOnLogin = reader.bool();
+                    break;
+                case /* bool check_on_password_change */ 3:
+                    message.checkOnPasswordChange = reader.bool();
+                    break;
+                case /* bool force_password_change_on_breach */ 4:
+                    message.forcePasswordChangeOnBreach = reader.bool();
+                    break;
+                case /* string provider */ 5:
+                    message.provider = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: BreachDetectionConfig, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool enabled = 1; */
+        if (message.enabled !== false)
+            writer.tag(1, WireType.Varint).bool(message.enabled);
+        /* bool check_on_login = 2; */
+        if (message.checkOnLogin !== false)
+            writer.tag(2, WireType.Varint).bool(message.checkOnLogin);
+        /* bool check_on_password_change = 3; */
+        if (message.checkOnPasswordChange !== false)
+            writer.tag(3, WireType.Varint).bool(message.checkOnPasswordChange);
+        /* bool force_password_change_on_breach = 4; */
+        if (message.forcePasswordChangeOnBreach !== false)
+            writer.tag(4, WireType.Varint).bool(message.forcePasswordChangeOnBreach);
+        /* string provider = 5; */
+        if (message.provider !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.provider);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.BreachDetectionConfig
+ */
+export const BreachDetectionConfig = new BreachDetectionConfig$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class NetworkPolicy$Type extends MessageType<NetworkPolicy> {
+    constructor() {
+        super("sid.v1.admin.NetworkPolicy", [
+            { no: 1, name: "allowed_countries", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "blocked_countries", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "block_tor", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 4, name: "block_datacenter_ips", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 5, name: "violation_reaction", kind: "enum", T: () => ["sid.v1.admin.NetworkViolationReaction", NetworkViolationReaction, "NETWORK_VIOLATION_REACTION_"] }
+        ]);
+    }
+    create(value?: PartialMessage<NetworkPolicy>): NetworkPolicy {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.allowedCountries = [];
+        message.blockedCountries = [];
+        message.blockTor = false;
+        message.blockDatacenterIps = false;
+        message.violationReaction = 0;
+        if (value !== undefined)
+            reflectionMergePartial<NetworkPolicy>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: NetworkPolicy): NetworkPolicy {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated string allowed_countries */ 1:
+                    message.allowedCountries.push(reader.string());
+                    break;
+                case /* repeated string blocked_countries */ 2:
+                    message.blockedCountries.push(reader.string());
+                    break;
+                case /* bool block_tor */ 3:
+                    message.blockTor = reader.bool();
+                    break;
+                case /* bool block_datacenter_ips */ 4:
+                    message.blockDatacenterIps = reader.bool();
+                    break;
+                case /* sid.v1.admin.NetworkViolationReaction violation_reaction */ 5:
+                    message.violationReaction = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: NetworkPolicy, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated string allowed_countries = 1; */
+        for (let i = 0; i < message.allowedCountries.length; i++)
+            writer.tag(1, WireType.LengthDelimited).string(message.allowedCountries[i]);
+        /* repeated string blocked_countries = 2; */
+        for (let i = 0; i < message.blockedCountries.length; i++)
+            writer.tag(2, WireType.LengthDelimited).string(message.blockedCountries[i]);
+        /* bool block_tor = 3; */
+        if (message.blockTor !== false)
+            writer.tag(3, WireType.Varint).bool(message.blockTor);
+        /* bool block_datacenter_ips = 4; */
+        if (message.blockDatacenterIps !== false)
+            writer.tag(4, WireType.Varint).bool(message.blockDatacenterIps);
+        /* sid.v1.admin.NetworkViolationReaction violation_reaction = 5; */
+        if (message.violationReaction !== 0)
+            writer.tag(5, WireType.Varint).int32(message.violationReaction);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.NetworkPolicy
+ */
+export const NetworkPolicy = new NetworkPolicy$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RunIntegrityCheckRequest$Type extends MessageType<RunIntegrityCheckRequest> {
+    constructor() {
+        super("sid.v1.admin.RunIntegrityCheckRequest", [
+            { no: 1, name: "layers", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<RunIntegrityCheckRequest>): RunIntegrityCheckRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.layers = [];
