@structured-id/ui-core 1.3.0 → 3.0.0

package/src/generated/sid/v1/admin/security.ts

@@ -1,4077 +0,0 @@
-// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
-// @generated from protobuf file "sid/v1/admin/security.proto" (package "sid.v1.admin", syntax proto3)
-// tslint:disable
-import { ServiceType } from "@protobuf-ts/runtime-rpc";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { Timestamp } from "../../../google/protobuf/timestamp";
-// ══════════════════════════════════════════════════════════════════════════
-// Empty request messages (buf lint: no google.protobuf.Empty as request)
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * @generated from protobuf message sid.v1.admin.GetPasswordPolicyRequest
- */
-export interface GetPasswordPolicyRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.GetBruteForceConfigRequest
- */
-export interface GetBruteForceConfigRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.GetSecurityHeadersRequest
- */
-export interface GetSecurityHeadersRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.GetRateLimitConfigRequest
- */
-export interface GetRateLimitConfigRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.GetRateLimitDashboardRequest
- */
-export interface GetRateLimitDashboardRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.ListAnomalyRulesRequest
- */
-export interface ListAnomalyRulesRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.GetCaptchaConfigRequest
- */
-export interface GetCaptchaConfigRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.GetSecurityPolicyRequest
- */
-export interface GetSecurityPolicyRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.ListApplicationOverridesRequest
- */
-export interface ListApplicationOverridesRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.GetNetworkPolicyRequest
- */
-export interface GetNetworkPolicyRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.GetBreachDetectionConfigRequest
- */
-export interface GetBreachDetectionConfigRequest {
-}
-/**
- * @generated from protobuf message sid.v1.admin.ListIpAllowlistEntriesRequest
- */
-export interface ListIpAllowlistEntriesRequest {
-}
-// ══════════════════════════════════════════════════════════════════════════
-// Password Policy
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * @generated from protobuf message sid.v1.admin.PasswordPolicy
- */
-export interface PasswordPolicy {
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.PasswordPolicyRule rules = 1
-     */
-    rules: PasswordPolicyRule[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.PasswordPolicyRule
- */
-export interface PasswordPolicyRule {
-    /**
-     * @generated from protobuf field: sid.v1.admin.PasswordPolicyRuleType type = 1
-     */
-    type: PasswordPolicyRuleType;
-    /**
-     * @generated from protobuf field: int32 value = 2
-     */
-    value: number; // Meaning depends on type
-    /**
-     * @generated from protobuf field: string pattern = 3
-     */
-    pattern: string; // For REGEX type
-}
-// ══════════════════════════════════════════════════════════════════════════
-// Brute Force Protection
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * @generated from protobuf message sid.v1.admin.BruteForceConfig
- */
-export interface BruteForceConfig {
-    /**
-     * @generated from protobuf field: bool enabled = 1
-     */
-    enabled: boolean;
-    /**
-     * @generated from protobuf field: sid.v1.admin.BruteForceLockoutMode mode = 2
-     */
-    mode: BruteForceLockoutMode;
-    /**
-     * @generated from protobuf field: int32 max_login_failures = 3
-     */
-    maxLoginFailures: number;
-    /**
-     * @generated from protobuf field: int32 lockout_duration_seconds = 4
-     */
-    lockoutDurationSeconds: number;
-    /**
-     * @generated from protobuf field: int32 max_lockout_duration_seconds = 5
-     */
-    maxLockoutDurationSeconds: number;
-    /**
-     * @generated from protobuf field: int32 failure_reset_seconds = 6
-     */
-    failureResetSeconds: number;
-    /**
-     * @generated from protobuf field: int32 quick_login_check_ms = 7
-     */
-    quickLoginCheckMs: number;
-}
-// ══════════════════════════════════════════════════════════════════════════
-// Security Headers
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * @generated from protobuf message sid.v1.admin.SecurityHeaders
- */
-export interface SecurityHeaders {
-    /**
-     * @generated from protobuf field: string x_frame_options = 1
-     */
-    xFrameOptions: string; // DENY, SAMEORIGIN, ALLOW-FROM
-    /**
-     * @generated from protobuf field: string content_security_policy = 2
-     */
-    contentSecurityPolicy: string;
-    /**
-     * @generated from protobuf field: bool x_content_type_options_nosniff = 3
-     */
-    xContentTypeOptionsNosniff: boolean;
-    /**
-     * @generated from protobuf field: int32 hsts_max_age = 4
-     */
-    hstsMaxAge: number;
-    /**
-     * @generated from protobuf field: bool hsts_include_subdomains = 5
-     */
-    hstsIncludeSubdomains: boolean;
-    /**
-     * @generated from protobuf field: bool hsts_preload = 6
-     */
-    hstsPreload: boolean;
-    /**
-     * @generated from protobuf field: bool x_xss_protection = 7
-     */
-    xXssProtection: boolean;
-    /**
-     * @generated from protobuf field: string referrer_policy = 8
-     */
-    referrerPolicy: string;
-}
-// ══════════════════════════════════════════════════════════════════════════
-// Rate Limits
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * @generated from protobuf message sid.v1.admin.RateLimitConfig
- */
-export interface RateLimitConfig {
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.RateLimitRule rules = 1
-     */
-    rules: RateLimitRule[];
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.RateLimitOverride overrides = 2
-     */
-    overrides: RateLimitOverride[];
-    /**
-     * @generated from protobuf field: repeated string ip_allowlist = 3
-     */
-    ipAllowlist: string[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.RateLimitRule
- */
-export interface RateLimitRule {
-    /**
-     * @generated from protobuf field: string endpoint = 1
-     */
-    endpoint: string; // "login", "register", "token", etc.
-    /**
-     * @generated from protobuf field: int32 max_requests = 2
-     */
-    maxRequests: number;
-    /**
-     * @generated from protobuf field: int32 window_seconds = 3
-     */
-    windowSeconds: number;
-    /**
-     * @generated from protobuf field: string scope = 4
-     */
-    scope: string; // "ip", "user", "global"
-}
-/**
- * @generated from protobuf message sid.v1.admin.RateLimitOverride
- */
-export interface RateLimitOverride {
-    /**
-     * @generated from protobuf field: string id = 1
-     */
-    id: string;
-    /**
-     * @generated from protobuf field: string target_type = 2
-     */
-    targetType: string; // "ip", "cidr", "application"
-    /**
-     * @generated from protobuf field: string target = 3
-     */
-    target: string;
-    /**
-     * @generated from protobuf field: int32 max_requests = 4
-     */
-    maxRequests: number;
-    /**
-     * @generated from protobuf field: int32 window_seconds = 5
-     */
-    windowSeconds: number;
-}
-/**
- * @generated from protobuf message sid.v1.admin.RateLimitDashboard
- */
-export interface RateLimitDashboard {
-    /**
-     * @generated from protobuf field: int32 total_blocked_last_hour = 1
-     */
-    totalBlockedLastHour: number;
-    /**
-     * @generated from protobuf field: int32 total_blocked_last_day = 2
-     */
-    totalBlockedLastDay: number;
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.RateLimitTopEntry top_blocked_ips = 3
-     */
-    topBlockedIps: RateLimitTopEntry[];
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.RateLimitTopEntry top_blocked_endpoints = 4
-     */
-    topBlockedEndpoints: RateLimitTopEntry[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.RateLimitTopEntry
- */
-export interface RateLimitTopEntry {
-    /**
-     * @generated from protobuf field: string key = 1
-     */
-    key: string;
-    /**
-     * @generated from protobuf field: int32 count = 2
-     */
-    count: number;
-}
-// ══════════════════════════════════════════════════════════════════════════
-// Anomaly Rules
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * @generated from protobuf message sid.v1.admin.AnomalyRule
- */
-export interface AnomalyRule {
-    /**
-     * @generated from protobuf field: string id = 1
-     */
-    id: string;
-    /**
-     * @generated from protobuf field: string name = 2
-     */
-    name: string;
-    /**
-     * @generated from protobuf field: string description = 3
-     */
-    description: string;
-    /**
-     * @generated from protobuf field: sid.v1.admin.AnomalyRuleType type = 4
-     */
-    type: AnomalyRuleType;
-    /**
-     * @generated from protobuf field: bool enabled = 5
-     */
-    enabled: boolean;
-    /**
-     * Contribution of the rule to the risk score (0-100). Read-only where the
-     * server does not let administrators tune rules.
-     *
-     * @generated from protobuf field: int32 weight = 6
-     */
-    weight: number;
-}
-/**
- * @generated from protobuf message sid.v1.admin.ListAnomalyRulesResponse
- */
-export interface ListAnomalyRulesResponse {
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.AnomalyRule rules = 1
-     */
-    rules: AnomalyRule[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.GetAnomalyEventLogRequest
- */
-export interface GetAnomalyEventLogRequest {
-    /**
-     * @generated from protobuf field: int32 page_size = 1
-     */
-    pageSize: number;
-    /**
-     * @generated from protobuf field: string page_token = 2
-     */
-    pageToken: string;
-    /**
-     * @generated from protobuf field: optional string rule_id = 3
-     */
-    ruleId?: string;
-}
-/**
- * @generated from protobuf message sid.v1.admin.AnomalyEventLog
- */
-export interface AnomalyEventLog {
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.AnomalyEvent events = 1
-     */
-    events: AnomalyEvent[];
-    /**
-     * @generated from protobuf field: string next_page_token = 2
-     */
-    nextPageToken: string;
-}
-/**
- * @generated from protobuf message sid.v1.admin.AnomalyEvent
- */
-export interface AnomalyEvent {
-    /**
-     * @generated from protobuf field: string id = 1
-     */
-    id: string;
-    /**
-     * @generated from protobuf field: string rule_id = 2
-     */
-    ruleId: string;
-    /**
-     * @generated from protobuf field: string profile_id = 3
-     */
-    profileId: string;
-    /**
-     * @generated from protobuf field: string ip_address = 4
-     */
-    ipAddress: string;
-    /**
-     * @generated from protobuf field: string description = 5
-     */
-    description: string;
-    /**
-     * @generated from protobuf field: int32 risk_score = 6
-     */
-    riskScore: number;
-    /**
-     * @generated from protobuf field: google.protobuf.Timestamp timestamp = 7
-     */
-    timestamp?: Timestamp;
-}
-// ══════════════════════════════════════════════════════════════════════════
-// CAPTCHA
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * @generated from protobuf message sid.v1.admin.CaptchaConfig
- */
-export interface CaptchaConfig {
-    /**
-     * @generated from protobuf field: bool enabled = 1
-     */
-    enabled: boolean;
-    /**
-     * @generated from protobuf field: sid.v1.admin.CaptchaProvider provider = 2
-     */
-    provider: CaptchaProvider;
-    /**
-     * @generated from protobuf field: string site_key = 3
-     */
-    siteKey: string;
-    /**
-     * @generated from protobuf field: string secret_key = 4
-     */
-    secretKey: string; // Write-only, masked in responses
-    /**
-     * @generated from protobuf field: double score_threshold = 5
-     */
-    scoreThreshold: number; // For reCAPTCHA v3 / Turnstile
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.CaptchaTrigger triggers = 6
-     */
-    triggers: CaptchaTrigger[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.TestCaptchaProviderRequest
- */
-export interface TestCaptchaProviderRequest {
-    /**
-     * @generated from protobuf field: sid.v1.admin.CaptchaProvider provider = 1
-     */
-    provider: CaptchaProvider;
-    /**
-     * @generated from protobuf field: string site_key = 2
-     */
-    siteKey: string;
-    /**
-     * @generated from protobuf field: string secret_key = 3
-     */
-    secretKey: string;
-}
-/**
- * @generated from protobuf message sid.v1.admin.TestCaptchaProviderResponse
- */
-export interface TestCaptchaProviderResponse {
-    /**
-     * @generated from protobuf field: bool success = 1
-     */
-    success: boolean;
-    /**
-     * @generated from protobuf field: string error = 2
-     */
-    error: string;
-}
-// ══════════════════════════════════════════════════════════════════════════
-// Security Policy
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * Full org-level security policy response: the stored policy, or the
- * server's fixed baseline when it is not configurable (`read_only`).
- *
- * @generated from protobuf message sid.v1.admin.SecurityPolicyResponse
- */
-export interface SecurityPolicyResponse {
-    /**
-     * Overall enforcement mode.
-     *
-     * @generated from protobuf field: string enforcement_mode = 1
-     */
-    enforcementMode: string; // "hard", "soft", "audit"
-    /**
-     * Sub-policy toggles.
-     *
-     * @generated from protobuf field: bool rate_limits_enabled = 2
-     */
-    rateLimitsEnabled: boolean;
-    /**
-     * @generated from protobuf field: bool anomaly_detection_enabled = 3
-     */
-    anomalyDetectionEnabled: boolean;
-    /**
-     * @generated from protobuf field: bool captcha_enabled = 4
-     */
-    captchaEnabled: boolean;
-    /**
-     * @generated from protobuf field: bool breach_detection_enabled = 5
-     */
-    breachDetectionEnabled: boolean;
-    /**
-     * @generated from protobuf field: bool enrollment_enabled = 6
-     */
-    enrollmentEnabled: boolean;
-    /**
-     * Auth requirements.
