@toshicloud/sdk 0.2.0 → 0.3.1

package/dist/gen/toshi/workspace/v1/workspace_pb.d.ts

@@ -1,5 +1,5 @@
-import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { Duration, DurationJson, FieldMask, FieldMaskJson, Timestamp, TimestampJson } from "@bufbuild/protobuf/wkt";
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { Duration, DurationJson, Timestamp, TimestampJson } from "@bufbuild/protobuf/wkt";
 import type { RecordingKind, RecordingKindJson } from "./recordings_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 /**
@@ -7,2145 +7,1617 @@ import type { Message } from "@bufbuild/protobuf";
  */
 export declare const file_toshi_workspace_v1_workspace: GenFile;
 /**
- * Workload is one unit of work of any kind.
+ * Job runs one command once and ends.
  *
- * @generated from message toshi.workspace.v1.Workload
+ * @generated from message toshi.workspace.v1.Job
  */
-export type Workload = Message<"toshi.workspace.v1.Workload"> & {
+export type Job = Message<"toshi.workspace.v1.Job"> & {
     /**
-     * Assigned by the server; unique within the workspace.
+     * Assigned by the server; unique within the workspace, among its jobs,
+     * sandboxes and services.
      *
      * @generated from field: string id = 1;
      */
     id: string;
     /**
-     * Follows from which spec is set.
-     *
-     * @generated from field: toshi.workspace.v1.WorkloadKind kind = 2;
-     */
-    kind: WorkloadKind;
-    /**
-     * The kind-specific spec, as created.
-     *
-     * @generated from oneof toshi.workspace.v1.Workload.spec
-     */
-    spec: {
-        /**
-         * @generated from field: toshi.workspace.v1.JobSpec job = 3;
-         */
-        value: JobSpec;
-        case: "job";
-    } | {
-        /**
-         * @generated from field: toshi.workspace.v1.SandboxSpec sandbox = 4;
-         */
-        value: SandboxSpec;
-        case: "sandbox";
-    } | {
-        /**
-         * @generated from field: toshi.workspace.v1.ServiceSpec service = 5;
-         */
-        value: ServiceSpec;
-        case: "service";
-    } | {
-        case: undefined;
-        value?: undefined;
-    };
-    /**
-     * @generated from field: toshi.workspace.v1.WorkloadStatus status = 6;
-     */
-    status?: WorkloadStatus | undefined;
-    /**
-     * @generated from field: string project = 7;
+     * @generated from field: string project = 2;
      */
     project: string;
     /**
-     * @generated from field: string environment = 8;
+     * @generated from field: string environment = 3;
      */
     environment: string;
     /**
-     * Free-form labels, set at create and changed by PatchWorkload.
+     * Free-form labels, set at create and changed by UpdateJob.
      *
-     * @generated from field: map<string, string> labels = 9;
+     * @generated from field: map<string, string> labels = 4;
      */
     labels: {
         [key: string]: string;
     };
+    /**
+     * The job as created.
+     *
+     * @generated from field: toshi.workspace.v1.JobSpec spec = 5;
+     */
+    spec?: JobSpec | undefined;
+    /**
+     * @generated from field: toshi.workspace.v1.JobStatus status = 6;
+     */
+    status?: JobStatus | undefined;
     /**
      * What it records of its runs, fixed at create: never UNSPECIFIED.
      *
-     * @generated from field: toshi.workspace.v1.RecordingPolicy recording = 10;
+     * @generated from field: toshi.workspace.v1.RecordingPolicy recording = 7;
      */
     recording: RecordingPolicy;
 };
 /**
- * Workload is one unit of work of any kind.
+ * Job runs one command once and ends.
  *
- * @generated from message toshi.workspace.v1.Workload
+ * @generated from message toshi.workspace.v1.Job
  */
-export type WorkloadJson = {
+export type JobJson = {
     /**
-     * Assigned by the server; unique within the workspace.
+     * Assigned by the server; unique within the workspace, among its jobs,
+     * sandboxes and services.
      *
      * @generated from field: string id = 1;
      */
     id?: string;
     /**
-     * Follows from which spec is set.
-     *
-     * @generated from field: toshi.workspace.v1.WorkloadKind kind = 2;
-     */
-    kind?: WorkloadKindJson;
-    /**
-     * @generated from field: toshi.workspace.v1.JobSpec job = 3;
-     */
-    job?: JobSpecJson;
-    /**
-     * @generated from field: toshi.workspace.v1.SandboxSpec sandbox = 4;
-     */
-    sandbox?: SandboxSpecJson;
-    /**
-     * @generated from field: toshi.workspace.v1.ServiceSpec service = 5;
-     */
-    service?: ServiceSpecJson;
-    /**
-     * @generated from field: toshi.workspace.v1.WorkloadStatus status = 6;
-     */
-    status?: WorkloadStatusJson;
-    /**
-     * @generated from field: string project = 7;
+     * @generated from field: string project = 2;
      */
     project?: string;
     /**
-     * @generated from field: string environment = 8;
+     * @generated from field: string environment = 3;
      */
     environment?: string;
     /**
-     * Free-form labels, set at create and changed by PatchWorkload.
+     * Free-form labels, set at create and changed by UpdateJob.
      *
-     * @generated from field: map<string, string> labels = 9;
+     * @generated from field: map<string, string> labels = 4;
      */
     labels?: {
         [key: string]: string;
     };
+    /**
+     * The job as created.
+     *
+     * @generated from field: toshi.workspace.v1.JobSpec spec = 5;
+     */
+    spec?: JobSpecJson;
+    /**
+     * @generated from field: toshi.workspace.v1.JobStatus status = 6;
+     */
+    status?: JobStatusJson;
     /**
      * What it records of its runs, fixed at create: never UNSPECIFIED.
      *
-     * @generated from field: toshi.workspace.v1.RecordingPolicy recording = 10;
+     * @generated from field: toshi.workspace.v1.RecordingPolicy recording = 7;
      */
     recording?: RecordingPolicyJson;
 };
 /**
- * Describes the message toshi.workspace.v1.Workload.
- * Use `create(WorkloadSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.Job.
+ * Use `create(JobSchema)` to create a new message.
  */
-export declare const WorkloadSchema: GenMessage<Workload, {
-    jsonType: WorkloadJson;
+export declare const JobSchema: GenMessage<Job, {
+    jsonType: JobJson;
 }>;
 /**
- * JobSpec is a job: one command, run once.
+ * JobStatus is a job's state and when it got there.
  *
- * @generated from message toshi.workspace.v1.JobSpec
+ * @generated from message toshi.workspace.v1.JobStatus
  */
-export type JobSpec = Message<"toshi.workspace.v1.JobSpec"> & {
+export type JobStatus = Message<"toshi.workspace.v1.JobStatus"> & {
     /**
-     * @generated from field: toshi.workspace.v1.Command command = 1;
+     * @generated from field: toshi.workspace.v1.JobState state = 1;
      */
-    command?: Command | undefined;
+    state: JobState;
     /**
-     * What in its workspace the job uses. Checked at create
-     * against the job's project and environment, and fixed when the job
-     * starts; GetWorkloadResponse.bound shows what each was fixed to.
+     * Set once the state is ENDED: EXITED, CANCELLED or FAILED.
      *
-     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 2;
+     * @generated from field: toshi.workspace.v1.EndReason end_reason = 2;
      */
-    bindings: Binding[];
+    endReason: EndReason;
+    /**
+     * The most recent error Toshi met running the job.
+     *
+     * @generated from field: toshi.workspace.v1.Error last_error = 3;
+     */
+    lastError?: Error | undefined;
+    /**
+     * @generated from field: google.protobuf.Timestamp created_at = 4;
+     */
+    createdAt?: Timestamp | undefined;
+    /**
+     * @generated from field: google.protobuf.Timestamp queued_at = 5;
+     */
+    queuedAt?: Timestamp | undefined;
+    /**
+     * @generated from field: google.protobuf.Timestamp started_at = 6;
+     */
+    startedAt?: Timestamp | undefined;
+    /**
+     * @generated from field: google.protobuf.Timestamp ended_at = 7;
+     */
+    endedAt?: Timestamp | undefined;
+    /**
+     * When anything in the job last changed.
+     *
+     * @generated from field: google.protobuf.Timestamp updated_at = 8;
+     */
+    updatedAt?: Timestamp | undefined;
+    /**
+     * The command's exit status, set when end_reason is EXITED.
+     *
+     * @generated from field: optional int32 exit_code = 9;
+     */
+    exitCode?: number | undefined;
 };
 /**
- * JobSpec is a job: one command, run once.
+ * JobStatus is a job's state and when it got there.
  *
- * @generated from message toshi.workspace.v1.JobSpec
+ * @generated from message toshi.workspace.v1.JobStatus
  */
-export type JobSpecJson = {
+export type JobStatusJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Command command = 1;
+     * @generated from field: toshi.workspace.v1.JobState state = 1;
      */
-    command?: CommandJson;
+    state?: JobStateJson;
     /**
-     * What in its workspace the job uses. Checked at create
-     * against the job's project and environment, and fixed when the job
-     * starts; GetWorkloadResponse.bound shows what each was fixed to.
+     * Set once the state is ENDED: EXITED, CANCELLED or FAILED.
      *
-     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 2;
+     * @generated from field: toshi.workspace.v1.EndReason end_reason = 2;
      */
-    bindings?: BindingJson[];
+    endReason?: EndReasonJson;
+    /**
+     * The most recent error Toshi met running the job.
+     *
+     * @generated from field: toshi.workspace.v1.Error last_error = 3;
+     */
+    lastError?: ErrorJson;
+    /**
+     * @generated from field: google.protobuf.Timestamp created_at = 4;
+     */
+    createdAt?: TimestampJson;
+    /**
+     * @generated from field: google.protobuf.Timestamp queued_at = 5;
+     */
+    queuedAt?: TimestampJson;
+    /**
+     * @generated from field: google.protobuf.Timestamp started_at = 6;
+     */
+    startedAt?: TimestampJson;
+    /**
+     * @generated from field: google.protobuf.Timestamp ended_at = 7;
+     */
+    endedAt?: TimestampJson;
+    /**
+     * When anything in the job last changed.
+     *
+     * @generated from field: google.protobuf.Timestamp updated_at = 8;
+     */
+    updatedAt?: TimestampJson;
+    /**
+     * The command's exit status, set when end_reason is EXITED.
+     *
+     * @generated from field: optional int32 exit_code = 9;
+     */
+    exitCode?: number;
 };
 /**
- * Describes the message toshi.workspace.v1.JobSpec.
- * Use `create(JobSpecSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.JobStatus.
+ * Use `create(JobStatusSchema)` to create a new message.
  */
-export declare const JobSpecSchema: GenMessage<JobSpec, {
-    jsonType: JobSpecJson;
+export declare const JobStatusSchema: GenMessage<JobStatus, {
+    jsonType: JobStatusJson;
 }>;
 /**
- * Binding is one binding a workload declares.
+ * Sandbox runs until it is deleted or its time limit passes.
  *
- * @generated from message toshi.workspace.v1.Binding
+ * @generated from message toshi.workspace.v1.Sandbox
  */
-export type Binding = Message<"toshi.workspace.v1.Binding"> & {
+export type Sandbox = Message<"toshi.workspace.v1.Sandbox"> & {
     /**
-     * Names the binding in the workload: a lowercase DNS label, unique in
-     * the workload.
+     * Assigned by the server; unique within the workspace, among its jobs,
+     * sandboxes and services.
      *
-     * @generated from field: string name = 1;
+     * @generated from field: string id = 1;
      */
-    name: string;
+    id: string;
     /**
-     * What the binding is to. Set exactly one.
+     * @generated from field: string project = 2;
+     */
+    project: string;
+    /**
+     * @generated from field: string environment = 3;
+     */
+    environment: string;
+    /**
+     * Free-form labels, set at create and changed by UpdateSandbox.
      *
-     * @generated from oneof toshi.workspace.v1.Binding.target
+     * @generated from field: map<string, string> labels = 4;
      */
-    target: {
-        /**
-         * A channel of a service of the workload's project and environment.
-         *
-         * @generated from field: toshi.workspace.v1.ServiceChannel service = 2;
-         */
-        value: ServiceChannel;
-        case: "service";
-    } | {
-        /**
-         * The secret set of the workload's environment.
-         *
-         * @generated from field: toshi.workspace.v1.EnvironmentSecrets secrets = 3;
-         */
-        value: EnvironmentSecrets;
-        case: "secrets";
-    } | {
-        case: undefined;
-        value?: undefined;
+    labels: {
+        [key: string]: string;
     };
+    /**
+     * The sandbox as created, with max_duration as UpdateSandbox last raised
+     * it.
+     *
+     * @generated from field: toshi.workspace.v1.SandboxSpec spec = 5;
+     */
+    spec?: SandboxSpec | undefined;
+    /**
+     * @generated from field: toshi.workspace.v1.SandboxStatus status = 6;
+     */
+    status?: SandboxStatus | undefined;
+    /**
+     * What it records of its runs, fixed at create: never UNSPECIFIED.
+     *
+     * @generated from field: toshi.workspace.v1.RecordingPolicy recording = 7;
+     */
+    recording: RecordingPolicy;
 };
 /**
- * Binding is one binding a workload declares.
+ * Sandbox runs until it is deleted or its time limit passes.
  *
- * @generated from message toshi.workspace.v1.Binding
+ * @generated from message toshi.workspace.v1.Sandbox
  */
-export type BindingJson = {
+export type SandboxJson = {
     /**
-     * Names the binding in the workload: a lowercase DNS label, unique in
-     * the workload.
+     * Assigned by the server; unique within the workspace, among its jobs,
+     * sandboxes and services.
      *
-     * @generated from field: string name = 1;
+     * @generated from field: string id = 1;
      */
-    name?: string;
+    id?: string;
     /**
-     * A channel of a service of the workload's project and environment.
+     * @generated from field: string project = 2;
+     */
+    project?: string;
+    /**
+     * @generated from field: string environment = 3;
+     */
+    environment?: string;
+    /**
+     * Free-form labels, set at create and changed by UpdateSandbox.
      *
-     * @generated from field: toshi.workspace.v1.ServiceChannel service = 2;
+     * @generated from field: map<string, string> labels = 4;
      */
-    service?: ServiceChannelJson;
+    labels?: {
+        [key: string]: string;
+    };
     /**
-     * The secret set of the workload's environment.
+     * The sandbox as created, with max_duration as UpdateSandbox last raised
+     * it.
      *
-     * @generated from field: toshi.workspace.v1.EnvironmentSecrets secrets = 3;
+     * @generated from field: toshi.workspace.v1.SandboxSpec spec = 5;
      */
-    secrets?: EnvironmentSecretsJson;
+    spec?: SandboxSpecJson;
+    /**
+     * @generated from field: toshi.workspace.v1.SandboxStatus status = 6;
+     */
+    status?: SandboxStatusJson;
+    /**
+     * What it records of its runs, fixed at create: never UNSPECIFIED.
+     *
+     * @generated from field: toshi.workspace.v1.RecordingPolicy recording = 7;
+     */
+    recording?: RecordingPolicyJson;
 };
 /**
- * Describes the message toshi.workspace.v1.Binding.
- * Use `create(BindingSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.Sandbox.
+ * Use `create(SandboxSchema)` to create a new message.
  */
-export declare const BindingSchema: GenMessage<Binding, {
-    jsonType: BindingJson;
+export declare const SandboxSchema: GenMessage<Sandbox, {
+    jsonType: SandboxJson;
 }>;
 /**
- * ServiceChannel is a channel of a service, by the service's name and the
- * channel's name in its recipe, as a recipe's uses names it:
- * "<service>.<channel>".
+ * SandboxStatus is a sandbox's state and when it got there.
  *
- * @generated from message toshi.workspace.v1.ServiceChannel
+ * @generated from message toshi.workspace.v1.SandboxStatus
  */
-export type ServiceChannel = Message<"toshi.workspace.v1.ServiceChannel"> & {
+export type SandboxStatus = Message<"toshi.workspace.v1.SandboxStatus"> & {
     /**
-     * @generated from field: string service = 1;
+     * @generated from field: toshi.workspace.v1.SandboxState state = 1;
      */
-    service: string;
+    state: SandboxState;
     /**
-     * @generated from field: string channel = 2;
+     * Set once the state is ENDED: STOPPED or FAILED.
+     *
+     * @generated from field: toshi.workspace.v1.EndReason end_reason = 2;
      */
-    channel: string;
-};
-/**
- * ServiceChannel is a channel of a service, by the service's name and the
- * channel's name in its recipe, as a recipe's uses names it:
- * "<service>.<channel>".
- *
- * @generated from message toshi.workspace.v1.ServiceChannel
- */
-export type ServiceChannelJson = {
+    endReason: EndReason;
     /**
-     * @generated from field: string service = 1;
+     * The most recent error Toshi met running the sandbox.
+     *
+     * @generated from field: toshi.workspace.v1.Error last_error = 3;
      */
-    service?: string;
+    lastError?: Error | undefined;
     /**
-     * @generated from field: string channel = 2;
+     * @generated from field: google.protobuf.Timestamp created_at = 4;
      */
-    channel?: string;
-};
-/**
- * Describes the message toshi.workspace.v1.ServiceChannel.
- * Use `create(ServiceChannelSchema)` to create a new message.
- */
-export declare const ServiceChannelSchema: GenMessage<ServiceChannel, {
-    jsonType: ServiceChannelJson;
-}>;
-/**
- * EnvironmentSecrets binds the secret set of the workload's environment,
- * with the project's shared keys. The set must grant the workload's kind.
- *
- * @generated from message toshi.workspace.v1.EnvironmentSecrets
- */
-export type EnvironmentSecrets = Message<"toshi.workspace.v1.EnvironmentSecrets"> & {};
-/**
- * EnvironmentSecrets binds the secret set of the workload's environment,
- * with the project's shared keys. The set must grant the workload's kind.
- *
- * @generated from message toshi.workspace.v1.EnvironmentSecrets
- */
-export type EnvironmentSecretsJson = {};
-/**
- * Describes the message toshi.workspace.v1.EnvironmentSecrets.
- * Use `create(EnvironmentSecretsSchema)` to create a new message.
- */
-export declare const EnvironmentSecretsSchema: GenMessage<EnvironmentSecrets, {
-    jsonType: EnvironmentSecretsJson;
-}>;
-/**
- * BoundBinding is a binding as it was fixed when its workload started.
- * A later change or delete of the target leaves it as it is.