+        if (value !== undefined)
+            reflectionMergePartial<RunIntegrityCheckRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RunIntegrityCheckRequest): RunIntegrityCheckRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated string layers */ 1:
+                    message.layers.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RunIntegrityCheckRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated string layers = 1; */
+        for (let i = 0; i < message.layers.length; i++)
+            writer.tag(1, WireType.LengthDelimited).string(message.layers[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.RunIntegrityCheckRequest
+ */
+export const RunIntegrityCheckRequest = new RunIntegrityCheckRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class IntegrityCheckResponse$Type extends MessageType<IntegrityCheckResponse> {
+    constructor() {
+        super("sid.v1.admin.IntegrityCheckResponse", [
+            { no: 1, name: "passed", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "total_entities_checked", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 3, name: "total_issues_found", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 4, name: "duration_ms", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 5, name: "layers", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => IntegrityLayerResult }
+        ]);
+    }
+    create(value?: PartialMessage<IntegrityCheckResponse>): IntegrityCheckResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.passed = false;
+        message.totalEntitiesChecked = 0n;
+        message.totalIssuesFound = 0n;
+        message.durationMs = 0n;
+        message.layers = [];
+        if (value !== undefined)
+            reflectionMergePartial<IntegrityCheckResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IntegrityCheckResponse): IntegrityCheckResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool passed */ 1:
+                    message.passed = reader.bool();
+                    break;
+                case /* int64 total_entities_checked */ 2:
+                    message.totalEntitiesChecked = reader.int64().toBigInt();
+                    break;
+                case /* int64 total_issues_found */ 3:
+                    message.totalIssuesFound = reader.int64().toBigInt();
+                    break;
+                case /* int64 duration_ms */ 4:
+                    message.durationMs = reader.int64().toBigInt();
+                    break;
+                case /* repeated sid.v1.admin.IntegrityLayerResult layers */ 5:
+                    message.layers.push(IntegrityLayerResult.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: IntegrityCheckResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool passed = 1; */
+        if (message.passed !== false)
+            writer.tag(1, WireType.Varint).bool(message.passed);
+        /* int64 total_entities_checked = 2; */
+        if (message.totalEntitiesChecked !== 0n)
+            writer.tag(2, WireType.Varint).int64(message.totalEntitiesChecked);
+        /* int64 total_issues_found = 3; */
+        if (message.totalIssuesFound !== 0n)
+            writer.tag(3, WireType.Varint).int64(message.totalIssuesFound);
+        /* int64 duration_ms = 4; */
+        if (message.durationMs !== 0n)
+            writer.tag(4, WireType.Varint).int64(message.durationMs);
+        /* repeated sid.v1.admin.IntegrityLayerResult layers = 5; */
+        for (let i = 0; i < message.layers.length; i++)
+            IntegrityLayerResult.internalBinaryWrite(message.layers[i], writer.tag(5, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.IntegrityCheckResponse
+ */
+export const IntegrityCheckResponse = new IntegrityCheckResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class IntegrityLayerResult$Type extends MessageType<IntegrityLayerResult> {
+    constructor() {
+        super("sid.v1.admin.IntegrityLayerResult", [
+            { no: 1, name: "layer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "entities_checked", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 3, name: "entities_passed", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 4, name: "issues_found", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 5, name: "duration_ms", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 6, name: "issues", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => IntegrityIssue }
+        ]);
+    }
+    create(value?: PartialMessage<IntegrityLayerResult>): IntegrityLayerResult {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.layer = "";
+        message.entitiesChecked = 0n;
+        message.entitiesPassed = 0n;
+        message.issuesFound = 0n;
+        message.durationMs = 0n;
+        message.issues = [];
+        if (value !== undefined)