-     *
-     * @generated from protobuf field: string min_auth_level = 7
-     */
-    minAuthLevel: string; // "basic", "standard", "elevated", "critical"
-    /**
-     * @generated from protobuf field: string mfa_enforcement = 8
-     */
-    mfaEnforcement: string; // "optional", "required", "adaptive"
-    /**
-     * @generated from protobuf field: repeated string allowed_mfa_methods = 9
-     */
-    allowedMfaMethods: string[];
-    /**
-     * @generated from protobuf field: bool require_phishing_resistant = 10
-     */
-    requirePhishingResistant: boolean;
-    /**
-     * Password requirements.
-     *
-     * @generated from protobuf field: int32 password_min_length = 11
-     */
-    passwordMinLength: number;
-    /**
-     * @generated from protobuf field: int32 password_max_age_days = 12
-     */
-    passwordMaxAgeDays: number;
-    /**
-     * Session requirements.
-     *
-     * @generated from protobuf field: int32 session_max_lifetime_hours = 13
-     */
-    sessionMaxLifetimeHours: number;
-    /**
-     * @generated from protobuf field: int32 session_idle_timeout_hours = 14
-     */
-    sessionIdleTimeoutHours: number;
-    /**
-     * @generated from protobuf field: int32 session_max_concurrent = 15
-     */
-    sessionMaxConcurrent: number;
-    /**
-     * Network restrictions.
-     *
-     * @generated from protobuf field: sid.v1.admin.NetworkPolicy network = 16
-     */
-    network?: NetworkPolicy;
-    /**
-     * Whether the policy is the server's fixed baseline and cannot be changed.
-     *
-     * @generated from protobuf field: bool read_only = 17
-     */
-    readOnly: boolean;
-    /**
-     * Whether a single passkey with user verification satisfies MFA requirement.
-     * When true (default): passkey login grants standard assurance (no second factor needed).
-     * When false: passkey login grants basic assurance only.
-     *
-     * @generated from protobuf field: bool passkey_satisfies_mfa = 18
-     */
-    passkeySatisfiesMfa: boolean;
-}
-/**
- * @generated from protobuf message sid.v1.admin.ApplicationOverride
- */
-export interface ApplicationOverride {
-    /**
-     * @generated from protobuf field: string application_id = 1
-     */
-    applicationId: string;
-    /**
-     * @generated from protobuf field: string application_name = 2
-     */
-    applicationName: string;
-    /**
-     * @generated from protobuf field: optional string min_auth_level = 3
-     */
-    minAuthLevel?: string;
-    /**
-     * @generated from protobuf field: optional string enforcement_mode = 4
-     */
-    enforcementMode?: string;
-    /**
-     * @generated from protobuf field: repeated string required_amr = 5
-     */
-    requiredAmr: string[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.ListApplicationOverridesResponse
- */
-export interface ListApplicationOverridesResponse {
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.ApplicationOverride overrides = 1
-     */
-    overrides: ApplicationOverride[];
-}
-/**
- * Request for effective policy on a specific application.
- *
- * @generated from protobuf message sid.v1.admin.GetEffectivePolicyRequest
- */
-export interface GetEffectivePolicyRequest {
-    /**
-     * @generated from protobuf field: string client_id = 1
-     */
-    clientId: string;
-}
-/**
- * Request for enforcement evaluation.
- *
- * @generated from protobuf message sid.v1.admin.EvaluateEnforcementRequest
- */
-export interface EvaluateEnforcementRequest {
-    /**
-     * @generated from protobuf field: string profile_id = 1
-     */
-    profileId: string;
-    /**
-     * @generated from protobuf field: string client_id = 2
-     */
-    clientId: string; // Which application
-}
-/**
- * @generated from protobuf message sid.v1.admin.EvaluateEnforcementResponse
- */
-export interface EvaluateEnforcementResponse {
-    /**
-     * @generated from protobuf field: sid.v1.admin.EnforcementAction action = 1
-     */
-    action: EnforcementAction;
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.PolicyViolation violations = 2
-     */
-    violations: PolicyViolation[];
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.PolicyRequiredAction required_actions = 3
-     */
-    requiredActions: PolicyRequiredAction[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.PolicyViolation
- */
-export interface PolicyViolation {
-    /**
-     * @generated from protobuf field: string requirement = 1
-     */
-    requirement: string; // "mfa_required", "min_auth_level", etc.
-    /**
-     * @generated from protobuf field: string current = 2
-     */
-    current: string; // Current user state
-    /**
-     * @generated from protobuf field: string required = 3
-     */
-    required: string; // Required by policy
-}
-/**
- * @generated from protobuf message sid.v1.admin.PolicyRequiredAction
- */
-export interface PolicyRequiredAction {
-    /**
-     * @generated from protobuf field: string action_type = 1
-     */
-    actionType: string; // "enroll_mfa", "step_up_auth", "change_password", etc.
-    /**
-     * @generated from protobuf field: string description = 2
-     */
-    description: string;
-}
-// ══════════════════════════════════════════════════════════════════════════
-// Breach Detection
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * @generated from protobuf message sid.v1.admin.BreachDetectionConfig
- */
-export interface BreachDetectionConfig {
-    /**
-     * @generated from protobuf field: bool enabled = 1
-     */
-    enabled: boolean;
-    /**
-     * @generated from protobuf field: bool check_on_login = 2
-     */
-    checkOnLogin: boolean;
-    /**
-     * @generated from protobuf field: bool check_on_password_change = 3
-     */
-    checkOnPasswordChange: boolean;
-    /**
-     * @generated from protobuf field: bool force_password_change_on_breach = 4
-     */
-    forcePasswordChangeOnBreach: boolean;
-    /**
-     * @generated from protobuf field: string provider = 5
-     */
-    provider: string; // "hibp" (Have I Been Pwned k-anonymity API)
-}
-// ══════════════════════════════════════════════════════════════════════════
-// Network Policy
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * Network restrictions — country blocking, Tor/datacenter IP filtering.
- * Sub-policy of SecurityPolicy. Enforced at login via anomaly detection rules
- * (country_restriction, tor_exit_node, datacenter_ip).
- *
- * @generated from protobuf message sid.v1.admin.NetworkPolicy
- */
-export interface NetworkPolicy {
-    /**
-     * Country allow-list (ISO 3166-1 alpha-2). Empty = all countries allowed.
-     * When non-empty, ONLY listed countries are permitted (allow-list mode).
-     * Mutually exclusive with blocked_countries.
-     *
-     * @generated from protobuf field: repeated string allowed_countries = 1
-     */
-    allowedCountries: string[];
-    /**
-     * Country block-list (ISO 3166-1 alpha-2). Empty = no countries blocked.
-     * Mutually exclusive with allowed_countries.
-     *
-     * @generated from protobuf field: repeated string blocked_countries = 2
-     */
-    blockedCountries: string[];
-    /**
-     * Block logins from known Tor exit nodes.
-     * Uses auto-updated CDN blocklist.
-     *
-     * @generated from protobuf field: bool block_tor = 3
-     */
-    blockTor: boolean;
-    /**
-     * Block logins from datacenter/hosting provider IPs
-     * (AWS, GCP, Azure, DigitalOcean, etc.) via MaxMind ASN database.
-     *
-     * @generated from protobuf field: bool block_datacenter_ips = 4
-     */
-    blockDatacenterIps: boolean;
-    /**
-     * Reaction for network policy violations.
-     *
-     * @generated from protobuf field: sid.v1.admin.NetworkViolationReaction violation_reaction = 5
-     */
-    violationReaction: NetworkViolationReaction;
-}
-// ══════════════════════════════════════════════════════════════════════════
-// Data Integrity
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * @generated from protobuf message sid.v1.admin.RunIntegrityCheckRequest
- */
-export interface RunIntegrityCheckRequest {
-    /**
-     * Which layers to check (empty = all the server checks), e.g.
-     * "audit_chain", "graph_consistency". A layer the server does not check
-     * returns pass with 0 entities.
-     *
-     * @generated from protobuf field: repeated string layers = 1
-     */
-    layers: string[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.IntegrityCheckResponse
- */
-export interface IntegrityCheckResponse {
-    /**
-     * @generated from protobuf field: bool passed = 1
-     */
-    passed: boolean;
-    /**
-     * @generated from protobuf field: int64 total_entities_checked = 2
-     */
-    totalEntitiesChecked: bigint;
-    /**
-     * @generated from protobuf field: int64 total_issues_found = 3
-     */
-    totalIssuesFound: bigint;
-    /**
-     * @generated from protobuf field: int64 duration_ms = 4
-     */
-    durationMs: bigint;
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.IntegrityLayerResult layers = 5
-     */
-    layers: IntegrityLayerResult[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.IntegrityLayerResult
- */
-export interface IntegrityLayerResult {
-    /**
-     * @generated from protobuf field: string layer = 1
-     */
-    layer: string; // "audit_chain", "graph_consistency", etc.
-    /**
-     * @generated from protobuf field: int64 entities_checked = 2
-     */
-    entitiesChecked: bigint;
-    /**
-     * @generated from protobuf field: int64 entities_passed = 3
-     */
-    entitiesPassed: bigint;
-    /**
-     * @generated from protobuf field: int64 issues_found = 4
-     */
-    issuesFound: bigint;
-    /**
-     * @generated from protobuf field: int64 duration_ms = 5
-     */
-    durationMs: bigint;
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.IntegrityIssue issues = 6
-     */
-    issues: IntegrityIssue[];
-}
-/**
- * @generated from protobuf message sid.v1.admin.IntegrityIssue
- */
-export interface IntegrityIssue {
-    /**
-     * @generated from protobuf field: string layer = 1
-     */
-    layer: string;
-    /**
-     * @generated from protobuf field: string severity = 2
-     */
-    severity: string; // "info", "warning", "error", "critical"
-    /**
-     * @generated from protobuf field: string entity_type = 3
-     */
-    entityType: string;
-    /**
-     * @generated from protobuf field: string entity_id = 4
-     */
-    entityId: string;
-    /**
-     * @generated from protobuf field: string description = 5
-     */
-    description: string;
-    /**
-     * @generated from protobuf field: bool auto_repairable = 6
-     */
-    autoRepairable: boolean;
-}
-// ══════════════════════════════════════════════════════════════════════════
-// IP Allowlist
-// ══════════════════════════════════════════════════════════════════════════
-
-/**
- * Add an IP address or CIDR range to the global allowlist.
- * Allowlisted IPs override ALL negative IP intelligence labels (Tor, datacenter, blocklist).
- *
- * @generated from protobuf message sid.v1.admin.AddIpAllowlistEntryRequest
- */
-export interface AddIpAllowlistEntryRequest {
-    /**
-     * IP address or CIDR (e.g., "10.0.0.0/8", "192.168.1.1").
-     *
-     * @generated from protobuf field: string cidr = 1
-     */
-    cidr: string;
-    /**
-     * Optional human-readable description (e.g., "Office VPN", "CI/CD runner").
-     *
-     * @generated from protobuf field: string description = 2
-     */
-    description: string;
-}
-/**
- * Remove an IP address or CIDR from the global allowlist.
- *
- * @generated from protobuf message sid.v1.admin.RemoveIpAllowlistEntryRequest
- */
-export interface RemoveIpAllowlistEntryRequest {
-    /**
-     * Exact CIDR to remove (must match stored value).
-     *
-     * @generated from protobuf field: string cidr = 1
-     */
-    cidr: string;
-}
-/**
- * Current state of the IP allowlist.
- *
- * @generated from protobuf message sid.v1.admin.IpAllowlistResponse
- */
-export interface IpAllowlistResponse {
-    /**
-     * @generated from protobuf field: repeated sid.v1.admin.IpAllowlistEntry entries = 1
-     */
-    entries: IpAllowlistEntry[];
-}
-/**
- * A single IP allowlist entry.