- *
- * @generated from message toshi.workspace.v1.BoundBinding
- */
-export type BoundBinding = Message<"toshi.workspace.v1.BoundBinding"> & {
-    /**
-     * @generated from field: string name = 1;
-     */
-    name: string;
+    createdAt?: Timestamp | undefined;
     /**
-     * @generated from oneof toshi.workspace.v1.BoundBinding.target
+     * @generated from field: google.protobuf.Timestamp queued_at = 5;
      */
-    target: {
-        /**
-         * @generated from field: toshi.workspace.v1.BoundService service = 2;
-         */
-        value: BoundService;
-        case: "service";
-    } | {
-        /**
-         * @generated from field: toshi.workspace.v1.BoundSecrets secrets = 3;
-         */
-        value: BoundSecrets;
-        case: "secrets";
-    } | {
-        case: undefined;
-        value?: undefined;
-    };
+    queuedAt?: Timestamp | undefined;
     /**
-     * @generated from field: google.protobuf.Timestamp taken_at = 4;
+     * @generated from field: google.protobuf.Timestamp started_at = 6;
      */
-    takenAt?: Timestamp | undefined;
-};
-/**
- * BoundBinding is a binding as it was fixed when its workload started.
- * A later change or delete of the target leaves it as it is.
- *
- * @generated from message toshi.workspace.v1.BoundBinding
- */
-export type BoundBindingJson = {
+    startedAt?: Timestamp | undefined;
     /**
-     * @generated from field: string name = 1;
+     * @generated from field: google.protobuf.Timestamp ended_at = 7;
      */
-    name?: string;
+    endedAt?: Timestamp | undefined;
     /**
-     * @generated from field: toshi.workspace.v1.BoundService service = 2;
+     * When anything in the sandbox last changed.
+     *
+     * @generated from field: google.protobuf.Timestamp updated_at = 8;
      */
-    service?: BoundServiceJson;
+    updatedAt?: Timestamp | undefined;
     /**
-     * @generated from field: toshi.workspace.v1.BoundSecrets secrets = 3;
+     * Why it was stopped, set once it has ended: with STOPPED, and with
+     * FAILED when it failed after a stop was asked.
+     *
+     * @generated from field: toshi.workspace.v1.StopReason stop_reason = 9;
      */
-    secrets?: BoundSecretsJson;
+    stopReason: StopReason;
     /**
-     * @generated from field: google.protobuf.Timestamp taken_at = 4;
+     * While it runs, its previews: one for each of its http channels served
+     * at a hostname of its own, the channel `preview` among them. Empty
+     * while the control plane serves no previews. Making or deleting such a
+     * channel changes the sandbox, so WatchSandboxes sends it again.
+     *
+     * @generated from field: repeated toshi.workspace.v1.SandboxPreview previews = 10;
      */
-    takenAt?: TimestampJson;
+    previews: SandboxPreview[];
 };
 /**
- * Describes the message toshi.workspace.v1.BoundBinding.
- * Use `create(BoundBindingSchema)` to create a new message.
- */
-export declare const BoundBindingSchema: GenMessage<BoundBinding, {
-    jsonType: BoundBindingJson;
-}>;
-/**
- * BoundService is a service channel as it was when the workload started.
+ * SandboxStatus is a sandbox's state and when it got there.
  *
- * @generated from message toshi.workspace.v1.BoundService
+ * @generated from message toshi.workspace.v1.SandboxStatus
  */
-export type BoundService = Message<"toshi.workspace.v1.BoundService"> & {
+export type SandboxStatusJson = {
     /**
-     * @generated from field: string service = 1;
+     * @generated from field: toshi.workspace.v1.SandboxState state = 1;
      */
-    service: string;
+    state?: SandboxStateJson;
     /**
-     * The service's workload ID.
+     * Set once the state is ENDED: STOPPED or FAILED.
      *
-     * @generated from field: string service_id = 2;
+     * @generated from field: toshi.workspace.v1.EndReason end_reason = 2;
      */
-    serviceId: string;
+    endReason?: EndReasonJson;
     /**
-     * The service's revision that was current.
+     * The most recent error Toshi met running the sandbox.
      *
-     * @generated from field: int64 revision = 3;
+     * @generated from field: toshi.workspace.v1.Error last_error = 3;
      */
-    revision: bigint;
+    lastError?: ErrorJson;
     /**
-     * @generated from field: string channel = 4;
+     * @generated from field: google.protobuf.Timestamp created_at = 4;
      */
-    channel: string;
+    createdAt?: TimestampJson;
     /**
-     * The channel's shape and, for an http channel, its guest port.
-     *
-     * @generated from field: string shape = 5;
+     * @generated from field: google.protobuf.Timestamp queued_at = 5;
      */
-    shape: string;
+    queuedAt?: TimestampJson;
     /**
-     * @generated from field: int32 port = 6;
+     * @generated from field: google.protobuf.Timestamp started_at = 6;
      */
-    port: number;
+    startedAt?: TimestampJson;
     /**
-     * What the channel accepts from the caller: "workload_identity", a
-     * connect credential signed by the workload identity issuer
-     * naming audience and this binding. Minted when the job's command
-     * starts, and passed only to that command.
+     * @generated from field: google.protobuf.Timestamp ended_at = 7;
+     */
+    endedAt?: TimestampJson;
+    /**
+     * When anything in the sandbox last changed.
      *
-     * @generated from field: string credential = 7;
+     * @generated from field: google.protobuf.Timestamp updated_at = 8;
      */
-    credential: string;
+    updatedAt?: TimestampJson;
     /**
-     * @generated from field: string audience = 8;
+     * Why it was stopped, set once it has ended: with STOPPED, and with
+     * FAILED when it failed after a stop was asked.
+     *
+     * @generated from field: toshi.workspace.v1.StopReason stop_reason = 9;
      */
-    audience: string;
+    stopReason?: StopReasonJson;
     /**
-     * The id (jti) of the connect credential minted for this binding. Never
-     * the credential.
+     * While it runs, its previews: one for each of its http channels served
+     * at a hostname of its own, the channel `preview` among them. Empty
+     * while the control plane serves no previews. Making or deleting such a
+     * channel changes the sandbox, so WatchSandboxes sends it again.
      *
-     * @generated from field: string credential_id = 9;
+     * @generated from field: repeated toshi.workspace.v1.SandboxPreview previews = 10;
      */
-    credentialId: string;
+    previews?: SandboxPreviewJson[];
 };
 /**
- * BoundService is a service channel as it was when the workload started.
+ * Describes the message toshi.workspace.v1.SandboxStatus.
+ * Use `create(SandboxStatusSchema)` to create a new message.
+ */
+export declare const SandboxStatusSchema: GenMessage<SandboxStatus, {
+    jsonType: SandboxStatusJson;
+}>;
+/**
+ * Service is a long-running service, started, stopped, woken and held.
  *
- * @generated from message toshi.workspace.v1.BoundService
+ * @generated from message toshi.workspace.v1.Service
  */
-export type BoundServiceJson = {
+export type Service = Message<"toshi.workspace.v1.Service"> & {
     /**
-     * @generated from field: string service = 1;
+     * Assigned by the server; unique within the workspace, among its jobs,
+     * sandboxes and services.
+     *
+     * @generated from field: string id = 1;
      */
-    service?: string;
+    id: string;
     /**
-     * The service's workload ID.
+     * @generated from field: string project = 2;
+     */
+    project: string;
+    /**
+     * @generated from field: string environment = 3;
+     */
+    environment: string;
+    /**
+     * Free-form labels, set at create and changed by UpdateService.
      *
-     * @generated from field: string service_id = 2;
+     * @generated from field: map<string, string> labels = 4;
      */
-    serviceId?: string;
+    labels: {
+        [key: string]: string;
+    };
     /**
-     * The service's revision that was current.
+     * The service as ServiceSpec describes its answers.
      *
-     * @generated from field: int64 revision = 3;
+     * @generated from field: toshi.workspace.v1.ServiceSpec spec = 5;
      */
-    revision?: string;
+    spec?: ServiceSpec | undefined;
     /**
-     * @generated from field: string channel = 4;
+     * @generated from field: toshi.workspace.v1.ServiceStatus status = 6;
      */
-    channel?: string;
+    status?: ServiceStatus | undefined;
+};
+/**
+ * Service is a long-running service, started, stopped, woken and held.
+ *
+ * @generated from message toshi.workspace.v1.Service
+ */
+export type ServiceJson = {
     /**
-     * The channel's shape and, for an http channel, its guest port.
+     * Assigned by the server; unique within the workspace, among its jobs,
+     * sandboxes and services.
      *
-     * @generated from field: string shape = 5;
+     * @generated from field: string id = 1;
      */
-    shape?: string;
+    id?: string;
     /**
-     * @generated from field: int32 port = 6;
+     * @generated from field: string project = 2;
      */
-    port?: number;
+    project?: string;
     /**
-     * What the channel accepts from the caller: "workload_identity", a
-     * connect credential signed by the workload identity issuer
-     * naming audience and this binding. Minted when the job's command
-     * starts, and passed only to that command.
-     *
-     * @generated from field: string credential = 7;
+     * @generated from field: string environment = 3;
      */
-    credential?: string;
+    environment?: string;
     /**
-     * @generated from field: string audience = 8;
+     * Free-form labels, set at create and changed by UpdateService.
+     *
+     * @generated from field: map<string, string> labels = 4;
      */
-    audience?: string;
+    labels?: {
+        [key: string]: string;
+    };
     /**
-     * The id (jti) of the connect credential minted for this binding. Never
-     * the credential.
+     * The service as ServiceSpec describes its answers.
      *
-     * @generated from field: string credential_id = 9;
+     * @generated from field: toshi.workspace.v1.ServiceSpec spec = 5;
      */
-    credentialId?: string;
+    spec?: ServiceSpecJson;
+    /**
+     * @generated from field: toshi.workspace.v1.ServiceStatus status = 6;
+     */
+    status?: ServiceStatusJson;
 };
 /**
- * Describes the message toshi.workspace.v1.BoundService.
- * Use `create(BoundServiceSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.Service.
+ * Use `create(ServiceSchema)` to create a new message.
  */
-export declare const BoundServiceSchema: GenMessage<BoundService, {
-    jsonType: BoundServiceJson;
+export declare const ServiceSchema: GenMessage<Service, {
+    jsonType: ServiceJson;
 }>;
 /**
- * BoundSecrets is the environment's secret set as it was when the
- * workload started: which keys, from which set, at which version. Never
- * a value.
+ * ServiceStatus is a service's state and when it got there.
  *
- * @generated from message toshi.workspace.v1.BoundSecrets
+ * @generated from message toshi.workspace.v1.ServiceStatus
  */
-export type BoundSecrets = Message<"toshi.workspace.v1.BoundSecrets"> & {
+export type ServiceStatus = Message<"toshi.workspace.v1.ServiceStatus"> & {
     /**
-     * @generated from field: string set_id = 1;
+     * @generated from field: toshi.workspace.v1.ServiceState state = 1;
      */
-    setId: string;
+    state: ServiceState;
     /**
-     * @generated from field: repeated toshi.workspace.v1.BoundKey keys = 2;
+     * Set once the state is ENDED: STOPPED or FAILED.
+     *
+     * @generated from field: toshi.workspace.v1.EndReason end_reason = 2;
      */
-    keys: BoundKey[];
-};
-/**
- * BoundSecrets is the environment's secret set as it was when the
- * workload started: which keys, from which set, at which version. Never
- * a value.
- *
- * @generated from message toshi.workspace.v1.BoundSecrets
- */
-export type BoundSecretsJson = {
+    endReason: EndReason;
     /**
-     * @generated from field: string set_id = 1;
+     * The most recent error Toshi met running the service.
+     *
+     * @generated from field: toshi.workspace.v1.Error last_error = 3;
      */
-    setId?: string;
+    lastError?: Error | undefined;
     /**
-     * @generated from field: repeated toshi.workspace.v1.BoundKey keys = 2;
+     * @generated from field: google.protobuf.Timestamp created_at = 4;
      */
-    keys?: BoundKeyJson[];
-};
-/**
- * Describes the message toshi.workspace.v1.BoundSecrets.
- * Use `create(BoundSecretsSchema)` to create a new message.
- */
-export declare const BoundSecretsSchema: GenMessage<BoundSecrets, {
-    jsonType: BoundSecretsJson;
-}>;
-/**
- * @generated from message toshi.workspace.v1.BoundKey
- */
-export type BoundKey = Message<"toshi.workspace.v1.BoundKey"> & {
+    createdAt?: Timestamp | undefined;
     /**
-     * The set the key is in: the environment's set or the project's shared
-     * set.
-     *
-     * @generated from field: string set_id = 1;
+     * @generated from field: google.protobuf.Timestamp queued_at = 5;
      */
-    setId: string;
+    queuedAt?: Timestamp | undefined;
     /**
-     * @generated from field: string name = 2;
+     * @generated from field: google.protobuf.Timestamp started_at = 6;
      */
-    name: string;
+    startedAt?: Timestamp | undefined;
     /**
-     * @generated from field: int64 version = 3;
+     * @generated from field: google.protobuf.Timestamp ended_at = 7;
      */
-    version: bigint;
+    endedAt?: Timestamp | undefined;
+    /**
+     * When anything in the service last changed.
+     *
+     * @generated from field: google.protobuf.Timestamp updated_at = 8;
+     */
+    updatedAt?: Timestamp | undefined;
 };
 /**
- * @generated from message toshi.workspace.v1.BoundKey
+ * ServiceStatus is a service's state and when it got there.
+ *
+ * @generated from message toshi.workspace.v1.ServiceStatus
  */
-export type BoundKeyJson = {
+export type ServiceStatusJson = {
     /**
-     * The set the key is in: the environment's set or the project's shared
-     * set.
-     *
-     * @generated from field: string set_id = 1;
+     * @generated from field: toshi.workspace.v1.ServiceState state = 1;
      */
-    setId?: string;
+    state?: ServiceStateJson;
     /**
-     * @generated from field: string name = 2;
-     */
-    name?: string;
-    /**
-     * @generated from field: int64 version = 3;
-     */
-    version?: string;
-};
-/**
- * Describes the message toshi.workspace.v1.BoundKey.
- * Use `create(BoundKeySchema)` to create a new message.
- */
-export declare const BoundKeySchema: GenMessage<BoundKey, {
-    jsonType: BoundKeyJson;
-}>;
-/**
- * SandboxSpec is a sandbox: a VM that runs until its owner
- * deletes it or Toshi stops it.
- *
- * @generated from message toshi.workspace.v1.SandboxSpec
- */
-export type SandboxSpec = Message<"toshi.workspace.v1.SandboxSpec"> & {
-    /**
-     * The runner size of its VM, as a job's runs-on label names one, for
-     * example "toshi-linux-2x". Required.
-     *
-     * @generated from field: string size = 1;
-     */
-    size: string;
-    /**
-     * How long it may run, in whole minutes. Unset, it runs until the plan's
-     * sandbox cap passes, or until it is stopped when the plan sets none. It
-     * cannot be longer than the plan's cap. Its owner can raise it while the
-     * sandbox runs (PatchWorkload).
-     *
-     * @generated from field: google.protobuf.Duration max_duration = 2;
-     */
-    maxDuration?: Duration | undefined;
-    /**
-     * What in its workspace the sandbox uses: only the secret set
-     * of its environment. Checked at create and fixed when the sandbox
-     * starts; each Execute gets the fixed values in its command's
-     * environment.
-     *
-     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 3;
-     */
-    bindings: Binding[];
-    /**
-     * Create only: the id of a state volume of the sandbox's project to
-     * attach to it, which it mounts when it starts. A volume of another
-     * project, or one attached or held elsewhere, fails the create with
-     * FAILED_PRECONDITION. Answers carry the id the create named, even after
-     * a detach; VolumeService answers what a volume is attached to now.
-     *
-     * @generated from field: string state_volume_id = 4;
-     */
-    stateVolumeId: string;
-};
-/**
- * SandboxSpec is a sandbox: a VM that runs until its owner
- * deletes it or Toshi stops it.
- *
- * @generated from message toshi.workspace.v1.SandboxSpec
- */
-export type SandboxSpecJson = {
-    /**
-     * The runner size of its VM, as a job's runs-on label names one, for
-     * example "toshi-linux-2x". Required.
-     *
-     * @generated from field: string size = 1;
-     */
-    size?: string;
-    /**
-     * How long it may run, in whole minutes. Unset, it runs until the plan's
-     * sandbox cap passes, or until it is stopped when the plan sets none. It
-     * cannot be longer than the plan's cap. Its owner can raise it while the
-     * sandbox runs (PatchWorkload).
-     *
-     * @generated from field: google.protobuf.Duration max_duration = 2;
-     */
-    maxDuration?: DurationJson;
-    /**
-     * What in its workspace the sandbox uses: only the secret set
-     * of its environment. Checked at create and fixed when the sandbox
-     * starts; each Execute gets the fixed values in its command's
-     * environment.
-     *
-     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 3;
-     */
-    bindings?: BindingJson[];
-    /**
-     * Create only: the id of a state volume of the sandbox's project to
-     * attach to it, which it mounts when it starts. A volume of another
-     * project, or one attached or held elsewhere, fails the create with
-     * FAILED_PRECONDITION. Answers carry the id the create named, even after
-     * a detach; VolumeService answers what a volume is attached to now.
-     *
-     * @generated from field: string state_volume_id = 4;
-     */
-    stateVolumeId?: string;
-};
-/**
- * Describes the message toshi.workspace.v1.SandboxSpec.
- * Use `create(SandboxSpecSchema)` to create a new message.
- */
-export declare const SandboxSpecSchema: GenMessage<SandboxSpec, {
-    jsonType: SandboxSpecJson;
-}>;
-/**
- * ServiceSpec is a service. Its fields are set wherever a service's
- * workload is answered: every workload and service call's answer, the
- * workload events and the webhook deliveries. A create sets name, size,
- * mode, recipe, state_volume and bindings and ignores revision and
- * template; answers leave recipe, state_volume and bindings empty. An
- * event carries the spec as of its own write; an event written before
- * events carried it has none.
- *
- * @generated from message toshi.workspace.v1.ServiceSpec
- */
-export type ServiceSpec = Message<"toshi.workspace.v1.ServiceSpec"> & {
-    /**
-     * The runner size its runs are placed by, for example "toshi-linux-2x".
-     * Empty in a create takes the configured default size.
-     *
-     * @generated from field: string size = 1;
-     */
-    size: string;
-    /**
-     * How it runs; set in a create, where UNSPECIFIED is always-on, and
-     * with SetServiceMode.