+            reflectionMergePartial<IntegrityLayerResult>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IntegrityLayerResult): IntegrityLayerResult {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string layer */ 1:
+                    message.layer = reader.string();
+                    break;
+                case /* int64 entities_checked */ 2:
+                    message.entitiesChecked = reader.int64().toBigInt();
+                    break;
+                case /* int64 entities_passed */ 3:
+                    message.entitiesPassed = reader.int64().toBigInt();
+                    break;
+                case /* int64 issues_found */ 4:
+                    message.issuesFound = reader.int64().toBigInt();
+                    break;
+                case /* int64 duration_ms */ 5:
+                    message.durationMs = reader.int64().toBigInt();
+                    break;
+                case /* repeated sid.v1.admin.IntegrityIssue issues */ 6:
+                    message.issues.push(IntegrityIssue.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: IntegrityLayerResult, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string layer = 1; */
+        if (message.layer !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.layer);
+        /* int64 entities_checked = 2; */
+        if (message.entitiesChecked !== 0n)
+            writer.tag(2, WireType.Varint).int64(message.entitiesChecked);
+        /* int64 entities_passed = 3; */
+        if (message.entitiesPassed !== 0n)
+            writer.tag(3, WireType.Varint).int64(message.entitiesPassed);
+        /* int64 issues_found = 4; */
+        if (message.issuesFound !== 0n)
+            writer.tag(4, WireType.Varint).int64(message.issuesFound);
+        /* int64 duration_ms = 5; */
+        if (message.durationMs !== 0n)
+            writer.tag(5, WireType.Varint).int64(message.durationMs);
+        /* repeated sid.v1.admin.IntegrityIssue issues = 6; */
+        for (let i = 0; i < message.issues.length; i++)
+            IntegrityIssue.internalBinaryWrite(message.issues[i], writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.IntegrityLayerResult
+ */
+export const IntegrityLayerResult = new IntegrityLayerResult$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class IntegrityIssue$Type extends MessageType<IntegrityIssue> {
+    constructor() {
+        super("sid.v1.admin.IntegrityIssue", [
+            { no: 1, name: "layer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "severity", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "entity_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "entity_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "auto_repairable", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+        ]);
+    }
+    create(value?: PartialMessage<IntegrityIssue>): IntegrityIssue {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.layer = "";
+        message.severity = "";
+        message.entityType = "";
+        message.entityId = "";
+        message.description = "";
+        message.autoRepairable = false;
+        if (value !== undefined)
+            reflectionMergePartial<IntegrityIssue>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IntegrityIssue): IntegrityIssue {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string layer */ 1:
+                    message.layer = reader.string();
+                    break;
+                case /* string severity */ 2:
+                    message.severity = reader.string();
+                    break;
+                case /* string entity_type */ 3:
+                    message.entityType = reader.string();
+                    break;
+                case /* string entity_id */ 4:
+                    message.entityId = reader.string();
+                    break;
+                case /* string description */ 5:
+                    message.description = reader.string();
+                    break;
+                case /* bool auto_repairable */ 6:
+                    message.autoRepairable = reader.bool();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: IntegrityIssue, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string layer = 1; */
+        if (message.layer !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.layer);
+        /* string severity = 2; */
+        if (message.severity !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.severity);
+        /* string entity_type = 3; */
+        if (message.entityType !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.entityType);
+        /* string entity_id = 4; */
+        if (message.entityId !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.entityId);
+        /* string description = 5; */
+        if (message.description !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.description);
+        /* bool auto_repairable = 6; */
+        if (message.autoRepairable !== false)
+            writer.tag(6, WireType.Varint).bool(message.autoRepairable);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.IntegrityIssue