- *
- * @generated from protobuf message sid.v1.admin.IpAllowlistEntry
- */
-export interface IpAllowlistEntry {
-    /**
-     * @generated from protobuf field: string cidr = 1
-     */
-    cidr: string;
-    /**
-     * @generated from protobuf field: string description = 2
-     */
-    description: string;
-    /**
-     * @generated from protobuf field: google.protobuf.Timestamp created_at = 3
-     */
-    createdAt?: Timestamp;
-}
-/**
- * @generated from protobuf enum sid.v1.admin.PasswordPolicyRuleType
- */
-export enum PasswordPolicyRuleType {
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_MIN_LENGTH = 1;
-     */
-    MIN_LENGTH = 1,
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_UPPERCASE = 2;
-     */
-    UPPERCASE = 2,
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_LOWERCASE = 3;
-     */
-    LOWERCASE = 3,
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_DIGITS = 4;
-     */
-    DIGITS = 4,
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_SPECIAL_CHARS = 5;
-     */
-    SPECIAL_CHARS = 5,
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_NOT_USERNAME = 6;
-     */
-    NOT_USERNAME = 6,
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_NOT_EMAIL = 7;
-     */
-    NOT_EMAIL = 7,
-    /**
-     * value = last N
-     *
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_PASSWORD_HISTORY = 8;
-     */
-    PASSWORD_HISTORY = 8,
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_REGEX = 9;
-     */
-    REGEX = 9,
-    /**
-     * @generated from protobuf enum value: PASSWORD_POLICY_RULE_TYPE_MAX_AGE_DAYS = 10;
-     */
-    MAX_AGE_DAYS = 10
-}
-/**
- * @generated from protobuf enum sid.v1.admin.BruteForceLockoutMode
- */
-export enum BruteForceLockoutMode {
-    /**
-     * @generated from protobuf enum value: BRUTE_FORCE_LOCKOUT_MODE_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * @generated from protobuf enum value: BRUTE_FORCE_LOCKOUT_MODE_PERMANENT = 1;
-     */
-    PERMANENT = 1,
-    /**
-     * @generated from protobuf enum value: BRUTE_FORCE_LOCKOUT_MODE_TEMPORARY = 2;
-     */
-    TEMPORARY = 2,
-    /**
-     * @generated from protobuf enum value: BRUTE_FORCE_LOCKOUT_MODE_PROGRESSIVE = 3;
-     */
-    PROGRESSIVE = 3
-}
-/**
- * @generated from protobuf enum sid.v1.admin.AnomalyRuleType
- */
-export enum AnomalyRuleType {
-    /**
-     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_IMPOSSIBLE_TRAVEL = 1;
-     */
-    IMPOSSIBLE_TRAVEL = 1,
-    /**
-     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_NEW_DEVICE = 2;
-     */
-    NEW_DEVICE = 2,
-    /**
-     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_NEW_COUNTRY = 3;
-     */
-    NEW_COUNTRY = 3,
-    /**
-     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_CREDENTIAL_STUFFING = 4;
-     */
-    CREDENTIAL_STUFFING = 4,
-    /**
-     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_BRUTE_FORCE = 5;
-     */
-    BRUTE_FORCE = 5,
-    /**
-     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_TOKEN_ABUSE = 6;
-     */
-    TOKEN_ABUSE = 6,
-    /**
-     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_SESSION_ANOMALY = 7;
-     */
-    SESSION_ANOMALY = 7,
-    /**
-     * @generated from protobuf enum value: ANOMALY_RULE_TYPE_CUSTOM = 8;
-     */
-    CUSTOM = 8
-}
-/**
- * @generated from protobuf enum sid.v1.admin.CaptchaProvider
- */
-export enum CaptchaProvider {
-    /**
-     * @generated from protobuf enum value: CAPTCHA_PROVIDER_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * @generated from protobuf enum value: CAPTCHA_PROVIDER_RECAPTCHA_V2 = 1;
-     */
-    RECAPTCHA_V2 = 1,
-    /**
-     * @generated from protobuf enum value: CAPTCHA_PROVIDER_RECAPTCHA_V3 = 2;
-     */
-    RECAPTCHA_V3 = 2,
-    /**
-     * @generated from protobuf enum value: CAPTCHA_PROVIDER_HCAPTCHA = 3;
-     */
-    HCAPTCHA = 3,
-    /**
-     * @generated from protobuf enum value: CAPTCHA_PROVIDER_TURNSTILE = 4;
-     */
-    TURNSTILE = 4
-}
-/**
- * @generated from protobuf enum sid.v1.admin.CaptchaTrigger
- */
-export enum CaptchaTrigger {
-    /**
-     * @generated from protobuf enum value: CAPTCHA_TRIGGER_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * @generated from protobuf enum value: CAPTCHA_TRIGGER_LOGIN = 1;
-     */
-    LOGIN = 1,
-    /**
-     * @generated from protobuf enum value: CAPTCHA_TRIGGER_REGISTER = 2;
-     */
-    REGISTER = 2,
-    /**
-     * @generated from protobuf enum value: CAPTCHA_TRIGGER_PASSWORD_RESET = 3;
-     */
-    PASSWORD_RESET = 3,
-    /**
-     * @generated from protobuf enum value: CAPTCHA_TRIGGER_AFTER_FAILURES = 4;
-     */
-    AFTER_FAILURES = 4
-}
-/**
- * @generated from protobuf enum sid.v1.admin.EnforcementAction
- */
-export enum EnforcementAction {
-    /**
-     * @generated from protobuf enum value: ENFORCEMENT_ACTION_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * @generated from protobuf enum value: ENFORCEMENT_ACTION_ALLOW = 1;
-     */
-    ALLOW = 1,
-    /**
-     * @generated from protobuf enum value: ENFORCEMENT_ACTION_STEP_UP = 2;
-     */
-    STEP_UP = 2,
-    /**
-     * @generated from protobuf enum value: ENFORCEMENT_ACTION_GRACE = 3;
-     */
-    GRACE = 3,
-    /**
-     * @generated from protobuf enum value: ENFORCEMENT_ACTION_BLOCK = 4;
-     */
-    BLOCK = 4
-}
-/**
- * How to handle network policy violations.
- *
- * @generated from protobuf enum sid.v1.admin.NetworkViolationReaction
- */
-export enum NetworkViolationReaction {
-    /**
-     * @generated from protobuf enum value: NETWORK_VIOLATION_REACTION_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * Deny login immediately. The default.
-     *
-     * @generated from protobuf enum value: NETWORK_VIOLATION_REACTION_BLOCK = 1;
-     */
-    BLOCK = 1,
-    /**
-     * Require additional authentication factor.
-     *
-     * @generated from protobuf enum value: NETWORK_VIOLATION_REACTION_STEP_UP = 2;
-     */
-    STEP_UP = 2,
-    /**
-     * Allow but trigger alert to admin (audit mode).
-     *
-     * @generated from protobuf enum value: NETWORK_VIOLATION_REACTION_ALERT = 3;
-     */
-    ALERT = 3
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class GetPasswordPolicyRequest$Type extends MessageType<GetPasswordPolicyRequest> {
-    constructor() {
-        super("sid.v1.admin.GetPasswordPolicyRequest", []);
-    }
-    create(value?: PartialMessage<GetPasswordPolicyRequest>): GetPasswordPolicyRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetPasswordPolicyRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetPasswordPolicyRequest): GetPasswordPolicyRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetPasswordPolicyRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetPasswordPolicyRequest
- */
-export const GetPasswordPolicyRequest = new GetPasswordPolicyRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetBruteForceConfigRequest$Type extends MessageType<GetBruteForceConfigRequest> {
-    constructor() {
-        super("sid.v1.admin.GetBruteForceConfigRequest", []);
-    }
-    create(value?: PartialMessage<GetBruteForceConfigRequest>): GetBruteForceConfigRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetBruteForceConfigRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetBruteForceConfigRequest): GetBruteForceConfigRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetBruteForceConfigRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetBruteForceConfigRequest
- */
-export const GetBruteForceConfigRequest = new GetBruteForceConfigRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetSecurityHeadersRequest$Type extends MessageType<GetSecurityHeadersRequest> {
-    constructor() {
-        super("sid.v1.admin.GetSecurityHeadersRequest", []);
-    }
-    create(value?: PartialMessage<GetSecurityHeadersRequest>): GetSecurityHeadersRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetSecurityHeadersRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetSecurityHeadersRequest): GetSecurityHeadersRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetSecurityHeadersRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetSecurityHeadersRequest
- */
-export const GetSecurityHeadersRequest = new GetSecurityHeadersRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetRateLimitConfigRequest$Type extends MessageType<GetRateLimitConfigRequest> {
-    constructor() {
-        super("sid.v1.admin.GetRateLimitConfigRequest", []);
-    }
-    create(value?: PartialMessage<GetRateLimitConfigRequest>): GetRateLimitConfigRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetRateLimitConfigRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetRateLimitConfigRequest): GetRateLimitConfigRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetRateLimitConfigRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetRateLimitConfigRequest
- */
-export const GetRateLimitConfigRequest = new GetRateLimitConfigRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetRateLimitDashboardRequest$Type extends MessageType<GetRateLimitDashboardRequest> {
-    constructor() {
-        super("sid.v1.admin.GetRateLimitDashboardRequest", []);
-    }
-    create(value?: PartialMessage<GetRateLimitDashboardRequest>): GetRateLimitDashboardRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetRateLimitDashboardRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetRateLimitDashboardRequest): GetRateLimitDashboardRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetRateLimitDashboardRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetRateLimitDashboardRequest
- */
-export const GetRateLimitDashboardRequest = new GetRateLimitDashboardRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAnomalyRulesRequest$Type extends MessageType<ListAnomalyRulesRequest> {
-    constructor() {
-        super("sid.v1.admin.ListAnomalyRulesRequest", []);
-    }
-    create(value?: PartialMessage<ListAnomalyRulesRequest>): ListAnomalyRulesRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<ListAnomalyRulesRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAnomalyRulesRequest): ListAnomalyRulesRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAnomalyRulesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.ListAnomalyRulesRequest
- */
-export const ListAnomalyRulesRequest = new ListAnomalyRulesRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetCaptchaConfigRequest$Type extends MessageType<GetCaptchaConfigRequest> {
-    constructor() {
-        super("sid.v1.admin.GetCaptchaConfigRequest", []);
-    }
-    create(value?: PartialMessage<GetCaptchaConfigRequest>): GetCaptchaConfigRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetCaptchaConfigRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCaptchaConfigRequest): GetCaptchaConfigRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetCaptchaConfigRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetCaptchaConfigRequest
- */
-export const GetCaptchaConfigRequest = new GetCaptchaConfigRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetSecurityPolicyRequest$Type extends MessageType<GetSecurityPolicyRequest> {
-    constructor() {
-        super("sid.v1.admin.GetSecurityPolicyRequest", []);
-    }
-    create(value?: PartialMessage<GetSecurityPolicyRequest>): GetSecurityPolicyRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetSecurityPolicyRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetSecurityPolicyRequest): GetSecurityPolicyRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetSecurityPolicyRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetSecurityPolicyRequest
- */
-export const GetSecurityPolicyRequest = new GetSecurityPolicyRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListApplicationOverridesRequest$Type extends MessageType<ListApplicationOverridesRequest> {
-    constructor() {
-        super("sid.v1.admin.ListApplicationOverridesRequest", []);
-    }
-    create(value?: PartialMessage<ListApplicationOverridesRequest>): ListApplicationOverridesRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<ListApplicationOverridesRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListApplicationOverridesRequest): ListApplicationOverridesRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListApplicationOverridesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.ListApplicationOverridesRequest
- */
-export const ListApplicationOverridesRequest = new ListApplicationOverridesRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetNetworkPolicyRequest$Type extends MessageType<GetNetworkPolicyRequest> {
-    constructor() {
-        super("sid.v1.admin.GetNetworkPolicyRequest", []);
-    }
-    create(value?: PartialMessage<GetNetworkPolicyRequest>): GetNetworkPolicyRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetNetworkPolicyRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetNetworkPolicyRequest): GetNetworkPolicyRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetNetworkPolicyRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetNetworkPolicyRequest
- */
-export const GetNetworkPolicyRequest = new GetNetworkPolicyRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetBreachDetectionConfigRequest$Type extends MessageType<GetBreachDetectionConfigRequest> {
-    constructor() {
-        super("sid.v1.admin.GetBreachDetectionConfigRequest", []);
-    }
-    create(value?: PartialMessage<GetBreachDetectionConfigRequest>): GetBreachDetectionConfigRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<GetBreachDetectionConfigRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetBreachDetectionConfigRequest): GetBreachDetectionConfigRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetBreachDetectionConfigRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetBreachDetectionConfigRequest
- */
-export const GetBreachDetectionConfigRequest = new GetBreachDetectionConfigRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListIpAllowlistEntriesRequest$Type extends MessageType<ListIpAllowlistEntriesRequest> {
-    constructor() {
-        super("sid.v1.admin.ListIpAllowlistEntriesRequest", []);
-    }
-    create(value?: PartialMessage<ListIpAllowlistEntriesRequest>): ListIpAllowlistEntriesRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        if (value !== undefined)
-            reflectionMergePartial<ListIpAllowlistEntriesRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListIpAllowlistEntriesRequest): ListIpAllowlistEntriesRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListIpAllowlistEntriesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.ListIpAllowlistEntriesRequest
- */
-export const ListIpAllowlistEntriesRequest = new ListIpAllowlistEntriesRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class PasswordPolicy$Type extends MessageType<PasswordPolicy> {
-    constructor() {
-        super("sid.v1.admin.PasswordPolicy", [
-            { no: 1, name: "rules", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => PasswordPolicyRule }
-        ]);
-    }
-    create(value?: PartialMessage<PasswordPolicy>): PasswordPolicy {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.rules = [];
-        if (value !== undefined)
-            reflectionMergePartial<PasswordPolicy>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PasswordPolicy): PasswordPolicy {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated sid.v1.admin.PasswordPolicyRule rules */ 1:
-                    message.rules.push(PasswordPolicyRule.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: PasswordPolicy, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated sid.v1.admin.PasswordPolicyRule rules = 1; */
-        for (let i = 0; i < message.rules.length; i++)
-            PasswordPolicyRule.internalBinaryWrite(message.rules[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.PasswordPolicy
- */
-export const PasswordPolicy = new PasswordPolicy$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class PasswordPolicyRule$Type extends MessageType<PasswordPolicyRule> {
-    constructor() {
-        super("sid.v1.admin.PasswordPolicyRule", [
-            { no: 1, name: "type", kind: "enum", T: () => ["sid.v1.admin.PasswordPolicyRuleType", PasswordPolicyRuleType, "PASSWORD_POLICY_RULE_TYPE_"] },
-            { no: 2, name: "value", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 3, name: "pattern", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<PasswordPolicyRule>): PasswordPolicyRule {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.type = 0;
-        message.value = 0;
-        message.pattern = "";
-        if (value !== undefined)
-            reflectionMergePartial<PasswordPolicyRule>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PasswordPolicyRule): PasswordPolicyRule {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* sid.v1.admin.PasswordPolicyRuleType type */ 1:
-                    message.type = reader.int32();
-                    break;
-                case /* int32 value */ 2:
-                    message.value = reader.int32();
-                    break;
-                case /* string pattern */ 3:
-                    message.pattern = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: PasswordPolicyRule, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* sid.v1.admin.PasswordPolicyRuleType type = 1; */
-        if (message.type !== 0)
-            writer.tag(1, WireType.Varint).int32(message.type);
-        /* int32 value = 2; */
-        if (message.value !== 0)
-            writer.tag(2, WireType.Varint).int32(message.value);
-        /* string pattern = 3; */
-        if (message.pattern !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.pattern);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.PasswordPolicyRule
- */
-export const PasswordPolicyRule = new PasswordPolicyRule$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class BruteForceConfig$Type extends MessageType<BruteForceConfig> {
-    constructor() {
-        super("sid.v1.admin.BruteForceConfig", [
-            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 2, name: "mode", kind: "enum", T: () => ["sid.v1.admin.BruteForceLockoutMode", BruteForceLockoutMode, "BRUTE_FORCE_LOCKOUT_MODE_"] },
-            { no: 3, name: "max_login_failures", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 4, name: "lockout_duration_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 5, name: "max_lockout_duration_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 6, name: "failure_reset_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 7, name: "quick_login_check_ms", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
-        ]);
-    }
-    create(value?: PartialMessage<BruteForceConfig>): BruteForceConfig {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.enabled = false;
-        message.mode = 0;
-        message.maxLoginFailures = 0;
-        message.lockoutDurationSeconds = 0;
-        message.maxLockoutDurationSeconds = 0;
-        message.failureResetSeconds = 0;
-        message.quickLoginCheckMs = 0;
-        if (value !== undefined)
-            reflectionMergePartial<BruteForceConfig>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BruteForceConfig): BruteForceConfig {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bool enabled */ 1:
-                    message.enabled = reader.bool();
-                    break;
-                case /* sid.v1.admin.BruteForceLockoutMode mode */ 2:
-                    message.mode = reader.int32();
-                    break;
-                case /* int32 max_login_failures */ 3:
-                    message.maxLoginFailures = reader.int32();
-                    break;
-                case /* int32 lockout_duration_seconds */ 4:
-                    message.lockoutDurationSeconds = reader.int32();
-                    break;
-                case /* int32 max_lockout_duration_seconds */ 5:
-                    message.maxLockoutDurationSeconds = reader.int32();
-                    break;
-                case /* int32 failure_reset_seconds */ 6:
-                    message.failureResetSeconds = reader.int32();
-                    break;
-                case /* int32 quick_login_check_ms */ 7:
-                    message.quickLoginCheckMs = reader.int32();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: BruteForceConfig, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bool enabled = 1; */
-        if (message.enabled !== false)
-            writer.tag(1, WireType.Varint).bool(message.enabled);
-        /* sid.v1.admin.BruteForceLockoutMode mode = 2; */
-        if (message.mode !== 0)
-            writer.tag(2, WireType.Varint).int32(message.mode);
-        /* int32 max_login_failures = 3; */
-        if (message.maxLoginFailures !== 0)
-            writer.tag(3, WireType.Varint).int32(message.maxLoginFailures);
-        /* int32 lockout_duration_seconds = 4; */
-        if (message.lockoutDurationSeconds !== 0)
-            writer.tag(4, WireType.Varint).int32(message.lockoutDurationSeconds);
-        /* int32 max_lockout_duration_seconds = 5; */
-        if (message.maxLockoutDurationSeconds !== 0)
-            writer.tag(5, WireType.Varint).int32(message.maxLockoutDurationSeconds);
-        /* int32 failure_reset_seconds = 6; */
-        if (message.failureResetSeconds !== 0)
-            writer.tag(6, WireType.Varint).int32(message.failureResetSeconds);
-        /* int32 quick_login_check_ms = 7; */
-        if (message.quickLoginCheckMs !== 0)
-            writer.tag(7, WireType.Varint).int32(message.quickLoginCheckMs);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.BruteForceConfig
- */
-export const BruteForceConfig = new BruteForceConfig$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SecurityHeaders$Type extends MessageType<SecurityHeaders> {
-    constructor() {
-        super("sid.v1.admin.SecurityHeaders", [
-            { no: 1, name: "x_frame_options", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "content_security_policy", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "x_content_type_options_nosniff", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 4, name: "hsts_max_age", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 5, name: "hsts_include_subdomains", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 6, name: "hsts_preload", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 7, name: "x_xss_protection", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 8, name: "referrer_policy", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<SecurityHeaders>): SecurityHeaders {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.xFrameOptions = "";
-        message.contentSecurityPolicy = "";
-        message.xContentTypeOptionsNosniff = false;
-        message.hstsMaxAge = 0;
-        message.hstsIncludeSubdomains = false;
-        message.hstsPreload = false;
-        message.xXssProtection = false;
-        message.referrerPolicy = "";
-        if (value !== undefined)
-            reflectionMergePartial<SecurityHeaders>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SecurityHeaders): SecurityHeaders {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string x_frame_options */ 1:
-                    message.xFrameOptions = reader.string();
-                    break;
-                case /* string content_security_policy */ 2:
-                    message.contentSecurityPolicy = reader.string();
-                    break;
-                case /* bool x_content_type_options_nosniff */ 3:
-                    message.xContentTypeOptionsNosniff = reader.bool();
-                    break;
-                case /* int32 hsts_max_age */ 4:
-                    message.hstsMaxAge = reader.int32();
-                    break;
-                case /* bool hsts_include_subdomains */ 5:
-                    message.hstsIncludeSubdomains = reader.bool();
-                    break;
-                case /* bool hsts_preload */ 6:
-                    message.hstsPreload = reader.bool();
-                    break;
-                case /* bool x_xss_protection */ 7:
-                    message.xXssProtection = reader.bool();
-                    break;
-                case /* string referrer_policy */ 8:
-                    message.referrerPolicy = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: SecurityHeaders, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string x_frame_options = 1; */
-        if (message.xFrameOptions !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.xFrameOptions);
-        /* string content_security_policy = 2; */
-        if (message.contentSecurityPolicy !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.contentSecurityPolicy);
-        /* bool x_content_type_options_nosniff = 3; */
-        if (message.xContentTypeOptionsNosniff !== false)
-            writer.tag(3, WireType.Varint).bool(message.xContentTypeOptionsNosniff);
-        /* int32 hsts_max_age = 4; */
-        if (message.hstsMaxAge !== 0)
-            writer.tag(4, WireType.Varint).int32(message.hstsMaxAge);
-        /* bool hsts_include_subdomains = 5; */
-        if (message.hstsIncludeSubdomains !== false)
-            writer.tag(5, WireType.Varint).bool(message.hstsIncludeSubdomains);
-        /* bool hsts_preload = 6; */
-        if (message.hstsPreload !== false)
-            writer.tag(6, WireType.Varint).bool(message.hstsPreload);
-        /* bool x_xss_protection = 7; */
-        if (message.xXssProtection !== false)
-            writer.tag(7, WireType.Varint).bool(message.xXssProtection);
-        /* string referrer_policy = 8; */
-        if (message.referrerPolicy !== "")
-            writer.tag(8, WireType.LengthDelimited).string(message.referrerPolicy);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.SecurityHeaders
- */
-export const SecurityHeaders = new SecurityHeaders$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class RateLimitConfig$Type extends MessageType<RateLimitConfig> {
-    constructor() {
-        super("sid.v1.admin.RateLimitConfig", [
-            { no: 1, name: "rules", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => RateLimitRule },
-            { no: 2, name: "overrides", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => RateLimitOverride },
-            { no: 3, name: "ip_allowlist", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<RateLimitConfig>): RateLimitConfig {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.rules = [];
-        message.overrides = [];
-        message.ipAllowlist = [];
-        if (value !== undefined)
-            reflectionMergePartial<RateLimitConfig>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitConfig): RateLimitConfig {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated sid.v1.admin.RateLimitRule rules */ 1:
-                    message.rules.push(RateLimitRule.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* repeated sid.v1.admin.RateLimitOverride overrides */ 2:
-                    message.overrides.push(RateLimitOverride.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* repeated string ip_allowlist */ 3:
-                    message.ipAllowlist.push(reader.string());
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: RateLimitConfig, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated sid.v1.admin.RateLimitRule rules = 1; */
-        for (let i = 0; i < message.rules.length; i++)
-            RateLimitRule.internalBinaryWrite(message.rules[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* repeated sid.v1.admin.RateLimitOverride overrides = 2; */
-        for (let i = 0; i < message.overrides.length; i++)
-            RateLimitOverride.internalBinaryWrite(message.overrides[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* repeated string ip_allowlist = 3; */
-        for (let i = 0; i < message.ipAllowlist.length; i++)
-            writer.tag(3, WireType.LengthDelimited).string(message.ipAllowlist[i]);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.RateLimitConfig
- */
-export const RateLimitConfig = new RateLimitConfig$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class RateLimitRule$Type extends MessageType<RateLimitRule> {
-    constructor() {
-        super("sid.v1.admin.RateLimitRule", [
-            { no: 1, name: "endpoint", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "max_requests", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 3, name: "window_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 4, name: "scope", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<RateLimitRule>): RateLimitRule {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.endpoint = "";
-        message.maxRequests = 0;
-        message.windowSeconds = 0;
-        message.scope = "";
-        if (value !== undefined)
-            reflectionMergePartial<RateLimitRule>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitRule): RateLimitRule {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string endpoint */ 1:
-                    message.endpoint = reader.string();
-                    break;
-                case /* int32 max_requests */ 2:
-                    message.maxRequests = reader.int32();
-                    break;
-                case /* int32 window_seconds */ 3:
-                    message.windowSeconds = reader.int32();
-                    break;
-                case /* string scope */ 4:
-                    message.scope = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: RateLimitRule, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string endpoint = 1; */
-        if (message.endpoint !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.endpoint);
-        /* int32 max_requests = 2; */
-        if (message.maxRequests !== 0)
-            writer.tag(2, WireType.Varint).int32(message.maxRequests);
-        /* int32 window_seconds = 3; */
-        if (message.windowSeconds !== 0)
-            writer.tag(3, WireType.Varint).int32(message.windowSeconds);
-        /* string scope = 4; */
-        if (message.scope !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.scope);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.RateLimitRule
- */
-export const RateLimitRule = new RateLimitRule$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class RateLimitOverride$Type extends MessageType<RateLimitOverride> {
-    constructor() {
-        super("sid.v1.admin.RateLimitOverride", [
-            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "target_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "target", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "max_requests", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 5, name: "window_seconds", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
-        ]);
-    }
-    create(value?: PartialMessage<RateLimitOverride>): RateLimitOverride {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.id = "";
-        message.targetType = "";
-        message.target = "";
-        message.maxRequests = 0;
-        message.windowSeconds = 0;
-        if (value !== undefined)
-            reflectionMergePartial<RateLimitOverride>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitOverride): RateLimitOverride {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string id */ 1:
-                    message.id = reader.string();
-                    break;
-                case /* string target_type */ 2:
-                    message.targetType = reader.string();
-                    break;
-                case /* string target */ 3:
-                    message.target = reader.string();
-                    break;
-                case /* int32 max_requests */ 4:
-                    message.maxRequests = reader.int32();
-                    break;
-                case /* int32 window_seconds */ 5:
-                    message.windowSeconds = reader.int32();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: RateLimitOverride, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string id = 1; */
-        if (message.id !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.id);
-        /* string target_type = 2; */
-        if (message.targetType !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.targetType);
-        /* string target = 3; */
-        if (message.target !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.target);
-        /* int32 max_requests = 4; */
-        if (message.maxRequests !== 0)
-            writer.tag(4, WireType.Varint).int32(message.maxRequests);
-        /* int32 window_seconds = 5; */
-        if (message.windowSeconds !== 0)
-            writer.tag(5, WireType.Varint).int32(message.windowSeconds);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.RateLimitOverride
- */
-export const RateLimitOverride = new RateLimitOverride$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class RateLimitDashboard$Type extends MessageType<RateLimitDashboard> {
-    constructor() {
-        super("sid.v1.admin.RateLimitDashboard", [
-            { no: 1, name: "total_blocked_last_hour", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 2, name: "total_blocked_last_day", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 3, name: "top_blocked_ips", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => RateLimitTopEntry },
-            { no: 4, name: "top_blocked_endpoints", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => RateLimitTopEntry }
-        ]);
-    }
-    create(value?: PartialMessage<RateLimitDashboard>): RateLimitDashboard {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.totalBlockedLastHour = 0;
-        message.totalBlockedLastDay = 0;
-        message.topBlockedIps = [];
-        message.topBlockedEndpoints = [];
-        if (value !== undefined)
-            reflectionMergePartial<RateLimitDashboard>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitDashboard): RateLimitDashboard {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* int32 total_blocked_last_hour */ 1:
-                    message.totalBlockedLastHour = reader.int32();
-                    break;
-                case /* int32 total_blocked_last_day */ 2:
-                    message.totalBlockedLastDay = reader.int32();
-                    break;