-     *
-     * @generated from field: toshi.workspace.v1.ServiceMode mode = 2;
-     */
-    mode: ServiceMode;
-    /**
-     * The number of its current revision: its next run runs that recipe.
-     *
-     * @generated from field: int64 revision = 3;
-     */
-    revision: bigint;
-    /**
-     * Its name, a lower-case DNS label, unique among the tenant's services
-     * that are not deleted, whatever their project or environment. Set in
-     * a create; answers carry it.
-     *
-     * @generated from field: string name = 4;
-     */
-    name: string;
-    /**
-     * The template its recipe starts from: "agent", "mcp-server",
-     * "model-server", "database", "browser", "dev-server", "media-server",
-     * "proxy" or "custom". Set by the server; ignored in a request.
-     *
-     * @generated from field: string template = 5;
-     */
-    template: string;
-    /**
-     * Create only: the recipe of revision 1, in TOML. Answers leave it
-     * empty.
-     *
-     * @generated from field: string recipe = 6;
-     */
-    recipe: string;
-    /**
-     * Create only: a state volume made with the service. Answers leave it
-     * unset.
-     *
-     * @generated from field: toshi.workspace.v1.StateVolumeSpec state_volume = 7;
-     */
-    stateVolume?: StateVolumeSpec | undefined;
-    /**
-     * Create only: the service's bindings, secret sets only. Answers leave
-     * them empty.
-     *
-     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 8;
-     */
-    bindings: Binding[];
-    /**
-     * Whether a started on-demand service is asleep: no run is live, and
-     * nothing keeps it awake. Set by the server; ignored in a request.
-     *
-     * @generated from field: bool sleeping = 9;
-     */
-    sleeping: boolean;
-    /**
-     * Until when a started on-demand service stays awake with no hold;
-     * unset for an always-on service. Set by the server; ignored in a
-     * request.
-     *
-     * @generated from field: google.protobuf.Timestamp awake_until = 10;
-     */
-    awakeUntil?: Timestamp | undefined;
-};
-/**
- * ServiceSpec is a service. Its fields are set wherever a service's
- * workload is answered: every workload and service call's answer, the
- * workload events and the webhook deliveries. A create sets name, size,
- * mode, recipe, state_volume and bindings and ignores revision and
- * template; answers leave recipe, state_volume and bindings empty. An
- * event carries the spec as of its own write; an event written before
- * events carried it has none.
- *
- * @generated from message toshi.workspace.v1.ServiceSpec
- */
-export type ServiceSpecJson = {
-    /**
-     * The runner size its runs are placed by, for example "toshi-linux-2x".
-     * Empty in a create takes the configured default size.
-     *
-     * @generated from field: string size = 1;
-     */
-    size?: string;
-    /**
-     * How it runs; set in a create, where UNSPECIFIED is always-on, and
-     * with SetServiceMode.
-     *
-     * @generated from field: toshi.workspace.v1.ServiceMode mode = 2;
-     */
-    mode?: ServiceModeJson;
-    /**
-     * The number of its current revision: its next run runs that recipe.
-     *
-     * @generated from field: int64 revision = 3;
-     */
-    revision?: string;
-    /**
-     * Its name, a lower-case DNS label, unique among the tenant's services
-     * that are not deleted, whatever their project or environment. Set in
-     * a create; answers carry it.
-     *
-     * @generated from field: string name = 4;
-     */
-    name?: string;
-    /**
-     * The template its recipe starts from: "agent", "mcp-server",
-     * "model-server", "database", "browser", "dev-server", "media-server",
-     * "proxy" or "custom". Set by the server; ignored in a request.
-     *
-     * @generated from field: string template = 5;
-     */
-    template?: string;
-    /**
-     * Create only: the recipe of revision 1, in TOML. Answers leave it
-     * empty.
-     *
-     * @generated from field: string recipe = 6;
-     */
-    recipe?: string;
-    /**
-     * Create only: a state volume made with the service. Answers leave it
-     * unset.
-     *
-     * @generated from field: toshi.workspace.v1.StateVolumeSpec state_volume = 7;
-     */
-    stateVolume?: StateVolumeSpecJson;
-    /**
-     * Create only: the service's bindings, secret sets only. Answers leave
-     * them empty.
-     *
-     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 8;
-     */
-    bindings?: BindingJson[];
-    /**
-     * Whether a started on-demand service is asleep: no run is live, and
-     * nothing keeps it awake. Set by the server; ignored in a request.
-     *
-     * @generated from field: bool sleeping = 9;
-     */
-    sleeping?: boolean;
-    /**
-     * Until when a started on-demand service stays awake with no hold;
-     * unset for an always-on service. Set by the server; ignored in a
-     * request.
-     *
-     * @generated from field: google.protobuf.Timestamp awake_until = 10;
-     */
-    awakeUntil?: TimestampJson;
-};
-/**
- * Describes the message toshi.workspace.v1.ServiceSpec.
- * Use `create(ServiceSpecSchema)` to create a new message.
- */
-export declare const ServiceSpecSchema: GenMessage<ServiceSpec, {
-    jsonType: ServiceSpecJson;
-}>;
-/**
- * StateVolumeSpec is the state volume a service is created with: it is
- * named after the service.
- *
- * @generated from message toshi.workspace.v1.StateVolumeSpec
- */
-export type StateVolumeSpec = Message<"toshi.workspace.v1.StateVolumeSpec"> & {
-    /**
-     * The volume's size cap, in bytes.
-     *
-     * @generated from field: int64 size_cap_bytes = 1;
-     */
-    sizeCapBytes: bigint;
-};
-/**
- * StateVolumeSpec is the state volume a service is created with: it is
- * named after the service.
- *
- * @generated from message toshi.workspace.v1.StateVolumeSpec
- */
-export type StateVolumeSpecJson = {
-    /**
-     * The volume's size cap, in bytes.
-     *
-     * @generated from field: int64 size_cap_bytes = 1;
-     */
-    sizeCapBytes?: string;
-};
-/**
- * Describes the message toshi.workspace.v1.StateVolumeSpec.
- * Use `create(StateVolumeSpecSchema)` to create a new message.
- */
-export declare const StateVolumeSpecSchema: GenMessage<StateVolumeSpec, {
-    jsonType: StateVolumeSpecJson;
-}>;
-/**
- * Command is a program to run in a workload's VM. argv is not passed
- * through a shell.
- *
- * @generated from message toshi.workspace.v1.Command
- */
-export type Command = Message<"toshi.workspace.v1.Command"> & {
-    /**
-     * The program and its arguments; argv[0] is looked up on the PATH.
-     *
-     * @generated from field: repeated string argv = 1;
-     */
-    argv: string[];
-    /**
-     * Added to the environment the command starts with.
-     *
-     * @generated from field: map<string, string> env = 2;
-     */
-    env: {
-        [key: string]: string;
-    };
-    /**
-     * The working directory; empty means the VM's default.
-     *
-     * @generated from field: string cwd = 3;
-     */
-    cwd: string;
-};
-/**
- * Command is a program to run in a workload's VM. argv is not passed
- * through a shell.
- *
- * @generated from message toshi.workspace.v1.Command
- */
-export type CommandJson = {
-    /**
-     * The program and its arguments; argv[0] is looked up on the PATH.
-     *
-     * @generated from field: repeated string argv = 1;
-     */
-    argv?: string[];
-    /**
-     * Added to the environment the command starts with.
-     *
-     * @generated from field: map<string, string> env = 2;
-     */
-    env?: {
-        [key: string]: string;
-    };
-    /**
-     * The working directory; empty means the VM's default.
-     *
-     * @generated from field: string cwd = 3;
-     */
-    cwd?: string;
-};
-/**
- * Describes the message toshi.workspace.v1.Command.
- * Use `create(CommandSchema)` to create a new message.
- */
-export declare const CommandSchema: GenMessage<Command, {
-    jsonType: CommandJson;
-}>;
-/**
- * WorkloadStatus is a workload's state and when it got there.
- *
- * @generated from message toshi.workspace.v1.WorkloadStatus
- */
-export type WorkloadStatus = Message<"toshi.workspace.v1.WorkloadStatus"> & {
-    /**
-     * @generated from field: toshi.workspace.v1.WorkloadState state = 1;
-     */
-    state: WorkloadState;
-    /**
-     * Set once the state is ENDED.
-     *
-     * @generated from field: toshi.workspace.v1.EndReason end_reason = 2;
-     */
-    endReason: EndReason;
-    /**
-     * A job's exit status, set when end_reason is EXITED.
-     *
-     * @generated from field: optional int32 exit_code = 3;
-     */
-    exitCode?: number | undefined;
-    /**
-     * The most recent error Toshi met running the workload.
-     *
-     * @generated from field: toshi.workspace.v1.Error last_error = 4;
-     */
-    lastError?: Error | undefined;
-    /**
-     * @generated from field: google.protobuf.Timestamp created_at = 5;
-     */
-    createdAt?: Timestamp | undefined;
-    /**
-     * @generated from field: google.protobuf.Timestamp queued_at = 6;
-     */
-    queuedAt?: Timestamp | undefined;
-    /**
-     * @generated from field: google.protobuf.Timestamp started_at = 7;
-     */
-    startedAt?: Timestamp | undefined;
-    /**
-     * @generated from field: google.protobuf.Timestamp ended_at = 8;
-     */
-    endedAt?: Timestamp | undefined;
-    /**
-     * When anything in the workload last changed.
-     *
-     * @generated from field: google.protobuf.Timestamp updated_at = 9;
-     */
-    updatedAt?: Timestamp | undefined;
-    /**
-     * Why a sandbox was stopped, set once it has ended: with STOPPED, and
-     * with FAILED when it failed after a stop was asked.
-     *
-     * @generated from field: toshi.workspace.v1.StopReason stop_reason = 10;
-     */
-    stopReason: StopReason;
-    /**
-     * A running sandbox's previews: one for each of its http channels served
-     * at a hostname of its own, the channel `preview` among them. Empty for
-     * a job, and while the control plane serves no previews. Making or
-     * deleting such a channel changes the workload, so WatchWorkloads sends
-     * it again.
-     *
-     * @generated from field: repeated toshi.workspace.v1.SandboxPreview previews = 11;
-     */
-    previews: SandboxPreview[];
-};
-/**
- * WorkloadStatus is a workload's state and when it got there.
- *
- * @generated from message toshi.workspace.v1.WorkloadStatus
- */
-export type WorkloadStatusJson = {
-    /**
-     * @generated from field: toshi.workspace.v1.WorkloadState state = 1;
-     */
-    state?: WorkloadStateJson;
-    /**
-     * Set once the state is ENDED.
-     *
-     * @generated from field: toshi.workspace.v1.EndReason end_reason = 2;
+     * Set once the state is ENDED: STOPPED or FAILED.
+     *
+     * @generated from field: toshi.workspace.v1.EndReason end_reason = 2;
      */
     endReason?: EndReasonJson;
     /**
-     * A job's exit status, set when end_reason is EXITED.
-     *
-     * @generated from field: optional int32 exit_code = 3;
-     */
-    exitCode?: number;
-    /**
-     * The most recent error Toshi met running the workload.
+     * The most recent error Toshi met running the service.
      *
-     * @generated from field: toshi.workspace.v1.Error last_error = 4;
+     * @generated from field: toshi.workspace.v1.Error last_error = 3;
      */
     lastError?: ErrorJson;
     /**
-     * @generated from field: google.protobuf.Timestamp created_at = 5;
+     * @generated from field: google.protobuf.Timestamp created_at = 4;
      */
     createdAt?: TimestampJson;
     /**
-     * @generated from field: google.protobuf.Timestamp queued_at = 6;
+     * @generated from field: google.protobuf.Timestamp queued_at = 5;
      */
     queuedAt?: TimestampJson;
     /**
-     * @generated from field: google.protobuf.Timestamp started_at = 7;
+     * @generated from field: google.protobuf.Timestamp started_at = 6;
      */
     startedAt?: TimestampJson;
     /**
-     * @generated from field: google.protobuf.Timestamp ended_at = 8;
+     * @generated from field: google.protobuf.Timestamp ended_at = 7;
      */
     endedAt?: TimestampJson;
     /**
-     * When anything in the workload last changed.
+     * When anything in the service last changed.
      *
-     * @generated from field: google.protobuf.Timestamp updated_at = 9;
+     * @generated from field: google.protobuf.Timestamp updated_at = 8;
      */
     updatedAt?: TimestampJson;
-    /**
-     * Why a sandbox was stopped, set once it has ended: with STOPPED, and
-     * with FAILED when it failed after a stop was asked.
-     *
-     * @generated from field: toshi.workspace.v1.StopReason stop_reason = 10;
-     */
-    stopReason?: StopReasonJson;
-    /**
-     * A running sandbox's previews: one for each of its http channels served
-     * at a hostname of its own, the channel `preview` among them. Empty for
-     * a job, and while the control plane serves no previews. Making or
-     * deleting such a channel changes the workload, so WatchWorkloads sends
-     * it again.
-     *
-     * @generated from field: repeated toshi.workspace.v1.SandboxPreview previews = 11;
-     */
-    previews?: SandboxPreviewJson[];
 };
 /**
- * Describes the message toshi.workspace.v1.WorkloadStatus.
- * Use `create(WorkloadStatusSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.ServiceStatus.
+ * Use `create(ServiceStatusSchema)` to create a new message.
  */
-export declare const WorkloadStatusSchema: GenMessage<WorkloadStatus, {
-    jsonType: WorkloadStatusJson;
+export declare const ServiceStatusSchema: GenMessage<ServiceStatus, {
+    jsonType: ServiceStatusJson;
 }>;
 /**
- * SandboxPreview is where a browser opens one http channel of a sandbox.
+ * JobSpec is a job: one command, run once.
  *
- * @generated from message toshi.workspace.v1.SandboxPreview
+ * @generated from message toshi.workspace.v1.JobSpec
  */
-export type SandboxPreview = Message<"toshi.workspace.v1.SandboxPreview"> & {
+export type JobSpec = Message<"toshi.workspace.v1.JobSpec"> & {
     /**
-     * The channel's name; `preview` for the port the sandbox's image
-     * declares.
-     *
-     * @generated from field: string channel = 1;
+     * @generated from field: toshi.workspace.v1.Command command = 1;
      */
-    channel: string;
+    command?: Command | undefined;
     /**
-     * The guest port the channel reaches.
+     * What in its workspace the job uses. Checked at create
+     * against the job's project and environment, and fixed when the job
+     * starts; GetJobResponse.bound shows what each was fixed to.
      *
-     * @generated from field: int32 port = 2;
+     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 2;
      */
-    port: number;
+    bindings: Binding[];
     /**
-     * The preview's origin, a scheme and a hostname without a path.
+     * The runner size the job runs at, a Linux size such as
+     * "toshi-linux-2x": jobs run on Linux guests only. Empty in a create
+     * takes the configured default size. Another value fails the create with
+     * INVALID_ARGUMENT.
      *
-     * @generated from field: string url = 3;
+     * @generated from field: string size = 3;
      */
-    url: string;
+    size: string;
 };
 /**
- * SandboxPreview is where a browser opens one http channel of a sandbox.
+ * JobSpec is a job: one command, run once.
  *
- * @generated from message toshi.workspace.v1.SandboxPreview
+ * @generated from message toshi.workspace.v1.JobSpec
  */
-export type SandboxPreviewJson = {
+export type JobSpecJson = {
     /**
-     * The channel's name; `preview` for the port the sandbox's image
-     * declares.
-     *
-     * @generated from field: string channel = 1;
+     * @generated from field: toshi.workspace.v1.Command command = 1;
      */
-    channel?: string;
+    command?: CommandJson;
     /**
-     * The guest port the channel reaches.
+     * What in its workspace the job uses. Checked at create
+     * against the job's project and environment, and fixed when the job
+     * starts; GetJobResponse.bound shows what each was fixed to.
      *
-     * @generated from field: int32 port = 2;
+     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 2;
      */
-    port?: number;
+    bindings?: BindingJson[];
     /**
-     * The preview's origin, a scheme and a hostname without a path.
+     * The runner size the job runs at, a Linux size such as
+     * "toshi-linux-2x": jobs run on Linux guests only. Empty in a create
+     * takes the configured default size. Another value fails the create with
+     * INVALID_ARGUMENT.
      *
-     * @generated from field: string url = 3;
+     * @generated from field: string size = 3;
      */
-    url?: string;
+    size?: string;
 };
 /**
- * Describes the message toshi.workspace.v1.SandboxPreview.
- * Use `create(SandboxPreviewSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.JobSpec.
+ * Use `create(JobSpecSchema)` to create a new message.
  */
-export declare const SandboxPreviewSchema: GenMessage<SandboxPreview, {
-    jsonType: SandboxPreviewJson;
+export declare const JobSpecSchema: GenMessage<JobSpec, {
+    jsonType: JobSpecJson;
 }>;
 /**
- * Error is a failure carried in a resource rather than returned by a call.
+ * Binding is one binding a workload declares.
  *
- * @generated from message toshi.workspace.v1.Error
+ * @generated from message toshi.workspace.v1.Binding
  */
-export type Error = Message<"toshi.workspace.v1.Error"> & {
+export type Binding = Message<"toshi.workspace.v1.Binding"> & {
     /**
-     * A Connect error code name, such as "unavailable".
+     * Names the binding in the workload: a lowercase DNS label, unique in
+     * the workload.
      *
-     * @generated from field: string code = 1;
+     * @generated from field: string name = 1;
      */
-    code: string;
+    name: string;
     /**
-     * @generated from field: string message = 2;
+     * What the binding is to. Set exactly one.
+     *
+     * @generated from oneof toshi.workspace.v1.Binding.target
      */
-    message: string;
+    target: {
+        /**
+         * A channel of a service of the workload's project and environment.
+         *
+         * @generated from field: toshi.workspace.v1.ServiceChannel service = 2;
+         */
+        value: ServiceChannel;
+        case: "service";
+    } | {
+        /**
+         * The secret set of the workload's environment.
+         *
+         * @generated from field: toshi.workspace.v1.EnvironmentSecrets secrets = 3;
+         */
+        value: EnvironmentSecrets;
+        case: "secrets";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
 };
 /**
- * Error is a failure carried in a resource rather than returned by a call.
+ * Binding is one binding a workload declares.
  *
- * @generated from message toshi.workspace.v1.Error
+ * @generated from message toshi.workspace.v1.Binding
  */
-export type ErrorJson = {
+export type BindingJson = {
     /**
-     * A Connect error code name, such as "unavailable".
+     * Names the binding in the workload: a lowercase DNS label, unique in
+     * the workload.