+ */
+export const IntegrityIssue = new IntegrityIssue$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class AddIpAllowlistEntryRequest$Type extends MessageType<AddIpAllowlistEntryRequest> {
+    constructor() {
+        super("sid.v1.admin.AddIpAllowlistEntryRequest", [
+            { no: 1, name: "cidr", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<AddIpAllowlistEntryRequest>): AddIpAllowlistEntryRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.cidr = "";
+        message.description = "";
+        if (value !== undefined)
+            reflectionMergePartial<AddIpAllowlistEntryRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AddIpAllowlistEntryRequest): AddIpAllowlistEntryRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string cidr */ 1:
+                    message.cidr = reader.string();
+                    break;
+                case /* string description */ 2:
+                    message.description = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: AddIpAllowlistEntryRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string cidr = 1; */
+        if (message.cidr !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.cidr);
+        /* string description = 2; */
+        if (message.description !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.description);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.AddIpAllowlistEntryRequest
+ */
+export const AddIpAllowlistEntryRequest = new AddIpAllowlistEntryRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RemoveIpAllowlistEntryRequest$Type extends MessageType<RemoveIpAllowlistEntryRequest> {
+    constructor() {
+        super("sid.v1.admin.RemoveIpAllowlistEntryRequest", [
+            { no: 1, name: "cidr", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<RemoveIpAllowlistEntryRequest>): RemoveIpAllowlistEntryRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.cidr = "";
+        if (value !== undefined)
+            reflectionMergePartial<RemoveIpAllowlistEntryRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RemoveIpAllowlistEntryRequest): RemoveIpAllowlistEntryRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string cidr */ 1:
+                    message.cidr = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RemoveIpAllowlistEntryRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string cidr = 1; */
+        if (message.cidr !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.cidr);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.RemoveIpAllowlistEntryRequest
+ */
+export const RemoveIpAllowlistEntryRequest = new RemoveIpAllowlistEntryRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class IpAllowlistResponse$Type extends MessageType<IpAllowlistResponse> {
+    constructor() {
+        super("sid.v1.admin.IpAllowlistResponse", [
+            { no: 1, name: "entries", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => IpAllowlistEntry }
+        ]);
+    }
+    create(value?: PartialMessage<IpAllowlistResponse>): IpAllowlistResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.entries = [];
+        if (value !== undefined)
+            reflectionMergePartial<IpAllowlistResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IpAllowlistResponse): IpAllowlistResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.admin.IpAllowlistEntry entries */ 1:
+                    message.entries.push(IpAllowlistEntry.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: IpAllowlistResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.admin.IpAllowlistEntry entries = 1; */
+        for (let i = 0; i < message.entries.length; i++)
+            IpAllowlistEntry.internalBinaryWrite(message.entries[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.IpAllowlistResponse
+ */
+export const IpAllowlistResponse = new IpAllowlistResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class IpAllowlistEntry$Type extends MessageType<IpAllowlistEntry> {
+    constructor() {
+        super("sid.v1.admin.IpAllowlistEntry", [
+            { no: 1, name: "cidr", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "created_at", kind: "message", T: () => Timestamp }
+        ]);
+    }
+    create(value?: PartialMessage<IpAllowlistEntry>): IpAllowlistEntry {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.cidr = "";
+        message.description = "";
+        if (value !== undefined)
+            reflectionMergePartial<IpAllowlistEntry>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IpAllowlistEntry): IpAllowlistEntry {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string cidr */ 1:
+                    message.cidr = reader.string();
+                    break;
+                case /* string description */ 2:
+                    message.description = reader.string();
+                    break;
+                case /* google.protobuf.Timestamp created_at */ 3:
+                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: IpAllowlistEntry, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string cidr = 1; */
+        if (message.cidr !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.cidr);
+        /* string description = 2; */
+        if (message.description !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.description);
+        /* google.protobuf.Timestamp created_at = 3; */
+        if (message.createdAt)
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.IpAllowlistEntry
+ */
+export const IpAllowlistEntry = new IpAllowlistEntry$Type();
+/**
+ * @generated ServiceType for protobuf service sid.v1.admin.SecurityService
+ */
+export const SecurityService = new ServiceType("sid.v1.admin.SecurityService", [
+    { name: "GetPasswordPolicy", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/password-policy" } }, I: GetPasswordPolicyRequest, O: PasswordPolicy },
+    { name: "UpdatePasswordPolicy", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/password-policy", body: "*" } }, I: PasswordPolicy, O: PasswordPolicy },
+    { name: "GetBruteForceConfig", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/brute-force" } }, I: GetBruteForceConfigRequest, O: BruteForceConfig },
+    { name: "UpdateBruteForceConfig", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/brute-force", body: "*" } }, I: BruteForceConfig, O: BruteForceConfig },
+    { name: "GetSecurityHeaders", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/headers" } }, I: GetSecurityHeadersRequest, O: SecurityHeaders },
+    { name: "UpdateSecurityHeaders", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/headers", body: "*" } }, I: SecurityHeaders, O: SecurityHeaders },
+    { name: "GetRateLimitConfig", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/rate-limits" } }, I: GetRateLimitConfigRequest, O: RateLimitConfig },
+    { name: "GetRateLimitDashboard", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/rate-limits/dashboard" } }, I: GetRateLimitDashboardRequest, O: RateLimitDashboard },
+    { name: "ListAnomalyRules", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/anomaly-rules" } }, I: ListAnomalyRulesRequest, O: ListAnomalyRulesResponse },
+    { name: "GetAnomalyEventLog", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/anomaly-events" } }, I: GetAnomalyEventLogRequest, O: AnomalyEventLog },
+    { name: "GetCaptchaConfig", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/captcha" } }, I: GetCaptchaConfigRequest, O: CaptchaConfig },
+    { name: "UpdateCaptchaConfig", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/captcha", body: "*" } }, I: CaptchaConfig, O: CaptchaConfig },
+    { name: "TestCaptchaProvider", options: { "google.api.http": { post: "/v1/admin/security/captcha/test", body: "*" } }, I: TestCaptchaProviderRequest, O: TestCaptchaProviderResponse },
+    { name: "GetSecurityPolicy", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/policy" } }, I: GetSecurityPolicyRequest, O: SecurityPolicyResponse },
+    { name: "ListApplicationOverrides", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/policy/overrides" } }, I: ListApplicationOverridesRequest, O: ListApplicationOverridesResponse },
+    { name: "GetEffectivePolicy", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/policy/effective/{client_id}" } }, I: GetEffectivePolicyRequest, O: SecurityPolicyResponse },
+    { name: "EvaluateEnforcement", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/policy/evaluate" } }, I: EvaluateEnforcementRequest, O: EvaluateEnforcementResponse },
+    { name: "GetNetworkPolicy", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/network-policy" } }, I: GetNetworkPolicyRequest, O: NetworkPolicy },
+    { name: "UpdateNetworkPolicy", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/network-policy", body: "*" } }, I: NetworkPolicy, O: NetworkPolicy },
+    { name: "GetBreachDetectionConfig", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/breach-detection" } }, I: GetBreachDetectionConfigRequest, O: BreachDetectionConfig },
+    { name: "UpdateBreachDetectionConfig", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/breach-detection", body: "*" } }, I: BreachDetectionConfig, O: BreachDetectionConfig },
+    { name: "RunIntegrityCheck", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { post: "/v1/admin/security/integrity/check", body: "*" } }, I: RunIntegrityCheckRequest, O: IntegrityCheckResponse },
+    { name: "ListIpAllowlistEntries", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/ip-allowlist" } }, I: ListIpAllowlistEntriesRequest, O: IpAllowlistResponse },
+    { name: "AddIpAllowlistEntry", options: { "google.api.http": { post: "/v1/admin/security/ip-allowlist", body: "*" } }, I: AddIpAllowlistEntryRequest, O: IpAllowlistResponse },
+    { name: "RemoveIpAllowlistEntry", options: { "google.api.http": { delete: "/v1/admin/security/ip-allowlist/{cidr}" } }, I: RemoveIpAllowlistEntryRequest, O: IpAllowlistResponse }
+]);