-                case /* repeated sid.v1.admin.RateLimitTopEntry top_blocked_ips */ 3:
-                    message.topBlockedIps.push(RateLimitTopEntry.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* repeated sid.v1.admin.RateLimitTopEntry top_blocked_endpoints */ 4:
-                    message.topBlockedEndpoints.push(RateLimitTopEntry.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: RateLimitDashboard, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* int32 total_blocked_last_hour = 1; */
-        if (message.totalBlockedLastHour !== 0)
-            writer.tag(1, WireType.Varint).int32(message.totalBlockedLastHour);
-        /* int32 total_blocked_last_day = 2; */
-        if (message.totalBlockedLastDay !== 0)
-            writer.tag(2, WireType.Varint).int32(message.totalBlockedLastDay);
-        /* repeated sid.v1.admin.RateLimitTopEntry top_blocked_ips = 3; */
-        for (let i = 0; i < message.topBlockedIps.length; i++)
-            RateLimitTopEntry.internalBinaryWrite(message.topBlockedIps[i], writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        /* repeated sid.v1.admin.RateLimitTopEntry top_blocked_endpoints = 4; */
-        for (let i = 0; i < message.topBlockedEndpoints.length; i++)
-            RateLimitTopEntry.internalBinaryWrite(message.topBlockedEndpoints[i], writer.tag(4, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.RateLimitDashboard
- */
-export const RateLimitDashboard = new RateLimitDashboard$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class RateLimitTopEntry$Type extends MessageType<RateLimitTopEntry> {
-    constructor() {
-        super("sid.v1.admin.RateLimitTopEntry", [
-            { no: 1, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "count", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
-        ]);
-    }
-    create(value?: PartialMessage<RateLimitTopEntry>): RateLimitTopEntry {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.key = "";
-        message.count = 0;
-        if (value !== undefined)
-            reflectionMergePartial<RateLimitTopEntry>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RateLimitTopEntry): RateLimitTopEntry {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string key */ 1:
-                    message.key = reader.string();
-                    break;
-                case /* int32 count */ 2:
-                    message.count = reader.int32();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: RateLimitTopEntry, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string key = 1; */
-        if (message.key !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.key);
-        /* int32 count = 2; */
-        if (message.count !== 0)
-            writer.tag(2, WireType.Varint).int32(message.count);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.RateLimitTopEntry
- */
-export const RateLimitTopEntry = new RateLimitTopEntry$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AnomalyRule$Type extends MessageType<AnomalyRule> {
-    constructor() {
-        super("sid.v1.admin.AnomalyRule", [
-            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "type", kind: "enum", T: () => ["sid.v1.admin.AnomalyRuleType", AnomalyRuleType, "ANOMALY_RULE_TYPE_"] },
-            { no: 5, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 6, name: "weight", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
-        ]);
-    }
-    create(value?: PartialMessage<AnomalyRule>): AnomalyRule {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.id = "";
-        message.name = "";
-        message.description = "";
-        message.type = 0;
-        message.enabled = false;
-        message.weight = 0;
-        if (value !== undefined)
-            reflectionMergePartial<AnomalyRule>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AnomalyRule): AnomalyRule {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string id */ 1:
-                    message.id = reader.string();
-                    break;
-                case /* string name */ 2:
-                    message.name = reader.string();
-                    break;
-                case /* string description */ 3:
-                    message.description = reader.string();
-                    break;
-                case /* sid.v1.admin.AnomalyRuleType type */ 4:
-                    message.type = reader.int32();
-                    break;
-                case /* bool enabled */ 5:
-                    message.enabled = reader.bool();
-                    break;
-                case /* int32 weight */ 6:
-                    message.weight = reader.int32();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AnomalyRule, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string id = 1; */
-        if (message.id !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.id);
-        /* string name = 2; */
-        if (message.name !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.name);
-        /* string description = 3; */
-        if (message.description !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.description);
-        /* sid.v1.admin.AnomalyRuleType type = 4; */
-        if (message.type !== 0)
-            writer.tag(4, WireType.Varint).int32(message.type);
-        /* bool enabled = 5; */
-        if (message.enabled !== false)
-            writer.tag(5, WireType.Varint).bool(message.enabled);
-        /* int32 weight = 6; */
-        if (message.weight !== 0)
-            writer.tag(6, WireType.Varint).int32(message.weight);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.AnomalyRule
- */
-export const AnomalyRule = new AnomalyRule$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListAnomalyRulesResponse$Type extends MessageType<ListAnomalyRulesResponse> {
-    constructor() {
-        super("sid.v1.admin.ListAnomalyRulesResponse", [
-            { no: 1, name: "rules", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => AnomalyRule }
-        ]);
-    }
-    create(value?: PartialMessage<ListAnomalyRulesResponse>): ListAnomalyRulesResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.rules = [];
-        if (value !== undefined)
-            reflectionMergePartial<ListAnomalyRulesResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListAnomalyRulesResponse): ListAnomalyRulesResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated sid.v1.admin.AnomalyRule rules */ 1:
-                    message.rules.push(AnomalyRule.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListAnomalyRulesResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated sid.v1.admin.AnomalyRule rules = 1; */
-        for (let i = 0; i < message.rules.length; i++)
-            AnomalyRule.internalBinaryWrite(message.rules[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.ListAnomalyRulesResponse
- */
-export const ListAnomalyRulesResponse = new ListAnomalyRulesResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetAnomalyEventLogRequest$Type extends MessageType<GetAnomalyEventLogRequest> {
-    constructor() {
-        super("sid.v1.admin.GetAnomalyEventLogRequest", [
-            { no: 1, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 2, name: "page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "rule_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetAnomalyEventLogRequest>): GetAnomalyEventLogRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.pageSize = 0;
-        message.pageToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetAnomalyEventLogRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetAnomalyEventLogRequest): GetAnomalyEventLogRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* int32 page_size */ 1:
-                    message.pageSize = reader.int32();
-                    break;
-                case /* string page_token */ 2:
-                    message.pageToken = reader.string();
-                    break;
-                case /* optional string rule_id */ 3:
-                    message.ruleId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetAnomalyEventLogRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* int32 page_size = 1; */
-        if (message.pageSize !== 0)
-            writer.tag(1, WireType.Varint).int32(message.pageSize);
-        /* string page_token = 2; */
-        if (message.pageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.pageToken);
-        /* optional string rule_id = 3; */
-        if (message.ruleId !== undefined)
-            writer.tag(3, WireType.LengthDelimited).string(message.ruleId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetAnomalyEventLogRequest
- */
-export const GetAnomalyEventLogRequest = new GetAnomalyEventLogRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AnomalyEventLog$Type extends MessageType<AnomalyEventLog> {
-    constructor() {
-        super("sid.v1.admin.AnomalyEventLog", [
-            { no: 1, name: "events", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => AnomalyEvent },
-            { no: 2, name: "next_page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<AnomalyEventLog>): AnomalyEventLog {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.events = [];
-        message.nextPageToken = "";
-        if (value !== undefined)
-            reflectionMergePartial<AnomalyEventLog>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AnomalyEventLog): AnomalyEventLog {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated sid.v1.admin.AnomalyEvent events */ 1:
-                    message.events.push(AnomalyEvent.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* string next_page_token */ 2:
-                    message.nextPageToken = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AnomalyEventLog, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated sid.v1.admin.AnomalyEvent events = 1; */
-        for (let i = 0; i < message.events.length; i++)
-            AnomalyEvent.internalBinaryWrite(message.events[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string next_page_token = 2; */
-        if (message.nextPageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextPageToken);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.AnomalyEventLog
- */
-export const AnomalyEventLog = new AnomalyEventLog$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AnomalyEvent$Type extends MessageType<AnomalyEvent> {
-    constructor() {
-        super("sid.v1.admin.AnomalyEvent", [
-            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "rule_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "profile_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "ip_address", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "risk_score", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 7, name: "timestamp", kind: "message", T: () => Timestamp }
-        ]);
-    }
-    create(value?: PartialMessage<AnomalyEvent>): AnomalyEvent {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.id = "";
-        message.ruleId = "";
-        message.profileId = "";
-        message.ipAddress = "";
-        message.description = "";
-        message.riskScore = 0;
-        if (value !== undefined)
-            reflectionMergePartial<AnomalyEvent>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AnomalyEvent): AnomalyEvent {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string id */ 1:
-                    message.id = reader.string();
-                    break;
-                case /* string rule_id */ 2:
-                    message.ruleId = reader.string();
-                    break;
-                case /* string profile_id */ 3:
-                    message.profileId = reader.string();
-                    break;
-                case /* string ip_address */ 4:
-                    message.ipAddress = reader.string();
-                    break;
-                case /* string description */ 5:
-                    message.description = reader.string();
-                    break;
-                case /* int32 risk_score */ 6:
-                    message.riskScore = reader.int32();
-                    break;
-                case /* google.protobuf.Timestamp timestamp */ 7:
-                    message.timestamp = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.timestamp);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AnomalyEvent, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string id = 1; */
-        if (message.id !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.id);
-        /* string rule_id = 2; */
-        if (message.ruleId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.ruleId);
-        /* string profile_id = 3; */
-        if (message.profileId !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.profileId);
-        /* string ip_address = 4; */
-        if (message.ipAddress !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.ipAddress);
-        /* string description = 5; */
-        if (message.description !== "")
-            writer.tag(5, WireType.LengthDelimited).string(message.description);
-        /* int32 risk_score = 6; */
-        if (message.riskScore !== 0)
-            writer.tag(6, WireType.Varint).int32(message.riskScore);
-        /* google.protobuf.Timestamp timestamp = 7; */
-        if (message.timestamp)
-            Timestamp.internalBinaryWrite(message.timestamp, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.AnomalyEvent
- */
-export const AnomalyEvent = new AnomalyEvent$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class CaptchaConfig$Type extends MessageType<CaptchaConfig> {
-    constructor() {
-        super("sid.v1.admin.CaptchaConfig", [
-            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 2, name: "provider", kind: "enum", T: () => ["sid.v1.admin.CaptchaProvider", CaptchaProvider, "CAPTCHA_PROVIDER_"] },
-            { no: 3, name: "site_key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "secret_key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "score_threshold", kind: "scalar", T: 1 /*ScalarType.DOUBLE*/ },
-            { no: 6, name: "triggers", kind: "enum", repeat: 1 /*RepeatType.PACKED*/, T: () => ["sid.v1.admin.CaptchaTrigger", CaptchaTrigger, "CAPTCHA_TRIGGER_"] }
-        ]);
-    }
-    create(value?: PartialMessage<CaptchaConfig>): CaptchaConfig {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.enabled = false;
-        message.provider = 0;
-        message.siteKey = "";
-        message.secretKey = "";
-        message.scoreThreshold = 0;
-        message.triggers = [];
-        if (value !== undefined)
-            reflectionMergePartial<CaptchaConfig>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CaptchaConfig): CaptchaConfig {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bool enabled */ 1:
-                    message.enabled = reader.bool();
-                    break;
-                case /* sid.v1.admin.CaptchaProvider provider */ 2:
-                    message.provider = reader.int32();
-                    break;
-                case /* string site_key */ 3:
-                    message.siteKey = reader.string();
-                    break;
-                case /* string secret_key */ 4:
-                    message.secretKey = reader.string();
-                    break;
-                case /* double score_threshold */ 5:
-                    message.scoreThreshold = reader.double();
-                    break;
-                case /* repeated sid.v1.admin.CaptchaTrigger triggers */ 6:
-                    if (wireType === WireType.LengthDelimited)
-                        for (let e = reader.int32() + reader.pos; reader.pos < e;)
-                            message.triggers.push(reader.int32());
-                    else
-                        message.triggers.push(reader.int32());
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: CaptchaConfig, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bool enabled = 1; */
-        if (message.enabled !== false)
-            writer.tag(1, WireType.Varint).bool(message.enabled);
-        /* sid.v1.admin.CaptchaProvider provider = 2; */
-        if (message.provider !== 0)
-            writer.tag(2, WireType.Varint).int32(message.provider);
-        /* string site_key = 3; */
-        if (message.siteKey !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.siteKey);
-        /* string secret_key = 4; */
-        if (message.secretKey !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.secretKey);
-        /* double score_threshold = 5; */
-        if (message.scoreThreshold !== 0)
-            writer.tag(5, WireType.Bit64).double(message.scoreThreshold);
-        /* repeated sid.v1.admin.CaptchaTrigger triggers = 6; */
-        if (message.triggers.length) {
-            writer.tag(6, WireType.LengthDelimited).fork();
-            for (let i = 0; i < message.triggers.length; i++)
-                writer.int32(message.triggers[i]);
-            writer.join();
-        }
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.CaptchaConfig
- */