      *
-     * @generated from field: string code = 1;
+     * @generated from field: string name = 1;
+     */
+    name?: string;
+    /**
+     * A channel of a service of the workload's project and environment.
+     *
+     * @generated from field: toshi.workspace.v1.ServiceChannel service = 2;
      */
-    code?: string;
+    service?: ServiceChannelJson;
     /**
-     * @generated from field: string message = 2;
+     * The secret set of the workload's environment.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentSecrets secrets = 3;
      */
-    message?: string;
+    secrets?: EnvironmentSecretsJson;
 };
 /**
- * Describes the message toshi.workspace.v1.Error.
- * Use `create(ErrorSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.Binding.
+ * Use `create(BindingSchema)` to create a new message.
  */
-export declare const ErrorSchema: GenMessage<Error, {
-    jsonType: ErrorJson;
+export declare const BindingSchema: GenMessage<Binding, {
+    jsonType: BindingJson;
 }>;
 /**
- * Output is what a job's command wrote, returned with the call that waited
- * for it.
+ * ServiceChannel is a channel of a service, by the service's name and the
+ * channel's name in its recipe, as a recipe's uses names it:
+ * "<service>.<channel>".
  *
- * @generated from message toshi.workspace.v1.Output
+ * @generated from message toshi.workspace.v1.ServiceChannel
  */
-export type Output = Message<"toshi.workspace.v1.Output"> & {
-    /**
-     * @generated from field: bytes stdout = 1;
-     */
-    stdout: Uint8Array;
+export type ServiceChannel = Message<"toshi.workspace.v1.ServiceChannel"> & {
     /**
-     * @generated from field: bytes stderr = 2;
+     * @generated from field: string service = 1;
      */
-    stderr: Uint8Array;
+    service: string;
     /**
-     * True when the server kept only the start of a stream.
-     *
-     * @generated from field: bool truncated = 3;
+     * @generated from field: string channel = 2;
      */
-    truncated: boolean;
+    channel: string;
 };
 /**
- * Output is what a job's command wrote, returned with the call that waited
- * for it.
+ * ServiceChannel is a channel of a service, by the service's name and the
+ * channel's name in its recipe, as a recipe's uses names it:
+ * "<service>.<channel>".
  *
- * @generated from message toshi.workspace.v1.Output
+ * @generated from message toshi.workspace.v1.ServiceChannel
  */
-export type OutputJson = {
-    /**
-     * @generated from field: bytes stdout = 1;
-     */
-    stdout?: string;
+export type ServiceChannelJson = {
     /**
-     * @generated from field: bytes stderr = 2;
+     * @generated from field: string service = 1;
      */
-    stderr?: string;
+    service?: string;
     /**
-     * True when the server kept only the start of a stream.
-     *
-     * @generated from field: bool truncated = 3;
+     * @generated from field: string channel = 2;
      */
-    truncated?: boolean;
+    channel?: string;
 };
 /**
- * Describes the message toshi.workspace.v1.Output.
- * Use `create(OutputSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.ServiceChannel.
+ * Use `create(ServiceChannelSchema)` to create a new message.
  */
-export declare const OutputSchema: GenMessage<Output, {
-    jsonType: OutputJson;
+export declare const ServiceChannelSchema: GenMessage<ServiceChannel, {
+    jsonType: ServiceChannelJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.CreateWorkloadRequest
+ * EnvironmentSecrets binds the secret set of the workload's environment,
+ * with the project's shared keys. The set must grant the workload's kind.
+ *
+ * @generated from message toshi.workspace.v1.EnvironmentSecrets
  */
-export type CreateWorkloadRequest = Message<"toshi.workspace.v1.CreateWorkloadRequest"> & {
-    /**
-     * @generated from field: string project = 1;
-     */
-    project: string;
+export type EnvironmentSecrets = Message<"toshi.workspace.v1.EnvironmentSecrets"> & {};
+/**
+ * EnvironmentSecrets binds the secret set of the workload's environment,
+ * with the project's shared keys. The set must grant the workload's kind.
+ *
+ * @generated from message toshi.workspace.v1.EnvironmentSecrets
+ */
+export type EnvironmentSecretsJson = {};
+/**
+ * Describes the message toshi.workspace.v1.EnvironmentSecrets.
+ * Use `create(EnvironmentSecretsSchema)` to create a new message.
+ */
+export declare const EnvironmentSecretsSchema: GenMessage<EnvironmentSecrets, {
+    jsonType: EnvironmentSecretsJson;
+}>;
+/**
+ * BoundBinding is a binding as it was fixed when its workload started.
+ * A later change or delete of the target leaves it as it is.
+ *
+ * @generated from message toshi.workspace.v1.BoundBinding
+ */
+export type BoundBinding = Message<"toshi.workspace.v1.BoundBinding"> & {
     /**
-     * @generated from field: string environment = 2;
+     * @generated from field: string name = 1;
      */
-    environment: string;
+    name: string;
     /**
-     * Exactly one is set; it names the kind.
-     *
-     * @generated from oneof toshi.workspace.v1.CreateWorkloadRequest.spec
+     * @generated from oneof toshi.workspace.v1.BoundBinding.target
      */
-    spec: {
-        /**
-         * @generated from field: toshi.workspace.v1.JobSpec job = 3;
-         */
-        value: JobSpec;
-        case: "job";
-    } | {
+    target: {
         /**
-         * @generated from field: toshi.workspace.v1.SandboxSpec sandbox = 4;
+         * @generated from field: toshi.workspace.v1.BoundService service = 2;
          */
-        value: SandboxSpec;
-        case: "sandbox";
+        value: BoundService;
+        case: "service";
     } | {
         /**
-         * @generated from field: toshi.workspace.v1.ServiceSpec service = 5;
+         * @generated from field: toshi.workspace.v1.BoundSecrets secrets = 3;
          */
-        value: ServiceSpec;
-        case: "service";
+        value: BoundSecrets;
+        case: "secrets";
     } | {
         case: undefined;
         value?: undefined;
     };
     /**
-     * @generated from field: map<string, string> labels = 6;
+     * @generated from field: google.protobuf.Timestamp taken_at = 4;
      */
-    labels: {
-        [key: string]: string;
-    };
+    takenAt?: Timestamp | undefined;
+};
+/**
+ * BoundBinding is a binding as it was fixed when its workload started.
+ * A later change or delete of the target leaves it as it is.
+ *
+ * @generated from message toshi.workspace.v1.BoundBinding
+ */
+export type BoundBindingJson = {
     /**
-     * Required: the same key on every retry of this create.
-     *
-     * @generated from field: string request_key = 7;
+     * @generated from field: string name = 1;
      */
-    requestKey: string;
+    name?: string;
     /**
-     * For a job: block until it ends, at most this long. Zero returns at once.
-     * Set for another kind it fails with INVALID_ARGUMENT.
-     *
-     * @generated from field: google.protobuf.Duration wait_for_end = 8;
+     * @generated from field: toshi.workspace.v1.BoundService service = 2;
      */
-    waitForEnd?: Duration | undefined;
+    service?: BoundServiceJson;
     /**
-     * What the workload records of its runs. UNSPECIFIED takes the default
-     * RecordingPolicy names.
-     *
-     * @generated from field: toshi.workspace.v1.RecordingPolicy recording = 9;
+     * @generated from field: toshi.workspace.v1.BoundSecrets secrets = 3;
      */
-    recording: RecordingPolicy;
+    secrets?: BoundSecretsJson;
+    /**
+     * @generated from field: google.protobuf.Timestamp taken_at = 4;
+     */
+    takenAt?: TimestampJson;
 };
 /**
- * @generated from message toshi.workspace.v1.CreateWorkloadRequest
+ * Describes the message toshi.workspace.v1.BoundBinding.
+ * Use `create(BoundBindingSchema)` to create a new message.
+ */
+export declare const BoundBindingSchema: GenMessage<BoundBinding, {
+    jsonType: BoundBindingJson;
+}>;
+/**
+ * BoundService is a service channel as it was when the workload started.
+ *
+ * @generated from message toshi.workspace.v1.BoundService
  */
-export type CreateWorkloadRequestJson = {
+export type BoundService = Message<"toshi.workspace.v1.BoundService"> & {
     /**
-     * @generated from field: string project = 1;
+     * @generated from field: string service = 1;
      */
-    project?: string;
+    service: string;
     /**
-     * @generated from field: string environment = 2;
+     * The service's workload ID.
+     *
+     * @generated from field: string service_id = 2;
      */
-    environment?: string;
+    serviceId: string;
     /**
-     * @generated from field: toshi.workspace.v1.JobSpec job = 3;
+     * The service's revision that was current.
+     *
+     * @generated from field: int64 revision = 3;
      */
-    job?: JobSpecJson;
+    revision: bigint;
     /**
-     * @generated from field: toshi.workspace.v1.SandboxSpec sandbox = 4;
+     * @generated from field: string channel = 4;
      */
-    sandbox?: SandboxSpecJson;
+    channel: string;
     /**
-     * @generated from field: toshi.workspace.v1.ServiceSpec service = 5;
+     * The channel's shape and, for an http channel, its guest port.
+     *
+     * @generated from field: string shape = 5;
      */
-    service?: ServiceSpecJson;
+    shape: string;
     /**
-     * @generated from field: map<string, string> labels = 6;
+     * @generated from field: int32 port = 6;
      */
-    labels?: {
-        [key: string]: string;
-    };
+    port: number;
     /**
-     * Required: the same key on every retry of this create.
+     * What the channel accepts from the caller: "workload_identity", a
+     * connect credential signed by the workload identity issuer
+     * naming audience and this binding. Minted when the job's command
+     * starts, and passed only to that command.
      *
-     * @generated from field: string request_key = 7;
+     * @generated from field: string credential = 7;
      */
-    requestKey?: string;
+    credential: string;
     /**
-     * For a job: block until it ends, at most this long. Zero returns at once.
-     * Set for another kind it fails with INVALID_ARGUMENT.
-     *
-     * @generated from field: google.protobuf.Duration wait_for_end = 8;
+     * @generated from field: string audience = 8;
      */
-    waitForEnd?: DurationJson;
+    audience: string;
     /**
-     * What the workload records of its runs. UNSPECIFIED takes the default
-     * RecordingPolicy names.
+     * The id (jti) of the connect credential minted for this binding. Never
+     * the credential.
      *
-     * @generated from field: toshi.workspace.v1.RecordingPolicy recording = 9;
+     * @generated from field: string credential_id = 9;
      */
-    recording?: RecordingPolicyJson;
+    credentialId: string;
 };
 /**
- * Describes the message toshi.workspace.v1.CreateWorkloadRequest.
- * Use `create(CreateWorkloadRequestSchema)` to create a new message.
- */
-export declare const CreateWorkloadRequestSchema: GenMessage<CreateWorkloadRequest, {
-    jsonType: CreateWorkloadRequestJson;
-}>;
-/**
- * @generated from message toshi.workspace.v1.CreateWorkloadResponse
+ * BoundService is a service channel as it was when the workload started.
+ *
+ * @generated from message toshi.workspace.v1.BoundService
  */
-export type CreateWorkloadResponse = Message<"toshi.workspace.v1.CreateWorkloadResponse"> & {
+export type BoundServiceJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * @generated from field: string service = 1;
      */
-    workload?: Workload | undefined;
+    service?: string;
     /**
-     * Set when wait_for_end was set and the job had ended when the call
-     * answered.
+     * The service's workload ID.
      *
-     * @generated from field: toshi.workspace.v1.Output output = 2;
-     */
-    output?: Output | undefined;
-};
-/**
- * @generated from message toshi.workspace.v1.CreateWorkloadResponse
- */
-export type CreateWorkloadResponseJson = {
-    /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * @generated from field: string service_id = 2;
      */
-    workload?: WorkloadJson;
+    serviceId?: string;
     /**
-     * Set when wait_for_end was set and the job had ended when the call
-     * answered.
+     * The service's revision that was current.
      *
-     * @generated from field: toshi.workspace.v1.Output output = 2;
+     * @generated from field: int64 revision = 3;
      */
-    output?: OutputJson;
-};
-/**
- * Describes the message toshi.workspace.v1.CreateWorkloadResponse.
- * Use `create(CreateWorkloadResponseSchema)` to create a new message.
- */
-export declare const CreateWorkloadResponseSchema: GenMessage<CreateWorkloadResponse, {
-    jsonType: CreateWorkloadResponseJson;
-}>;
-/**
- * @generated from message toshi.workspace.v1.GetWorkloadRequest
- */
-export type GetWorkloadRequest = Message<"toshi.workspace.v1.GetWorkloadRequest"> & {
+    revision?: string;
     /**
-     * @generated from field: string project = 1;
+     * @generated from field: string channel = 4;
      */
-    project: string;
+    channel?: string;
     /**
-     * @generated from field: string environment = 2;
+     * The channel's shape and, for an http channel, its guest port.
+     *
+     * @generated from field: string shape = 5;
      */
-    environment: string;
+    shape?: string;
     /**
-     * @generated from field: string id = 3;
+     * @generated from field: int32 port = 6;
      */
-    id: string;
-};
-/**
- * @generated from message toshi.workspace.v1.GetWorkloadRequest
- */
-export type GetWorkloadRequestJson = {
+    port?: number;
     /**
-     * @generated from field: string project = 1;
+     * What the channel accepts from the caller: "workload_identity", a
+     * connect credential signed by the workload identity issuer
+     * naming audience and this binding. Minted when the job's command
+     * starts, and passed only to that command.
+     *
+     * @generated from field: string credential = 7;
      */
-    project?: string;
+    credential?: string;
     /**
-     * @generated from field: string environment = 2;
+     * @generated from field: string audience = 8;
      */
-    environment?: string;
+    audience?: string;
     /**
-     * @generated from field: string id = 3;
+     * The id (jti) of the connect credential minted for this binding. Never
+     * the credential.
+     *
+     * @generated from field: string credential_id = 9;
      */
-    id?: string;
+    credentialId?: string;
 };
 /**
- * Describes the message toshi.workspace.v1.GetWorkloadRequest.
- * Use `create(GetWorkloadRequestSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.BoundService.
+ * Use `create(BoundServiceSchema)` to create a new message.
  */
-export declare const GetWorkloadRequestSchema: GenMessage<GetWorkloadRequest, {
-    jsonType: GetWorkloadRequestJson;
+export declare const BoundServiceSchema: GenMessage<BoundService, {
+    jsonType: BoundServiceJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.GetWorkloadResponse
+ * BoundSecrets is the environment's secret set as it was when the
+ * workload started: which keys, from which set, at which version. Never
+ * a value.
+ *
+ * @generated from message toshi.workspace.v1.BoundSecrets
  */
-export type GetWorkloadResponse = Message<"toshi.workspace.v1.GetWorkloadResponse"> & {
+export type BoundSecrets = Message<"toshi.workspace.v1.BoundSecrets"> & {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * @generated from field: string set_id = 1;
      */
-    workload?: Workload | undefined;
+    setId: string;
     /**
-     * The workload's bindings as they were fixed when it started, in name
-     * order; empty before it started.
-     *
-     * @generated from field: repeated toshi.workspace.v1.BoundBinding bound = 2;
+     * @generated from field: repeated toshi.workspace.v1.BoundKey keys = 2;
      */
-    bound: BoundBinding[];
+    keys: BoundKey[];
 };
 /**
- * @generated from message toshi.workspace.v1.GetWorkloadResponse
+ * BoundSecrets is the environment's secret set as it was when the
+ * workload started: which keys, from which set, at which version. Never
+ * a value.
+ *
+ * @generated from message toshi.workspace.v1.BoundSecrets
  */
-export type GetWorkloadResponseJson = {
+export type BoundSecretsJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * @generated from field: string set_id = 1;
      */
-    workload?: WorkloadJson;
+    setId?: string;
     /**
-     * The workload's bindings as they were fixed when it started, in name
-     * order; empty before it started.
-     *
-     * @generated from field: repeated toshi.workspace.v1.BoundBinding bound = 2;
+     * @generated from field: repeated toshi.workspace.v1.BoundKey keys = 2;
      */
-    bound?: BoundBindingJson[];
+    keys?: BoundKeyJson[];
 };
 /**
- * Describes the message toshi.workspace.v1.GetWorkloadResponse.
- * Use `create(GetWorkloadResponseSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.BoundSecrets.
+ * Use `create(BoundSecretsSchema)` to create a new message.
  */
-export declare const GetWorkloadResponseSchema: GenMessage<GetWorkloadResponse, {
-    jsonType: GetWorkloadResponseJson;
+export declare const BoundSecretsSchema: GenMessage<BoundSecrets, {
+    jsonType: BoundSecretsJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.ListWorkloadsRequest
+ * @generated from message toshi.workspace.v1.BoundKey
  */
-export type ListWorkloadsRequest = Message<"toshi.workspace.v1.ListWorkloadsRequest"> & {
-    /**
-     * @generated from field: string project = 1;
-     */
-    project: string;
-    /**
-     * @generated from field: string environment = 2;
-     */
-    environment: string;
-    /**
-     * Empty matches every kind.
-     *
-     * @generated from field: repeated toshi.workspace.v1.WorkloadKind kinds = 3;
-     */
-    kinds: WorkloadKind[];
-    /**
-     * Empty matches every state.
-     *
-     * @generated from field: repeated toshi.workspace.v1.WorkloadState states = 4;
-     */
-    states: WorkloadState[];
+export type BoundKey = Message<"toshi.workspace.v1.BoundKey"> & {
     /**
-     * The most workloads in one page; zero lets the server choose.
+     * The set the key is in: the environment's set or the project's shared
+     * set.
      *
-     * @generated from field: int32 page_size = 5;
+     * @generated from field: string set_id = 1;
      */
-    pageSize: number;
+    setId: string;
     /**
-     * From an earlier response's next_page_token; empty for the first page.
-     *
-     * @generated from field: string page_token = 6;
+     * @generated from field: string name = 2;
      */
-    pageToken: string;
+    name: string;
     /**
-     * Only the workloads that carry every one of these labels, each with
-     * exactly this value. A workload without one of the keys never matches,
-     * even when the value given is empty. No labels matches every workload.
-     *
-     * @generated from field: map<string, string> labels = 7;
+     * @generated from field: int64 version = 3;
      */
-    labels: {
-        [key: string]: string;
-    };
+    version: bigint;
 };
 /**
- * @generated from message toshi.workspace.v1.ListWorkloadsRequest
+ * @generated from message toshi.workspace.v1.BoundKey
  */
-export type ListWorkloadsRequestJson = {
+export type BoundKeyJson = {
     /**
-     * @generated from field: string project = 1;
+     * The set the key is in: the environment's set or the project's shared
+     * set.
+     *
+     * @generated from field: string set_id = 1;
      */
-    project?: string;
+    setId?: string;
     /**
-     * @generated from field: string environment = 2;
+     * @generated from field: string name = 2;
      */
-    environment?: string;
+    name?: string;
     /**
-     * Empty matches every kind.
-     *
-     * @generated from field: repeated toshi.workspace.v1.WorkloadKind kinds = 3;
+     * @generated from field: int64 version = 3;
      */
-    kinds?: WorkloadKindJson[];
+    version?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.BoundKey.
+ * Use `create(BoundKeySchema)` to create a new message.
+ */
+export declare const BoundKeySchema: GenMessage<BoundKey, {
+    jsonType: BoundKeyJson;
+}>;
+/**
+ * SandboxSpec is a sandbox: a VM that runs until its owner
+ * deletes it or Toshi stops it.
+ *
+ * @generated from message toshi.workspace.v1.SandboxSpec
+ */
+export type SandboxSpec = Message<"toshi.workspace.v1.SandboxSpec"> & {
     /**
-     * Empty matches every state.
+     * The runner size of its VM, as a job's runs-on label names one, for
+     * example "toshi-linux-2x". Required.
      *
-     * @generated from field: repeated toshi.workspace.v1.WorkloadState states = 4;
+     * @generated from field: string size = 1;
      */
-    states?: WorkloadStateJson[];
+    size: string;
     /**
-     * The most workloads in one page; zero lets the server choose.
+     * How long it may run, in whole minutes. Unset, it runs until the plan's
+     * sandbox cap passes, or until it is stopped when the plan sets none. It
+     * cannot be longer than the plan's cap. Its owner can raise it while the
+     * sandbox runs (UpdateSandbox).
      *
-     * @generated from field: int32 page_size = 5;
+     * @generated from field: google.protobuf.Duration max_duration = 2;
      */
-    pageSize?: number;
+    maxDuration?: Duration | undefined;
     /**
-     * From an earlier response's next_page_token; empty for the first page.
+     * What in its workspace the sandbox uses: only the secret set
+     * of its environment. Checked at create and fixed when the sandbox
+     * starts; each Execute gets the fixed values in its command's
+     * environment.
      *
-     * @generated from field: string page_token = 6;
+     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 3;
      */
-    pageToken?: string;
+    bindings: Binding[];
     /**
-     * Only the workloads that carry every one of these labels, each with
-     * exactly this value. A workload without one of the keys never matches,
-     * even when the value given is empty. No labels matches every workload.
+     * Create only: the id of a state volume of the sandbox's project to
+     * attach to it, which it mounts when it starts. A volume of another
+     * project, or one attached or held elsewhere, fails the create with
+     * FAILED_PRECONDITION. Answers carry the id the create named, even after
+     * a detach; VolumeService answers what a volume is attached to now.
      *
-     * @generated from field: map<string, string> labels = 7;
+     * @generated from field: string state_volume_id = 4;
      */
-    labels?: {
-        [key: string]: string;
-    };
+    stateVolumeId: string;
 };
 /**
- * Describes the message toshi.workspace.v1.ListWorkloadsRequest.
- * Use `create(ListWorkloadsRequestSchema)` to create a new message.
- */
-export declare const ListWorkloadsRequestSchema: GenMessage<ListWorkloadsRequest, {
-    jsonType: ListWorkloadsRequestJson;
-}>;
-/**
- * @generated from message toshi.workspace.v1.ListWorkloadsResponse
+ * SandboxSpec is a sandbox: a VM that runs until its owner
+ * deletes it or Toshi stops it.
+ *
+ * @generated from message toshi.workspace.v1.SandboxSpec
  */
-export type ListWorkloadsResponse = Message<"toshi.workspace.v1.ListWorkloadsResponse"> & {
-    /**
-     * @generated from field: repeated toshi.workspace.v1.Workload workloads = 1;
-     */
-    workloads: Workload[];
+export type SandboxSpecJson = {
     /**
-     * Empty on the last page.
+     * The runner size of its VM, as a job's runs-on label names one, for
+     * example "toshi-linux-2x". Required.
      *
-     * @generated from field: string next_page_token = 2;
+     * @generated from field: string size = 1;
      */
-    nextPageToken: string;
+    size?: string;
     /**
-     * The event log's position when the first page was read; every page of
-     * the list returns it. WatchWorkloads from this cursor shows every change
-     * after the list.
+     * How long it may run, in whole minutes. Unset, it runs until the plan's
+     * sandbox cap passes, or until it is stopped when the plan sets none. It
+     * cannot be longer than the plan's cap. Its owner can raise it while the
+     * sandbox runs (UpdateSandbox).
      *
-     * @generated from field: string cursor = 3;
-     */
-    cursor: string;
-};
-/**
- * @generated from message toshi.workspace.v1.ListWorkloadsResponse
- */
-export type ListWorkloadsResponseJson = {
-    /**
-     * @generated from field: repeated toshi.workspace.v1.Workload workloads = 1;
+     * @generated from field: google.protobuf.Duration max_duration = 2;
      */
-    workloads?: WorkloadJson[];
+    maxDuration?: DurationJson;
     /**
-     * Empty on the last page.
+     * What in its workspace the sandbox uses: only the secret set
+     * of its environment. Checked at create and fixed when the sandbox
+     * starts; each Execute gets the fixed values in its command's
+     * environment.
      *
-     * @generated from field: string next_page_token = 2;
+     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 3;
      */
-    nextPageToken?: string;
+    bindings?: BindingJson[];
     /**
-     * The event log's position when the first page was read; every page of
-     * the list returns it. WatchWorkloads from this cursor shows every change
-     * after the list.
+     * Create only: the id of a state volume of the sandbox's project to
+     * attach to it, which it mounts when it starts. A volume of another
+     * project, or one attached or held elsewhere, fails the create with
+     * FAILED_PRECONDITION. Answers carry the id the create named, even after
+     * a detach; VolumeService answers what a volume is attached to now.
      *
-     * @generated from field: string cursor = 3;
+     * @generated from field: string state_volume_id = 4;
      */
-    cursor?: string;
+    stateVolumeId?: string;
 };
 /**
- * Describes the message toshi.workspace.v1.ListWorkloadsResponse.
- * Use `create(ListWorkloadsResponseSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.SandboxSpec.
+ * Use `create(SandboxSpecSchema)` to create a new message.
  */
-export declare const ListWorkloadsResponseSchema: GenMessage<ListWorkloadsResponse, {
-    jsonType: ListWorkloadsResponseJson;
+export declare const SandboxSpecSchema: GenMessage<SandboxSpec, {
+    jsonType: SandboxSpecJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.PatchWorkloadRequest
+ * ServiceSpec is a service. Its fields are set wherever a service's
+ * workload is answered: every workload and service call's answer, the
+ * workload events and the webhook deliveries. A create sets name, size,
+ * mode, recipe, state_volume and bindings and ignores revision and
+ * template; answers leave recipe, state_volume and bindings empty. An
+ * event carries the spec as of its own write; an event written before
+ * events carried it has none.
+ *
+ * @generated from message toshi.workspace.v1.ServiceSpec
  */
-export type PatchWorkloadRequest = Message<"toshi.workspace.v1.PatchWorkloadRequest"> & {
-    /**
-     * @generated from field: string project = 1;
-     */
-    project: string;
-    /**
-     * @generated from field: string environment = 2;
-     */
-    environment: string;
-    /**
-     * @generated from field: string id = 3;
-     */
-    id: string;
+export type ServiceSpec = Message<"toshi.workspace.v1.ServiceSpec"> & {
     /**
-     * Carries the new values of the fields update_mask names.
+     * The runner size its runs are placed by, for example "toshi-linux-2x".
+     * Empty in a create takes the configured default size.
      *
-     * @generated from field: toshi.workspace.v1.Workload workload = 4;
-     */
-    workload?: Workload | undefined;
-    /**
-     * @generated from field: google.protobuf.FieldMask update_mask = 5;
+     * @generated from field: string size = 1;
      */
-    updateMask?: FieldMask | undefined;
+    size: string;
     /**
-     * @generated from field: string request_key = 6;
+     * How it runs; set in a create, where UNSPECIFIED is always-on, and
+     * with SetServiceMode.
+     *
+     * @generated from field: toshi.workspace.v1.ServiceMode mode = 2;
      */
-    requestKey: string;
-};
-/**
- * @generated from message toshi.workspace.v1.PatchWorkloadRequest
- */
-export type PatchWorkloadRequestJson = {
+    mode: ServiceMode;
     /**
-     * @generated from field: string project = 1;
+     * The number of its current revision: its next run runs that recipe.
+     *
+     * @generated from field: int64 revision = 3;
      */
-    project?: string;
+    revision: bigint;
     /**
-     * @generated from field: string environment = 2;
+     * Its name, a lower-case DNS label, unique among the tenant's services
+     * that are not deleted, whatever their project or environment. Set in
+     * a create; answers carry it.
+     *
+     * @generated from field: string name = 4;
      */
-    environment?: string;
+    name: string;
     /**
-     * @generated from field: string id = 3;
+     * The template its recipe starts from: "agent", "mcp-server",
+     * "model-server", "database", "browser", "dev-server", "media-server",
+     * "proxy" or "custom". Set by the server; ignored in a request.
+     *
+     * @generated from field: string template = 5;
      */
-    id?: string;
+    template: string;
     /**
-     * Carries the new values of the fields update_mask names.
+     * Create only: the recipe of revision 1, in TOML. Answers leave it
+     * empty.
      *
-     * @generated from field: toshi.workspace.v1.Workload workload = 4;
+     * @generated from field: string recipe = 6;
      */
-    workload?: WorkloadJson;
+    recipe: string;
     /**
-     * @generated from field: google.protobuf.FieldMask update_mask = 5;
+     * Create only: a state volume made with the service. Answers leave it
+     * unset.
+     *
+     * @generated from field: toshi.workspace.v1.StateVolumeSpec state_volume = 7;
      */
-    updateMask?: FieldMaskJson;
+    stateVolume?: StateVolumeSpec | undefined;
     /**
-     * @generated from field: string request_key = 6;
+     * Create only: the service's bindings, secret sets only. Answers leave
+     * them empty.
+     *
+     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 8;
      */
-    requestKey?: string;
-};
-/**
- * Describes the message toshi.workspace.v1.PatchWorkloadRequest.
- * Use `create(PatchWorkloadRequestSchema)` to create a new message.
- */
-export declare const PatchWorkloadRequestSchema: GenMessage<PatchWorkloadRequest, {
-    jsonType: PatchWorkloadRequestJson;
-}>;
-/**
- * @generated from message toshi.workspace.v1.PatchWorkloadResponse
- */
-export type PatchWorkloadResponse = Message<"toshi.workspace.v1.PatchWorkloadResponse"> & {
+    bindings: Binding[];
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * Whether a started on-demand service is asleep: no run is live, and
+     * nothing keeps it awake. Set by the server; ignored in a request.
+     *
+     * @generated from field: bool sleeping = 9;
      */
-    workload?: Workload | undefined;
+    sleeping: boolean;
     /**
-     * Set when the mask names "sandbox.max_duration": completes successfully
-     * when the sandbox's host acknowledges the new limit in time.
+     * Until when a started on-demand service stays awake with no hold;
+     * unset for an always-on service. Set by the server; ignored in a
+     * request.
      *
-     * @generated from field: toshi.workspace.v1.Operation operation = 2;
+     * @generated from field: google.protobuf.Timestamp awake_until = 10;
      */
-    operation?: Operation | undefined;
+    awakeUntil?: Timestamp | undefined;
 };
 /**
- * @generated from message toshi.workspace.v1.PatchWorkloadResponse
+ * ServiceSpec is a service. Its fields are set wherever a service's
+ * workload is answered: every workload and service call's answer, the
+ * workload events and the webhook deliveries. A create sets name, size,
+ * mode, recipe, state_volume and bindings and ignores revision and
+ * template; answers leave recipe, state_volume and bindings empty. An
+ * event carries the spec as of its own write; an event written before
+ * events carried it has none.
+ *
+ * @generated from message toshi.workspace.v1.ServiceSpec
  */
-export type PatchWorkloadResponseJson = {
+export type ServiceSpecJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The runner size its runs are placed by, for example "toshi-linux-2x".
+     * Empty in a create takes the configured default size.
+     *
+     * @generated from field: string size = 1;
      */
-    workload?: WorkloadJson;
+    size?: string;
     /**
-     * Set when the mask names "sandbox.max_duration": completes successfully
-     * when the sandbox's host acknowledges the new limit in time.
+     * How it runs; set in a create, where UNSPECIFIED is always-on, and
+     * with SetServiceMode.
      *
-     * @generated from field: toshi.workspace.v1.Operation operation = 2;
+     * @generated from field: toshi.workspace.v1.ServiceMode mode = 2;
      */
-    operation?: OperationJson;
-};
-/**
- * Describes the message toshi.workspace.v1.PatchWorkloadResponse.
- * Use `create(PatchWorkloadResponseSchema)` to create a new message.
- */
-export declare const PatchWorkloadResponseSchema: GenMessage<PatchWorkloadResponse, {
-    jsonType: PatchWorkloadResponseJson;
-}>;
-/**
- * @generated from message toshi.workspace.v1.DeleteWorkloadRequest
- */
-export type DeleteWorkloadRequest = Message<"toshi.workspace.v1.DeleteWorkloadRequest"> & {
+    mode?: ServiceModeJson;
     /**
-     * @generated from field: string project = 1;
+     * The number of its current revision: its next run runs that recipe.
+     *
+     * @generated from field: int64 revision = 3;
      */
-    project: string;
+    revision?: string;
     /**
-     * @generated from field: string environment = 2;
+     * Its name, a lower-case DNS label, unique among the tenant's services
+     * that are not deleted, whatever their project or environment. Set in
+     * a create; answers carry it.
+     *
+     * @generated from field: string name = 4;
      */
-    environment: string;
+    name?: string;
     /**
-     * @generated from field: string id = 3;
+     * The template its recipe starts from: "agent", "mcp-server",
+     * "model-server", "database", "browser", "dev-server", "media-server",
+     * "proxy" or "custom". Set by the server; ignored in a request.
+     *
+     * @generated from field: string template = 5;
      */
-    id: string;
+    template?: string;
     /**
-     * @generated from field: string request_key = 4;
+     * Create only: the recipe of revision 1, in TOML. Answers leave it
+     * empty.
+     *
+     * @generated from field: string recipe = 6;
      */
-    requestKey: string;
-};
-/**
- * @generated from message toshi.workspace.v1.DeleteWorkloadRequest
- */
-export type DeleteWorkloadRequestJson = {
+    recipe?: string;
     /**
-     * @generated from field: string project = 1;
+     * Create only: a state volume made with the service. Answers leave it
+     * unset.
+     *
+     * @generated from field: toshi.workspace.v1.StateVolumeSpec state_volume = 7;
      */
-    project?: string;
+    stateVolume?: StateVolumeSpecJson;
     /**
-     * @generated from field: string environment = 2;
+     * Create only: the service's bindings, secret sets only. Answers leave
+     * them empty.
+     *
+     * @generated from field: repeated toshi.workspace.v1.Binding bindings = 8;
      */
-    environment?: string;
+    bindings?: BindingJson[];
     /**
-     * @generated from field: string id = 3;
+     * Whether a started on-demand service is asleep: no run is live, and
+     * nothing keeps it awake. Set by the server; ignored in a request.
+     *
+     * @generated from field: bool sleeping = 9;
      */
-    id?: string;
+    sleeping?: boolean;
     /**
-     * @generated from field: string request_key = 4;
+     * Until when a started on-demand service stays awake with no hold;
+     * unset for an always-on service. Set by the server; ignored in a
+     * request.
+     *
+     * @generated from field: google.protobuf.Timestamp awake_until = 10;
      */
-    requestKey?: string;
+    awakeUntil?: TimestampJson;
 };
 /**
- * Describes the message toshi.workspace.v1.DeleteWorkloadRequest.
- * Use `create(DeleteWorkloadRequestSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.ServiceSpec.
+ * Use `create(ServiceSpecSchema)` to create a new message.
  */
-export declare const DeleteWorkloadRequestSchema: GenMessage<DeleteWorkloadRequest, {
-    jsonType: DeleteWorkloadRequestJson;
+export declare const ServiceSpecSchema: GenMessage<ServiceSpec, {
+    jsonType: ServiceSpecJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.DeleteWorkloadResponse
+ * StateVolumeSpec is the state volume a service is created with: it is
+ * named after the service.
+ *
+ * @generated from message toshi.workspace.v1.StateVolumeSpec
  */
-export type DeleteWorkloadResponse = Message<"toshi.workspace.v1.DeleteWorkloadResponse"> & {
+export type StateVolumeSpec = Message<"toshi.workspace.v1.StateVolumeSpec"> & {
     /**
-     * @generated from field: toshi.workspace.v1.Operation operation = 1;
+     * The volume's size cap, in bytes.
+     *
+     * @generated from field: int64 size_cap_bytes = 1;
      */
-    operation?: Operation | undefined;
+    sizeCapBytes: bigint;
 };
 /**
- * @generated from message toshi.workspace.v1.DeleteWorkloadResponse
+ * StateVolumeSpec is the state volume a service is created with: it is
+ * named after the service.
+ *
+ * @generated from message toshi.workspace.v1.StateVolumeSpec
  */
-export type DeleteWorkloadResponseJson = {
+export type StateVolumeSpecJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Operation operation = 1;
+     * The volume's size cap, in bytes.
+     *
+     * @generated from field: int64 size_cap_bytes = 1;
      */
-    operation?: OperationJson;
+    sizeCapBytes?: string;
 };
 /**
- * Describes the message toshi.workspace.v1.DeleteWorkloadResponse.
- * Use `create(DeleteWorkloadResponseSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.StateVolumeSpec.
+ * Use `create(StateVolumeSpecSchema)` to create a new message.
  */
-export declare const DeleteWorkloadResponseSchema: GenMessage<DeleteWorkloadResponse, {
-    jsonType: DeleteWorkloadResponseJson;
+export declare const StateVolumeSpecSchema: GenMessage<StateVolumeSpec, {
+    jsonType: StateVolumeSpecJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.CancelWorkloadRequest
+ * Command is a program to run in a workload's VM. argv is not passed
+ * through a shell.
+ *
+ * @generated from message toshi.workspace.v1.Command
  */
-export type CancelWorkloadRequest = Message<"toshi.workspace.v1.CancelWorkloadRequest"> & {
+export type Command = Message<"toshi.workspace.v1.Command"> & {
     /**
-     * @generated from field: string project = 1;
+     * The program and its arguments; argv[0] is looked up on the PATH.