-export const CaptchaConfig = new CaptchaConfig$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TestCaptchaProviderRequest$Type extends MessageType<TestCaptchaProviderRequest> {
-    constructor() {
-        super("sid.v1.admin.TestCaptchaProviderRequest", [
-            { no: 1, name: "provider", kind: "enum", T: () => ["sid.v1.admin.CaptchaProvider", CaptchaProvider, "CAPTCHA_PROVIDER_"] },
-            { no: 2, name: "site_key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "secret_key", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TestCaptchaProviderRequest>): TestCaptchaProviderRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.provider = 0;
-        message.siteKey = "";
-        message.secretKey = "";
-        if (value !== undefined)
-            reflectionMergePartial<TestCaptchaProviderRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TestCaptchaProviderRequest): TestCaptchaProviderRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* sid.v1.admin.CaptchaProvider provider */ 1:
-                    message.provider = reader.int32();
-                    break;
-                case /* string site_key */ 2:
-                    message.siteKey = reader.string();
-                    break;
-                case /* string secret_key */ 3:
-                    message.secretKey = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TestCaptchaProviderRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* sid.v1.admin.CaptchaProvider provider = 1; */
-        if (message.provider !== 0)
-            writer.tag(1, WireType.Varint).int32(message.provider);
-        /* string site_key = 2; */
-        if (message.siteKey !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.siteKey);
-        /* string secret_key = 3; */
-        if (message.secretKey !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.secretKey);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.TestCaptchaProviderRequest
- */
-export const TestCaptchaProviderRequest = new TestCaptchaProviderRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class TestCaptchaProviderResponse$Type extends MessageType<TestCaptchaProviderResponse> {
-    constructor() {
-        super("sid.v1.admin.TestCaptchaProviderResponse", [
-            { no: 1, name: "success", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 2, name: "error", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<TestCaptchaProviderResponse>): TestCaptchaProviderResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.success = false;
-        message.error = "";
-        if (value !== undefined)
-            reflectionMergePartial<TestCaptchaProviderResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: TestCaptchaProviderResponse): TestCaptchaProviderResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bool success */ 1:
-                    message.success = reader.bool();
-                    break;
-                case /* string error */ 2:
-                    message.error = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: TestCaptchaProviderResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bool success = 1; */
-        if (message.success !== false)
-            writer.tag(1, WireType.Varint).bool(message.success);
-        /* string error = 2; */
-        if (message.error !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.error);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.TestCaptchaProviderResponse
- */
-export const TestCaptchaProviderResponse = new TestCaptchaProviderResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class SecurityPolicyResponse$Type extends MessageType<SecurityPolicyResponse> {
-    constructor() {
-        super("sid.v1.admin.SecurityPolicyResponse", [
-            { no: 1, name: "enforcement_mode", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "rate_limits_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 3, name: "anomaly_detection_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 4, name: "captcha_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 5, name: "breach_detection_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 6, name: "enrollment_enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 7, name: "min_auth_level", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 8, name: "mfa_enforcement", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 9, name: "allowed_mfa_methods", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 10, name: "require_phishing_resistant", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 11, name: "password_min_length", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 12, name: "password_max_age_days", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 13, name: "session_max_lifetime_hours", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 14, name: "session_idle_timeout_hours", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 15, name: "session_max_concurrent", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 16, name: "network", kind: "message", T: () => NetworkPolicy },
-            { no: 17, name: "read_only", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 18, name: "passkey_satisfies_mfa", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
-        ]);
-    }
-    create(value?: PartialMessage<SecurityPolicyResponse>): SecurityPolicyResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.enforcementMode = "";
-        message.rateLimitsEnabled = false;
-        message.anomalyDetectionEnabled = false;
-        message.captchaEnabled = false;
-        message.breachDetectionEnabled = false;
-        message.enrollmentEnabled = false;
-        message.minAuthLevel = "";
-        message.mfaEnforcement = "";
-        message.allowedMfaMethods = [];
-        message.requirePhishingResistant = false;
-        message.passwordMinLength = 0;
-        message.passwordMaxAgeDays = 0;
-        message.sessionMaxLifetimeHours = 0;
-        message.sessionIdleTimeoutHours = 0;
-        message.sessionMaxConcurrent = 0;
-        message.readOnly = false;
-        message.passkeySatisfiesMfa = false;
-        if (value !== undefined)
-            reflectionMergePartial<SecurityPolicyResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SecurityPolicyResponse): SecurityPolicyResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string enforcement_mode */ 1:
-                    message.enforcementMode = reader.string();
-                    break;
-                case /* bool rate_limits_enabled */ 2:
-                    message.rateLimitsEnabled = reader.bool();
-                    break;
-                case /* bool anomaly_detection_enabled */ 3:
-                    message.anomalyDetectionEnabled = reader.bool();
-                    break;
-                case /* bool captcha_enabled */ 4:
-                    message.captchaEnabled = reader.bool();
-                    break;
-                case /* bool breach_detection_enabled */ 5:
-                    message.breachDetectionEnabled = reader.bool();
-                    break;
-                case /* bool enrollment_enabled */ 6:
-                    message.enrollmentEnabled = reader.bool();
-                    break;
-                case /* string min_auth_level */ 7:
-                    message.minAuthLevel = reader.string();
-                    break;
-                case /* string mfa_enforcement */ 8:
-                    message.mfaEnforcement = reader.string();
-                    break;
-                case /* repeated string allowed_mfa_methods */ 9:
-                    message.allowedMfaMethods.push(reader.string());
-                    break;
-                case /* bool require_phishing_resistant */ 10:
-                    message.requirePhishingResistant = reader.bool();
-                    break;
-                case /* int32 password_min_length */ 11:
-                    message.passwordMinLength = reader.int32();
-                    break;
-                case /* int32 password_max_age_days */ 12:
-                    message.passwordMaxAgeDays = reader.int32();
-                    break;
-                case /* int32 session_max_lifetime_hours */ 13:
-                    message.sessionMaxLifetimeHours = reader.int32();
-                    break;
-                case /* int32 session_idle_timeout_hours */ 14:
-                    message.sessionIdleTimeoutHours = reader.int32();
-                    break;
-                case /* int32 session_max_concurrent */ 15:
-                    message.sessionMaxConcurrent = reader.int32();
-                    break;
-                case /* sid.v1.admin.NetworkPolicy network */ 16:
-                    message.network = NetworkPolicy.internalBinaryRead(reader, reader.uint32(), options, message.network);
-                    break;
-                case /* bool read_only */ 17:
-                    message.readOnly = reader.bool();
-                    break;
-                case /* bool passkey_satisfies_mfa */ 18:
-                    message.passkeySatisfiesMfa = reader.bool();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: SecurityPolicyResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string enforcement_mode = 1; */
-        if (message.enforcementMode !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.enforcementMode);
-        /* bool rate_limits_enabled = 2; */
-        if (message.rateLimitsEnabled !== false)
-            writer.tag(2, WireType.Varint).bool(message.rateLimitsEnabled);
-        /* bool anomaly_detection_enabled = 3; */
-        if (message.anomalyDetectionEnabled !== false)
-            writer.tag(3, WireType.Varint).bool(message.anomalyDetectionEnabled);
-        /* bool captcha_enabled = 4; */
-        if (message.captchaEnabled !== false)
-            writer.tag(4, WireType.Varint).bool(message.captchaEnabled);
-        /* bool breach_detection_enabled = 5; */
-        if (message.breachDetectionEnabled !== false)
-            writer.tag(5, WireType.Varint).bool(message.breachDetectionEnabled);
-        /* bool enrollment_enabled = 6; */
-        if (message.enrollmentEnabled !== false)
-            writer.tag(6, WireType.Varint).bool(message.enrollmentEnabled);
-        /* string min_auth_level = 7; */
-        if (message.minAuthLevel !== "")
-            writer.tag(7, WireType.LengthDelimited).string(message.minAuthLevel);
-        /* string mfa_enforcement = 8; */
-        if (message.mfaEnforcement !== "")
-            writer.tag(8, WireType.LengthDelimited).string(message.mfaEnforcement);
-        /* repeated string allowed_mfa_methods = 9; */
-        for (let i = 0; i < message.allowedMfaMethods.length; i++)
-            writer.tag(9, WireType.LengthDelimited).string(message.allowedMfaMethods[i]);
-        /* bool require_phishing_resistant = 10; */
-        if (message.requirePhishingResistant !== false)
-            writer.tag(10, WireType.Varint).bool(message.requirePhishingResistant);
-        /* int32 password_min_length = 11; */
-        if (message.passwordMinLength !== 0)
-            writer.tag(11, WireType.Varint).int32(message.passwordMinLength);
-        /* int32 password_max_age_days = 12; */
-        if (message.passwordMaxAgeDays !== 0)
-            writer.tag(12, WireType.Varint).int32(message.passwordMaxAgeDays);
-        /* int32 session_max_lifetime_hours = 13; */
-        if (message.sessionMaxLifetimeHours !== 0)
-            writer.tag(13, WireType.Varint).int32(message.sessionMaxLifetimeHours);
-        /* int32 session_idle_timeout_hours = 14; */
-        if (message.sessionIdleTimeoutHours !== 0)
-            writer.tag(14, WireType.Varint).int32(message.sessionIdleTimeoutHours);
-        /* int32 session_max_concurrent = 15; */
-        if (message.sessionMaxConcurrent !== 0)
-            writer.tag(15, WireType.Varint).int32(message.sessionMaxConcurrent);
-        /* sid.v1.admin.NetworkPolicy network = 16; */
-        if (message.network)
-            NetworkPolicy.internalBinaryWrite(message.network, writer.tag(16, WireType.LengthDelimited).fork(), options).join();
-        /* bool read_only = 17; */
-        if (message.readOnly !== false)
-            writer.tag(17, WireType.Varint).bool(message.readOnly);
-        /* bool passkey_satisfies_mfa = 18; */
-        if (message.passkeySatisfiesMfa !== false)
-            writer.tag(18, WireType.Varint).bool(message.passkeySatisfiesMfa);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.SecurityPolicyResponse
- */
-export const SecurityPolicyResponse = new SecurityPolicyResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ApplicationOverride$Type extends MessageType<ApplicationOverride> {
-    constructor() {
-        super("sid.v1.admin.ApplicationOverride", [
-            { no: 1, name: "application_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "application_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "min_auth_level", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "enforcement_mode", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "required_amr", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ApplicationOverride>): ApplicationOverride {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.applicationId = "";
-        message.applicationName = "";
-        message.requiredAmr = [];
-        if (value !== undefined)
-            reflectionMergePartial<ApplicationOverride>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ApplicationOverride): ApplicationOverride {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string application_id */ 1:
-                    message.applicationId = reader.string();
-                    break;
-                case /* string application_name */ 2:
-                    message.applicationName = reader.string();
-                    break;
-                case /* optional string min_auth_level */ 3:
-                    message.minAuthLevel = reader.string();
-                    break;
-                case /* optional string enforcement_mode */ 4:
-                    message.enforcementMode = reader.string();
-                    break;
-                case /* repeated string required_amr */ 5:
-                    message.requiredAmr.push(reader.string());
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ApplicationOverride, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string application_id = 1; */
-        if (message.applicationId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.applicationId);
-        /* string application_name = 2; */
-        if (message.applicationName !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.applicationName);
-        /* optional string min_auth_level = 3; */
-        if (message.minAuthLevel !== undefined)
-            writer.tag(3, WireType.LengthDelimited).string(message.minAuthLevel);
-        /* optional string enforcement_mode = 4; */
-        if (message.enforcementMode !== undefined)
-            writer.tag(4, WireType.LengthDelimited).string(message.enforcementMode);
-        /* repeated string required_amr = 5; */
-        for (let i = 0; i < message.requiredAmr.length; i++)
-            writer.tag(5, WireType.LengthDelimited).string(message.requiredAmr[i]);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.ApplicationOverride
- */
-export const ApplicationOverride = new ApplicationOverride$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ListApplicationOverridesResponse$Type extends MessageType<ListApplicationOverridesResponse> {
-    constructor() {
-        super("sid.v1.admin.ListApplicationOverridesResponse", [
-            { no: 1, name: "overrides", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => ApplicationOverride }
-        ]);
-    }
-    create(value?: PartialMessage<ListApplicationOverridesResponse>): ListApplicationOverridesResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.overrides = [];
-        if (value !== undefined)
-            reflectionMergePartial<ListApplicationOverridesResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListApplicationOverridesResponse): ListApplicationOverridesResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated sid.v1.admin.ApplicationOverride overrides */ 1:
-                    message.overrides.push(ApplicationOverride.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ListApplicationOverridesResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated sid.v1.admin.ApplicationOverride overrides = 1; */
-        for (let i = 0; i < message.overrides.length; i++)
-            ApplicationOverride.internalBinaryWrite(message.overrides[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.ListApplicationOverridesResponse
- */
-export const ListApplicationOverridesResponse = new ListApplicationOverridesResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetEffectivePolicyRequest$Type extends MessageType<GetEffectivePolicyRequest> {
-    constructor() {
-        super("sid.v1.admin.GetEffectivePolicyRequest", [