+     *
+     * @generated from field: repeated string argv = 1;
      */
-    project: string;
+    argv: string[];
     /**
-     * @generated from field: string environment = 2;
+     * Added to the environment the command starts with.
+     *
+     * @generated from field: map<string, string> env = 2;
      */
-    environment: string;
+    env: {
+        [key: string]: string;
+    };
     /**
-     * @generated from field: string id = 3;
+     * The working directory; empty means the VM's default.
+     *
+     * @generated from field: string cwd = 3;
      */
-    id: string;
+    cwd: string;
 };
 /**
- * @generated from message toshi.workspace.v1.CancelWorkloadRequest
+ * Command is a program to run in a workload's VM. argv is not passed
+ * through a shell.
+ *
+ * @generated from message toshi.workspace.v1.Command
  */
-export type CancelWorkloadRequestJson = {
-    /**
-     * @generated from field: string project = 1;
-     */
-    project?: string;
-    /**
-     * @generated from field: string environment = 2;
-     */
-    environment?: string;
+export type CommandJson = {
     /**
-     * @generated from field: string id = 3;
+     * The program and its arguments; argv[0] is looked up on the PATH.
+     *
+     * @generated from field: repeated string argv = 1;
      */
-    id?: string;
-};
-/**
- * Describes the message toshi.workspace.v1.CancelWorkloadRequest.
- * Use `create(CancelWorkloadRequestSchema)` to create a new message.
- */
-export declare const CancelWorkloadRequestSchema: GenMessage<CancelWorkloadRequest, {
-    jsonType: CancelWorkloadRequestJson;
-}>;
-/**
- * @generated from message toshi.workspace.v1.CancelWorkloadResponse
- */
-export type CancelWorkloadResponse = Message<"toshi.workspace.v1.CancelWorkloadResponse"> & {
+    argv?: string[];
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * Added to the environment the command starts with.
+     *
+     * @generated from field: map<string, string> env = 2;
      */
-    workload?: Workload | undefined;
-};
-/**
- * @generated from message toshi.workspace.v1.CancelWorkloadResponse
- */
-export type CancelWorkloadResponseJson = {
+    env?: {
+        [key: string]: string;
+    };
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The working directory; empty means the VM's default.
+     *
+     * @generated from field: string cwd = 3;
      */
-    workload?: WorkloadJson;
+    cwd?: string;
 };
 /**
- * Describes the message toshi.workspace.v1.CancelWorkloadResponse.
- * Use `create(CancelWorkloadResponseSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.Command.
+ * Use `create(CommandSchema)` to create a new message.
  */
-export declare const CancelWorkloadResponseSchema: GenMessage<CancelWorkloadResponse, {
-    jsonType: CancelWorkloadResponseJson;
+export declare const CommandSchema: GenMessage<Command, {
+    jsonType: CommandJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.WaitWorkloadRequest
+ * SandboxPreview is where a browser opens one http channel of a sandbox.
+ *
+ * @generated from message toshi.workspace.v1.SandboxPreview
  */
-export type WaitWorkloadRequest = Message<"toshi.workspace.v1.WaitWorkloadRequest"> & {
-    /**
-     * @generated from field: string project = 1;
-     */
-    project: string;
-    /**
-     * @generated from field: string environment = 2;
-     */
-    environment: string;
-    /**
-     * @generated from field: string id = 3;
-     */
-    id: string;
-    /**
-     * Return once the workload is in any of these states; empty means ENDED.
-     *
-     * @generated from field: repeated toshi.workspace.v1.WorkloadState states = 4;
-     */
-    states: WorkloadState[];
+export type SandboxPreview = Message<"toshi.workspace.v1.SandboxPreview"> & {
     /**
-     * The longest to block.
+     * The channel's name; `preview` for the port the sandbox's image
+     * declares.
      *
-     * @generated from field: google.protobuf.Duration timeout = 5;
-     */
-    timeout?: Duration | undefined;
-};
-/**
- * @generated from message toshi.workspace.v1.WaitWorkloadRequest
- */
-export type WaitWorkloadRequestJson = {
-    /**
-     * @generated from field: string project = 1;
-     */
-    project?: string;
-    /**
-     * @generated from field: string environment = 2;
-     */
-    environment?: string;
-    /**
-     * @generated from field: string id = 3;
+     * @generated from field: string channel = 1;
      */
-    id?: string;
+    channel: string;
     /**
-     * Return once the workload is in any of these states; empty means ENDED.
+     * The guest port the channel reaches.
      *
-     * @generated from field: repeated toshi.workspace.v1.WorkloadState states = 4;
+     * @generated from field: int32 port = 2;
      */
-    states?: WorkloadStateJson[];
+    port: number;
     /**
-     * The longest to block.
+     * The preview's origin, a scheme and a hostname without a path.
      *
-     * @generated from field: google.protobuf.Duration timeout = 5;
+     * @generated from field: string url = 3;
      */
-    timeout?: DurationJson;
+    url: string;
 };
 /**
- * Describes the message toshi.workspace.v1.WaitWorkloadRequest.
- * Use `create(WaitWorkloadRequestSchema)` to create a new message.
- */
-export declare const WaitWorkloadRequestSchema: GenMessage<WaitWorkloadRequest, {
-    jsonType: WaitWorkloadRequestJson;
-}>;
-/**
- * @generated from message toshi.workspace.v1.WaitWorkloadResponse
+ * SandboxPreview is where a browser opens one http channel of a sandbox.
+ *
+ * @generated from message toshi.workspace.v1.SandboxPreview
  */
-export type WaitWorkloadResponse = Message<"toshi.workspace.v1.WaitWorkloadResponse"> & {
-    /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
-     */
-    workload?: Workload | undefined;
+export type SandboxPreviewJson = {
     /**
-     * False when the bound passed first.
+     * The channel's name; `preview` for the port the sandbox's image
+     * declares.
      *
-     * @generated from field: bool reached = 2;
+     * @generated from field: string channel = 1;
      */
-    reached: boolean;
-};
-/**
- * @generated from message toshi.workspace.v1.WaitWorkloadResponse
- */
-export type WaitWorkloadResponseJson = {
+    channel?: string;
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The guest port the channel reaches.
+     *
+     * @generated from field: int32 port = 2;
      */
-    workload?: WorkloadJson;
+    port?: number;
     /**
-     * False when the bound passed first.
+     * The preview's origin, a scheme and a hostname without a path.
      *
-     * @generated from field: bool reached = 2;
+     * @generated from field: string url = 3;
      */
-    reached?: boolean;
+    url?: string;
 };
 /**
- * Describes the message toshi.workspace.v1.WaitWorkloadResponse.
- * Use `create(WaitWorkloadResponseSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.SandboxPreview.
+ * Use `create(SandboxPreviewSchema)` to create a new message.
  */
-export declare const WaitWorkloadResponseSchema: GenMessage<WaitWorkloadResponse, {
-    jsonType: WaitWorkloadResponseJson;
+export declare const SandboxPreviewSchema: GenMessage<SandboxPreview, {
+    jsonType: SandboxPreviewJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.WatchWorkloadsRequest
+ * Error is a failure carried in a resource rather than returned by a call.
+ *
+ * @generated from message toshi.workspace.v1.Error
  */
-export type WatchWorkloadsRequest = Message<"toshi.workspace.v1.WatchWorkloadsRequest"> & {
-    /**
-     * @generated from field: string project = 1;
-     */
-    project: string;
-    /**
-     * @generated from field: string environment = 2;
-     */
-    environment: string;
-    /**
-     * Empty matches every kind.
-     *
-     * @generated from field: repeated toshi.workspace.v1.WorkloadKind kinds = 3;
-     */
-    kinds: WorkloadKind[];
+export type Error = Message<"toshi.workspace.v1.Error"> & {
     /**
-     * Changes after this position; empty starts at the oldest event the log
-     * keeps. A cursor older than that event fails with OUT_OF_RANGE.
+     * A Connect error code name, such as "unavailable".
      *
-     * @generated from field: string cursor = 4;
+     * @generated from field: string code = 1;
      */
-    cursor: string;
+    code: string;
     /**
-     * Ask for keepalives: a message with only keepalive set whenever the
-     * stream has sent nothing for an interval the server sets (30
-     * seconds by default). Without it the stream sends changes only.
-     *
-     * @generated from field: bool keepalive = 5;
+     * @generated from field: string message = 2;
      */
-    keepalive: boolean;
+    message: string;
 };
 /**
- * @generated from message toshi.workspace.v1.WatchWorkloadsRequest
+ * Error is a failure carried in a resource rather than returned by a call.
+ *
+ * @generated from message toshi.workspace.v1.Error
  */
-export type WatchWorkloadsRequestJson = {
-    /**
-     * @generated from field: string project = 1;
-     */
-    project?: string;
-    /**
-     * @generated from field: string environment = 2;
-     */
-    environment?: string;
-    /**
-     * Empty matches every kind.
-     *
-     * @generated from field: repeated toshi.workspace.v1.WorkloadKind kinds = 3;
-     */
-    kinds?: WorkloadKindJson[];
+export type ErrorJson = {
     /**
-     * Changes after this position; empty starts at the oldest event the log
-     * keeps. A cursor older than that event fails with OUT_OF_RANGE.
+     * A Connect error code name, such as "unavailable".
      *
-     * @generated from field: string cursor = 4;
+     * @generated from field: string code = 1;
      */
-    cursor?: string;
+    code?: string;
     /**
-     * Ask for keepalives: a message with only keepalive set whenever the
-     * stream has sent nothing for an interval the server sets (30
-     * seconds by default). Without it the stream sends changes only.
-     *
-     * @generated from field: bool keepalive = 5;
+     * @generated from field: string message = 2;
      */
-    keepalive?: boolean;
+    message?: string;
 };
 /**
- * Describes the message toshi.workspace.v1.WatchWorkloadsRequest.
- * Use `create(WatchWorkloadsRequestSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.Error.
+ * Use `create(ErrorSchema)` to create a new message.
  */
-export declare const WatchWorkloadsRequestSchema: GenMessage<WatchWorkloadsRequest, {
-    jsonType: WatchWorkloadsRequestJson;
+export declare const ErrorSchema: GenMessage<Error, {
+    jsonType: ErrorJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.WatchWorkloadsResponse
+ * Output is what a job's command wrote, returned with the call that waited
+ * for it.
+ *
+ * @generated from message toshi.workspace.v1.Output
  */
-export type WatchWorkloadsResponse = Message<"toshi.workspace.v1.WatchWorkloadsResponse"> & {
-    /**
-     * The event that recorded the change.
-     *
-     * @generated from field: toshi.workspace.v1.EventType type = 1;
-     */
-    type: EventType;
+export type Output = Message<"toshi.workspace.v1.Output"> & {
     /**
-     * The workload after the change.
-     *
-     * @generated from field: toshi.workspace.v1.Workload workload = 2;
+     * @generated from field: bytes stdout = 1;
      */
-    workload?: Workload | undefined;
+    stdout: Uint8Array;
     /**
-     * Resume after this change.
-     *
-     * @generated from field: string cursor = 3;
+     * @generated from field: bytes stderr = 2;
      */
-    cursor: string;
+    stderr: Uint8Array;
     /**
-     * Set on a keepalive, with every other field empty. Only a request
-     * with keepalive set gets one.
+     * True when the server kept only the start of a stream.
      *
-     * @generated from field: toshi.workspace.v1.Keepalive keepalive = 4;
+     * @generated from field: bool truncated = 3;
      */
-    keepalive?: Keepalive | undefined;
+    truncated: boolean;
 };
 /**
- * @generated from message toshi.workspace.v1.WatchWorkloadsResponse
+ * Output is what a job's command wrote, returned with the call that waited
+ * for it.
+ *
+ * @generated from message toshi.workspace.v1.Output
  */
-export type WatchWorkloadsResponseJson = {
-    /**
-     * The event that recorded the change.
-     *
-     * @generated from field: toshi.workspace.v1.EventType type = 1;
-     */
-    type?: EventTypeJson;
+export type OutputJson = {
     /**
-     * The workload after the change.
-     *
-     * @generated from field: toshi.workspace.v1.Workload workload = 2;
+     * @generated from field: bytes stdout = 1;
      */
-    workload?: WorkloadJson;
+    stdout?: string;
     /**
-     * Resume after this change.
-     *
-     * @generated from field: string cursor = 3;
+     * @generated from field: bytes stderr = 2;
      */
-    cursor?: string;
+    stderr?: string;
     /**
-     * Set on a keepalive, with every other field empty. Only a request
-     * with keepalive set gets one.
+     * True when the server kept only the start of a stream.
      *
-     * @generated from field: toshi.workspace.v1.Keepalive keepalive = 4;
+     * @generated from field: bool truncated = 3;
      */
-    keepalive?: KeepaliveJson;
+    truncated?: boolean;
 };
 /**
- * Describes the message toshi.workspace.v1.WatchWorkloadsResponse.
- * Use `create(WatchWorkloadsResponseSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.Output.
+ * Use `create(OutputSchema)` to create a new message.
  */
-export declare const WatchWorkloadsResponseSchema: GenMessage<WatchWorkloadsResponse, {
-    jsonType: WatchWorkloadsResponseJson;
+export declare const OutputSchema: GenMessage<Output, {
+    jsonType: OutputJson;
 }>;
 /**
  * @generated from message toshi.workspace.v1.WatchOutputRequest
@@ -3002,9 +2474,11 @@ export type ExecuteStart = Message<"toshi.workspace.v1.ExecuteStart"> & {
      */
     environment: string;
     /**
-     * @generated from field: string workload_id = 3;
+     * The sandbox the command runs in.
+     *
+     * @generated from field: string sandbox_id = 3;
      */
-    workloadId: string;
+    sandboxId: string;
     /**
      * @generated from field: toshi.workspace.v1.Command command = 4;
      */
@@ -3033,9 +2507,11 @@ export type ExecuteStartJson = {
      */
     environment?: string;
     /**
-     * @generated from field: string workload_id = 3;
+     * The sandbox the command runs in.
+     *
+     * @generated from field: string sandbox_id = 3;
      */
-    workloadId?: string;
+    sandboxId?: string;
     /**
      * @generated from field: toshi.workspace.v1.Command command = 4;
      */
@@ -3529,12 +3005,28 @@ export type Event = Message<"toshi.workspace.v1.Event"> & {
      */
     payload: {
         /**
-         * The workload after the change, for the WORKLOAD_* types.
+         * The job after the change, for the WORKLOAD_* types of a job.
+         *
+         * @generated from field: toshi.workspace.v1.Job job = 13;
+         */
+        value: Job;
+        case: "job";
+    } | {
+        /**
+         * The sandbox after the change, for the WORKLOAD_* types of a sandbox.
          *
-         * @generated from field: toshi.workspace.v1.Workload workload = 7;
+         * @generated from field: toshi.workspace.v1.Sandbox sandbox = 14;
          */
-        value: Workload;
-        case: "workload";
+        value: Sandbox;
+        case: "sandbox";
+    } | {
+        /**
+         * The service after the change, for the WORKLOAD_* types of a service.
+         *
+         * @generated from field: toshi.workspace.v1.Service service = 15;
+         */
+        value: Service;
+        case: "service";
     } | {
         /**
          * For the EXECUTION_* types.
@@ -3616,11 +3108,23 @@ export type EventJson = {
      */
     cursor?: string;
     /**
-     * The workload after the change, for the WORKLOAD_* types.
+     * The job after the change, for the WORKLOAD_* types of a job.
+     *
+     * @generated from field: toshi.workspace.v1.Job job = 13;
+     */
+    job?: JobJson;
+    /**
+     * The sandbox after the change, for the WORKLOAD_* types of a sandbox.
+     *
+     * @generated from field: toshi.workspace.v1.Sandbox sandbox = 14;
+     */
+    sandbox?: SandboxJson;
+    /**
+     * The service after the change, for the WORKLOAD_* types of a service.
      *
-     * @generated from field: toshi.workspace.v1.Workload workload = 7;
+     * @generated from field: toshi.workspace.v1.Service service = 15;
      */
-    workload?: WorkloadJson;
+    service?: ServiceJson;
     /**
      * For the EXECUTION_* types.
      *
@@ -3809,12 +3313,14 @@ export type ListEventsRequest = Message<"toshi.workspace.v1.ListEventsRequest">
      */
     workloadId: string;
     /**
-     * Events after this position; empty starts at the oldest event the log
-     * keeps. A cursor older than that event fails with OUT_OF_RANGE.
+     * From an earlier response's next_page_token or cursor, or an event's
+     * cursor: the events after that position. Empty starts at the oldest
+     * event the log keeps; a position older than that event fails with
+     * OUT_OF_RANGE.
      *
-     * @generated from field: string cursor = 4;
+     * @generated from field: string page_token = 4;
      */
-    cursor: string;
+    pageToken: string;
     /**
      * The most events in one page; zero lets the server choose.
      *
@@ -3841,12 +3347,14 @@ export type ListEventsRequestJson = {
      */
     workloadId?: string;
     /**
-     * Events after this position; empty starts at the oldest event the log
-     * keeps. A cursor older than that event fails with OUT_OF_RANGE.
+     * From an earlier response's next_page_token or cursor, or an event's
+     * cursor: the events after that position. Empty starts at the oldest
+     * event the log keeps; a position older than that event fails with
+     * OUT_OF_RANGE.
      *
-     * @generated from field: string cursor = 4;
+     * @generated from field: string page_token = 4;
      */
-    cursor?: string;
+    pageToken?: string;
     /**
      * The most events in one page; zero lets the server choose.
      *
@@ -3870,12 +3378,19 @@ export type ListEventsResponse = Message<"toshi.workspace.v1.ListEventsResponse"
      */
     events: Event[];
     /**
-     * The position after the last event returned, or the cursor asked for
-     * when there were none: pass it to the next call.
+     * The position after the last event returned, or the page_token asked
+     * for when there were none. WatchEvents from this cursor shows every
+     * event after this page.
      *
      * @generated from field: string cursor = 2;
      */
     cursor: string;
+    /**
+     * Empty on the last page.
+     *
+     * @generated from field: string next_page_token = 3;
+     */
+    nextPageToken: string;
 };
 /**
  * @generated from message toshi.workspace.v1.ListEventsResponse
@@ -3886,12 +3401,19 @@ export type ListEventsResponseJson = {
      */
     events?: EventJson[];
     /**
-     * The position after the last event returned, or the cursor asked for
-     * when there were none: pass it to the next call.