-            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetEffectivePolicyRequest>): GetEffectivePolicyRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.clientId = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetEffectivePolicyRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetEffectivePolicyRequest): GetEffectivePolicyRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string client_id */ 1:
-                    message.clientId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetEffectivePolicyRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string client_id = 1; */
-        if (message.clientId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.clientId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.GetEffectivePolicyRequest
- */
-export const GetEffectivePolicyRequest = new GetEffectivePolicyRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class EvaluateEnforcementRequest$Type extends MessageType<EvaluateEnforcementRequest> {
-    constructor() {
-        super("sid.v1.admin.EvaluateEnforcementRequest", [
-            { no: 1, name: "profile_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<EvaluateEnforcementRequest>): EvaluateEnforcementRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.profileId = "";
-        message.clientId = "";
-        if (value !== undefined)
-            reflectionMergePartial<EvaluateEnforcementRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EvaluateEnforcementRequest): EvaluateEnforcementRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string profile_id */ 1:
-                    message.profileId = reader.string();
-                    break;
-                case /* string client_id */ 2:
-                    message.clientId = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: EvaluateEnforcementRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string profile_id = 1; */
-        if (message.profileId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.profileId);
-        /* string client_id = 2; */
-        if (message.clientId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.clientId);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.EvaluateEnforcementRequest
- */
-export const EvaluateEnforcementRequest = new EvaluateEnforcementRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class EvaluateEnforcementResponse$Type extends MessageType<EvaluateEnforcementResponse> {
-    constructor() {
-        super("sid.v1.admin.EvaluateEnforcementResponse", [
-            { no: 1, name: "action", kind: "enum", T: () => ["sid.v1.admin.EnforcementAction", EnforcementAction, "ENFORCEMENT_ACTION_"] },
-            { no: 2, name: "violations", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => PolicyViolation },
-            { no: 3, name: "required_actions", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => PolicyRequiredAction }
-        ]);
-    }
-    create(value?: PartialMessage<EvaluateEnforcementResponse>): EvaluateEnforcementResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.action = 0;
-        message.violations = [];
-        message.requiredActions = [];
-        if (value !== undefined)
-            reflectionMergePartial<EvaluateEnforcementResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EvaluateEnforcementResponse): EvaluateEnforcementResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* sid.v1.admin.EnforcementAction action */ 1:
-                    message.action = reader.int32();
-                    break;
-                case /* repeated sid.v1.admin.PolicyViolation violations */ 2:
-                    message.violations.push(PolicyViolation.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                case /* repeated sid.v1.admin.PolicyRequiredAction required_actions */ 3:
-                    message.requiredActions.push(PolicyRequiredAction.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: EvaluateEnforcementResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* sid.v1.admin.EnforcementAction action = 1; */
-        if (message.action !== 0)
-            writer.tag(1, WireType.Varint).int32(message.action);
-        /* repeated sid.v1.admin.PolicyViolation violations = 2; */
-        for (let i = 0; i < message.violations.length; i++)
-            PolicyViolation.internalBinaryWrite(message.violations[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* repeated sid.v1.admin.PolicyRequiredAction required_actions = 3; */
-        for (let i = 0; i < message.requiredActions.length; i++)
-            PolicyRequiredAction.internalBinaryWrite(message.requiredActions[i], writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.EvaluateEnforcementResponse
- */
-export const EvaluateEnforcementResponse = new EvaluateEnforcementResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class PolicyViolation$Type extends MessageType<PolicyViolation> {
-    constructor() {
-        super("sid.v1.admin.PolicyViolation", [
-            { no: 1, name: "requirement", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "current", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "required", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<PolicyViolation>): PolicyViolation {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.requirement = "";
-        message.current = "";
-        message.required = "";
-        if (value !== undefined)
-            reflectionMergePartial<PolicyViolation>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PolicyViolation): PolicyViolation {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string requirement */ 1:
-                    message.requirement = reader.string();
-                    break;
-                case /* string current */ 2:
-                    message.current = reader.string();
-                    break;
-                case /* string required */ 3:
-                    message.required = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: PolicyViolation, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string requirement = 1; */
-        if (message.requirement !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.requirement);
-        /* string current = 2; */
-        if (message.current !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.current);
-        /* string required = 3; */
-        if (message.required !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.required);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.PolicyViolation
- */
-export const PolicyViolation = new PolicyViolation$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class PolicyRequiredAction$Type extends MessageType<PolicyRequiredAction> {
-    constructor() {
-        super("sid.v1.admin.PolicyRequiredAction", [
-            { no: 1, name: "action_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<PolicyRequiredAction>): PolicyRequiredAction {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.actionType = "";
-        message.description = "";
-        if (value !== undefined)
-            reflectionMergePartial<PolicyRequiredAction>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PolicyRequiredAction): PolicyRequiredAction {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string action_type */ 1:
-                    message.actionType = reader.string();
-                    break;
-                case /* string description */ 2:
-                    message.description = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: PolicyRequiredAction, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string action_type = 1; */
-        if (message.actionType !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.actionType);
-        /* string description = 2; */
-        if (message.description !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.description);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.PolicyRequiredAction
- */
-export const PolicyRequiredAction = new PolicyRequiredAction$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class BreachDetectionConfig$Type extends MessageType<BreachDetectionConfig> {
-    constructor() {
-        super("sid.v1.admin.BreachDetectionConfig", [
-            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 2, name: "check_on_login", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 3, name: "check_on_password_change", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 4, name: "force_password_change_on_breach", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 5, name: "provider", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<BreachDetectionConfig>): BreachDetectionConfig {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.enabled = false;
-        message.checkOnLogin = false;
-        message.checkOnPasswordChange = false;
-        message.forcePasswordChangeOnBreach = false;
-        message.provider = "";
-        if (value !== undefined)
-            reflectionMergePartial<BreachDetectionConfig>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BreachDetectionConfig): BreachDetectionConfig {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bool enabled */ 1:
-                    message.enabled = reader.bool();
-                    break;
-                case /* bool check_on_login */ 2:
-                    message.checkOnLogin = reader.bool();
-                    break;
-                case /* bool check_on_password_change */ 3:
-                    message.checkOnPasswordChange = reader.bool();
-                    break;
-                case /* bool force_password_change_on_breach */ 4:
-                    message.forcePasswordChangeOnBreach = reader.bool();
-                    break;
-                case /* string provider */ 5:
-                    message.provider = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: BreachDetectionConfig, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bool enabled = 1; */
-        if (message.enabled !== false)
-            writer.tag(1, WireType.Varint).bool(message.enabled);
-        /* bool check_on_login = 2; */
-        if (message.checkOnLogin !== false)
-            writer.tag(2, WireType.Varint).bool(message.checkOnLogin);
-        /* bool check_on_password_change = 3; */
-        if (message.checkOnPasswordChange !== false)
-            writer.tag(3, WireType.Varint).bool(message.checkOnPasswordChange);
-        /* bool force_password_change_on_breach = 4; */
-        if (message.forcePasswordChangeOnBreach !== false)
-            writer.tag(4, WireType.Varint).bool(message.forcePasswordChangeOnBreach);
-        /* string provider = 5; */
-        if (message.provider !== "")
-            writer.tag(5, WireType.LengthDelimited).string(message.provider);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.BreachDetectionConfig
- */
-export const BreachDetectionConfig = new BreachDetectionConfig$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class NetworkPolicy$Type extends MessageType<NetworkPolicy> {
-    constructor() {
-        super("sid.v1.admin.NetworkPolicy", [
-            { no: 1, name: "allowed_countries", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "blocked_countries", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "block_tor", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 4, name: "block_datacenter_ips", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 5, name: "violation_reaction", kind: "enum", T: () => ["sid.v1.admin.NetworkViolationReaction", NetworkViolationReaction, "NETWORK_VIOLATION_REACTION_"] }
-        ]);
-    }
-    create(value?: PartialMessage<NetworkPolicy>): NetworkPolicy {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.allowedCountries = [];
-        message.blockedCountries = [];
-        message.blockTor = false;
-        message.blockDatacenterIps = false;
-        message.violationReaction = 0;
-        if (value !== undefined)
-            reflectionMergePartial<NetworkPolicy>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: NetworkPolicy): NetworkPolicy {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated string allowed_countries */ 1:
-                    message.allowedCountries.push(reader.string());
-                    break;
-                case /* repeated string blocked_countries */ 2:
-                    message.blockedCountries.push(reader.string());
-                    break;
-                case /* bool block_tor */ 3:
-                    message.blockTor = reader.bool();
-                    break;
-                case /* bool block_datacenter_ips */ 4:
-                    message.blockDatacenterIps = reader.bool();
-                    break;
-                case /* sid.v1.admin.NetworkViolationReaction violation_reaction */ 5:
-                    message.violationReaction = reader.int32();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: NetworkPolicy, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated string allowed_countries = 1; */
-        for (let i = 0; i < message.allowedCountries.length; i++)
-            writer.tag(1, WireType.LengthDelimited).string(message.allowedCountries[i]);
-        /* repeated string blocked_countries = 2; */
-        for (let i = 0; i < message.blockedCountries.length; i++)
-            writer.tag(2, WireType.LengthDelimited).string(message.blockedCountries[i]);
-        /* bool block_tor = 3; */
-        if (message.blockTor !== false)
-            writer.tag(3, WireType.Varint).bool(message.blockTor);
-        /* bool block_datacenter_ips = 4; */
-        if (message.blockDatacenterIps !== false)
-            writer.tag(4, WireType.Varint).bool(message.blockDatacenterIps);
-        /* sid.v1.admin.NetworkViolationReaction violation_reaction = 5; */
-        if (message.violationReaction !== 0)
-            writer.tag(5, WireType.Varint).int32(message.violationReaction);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.NetworkPolicy
- */
-export const NetworkPolicy = new NetworkPolicy$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class RunIntegrityCheckRequest$Type extends MessageType<RunIntegrityCheckRequest> {
-    constructor() {
-        super("sid.v1.admin.RunIntegrityCheckRequest", [
-            { no: 1, name: "layers", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<RunIntegrityCheckRequest>): RunIntegrityCheckRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.layers = [];
-        if (value !== undefined)
-            reflectionMergePartial<RunIntegrityCheckRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RunIntegrityCheckRequest): RunIntegrityCheckRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated string layers */ 1:
-                    message.layers.push(reader.string());
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: RunIntegrityCheckRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated string layers = 1; */
-        for (let i = 0; i < message.layers.length; i++)
-            writer.tag(1, WireType.LengthDelimited).string(message.layers[i]);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.RunIntegrityCheckRequest
- */
-export const RunIntegrityCheckRequest = new RunIntegrityCheckRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class IntegrityCheckResponse$Type extends MessageType<IntegrityCheckResponse> {
-    constructor() {
-        super("sid.v1.admin.IntegrityCheckResponse", [
-            { no: 1, name: "passed", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 2, name: "total_entities_checked", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
-            { no: 3, name: "total_issues_found", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
-            { no: 4, name: "duration_ms", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
-            { no: 5, name: "layers", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => IntegrityLayerResult }
-        ]);
-    }
-    create(value?: PartialMessage<IntegrityCheckResponse>): IntegrityCheckResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.passed = false;
-        message.totalEntitiesChecked = 0n;
-        message.totalIssuesFound = 0n;
-        message.durationMs = 0n;
-        message.layers = [];
-        if (value !== undefined)
-            reflectionMergePartial<IntegrityCheckResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IntegrityCheckResponse): IntegrityCheckResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* bool passed */ 1:
-                    message.passed = reader.bool();
-                    break;
-                case /* int64 total_entities_checked */ 2:
-                    message.totalEntitiesChecked = reader.int64().toBigInt();
-                    break;
-                case /* int64 total_issues_found */ 3:
-                    message.totalIssuesFound = reader.int64().toBigInt();
-                    break;
-                case /* int64 duration_ms */ 4:
-                    message.durationMs = reader.int64().toBigInt();
-                    break;
-                case /* repeated sid.v1.admin.IntegrityLayerResult layers */ 5:
-                    message.layers.push(IntegrityLayerResult.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: IntegrityCheckResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bool passed = 1; */
-        if (message.passed !== false)
-            writer.tag(1, WireType.Varint).bool(message.passed);
-        /* int64 total_entities_checked = 2; */
-        if (message.totalEntitiesChecked !== 0n)
-            writer.tag(2, WireType.Varint).int64(message.totalEntitiesChecked);
-        /* int64 total_issues_found = 3; */
-        if (message.totalIssuesFound !== 0n)
-            writer.tag(3, WireType.Varint).int64(message.totalIssuesFound);
-        /* int64 duration_ms = 4; */
-        if (message.durationMs !== 0n)
-            writer.tag(4, WireType.Varint).int64(message.durationMs);
-        /* repeated sid.v1.admin.IntegrityLayerResult layers = 5; */
-        for (let i = 0; i < message.layers.length; i++)
-            IntegrityLayerResult.internalBinaryWrite(message.layers[i], writer.tag(5, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.IntegrityCheckResponse
- */
-export const IntegrityCheckResponse = new IntegrityCheckResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class IntegrityLayerResult$Type extends MessageType<IntegrityLayerResult> {
-    constructor() {
-        super("sid.v1.admin.IntegrityLayerResult", [
-            { no: 1, name: "layer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "entities_checked", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
-            { no: 3, name: "entities_passed", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
-            { no: 4, name: "issues_found", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
-            { no: 5, name: "duration_ms", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
-            { no: 6, name: "issues", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => IntegrityIssue }
-        ]);
-    }
-    create(value?: PartialMessage<IntegrityLayerResult>): IntegrityLayerResult {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.layer = "";
-        message.entitiesChecked = 0n;
-        message.entitiesPassed = 0n;
-        message.issuesFound = 0n;
-        message.durationMs = 0n;
-        message.issues = [];
-        if (value !== undefined)
-            reflectionMergePartial<IntegrityLayerResult>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IntegrityLayerResult): IntegrityLayerResult {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string layer */ 1:
-                    message.layer = reader.string();
-                    break;
-                case /* int64 entities_checked */ 2:
-                    message.entitiesChecked = reader.int64().toBigInt();
-                    break;
-                case /* int64 entities_passed */ 3:
-                    message.entitiesPassed = reader.int64().toBigInt();
-                    break;
-                case /* int64 issues_found */ 4:
-                    message.issuesFound = reader.int64().toBigInt();
-                    break;
-                case /* int64 duration_ms */ 5:
-                    message.durationMs = reader.int64().toBigInt();
-                    break;
-                case /* repeated sid.v1.admin.IntegrityIssue issues */ 6:
-                    message.issues.push(IntegrityIssue.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: IntegrityLayerResult, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string layer = 1; */
-        if (message.layer !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.layer);
-        /* int64 entities_checked = 2; */
-        if (message.entitiesChecked !== 0n)
-            writer.tag(2, WireType.Varint).int64(message.entitiesChecked);
-        /* int64 entities_passed = 3; */
-        if (message.entitiesPassed !== 0n)
-            writer.tag(3, WireType.Varint).int64(message.entitiesPassed);
-        /* int64 issues_found = 4; */
-        if (message.issuesFound !== 0n)
-            writer.tag(4, WireType.Varint).int64(message.issuesFound);
-        /* int64 duration_ms = 5; */
-        if (message.durationMs !== 0n)
-            writer.tag(5, WireType.Varint).int64(message.durationMs);
-        /* repeated sid.v1.admin.IntegrityIssue issues = 6; */
-        for (let i = 0; i < message.issues.length; i++)
-            IntegrityIssue.internalBinaryWrite(message.issues[i], writer.tag(6, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.IntegrityLayerResult
- */
-export const IntegrityLayerResult = new IntegrityLayerResult$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class IntegrityIssue$Type extends MessageType<IntegrityIssue> {
-    constructor() {
-        super("sid.v1.admin.IntegrityIssue", [
-            { no: 1, name: "layer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "severity", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "entity_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "entity_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "auto_repairable", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
-        ]);
-    }
-    create(value?: PartialMessage<IntegrityIssue>): IntegrityIssue {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.layer = "";
-        message.severity = "";
-        message.entityType = "";
-        message.entityId = "";
-        message.description = "";
-        message.autoRepairable = false;
-        if (value !== undefined)
-            reflectionMergePartial<IntegrityIssue>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IntegrityIssue): IntegrityIssue {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string layer */ 1:
-                    message.layer = reader.string();
-                    break;
-                case /* string severity */ 2:
-                    message.severity = reader.string();
-                    break;
-                case /* string entity_type */ 3:
-                    message.entityType = reader.string();
-                    break;
-                case /* string entity_id */ 4:
-                    message.entityId = reader.string();
-                    break;
-                case /* string description */ 5:
-                    message.description = reader.string();
-                    break;
-                case /* bool auto_repairable */ 6:
-                    message.autoRepairable = reader.bool();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: IntegrityIssue, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string layer = 1; */
-        if (message.layer !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.layer);
-        /* string severity = 2; */
-        if (message.severity !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.severity);
-        /* string entity_type = 3; */
-        if (message.entityType !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.entityType);
-        /* string entity_id = 4; */
-        if (message.entityId !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.entityId);
-        /* string description = 5; */
-        if (message.description !== "")
-            writer.tag(5, WireType.LengthDelimited).string(message.description);
-        /* bool auto_repairable = 6; */
-        if (message.autoRepairable !== false)
-            writer.tag(6, WireType.Varint).bool(message.autoRepairable);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.IntegrityIssue
- */
-export const IntegrityIssue = new IntegrityIssue$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class AddIpAllowlistEntryRequest$Type extends MessageType<AddIpAllowlistEntryRequest> {
-    constructor() {
-        super("sid.v1.admin.AddIpAllowlistEntryRequest", [
-            { no: 1, name: "cidr", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<AddIpAllowlistEntryRequest>): AddIpAllowlistEntryRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.cidr = "";
-        message.description = "";
-        if (value !== undefined)
-            reflectionMergePartial<AddIpAllowlistEntryRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AddIpAllowlistEntryRequest): AddIpAllowlistEntryRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string cidr */ 1:
-                    message.cidr = reader.string();
-                    break;
-                case /* string description */ 2:
-                    message.description = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: AddIpAllowlistEntryRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string cidr = 1; */
-        if (message.cidr !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.cidr);
-        /* string description = 2; */
-        if (message.description !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.description);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.AddIpAllowlistEntryRequest
- */
-export const AddIpAllowlistEntryRequest = new AddIpAllowlistEntryRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class RemoveIpAllowlistEntryRequest$Type extends MessageType<RemoveIpAllowlistEntryRequest> {
-    constructor() {
-        super("sid.v1.admin.RemoveIpAllowlistEntryRequest", [
-            { no: 1, name: "cidr", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<RemoveIpAllowlistEntryRequest>): RemoveIpAllowlistEntryRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.cidr = "";
-        if (value !== undefined)
-            reflectionMergePartial<RemoveIpAllowlistEntryRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RemoveIpAllowlistEntryRequest): RemoveIpAllowlistEntryRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string cidr */ 1:
-                    message.cidr = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: RemoveIpAllowlistEntryRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string cidr = 1; */
-        if (message.cidr !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.cidr);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.RemoveIpAllowlistEntryRequest
- */
-export const RemoveIpAllowlistEntryRequest = new RemoveIpAllowlistEntryRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class IpAllowlistResponse$Type extends MessageType<IpAllowlistResponse> {
-    constructor() {
-        super("sid.v1.admin.IpAllowlistResponse", [
-            { no: 1, name: "entries", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => IpAllowlistEntry }
-        ]);
-    }
-    create(value?: PartialMessage<IpAllowlistResponse>): IpAllowlistResponse {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.entries = [];
-        if (value !== undefined)
-            reflectionMergePartial<IpAllowlistResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IpAllowlistResponse): IpAllowlistResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated sid.v1.admin.IpAllowlistEntry entries */ 1:
-                    message.entries.push(IpAllowlistEntry.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: IpAllowlistResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated sid.v1.admin.IpAllowlistEntry entries = 1; */
-        for (let i = 0; i < message.entries.length; i++)
-            IpAllowlistEntry.internalBinaryWrite(message.entries[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.IpAllowlistResponse
- */
-export const IpAllowlistResponse = new IpAllowlistResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class IpAllowlistEntry$Type extends MessageType<IpAllowlistEntry> {
-    constructor() {
-        super("sid.v1.admin.IpAllowlistEntry", [
-            { no: 1, name: "cidr", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "created_at", kind: "message", T: () => Timestamp }
-        ]);
-    }
-    create(value?: PartialMessage<IpAllowlistEntry>): IpAllowlistEntry {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.cidr = "";
-        message.description = "";
-        if (value !== undefined)
-            reflectionMergePartial<IpAllowlistEntry>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IpAllowlistEntry): IpAllowlistEntry {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string cidr */ 1:
-                    message.cidr = reader.string();
-                    break;
-                case /* string description */ 2:
-                    message.description = reader.string();
-                    break;
-                case /* google.protobuf.Timestamp created_at */ 3:
-                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: IpAllowlistEntry, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string cidr = 1; */
-        if (message.cidr !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.cidr);
-        /* string description = 2; */
-        if (message.description !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.description);
-        /* google.protobuf.Timestamp created_at = 3; */
-        if (message.createdAt)
-            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.IpAllowlistEntry
- */
-export const IpAllowlistEntry = new IpAllowlistEntry$Type();
-/**
- * @generated ServiceType for protobuf service sid.v1.admin.SecurityService
- */
-export const SecurityService = new ServiceType("sid.v1.admin.SecurityService", [
-    { name: "GetPasswordPolicy", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/password-policy" } }, I: GetPasswordPolicyRequest, O: PasswordPolicy },
-    { name: "UpdatePasswordPolicy", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/password-policy", body: "*" } }, I: PasswordPolicy, O: PasswordPolicy },
-    { name: "GetBruteForceConfig", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/brute-force" } }, I: GetBruteForceConfigRequest, O: BruteForceConfig },
-    { name: "UpdateBruteForceConfig", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/brute-force", body: "*" } }, I: BruteForceConfig, O: BruteForceConfig },
-    { name: "GetSecurityHeaders", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/headers" } }, I: GetSecurityHeadersRequest, O: SecurityHeaders },
-    { name: "UpdateSecurityHeaders", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/headers", body: "*" } }, I: SecurityHeaders, O: SecurityHeaders },
-    { name: "GetRateLimitConfig", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/rate-limits" } }, I: GetRateLimitConfigRequest, O: RateLimitConfig },
-    { name: "GetRateLimitDashboard", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/rate-limits/dashboard" } }, I: GetRateLimitDashboardRequest, O: RateLimitDashboard },
-    { name: "ListAnomalyRules", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/anomaly-rules" } }, I: ListAnomalyRulesRequest, O: ListAnomalyRulesResponse },
-    { name: "GetAnomalyEventLog", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/anomaly-events" } }, I: GetAnomalyEventLogRequest, O: AnomalyEventLog },
-    { name: "GetCaptchaConfig", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/captcha" } }, I: GetCaptchaConfigRequest, O: CaptchaConfig },
-    { name: "UpdateCaptchaConfig", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/captcha", body: "*" } }, I: CaptchaConfig, O: CaptchaConfig },
-    { name: "TestCaptchaProvider", options: { "google.api.http": { post: "/v1/admin/security/captcha/test", body: "*" } }, I: TestCaptchaProviderRequest, O: TestCaptchaProviderResponse },
-    { name: "GetSecurityPolicy", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/policy" } }, I: GetSecurityPolicyRequest, O: SecurityPolicyResponse },
-    { name: "ListApplicationOverrides", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/policy/overrides" } }, I: ListApplicationOverridesRequest, O: ListApplicationOverridesResponse },
-    { name: "GetEffectivePolicy", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/policy/effective/{client_id}" } }, I: GetEffectivePolicyRequest, O: SecurityPolicyResponse },
-    { name: "EvaluateEnforcement", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/policy/evaluate" } }, I: EvaluateEnforcementRequest, O: EvaluateEnforcementResponse },
-    { name: "GetNetworkPolicy", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/network-policy" } }, I: GetNetworkPolicyRequest, O: NetworkPolicy },
-    { name: "UpdateNetworkPolicy", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/network-policy", body: "*" } }, I: NetworkPolicy, O: NetworkPolicy },
-    { name: "GetBreachDetectionConfig", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/breach-detection" } }, I: GetBreachDetectionConfigRequest, O: BreachDetectionConfig },
-    { name: "UpdateBreachDetectionConfig", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/security/breach-detection", body: "*" } }, I: BreachDetectionConfig, O: BreachDetectionConfig },
-    { name: "RunIntegrityCheck", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { post: "/v1/admin/security/integrity/check", body: "*" } }, I: RunIntegrityCheckRequest, O: IntegrityCheckResponse },
-    { name: "ListIpAllowlistEntries", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/security/ip-allowlist" } }, I: ListIpAllowlistEntriesRequest, O: IpAllowlistResponse },
-    { name: "AddIpAllowlistEntry", options: { "google.api.http": { post: "/v1/admin/security/ip-allowlist", body: "*" } }, I: AddIpAllowlistEntryRequest, O: IpAllowlistResponse },
-    { name: "RemoveIpAllowlistEntry", options: { "google.api.http": { delete: "/v1/admin/security/ip-allowlist/{cidr}" } }, I: RemoveIpAllowlistEntryRequest, O: IpAllowlistResponse }
-]);