+     * The position after the last event returned, or the page_token asked
+     * for when there were none. WatchEvents from this cursor shows every
+     * event after this page.
      *
      * @generated from field: string cursor = 2;
      */
     cursor?: string;
+    /**
+     * Empty on the last page.
+     *
+     * @generated from field: string next_page_token = 3;
+     */
+    nextPageToken?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.ListEventsResponse.
@@ -4083,9 +3605,11 @@ export type PreviewShareLink = Message<"toshi.workspace.v1.PreviewShareLink"> &
      */
     id: string;
     /**
-     * @generated from field: string workload_id = 2;
+     * The sandbox whose preview the link opens.
+     *
+     * @generated from field: string sandbox_id = 2;
      */
-    workloadId: string;
+    sandboxId: string;
     /**
      * @generated from field: toshi.workspace.v1.PreviewShareLinkState state = 3;
      */
@@ -4156,9 +3680,11 @@ export type PreviewShareLinkJson = {
      */
     id?: string;
     /**
-     * @generated from field: string workload_id = 2;
+     * The sandbox whose preview the link opens.
+     *
+     * @generated from field: string sandbox_id = 2;
      */
-    workloadId?: string;
+    sandboxId?: string;
     /**
      * @generated from field: toshi.workspace.v1.PreviewShareLinkState state = 3;
      */
@@ -4237,9 +3763,9 @@ export type CreatePreviewShareLinkRequest = Message<"toshi.workspace.v1.CreatePr
     /**
      * The sandbox whose preview the link opens.
      *
-     * @generated from field: string workload_id = 3;
+     * @generated from field: string sandbox_id = 3;
      */
-    workloadId: string;
+    sandboxId: string;
     /**
      * How long the link stays valid, at most the plan's maximum; unset is
      * 24 hours, or the plan's maximum when that is shorter.
@@ -4292,9 +3818,9 @@ export type CreatePreviewShareLinkRequestJson = {
     /**
      * The sandbox whose preview the link opens.
      *
-     * @generated from field: string workload_id = 3;
+     * @generated from field: string sandbox_id = 3;
      */
-    workloadId?: string;
+    sandboxId?: string;
     /**
      * How long the link stays valid, at most the plan's maximum; unset is
      * 24 hours, or the plan's maximum when that is shorter.
@@ -4377,9 +3903,21 @@ export type ListPreviewShareLinksRequest = Message<"toshi.workspace.v1.ListPrevi
      */
     environment: string;
     /**
-     * @generated from field: string workload_id = 3;
+     * @generated from field: string sandbox_id = 3;
      */
-    workloadId: string;
+    sandboxId: string;
+    /**
+     * The most share links in one page; zero lets the server choose.
+     *
+     * @generated from field: int32 page_size = 4;
+     */
+    pageSize: number;
+    /**
+     * From an earlier response's next_page_token; empty for the first page.
+     *
+     * @generated from field: string page_token = 5;
+     */
+    pageToken: string;
 };
 /**
  * @generated from message toshi.workspace.v1.ListPreviewShareLinksRequest
@@ -4394,9 +3932,21 @@ export type ListPreviewShareLinksRequestJson = {
      */
     environment?: string;
     /**
-     * @generated from field: string workload_id = 3;
+     * @generated from field: string sandbox_id = 3;
      */
-    workloadId?: string;
+    sandboxId?: string;
+    /**
+     * The most share links in one page; zero lets the server choose.
+     *
+     * @generated from field: int32 page_size = 4;
+     */
+    pageSize?: number;
+    /**
+     * From an earlier response's next_page_token; empty for the first page.
+     *
+     * @generated from field: string page_token = 5;
+     */
+    pageToken?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.ListPreviewShareLinksRequest.
@@ -4413,6 +3963,12 @@ export type ListPreviewShareLinksResponse = Message<"toshi.workspace.v1.ListPrev
      * @generated from field: repeated toshi.workspace.v1.PreviewShareLink share_links = 1;
      */
     shareLinks: PreviewShareLink[];
+    /**
+     * Empty on the last page.
+     *
+     * @generated from field: string next_page_token = 2;
+     */
+    nextPageToken: string;
 };
 /**
  * @generated from message toshi.workspace.v1.ListPreviewShareLinksResponse
@@ -4422,6 +3978,12 @@ export type ListPreviewShareLinksResponseJson = {
      * @generated from field: repeated toshi.workspace.v1.PreviewShareLink share_links = 1;
      */
     shareLinks?: PreviewShareLinkJson[];
+    /**
+     * Empty on the last page.
+     *
+     * @generated from field: string next_page_token = 2;
+     */
+    nextPageToken?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.ListPreviewShareLinksResponse.
@@ -4443,9 +4005,9 @@ export type RevokePreviewShareLinkRequest = Message<"toshi.workspace.v1.RevokePr
      */
     environment: string;
     /**
-     * @generated from field: string workload_id = 3;
+     * @generated from field: string sandbox_id = 3;
      */
-    workloadId: string;
+    sandboxId: string;
     /**
      * @generated from field: string share_link_id = 4;
      */
@@ -4464,9 +4026,9 @@ export type RevokePreviewShareLinkRequestJson = {
      */
     environment?: string;
     /**
-     * @generated from field: string workload_id = 3;
+     * @generated from field: string sandbox_id = 3;
      */
-    workloadId?: string;
+    sandboxId?: string;
     /**
      * @generated from field: string share_link_id = 4;
      */
@@ -4562,18 +4124,22 @@ export declare const StartServiceRequestSchema: GenMessage<StartServiceRequest,
  */
 export type StartServiceResponse = Message<"toshi.workspace.v1.StartServiceResponse"> & {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the start.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: Workload | undefined;
+    service?: Service | undefined;
 };
 /**
  * @generated from message toshi.workspace.v1.StartServiceResponse
  */
 export type StartServiceResponseJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the start.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: WorkloadJson;
+    service?: ServiceJson;
 };
 /**
  * Describes the message toshi.workspace.v1.StartServiceResponse.
@@ -4636,18 +4202,22 @@ export declare const StopServiceRequestSchema: GenMessage<StopServiceRequest, {
  */
 export type StopServiceResponse = Message<"toshi.workspace.v1.StopServiceResponse"> & {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the stop.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: Workload | undefined;
+    service?: Service | undefined;
 };
 /**
  * @generated from message toshi.workspace.v1.StopServiceResponse
  */
 export type StopServiceResponseJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the stop.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: WorkloadJson;
+    service?: ServiceJson;
 };
 /**
  * Describes the message toshi.workspace.v1.StopServiceResponse.
@@ -4722,18 +4292,22 @@ export declare const SetServiceModeRequestSchema: GenMessage<SetServiceModeReque
  */
 export type SetServiceModeResponse = Message<"toshi.workspace.v1.SetServiceModeResponse"> & {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the change.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: Workload | undefined;
+    service?: Service | undefined;
 };
 /**
  * @generated from message toshi.workspace.v1.SetServiceModeResponse
  */
 export type SetServiceModeResponseJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the change.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: WorkloadJson;
+    service?: ServiceJson;
 };
 /**
  * Describes the message toshi.workspace.v1.SetServiceModeResponse.
@@ -4796,18 +4370,22 @@ export declare const WakeServiceRequestSchema: GenMessage<WakeServiceRequest, {
  */
 export type WakeServiceResponse = Message<"toshi.workspace.v1.WakeServiceResponse"> & {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the wake.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: Workload | undefined;
+    service?: Service | undefined;
 };
 /**
  * @generated from message toshi.workspace.v1.WakeServiceResponse
  */
 export type WakeServiceResponseJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the wake.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: WorkloadJson;
+    service?: ServiceJson;
 };
 /**
  * Describes the message toshi.workspace.v1.WakeServiceResponse.
@@ -4881,27 +4459,31 @@ export declare const HoldServiceRequestSchema: GenMessage<HoldServiceRequest, {
  * @generated from message toshi.workspace.v1.HoldServiceResponse
  */
 export type HoldServiceResponse = Message<"toshi.workspace.v1.HoldServiceResponse"> & {
-    /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
-     */
-    workload?: Workload | undefined;
     /**
      * @generated from field: toshi.workspace.v1.ServiceHold hold = 2;
      */
     hold?: ServiceHold | undefined;
+    /**
+     * The service after the hold.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 3;
+     */
+    service?: Service | undefined;
 };
 /**
  * @generated from message toshi.workspace.v1.HoldServiceResponse
  */
 export type HoldServiceResponseJson = {
-    /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
-     */
-    workload?: WorkloadJson;
     /**
      * @generated from field: toshi.workspace.v1.ServiceHold hold = 2;
      */
     hold?: ServiceHoldJson;
+    /**
+     * The service after the hold.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 3;
+     */
+    service?: ServiceJson;
 };
 /**
  * Describes the message toshi.workspace.v1.HoldServiceResponse.
@@ -5009,18 +4591,22 @@ export declare const ReleaseServiceRequestSchema: GenMessage<ReleaseServiceReque
  */
 export type ReleaseServiceResponse = Message<"toshi.workspace.v1.ReleaseServiceResponse"> & {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the release.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: Workload | undefined;
+    service?: Service | undefined;
 };
 /**
  * @generated from message toshi.workspace.v1.ReleaseServiceResponse
  */
 export type ReleaseServiceResponseJson = {
     /**
-     * @generated from field: toshi.workspace.v1.Workload workload = 1;
+     * The service after the release.
+     *
+     * @generated from field: toshi.workspace.v1.Service service = 2;
      */
-    workload?: WorkloadJson;
+    service?: ServiceJson;
 };
 /**
  * Describes the message toshi.workspace.v1.ReleaseServiceResponse.
@@ -5046,11 +4632,17 @@ export type ListServiceRunsRequest = Message<"toshi.workspace.v1.ListServiceRuns
      */
     id: string;
     /**
-     * How many of the newest runs to return, at most 100; 0 returns 20.
+     * The most runs in one page; zero lets the server choose.
      *
      * @generated from field: int32 page_size = 4;
      */
     pageSize: number;
+    /**
+     * From an earlier response's next_page_token; empty for the first page.
+     *
+     * @generated from field: string page_token = 5;
+     */
+    pageToken: string;
 };
 /**
  * @generated from message toshi.workspace.v1.ListServiceRunsRequest
@@ -5069,11 +4661,17 @@ export type ListServiceRunsRequestJson = {
      */
     id?: string;
     /**
-     * How many of the newest runs to return, at most 100; 0 returns 20.
+     * The most runs in one page; zero lets the server choose.
      *
      * @generated from field: int32 page_size = 4;
      */
     pageSize?: number;
+    /**
+     * From an earlier response's next_page_token; empty for the first page.
+     *
+     * @generated from field: string page_token = 5;
+     */
+    pageToken?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.ListServiceRunsRequest.
@@ -5089,7 +4687,13 @@ export type ListServiceRunsResponse = Message<"toshi.workspace.v1.ListServiceRun
     /**
      * @generated from field: repeated toshi.workspace.v1.ServiceRun runs = 1;
      */
-    runs: ServiceRun[];
+    runs: ServiceRun[];
+    /**
+     * Empty on the last page.
+     *
+     * @generated from field: string next_page_token = 2;
+     */
+    nextPageToken: string;
 };
 /**
  * @generated from message toshi.workspace.v1.ListServiceRunsResponse
@@ -5099,6 +4703,12 @@ export type ListServiceRunsResponseJson = {
      * @generated from field: repeated toshi.workspace.v1.ServiceRun runs = 1;
      */
     runs?: ServiceRunJson[];
+    /**
+     * Empty on the last page.
+     *
+     * @generated from field: string next_page_token = 2;
+     */
+    nextPageToken?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.ListServiceRunsResponse.
@@ -5248,96 +4858,6 @@ export type ServiceRunJson = {
 export declare const ServiceRunSchema: GenMessage<ServiceRun, {
     jsonType: ServiceRunJson;
 }>;
-/**
- * WorkloadKind says how a workload runs and ends.
- *
- * @generated from enum toshi.workspace.v1.WorkloadKind
- */
-export declare enum WorkloadKind {
-    /**
-     * @generated from enum value: WORKLOAD_KIND_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * Starts, runs its command and ends on its own.
-     *
-     * @generated from enum value: WORKLOAD_KIND_JOB = 1;
-     */
-    JOB = 1,
-    /**
-     * Runs until its owner stops it.
-     *
-     * @generated from enum value: WORKLOAD_KIND_SANDBOX = 2;
-     */
-    SANDBOX = 2,
-    /**
-     * A long-running service.
-     *
-     * @generated from enum value: WORKLOAD_KIND_SERVICE = 3;
-     */
-    SERVICE = 3
-}
-/**
- * WorkloadKind says how a workload runs and ends.
- *
- * @generated from enum toshi.workspace.v1.WorkloadKind
- */
-export type WorkloadKindJson = "WORKLOAD_KIND_UNSPECIFIED" | "WORKLOAD_KIND_JOB" | "WORKLOAD_KIND_SANDBOX" | "WORKLOAD_KIND_SERVICE";
-/**
- * Describes the enum toshi.workspace.v1.WorkloadKind.
- */
-export declare const WorkloadKindSchema: GenEnum<WorkloadKind, WorkloadKindJson>;
-/**
- * WorkloadState is where a workload is in its life. Every kind shares it. A
- * workload can skip a state: a job cancelled while queued ends without
- * running.
- *
- * @generated from enum toshi.workspace.v1.WorkloadState
- */
-export declare enum WorkloadState {
-    /**
-     * @generated from enum value: WORKLOAD_STATE_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
-    /**
-     * Recorded, not yet waiting for capacity.
-     *
-     * @generated from enum value: WORKLOAD_STATE_CREATED = 1;
-     */
-    CREATED = 1,
-    /**
-     * Waiting for capacity.
-     *
-     * @generated from enum value: WORKLOAD_STATE_QUEUED = 2;
-     */
-    QUEUED = 2,
-    /**
-     * Its VM is up: a job's command is running, a sandbox or service is
-     * serving.
-     *
-     * @generated from enum value: WORKLOAD_STATE_RUNNING = 3;
-     */
-    RUNNING = 3,
-    /**
-     * It ended; the status's end_reason says how. An ended workload does not
-     * run again.
-     *
-     * @generated from enum value: WORKLOAD_STATE_ENDED = 4;
-     */
-    ENDED = 4
-}
-/**
- * WorkloadState is where a workload is in its life. Every kind shares it. A
- * workload can skip a state: a job cancelled while queued ends without
- * running.
- *
- * @generated from enum toshi.workspace.v1.WorkloadState
- */
-export type WorkloadStateJson = "WORKLOAD_STATE_UNSPECIFIED" | "WORKLOAD_STATE_CREATED" | "WORKLOAD_STATE_QUEUED" | "WORKLOAD_STATE_RUNNING" | "WORKLOAD_STATE_ENDED";
-/**
- * Describes the enum toshi.workspace.v1.WorkloadState.
- */
-export declare const WorkloadStateSchema: GenEnum<WorkloadState, WorkloadStateJson>;
 /**
  * EndReason says how a workload ended.
  *
@@ -5441,6 +4961,152 @@ export type StopReasonJson = "STOP_REASON_UNSPECIFIED" | "STOP_REASON_OWNER" | "
  * Describes the enum toshi.workspace.v1.StopReason.
  */
 export declare const StopReasonSchema: GenEnum<StopReason, StopReasonJson>;
+/**
+ * JobState is where a job is in its life. A job can skip a state: one
+ * cancelled while queued ends without running.
+ *
+ * @generated from enum toshi.workspace.v1.JobState
+ */
+export declare enum JobState {
+    /**
+     * @generated from enum value: JOB_STATE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Recorded, not yet waiting for capacity.
+     *
+     * @generated from enum value: JOB_STATE_CREATED = 1;
+     */
+    CREATED = 1,
+    /**
+     * Waiting for capacity.
+     *
+     * @generated from enum value: JOB_STATE_QUEUED = 2;
+     */
+    QUEUED = 2,
+    /**
+     * Its VM is up and its command is running.
+     *
+     * @generated from enum value: JOB_STATE_RUNNING = 3;
+     */
+    RUNNING = 3,
+    /**
+     * It ended; the status's end_reason says how. An ended job does not run
+     * again.
+     *
+     * @generated from enum value: JOB_STATE_ENDED = 4;
+     */
+    ENDED = 4
+}
+/**
+ * JobState is where a job is in its life. A job can skip a state: one
+ * cancelled while queued ends without running.
+ *
+ * @generated from enum toshi.workspace.v1.JobState
+ */
+export type JobStateJson = "JOB_STATE_UNSPECIFIED" | "JOB_STATE_CREATED" | "JOB_STATE_QUEUED" | "JOB_STATE_RUNNING" | "JOB_STATE_ENDED";
+/**
+ * Describes the enum toshi.workspace.v1.JobState.
+ */
+export declare const JobStateSchema: GenEnum<JobState, JobStateJson>;
+/**
+ * SandboxState is where a sandbox is in its life. A sandbox can skip a
+ * state: one deleted while queued ends without running.
+ *
+ * @generated from enum toshi.workspace.v1.SandboxState
+ */
+export declare enum SandboxState {
+    /**
+     * @generated from enum value: SANDBOX_STATE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Recorded, not yet waiting for capacity.
+     *
+     * @generated from enum value: SANDBOX_STATE_CREATED = 1;
+     */
+    CREATED = 1,
+    /**
+     * Waiting for capacity.
+     *
+     * @generated from enum value: SANDBOX_STATE_QUEUED = 2;
+     */
+    QUEUED = 2,
+    /**
+     * Its VM is up and serving.
+     *
+     * @generated from enum value: SANDBOX_STATE_RUNNING = 3;
+     */
+    RUNNING = 3,
+    /**
+     * It ended; the status's end_reason says how. An ended sandbox does not
+     * run again.
+     *
+     * @generated from enum value: SANDBOX_STATE_ENDED = 4;
+     */
+    ENDED = 4
+}
+/**
+ * SandboxState is where a sandbox is in its life. A sandbox can skip a
+ * state: one deleted while queued ends without running.
+ *
+ * @generated from enum toshi.workspace.v1.SandboxState
+ */
+export type SandboxStateJson = "SANDBOX_STATE_UNSPECIFIED" | "SANDBOX_STATE_CREATED" | "SANDBOX_STATE_QUEUED" | "SANDBOX_STATE_RUNNING" | "SANDBOX_STATE_ENDED";
+/**
+ * Describes the enum toshi.workspace.v1.SandboxState.
+ */
+export declare const SandboxStateSchema: GenEnum<SandboxState, SandboxStateJson>;
+/**
+ * ServiceState is where a service is in its life. Unlike a job or a
+ * sandbox, a service moves back: StopService returns it to CREATED, and an
+ * on-demand service that sleeps returns to CREATED until it is woken.
+ *
+ * @generated from enum toshi.workspace.v1.ServiceState
+ */
+export declare enum ServiceState {
+    /**
+     * @generated from enum value: SERVICE_STATE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Recorded, and not started or asleep.
+     *
+     * @generated from enum value: SERVICE_STATE_CREATED = 1;
+     */
+    CREATED = 1,
+    /**
+     * A run is waiting for capacity.
+     *
+     * @generated from enum value: SERVICE_STATE_QUEUED = 2;
+     */
+    QUEUED = 2,
+    /**
+     * A run's VM is up and serving.
+     *
+     * @generated from enum value: SERVICE_STATE_RUNNING = 3;
+     */
+    RUNNING = 3,
+    /**
+     * It ended; the status's end_reason says how. An ended service does not
+     * run again.
+     *
+     * @generated from enum value: SERVICE_STATE_ENDED = 4;
+     */
+    ENDED = 4
+}
+/**
+ * ServiceState is where a service is in its life. Unlike a job or a
+ * sandbox, a service moves back: StopService returns it to CREATED, and an
+ * on-demand service that sleeps returns to CREATED until it is woken.
+ *
+ * @generated from enum toshi.workspace.v1.ServiceState
+ */
+export type ServiceStateJson = "SERVICE_STATE_UNSPECIFIED" | "SERVICE_STATE_CREATED" | "SERVICE_STATE_QUEUED" | "SERVICE_STATE_RUNNING" | "SERVICE_STATE_ENDED";
+/**
+ * Describes the enum toshi.workspace.v1.ServiceState.
+ */
+export declare const ServiceStateSchema: GenEnum<ServiceState, ServiceStateJson>;
 /**
  * RecordingPolicy is what a workload records of its runs.
  *
@@ -5712,422 +5378,3 @@ export type ServiceRunStateJson = "SERVICE_RUN_STATE_UNSPECIFIED" | "SERVICE_RUN
  * Describes the enum toshi.workspace.v1.ServiceRunState.
  */
 export declare const ServiceRunStateSchema: GenEnum<ServiceRunState, ServiceRunStateJson>;
-/**
- * WorkspaceService is the Workspace API. The caller's credential
- * names the workspace; every request names the project and the environment
- * in its project and environment fields, and a call that leaves either empty
- * fails with INVALID_ARGUMENT. The environment is one of the project's
- * environments; a project or environment the workspace does not
- * have is NOT_FOUND. A workload, execution, operation or event of another
- * project or environment is NOT_FOUND.
- *
- * Every mutating call takes a request_key. A key is bound to the workspace,
- * the call and the request's payload: a retry with the same key and the same
- * payload returns what the first call returned and starts nothing new; the
- * same key with a different payload fails with FAILED_PRECONDITION.
- * CreateWorkload requires a key: a create without one fails with
- * INVALID_ARGUMENT. For the other calls an empty key means no retry
- * protection. CancelWorkload takes none: a repeat of it changes nothing.
- *
- * A caller over its rate limit gets RESOURCE_EXHAUSTED with a
- * google.rpc.RetryInfo detail: the delay before a retry, on every protocol.
- * The same whole seconds are in a Retry-After response header on Connect and
- * gRPC-Web calls and on gRPC streams, and in the trailing metadata of a gRPC
- * unary call.
- *
- * @generated from service toshi.workspace.v1.WorkspaceService
- */
-export declare const WorkspaceService: GenService<{
-    /**
-     * CreateWorkload creates a workload of the kind its spec names and returns
-     * it. With wait_for_end set, a job's call blocks until the job ends or the
-     * bound passes. If the job has ended when the call answers, the answer
-     * carries its exit status and output without a second read; otherwise it
-     * carries the job as it is and no output, and no later call returns it.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.CreateWorkload
-     */
-    createWorkload: {
-        methodKind: "unary";
-        input: typeof CreateWorkloadRequestSchema;
-        output: typeof CreateWorkloadResponseSchema;
-    };
-    /**
-     * GetWorkload returns one workload. An unknown ID fails with NOT_FOUND.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.GetWorkload
-     */
-    getWorkload: {
-        methodKind: "unary";
-        input: typeof GetWorkloadRequestSchema;
-        output: typeof GetWorkloadResponseSchema;
-    };
-    /**
-     * ListWorkloads returns the workloads that match every filter that is set,
-     * oldest first, a page at a time. A page token from one call stays valid
-     * while workloads are created: a later page never repeats or skips a
-     * workload of an earlier one.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.ListWorkloads
-     */
-    listWorkloads: {
-        methodKind: "unary";
-        input: typeof ListWorkloadsRequestSchema;
-        output: typeof ListWorkloadsResponseSchema;
-    };
-    /**
-     * PatchWorkload changes the fields the mask names and returns the workload.
-     * "labels" can be changed on any workload. "sandbox.max_duration" raises a
-     * running sandbox's limit and must be the only path: the new limit, in
-     * whole minutes from the sandbox's start, above its current one and no
-     * longer than the plan's sandbox cap. The response then carries an
-     * operation, which completes successfully when the sandbox's host
-     * acknowledges the new limit in time and the sandbox still runs with no
-     * stop asked for; until then the workload shows the current one. The
-     * operation fails with UNAVAILABLE when the host does not acknowledge the
-     * limit in time, and with FAILED_PRECONDITION when the sandbox stops
-     * first; the limit the control plane records is then unchanged. A host
-     * that applied the new limit but whose acknowledgment was lost can keep
-     * it until it takes the old limit back or the sandbox stops. A sandbox
-     * that is not running, has a stop asked for, has no limit of its own or
-     * has a raise pending, or whose host's agent cannot take a new limit,
-     * fails with FAILED_PRECONDITION. Another path fails with
-     * INVALID_ARGUMENT.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.PatchWorkload
-     */
-    patchWorkload: {
-        methodKind: "unary";
-        input: typeof PatchWorkloadRequestSchema;
-        output: typeof PatchWorkloadResponseSchema;
-    };
-    /**
-     * DeleteWorkload ends a workload that has not ended and then removes it.
-     * A job is cancelled, a sandbox or service is stopped, and every execution
-     * in it is cancelled. It returns an operation that is done once the
-     * workload is removed; GetWorkload then fails with NOT_FOUND, and the event
-     * log keeps its events.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.DeleteWorkload
-     */
-    deleteWorkload: {
-        methodKind: "unary";
-        input: typeof DeleteWorkloadRequestSchema;
-        output: typeof DeleteWorkloadResponseSchema;
-    };
-    /**
-     * CancelWorkload cancels a job that has not ended and returns it. The job
-     * is kept: it ends with END_REASON_CANCELLED, and GetWorkload and
-     * ListWorkloads return it. A job whose command has not started ends at
-     * once, and the answer carries the end; a job whose command runs ends
-     * once its host has stopped it, and WaitWorkload waits for that end.
-     * Every execution in the job is cancelled. A call for a job that has
-     * ended changes nothing and returns the job as it is. An unknown ID fails
-     * with NOT_FOUND; a sandbox or service fails with INVALID_ARGUMENT, since
-     * DeleteWorkload stops one.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.CancelWorkload
-     */
-    cancelWorkload: {
-        methodKind: "unary";
-        input: typeof CancelWorkloadRequestSchema;
-        output: typeof CancelWorkloadResponseSchema;
-    };
-    /**
-     * WaitWorkload blocks until the workload is in one of the states asked for
-     * or the bound passes, whichever is first, and returns the workload as it
-     * then is. Passing the bound is not an error: reached is false, and the
-     * caller asks again. The server may wait less than the bound asked for.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.WaitWorkload
-     */
-    waitWorkload: {
-        methodKind: "unary";
-        input: typeof WaitWorkloadRequestSchema;
-        output: typeof WaitWorkloadResponseSchema;
-    };
-    /**
-     * WatchWorkloads streams each change to a workload as the event log
-     * records it, from the position after a cursor, then as changes happen.
-     * A cursor from ListWorkloads, ListEvents or an earlier message resumes
-     * with no change missed and none repeated, while the log still keeps the
-     * events after it; an older cursor fails with OUT_OF_RANGE.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.WatchWorkloads
-     */
-    watchWorkloads: {
-        methodKind: "server_streaming";
-        input: typeof WatchWorkloadsRequestSchema;
-        output: typeof WatchWorkloadsResponseSchema;
-    };
-    /**
-     * WatchOutput streams a job's standard output and error while it runs:
-     * the bytes the server holds from the offsets asked for, then each write
-     * as it happens, and last how the job ended. A job that has not started
-     * yet is waited for. The server holds the first 1 MiB of each stream, as
-     * for CreateWorkload's output, and only while the job runs: a job whose
-     * output this server no longer holds (it has ended) or never held (its
-     * command runs on another server) fails with FAILED_PRECONDITION, and a
-     * job that ends while the call is answered is followed to its end. A
-     * sandbox or service fails with INVALID_ARGUMENT.
-     * A reader never slows or cancels the job: each reads what the server
-     * holds at its own pace.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.WatchOutput
-     */
-    watchOutput: {
-        methodKind: "server_streaming";
-        input: typeof WatchOutputRequestSchema;
-        output: typeof WatchOutputResponseSchema;
-    };
-    /**
-     * WatchTelemetry streams a sandbox's resource samples as its host reports
-     * them, in cursor order: the samples kept after a cursor, then each one as
-     * it is stored. Each sample stored takes the next cursor, also one timed
-     * before a sample already sent. Last comes an end, once the sandbox has
-     * ended and every sample still kept that was stored before it ended has
-     * been sent. A host can report a sample after the end: a watch resumed
-     * from the last cursor returns it, then ends again. A sandbox that has
-     * not started yet is waited for. A job or service fails with
-     * INVALID_ARGUMENT.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.WatchTelemetry
-     */
-    watchTelemetry: {
-        methodKind: "server_streaming";
-        input: typeof WatchTelemetryRequestSchema;
-        output: typeof WatchTelemetryResponseSchema;
-    };
-    /**
-     * WatchGuestLog streams what a sandbox's VM writes to its serial console:
-     * the bytes its host keeps from a cursor on, then each write as it
-     * happens, until the sandbox ends. The host keeps the newest part of the
-     * console; bytes it no longer keeps are skipped, and the next chunk's
-     * offset shows the gap. A slow reader does not block the VM's console
-     * writes; bytes rotated out before it reads them are skipped. A sandbox
-     * that has not started yet is waited for, and so is an empty console. A
-     * sandbox that has ended, or whose host keeps no console log, fails with
-     * FAILED_PRECONDITION. A job or service fails with INVALID_ARGUMENT.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.WatchGuestLog
-     */
-    watchGuestLog: {
-        methodKind: "server_streaming";
-        input: typeof WatchGuestLogRequestSchema;
-        output: typeof WatchGuestLogResponseSchema;
-    };
-    /**
-     * Execute starts a command in a running workload. The first request
-     * carries the start message; later requests carry standard input. The
-     * stream answers with the execution's ID, then its standard output and
-     * error as they are written, and ends with its exit status. A workload
-     * that is not running fails with FAILED_PRECONDITION. A server may cancel
-     * an execution whose client stops reading its output.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.Execute
-     */
-    execute: {
-        methodKind: "bidi_streaming";
-        input: typeof ExecuteRequestSchema;
-        output: typeof ExecuteResponseSchema;
-    };
-    /**
-     * CancelExecution stops an execution. Its Execute stream ends with an exit
-     * that says it was cancelled. Cancelling an execution that has ended
-     * changes nothing. It returns once the execution has ended, whether or not
-     * the Execute stream's client still reads it.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.CancelExecution
-     */
-    cancelExecution: {
-        methodKind: "unary";
-        input: typeof CancelExecutionRequestSchema;
-        output: typeof CancelExecutionResponseSchema;
-    };
-    /**
-     * GetOperation returns one operation. An unknown ID fails with NOT_FOUND.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.GetOperation
-     */
-    getOperation: {
-        methodKind: "unary";
-        input: typeof GetOperationRequestSchema;
-        output: typeof GetOperationResponseSchema;
-    };
-    /**
-     * WaitOperation blocks until the operation is done or the bound passes,
-     * whichever is first, and returns it. Passing the bound is not an error:
-     * the operation comes back not done, and the caller asks again. The server
-     * may wait less than the bound asked for.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.WaitOperation
-     */
-    waitOperation: {
-        methodKind: "unary";
-        input: typeof WaitOperationRequestSchema;
-        output: typeof WaitOperationResponseSchema;
-    };
-    /**
-     * ListEvents returns the events after a cursor, oldest first, a page at a
-     * time, for a client that polls or catches up after downtime.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.ListEvents
-     */
-    listEvents: {
-        methodKind: "unary";
-        input: typeof ListEventsRequestSchema;
-        output: typeof ListEventsResponseSchema;
-    };
-    /**
-     * WatchEvents streams the events after a cursor, then each new event as
-     * it is written, for a client that stays connected.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.WatchEvents
-     */
-    watchEvents: {
-        methodKind: "server_streaming";
-        input: typeof WatchEventsRequestSchema;
-        output: typeof WatchEventsResponseSchema;
-    };
-    /**
-     * CreatePreviewShareLink mints a share link for one of a running
-     * sandbox's previews: the channel `preview`, served at the sandbox's own
-     * hostname, unless the request names another of its http channels. The
-     * link is a signed link that admits one device, the first to open it,
-     * until it expires, carries its byte cap or is revoked, and only at that
-     * channel's hostname. The link is in this answer only. The sandbox must
-     * be running with that preview open, or the call fails with
-     * FAILED_PRECONDITION, as it does when the workspace's plan turns share
-     * links off. A channel or port the sandbox has no http channel for fails
-     * with NOT_FOUND; a channel that is not http, a port outside 1 to 65535,
-     * or an expiry or a byte cap above the plan's, with INVALID_ARGUMENT.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.CreatePreviewShareLink
-     */
-    createPreviewShareLink: {
-        methodKind: "unary";
-        input: typeof CreatePreviewShareLinkRequestSchema;
-        output: typeof CreatePreviewShareLinkResponseSchema;
-    };
-    /**
-     * ListPreviewShareLinks returns a sandbox's share links, for all of its
-     * previews, the oldest first, never with the link itself.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.ListPreviewShareLinks
-     */
-    listPreviewShareLinks: {
-        methodKind: "unary";
-        input: typeof ListPreviewShareLinksRequestSchema;
-        output: typeof ListPreviewShareLinksResponseSchema;
-    };
-    /**
-     * RevokePreviewShareLink revokes a share link: it admits no device
-     * again, and its open connections end within seconds. Revoking a link
-     * that was revoked or has ended returns it as it is.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.RevokePreviewShareLink
-     */
-    revokePreviewShareLink: {
-        methodKind: "unary";
-        input: typeof RevokePreviewShareLinkRequestSchema;
-        output: typeof RevokePreviewShareLinkResponseSchema;
-    };
-    /**
-     * StartService starts a service. An always-on service's workload
-     * moves from CREATED to QUEUED and its first run is queued as a job on
-     * a host, placed by the service's size; the run's start moves the
-     * workload to RUNNING. While the service is started, a run that ends is
-     * followed by another. An on-demand service is started asleep: it runs
-     * only once WakeService, a hold or a connect on one of its channels
-     * wakes it, and sleeps again when it has been idle for its recipe's
-     * idle period. Starting a started service returns it as it is. A size
-     * that is not a Linux one and a start past the plan's shared services
-     * fail with FAILED_PRECONDITION.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.StartService
-     */
-    startService: {
-        methodKind: "unary";
-        input: typeof StartServiceRequestSchema;
-        output: typeof StartServiceResponseSchema;
-    };
-    /**
-     * StopService stops a service: its workload moves back to CREATED and
-     * its live run is stopped. Stopping a service that is not started
-     * returns it as it is.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.StopService
-     */
-    stopService: {
-        methodKind: "unary";
-        input: typeof StopServiceRequestSchema;
-        output: typeof StopServiceResponseSchema;
-    };
-    /**
-     * SetServiceMode sets a service's mode. A started service stays
-     * started: set to ON_DEMAND, it sleeps once it is idle; set to
-     * ALWAYS_ON while asleep, its next run is queued.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.SetServiceMode
-     */
-    setServiceMode: {
-        methodKind: "unary";
-        input: typeof SetServiceModeRequestSchema;
-        output: typeof SetServiceModeResponseSchema;
-    };
-    /**
-     * WakeService wakes a started on-demand service that is asleep: its
-     * workload moves from CREATED to QUEUED and a run is queued, placed as a
-     * start is. A wake keeps the service awake for its recipe's idle period;
-     * waking an awake one extends that. The answer does not wait for the run
-     * to be ready: its ServiceRun's ready_at says when it is. Waking a
-     * started always-on service returns it as it is; a service that is not
-     * started fails with FAILED_PRECONDITION.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.WakeService
-     */
-    wakeService: {
-        methodKind: "unary";
-        input: typeof WakeServiceRequestSchema;
-        output: typeof WakeServiceResponseSchema;
-    };
-    /**
-     * HoldService takes or renews the caller's hold on a started service:
-     * while any hold is live, an on-demand service does not sleep, and a
-     * hold on one that is asleep wakes it. Each caller has one hold per
-     * service, live until its time to live runs out or ReleaseService drops
-     * it. A hold gives no access to the service. A service that is not
-     * started fails with FAILED_PRECONDITION, and a time to live above an
-     * hour with INVALID_ARGUMENT.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.HoldService
-     */
-    holdService: {
-        methodKind: "unary";
-        input: typeof HoldServiceRequestSchema;
-        output: typeof HoldServiceResponseSchema;
-    };
-    /**
-     * ReleaseService drops the caller's hold on a service. Releasing a hold
-     * the caller does not have returns the service as it is.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.ReleaseService
-     */
-    releaseService: {
-        methodKind: "unary";
-        input: typeof ReleaseServiceRequestSchema;
-        output: typeof ReleaseServiceResponseSchema;
-    };
-    /**
-     * ListServiceRuns returns a service's runs, the newest first: each run
-     * is a job on a host, of the revision that was current when it was
-     * queued.
-     *
-     * @generated from rpc toshi.workspace.v1.WorkspaceService.ListServiceRuns
-     */
-    listServiceRuns: {
-        methodKind: "unary";
-        input: typeof ListServiceRunsRequestSchema;
-        output: typeof ListServiceRunsResponseSchema;
-    };
-}>;