@toshicloud/sdk 0.5.0 → 0.5.1

package/dist/gen/toshi/workspace/v1/projects_pb.d.ts

@@ -1,5 +1,5 @@
 import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { Duration, DurationJson, Timestamp, TimestampJson } from "@bufbuild/protobuf/wkt";
+import type { Duration, DurationJson, FieldMask, FieldMaskJson, Timestamp, TimestampJson } from "@bufbuild/protobuf/wkt";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file toshi/workspace/v1/projects.proto.
@@ -23,6 +23,13 @@ export type Project = Message<"toshi.workspace.v1.Project"> & {
      * @generated from field: repeated toshi.workspace.v1.ProjectEnvironment environments = 3;
      */
     environments: ProjectEnvironment[];
+    /**
+     * admission is the project's admission webhook; unset when it has none.
+     * GetProject and UpdateProject return it; ListProjects does not.
+     *
+     * @generated from field: toshi.workspace.v1.ProjectAdmission admission = 4;
+     */
+    admission?: ProjectAdmission | undefined;
 };
 /**
  * Project is one of a workspace's projects.
@@ -42,6 +49,13 @@ export type ProjectJson = {
      * @generated from field: repeated toshi.workspace.v1.ProjectEnvironment environments = 3;
      */
     environments?: ProjectEnvironmentJson[];
+    /**
+     * admission is the project's admission webhook; unset when it has none.
+     * GetProject and UpdateProject return it; ListProjects does not.
+     *
+     * @generated from field: toshi.workspace.v1.ProjectAdmission admission = 4;
+     */
+    admission?: ProjectAdmissionJson;
 };
 /**
  * Describes the message toshi.workspace.v1.Project.
@@ -50,6 +64,87 @@ export type ProjectJson = {
 export declare const ProjectSchema: GenMessage<Project, {
     jsonType: ProjectJson;
 }>;
+/**
+ * ProjectAdmission is a project's admission webhook. At each admission
+ * point of the project, once Toshi's own checks have passed, the control
+ * plane posts the admission document to url, signed under Standard Webhooks
+ * with secret, and waits at most 2 seconds for {"allow": true} or
+ * {"allow": false, "reason": "..."}. No answer, an error, a status other
+ * than 2xx or another body is a deny. A refused workload's error is
+ * FAILED_PRECONDITION with an ErrorInfo, reason ADMISSION_DENIED, whose
+ * metadata names the module and the reason.
+ *
+ * @generated from message toshi.workspace.v1.ProjectAdmission
+ */
+export type ProjectAdmission = Message<"toshi.workspace.v1.ProjectAdmission"> & {
+    /**
+     * url is the https URL the document is posted to.
+     *
+     * @generated from field: string url = 1;
+     */
+    url: string;
+    /**
+     * secret is the signing secret: "whsec_" and the base64 of 24 to 64
+     * bytes. Input only: no call returns it.
+     *
+     * @generated from field: string secret = 2;
+     */
+    secret: string;
+    /**
+     * updated_by is who set it last, as the audit log names them.
+     *
+     * @generated from field: string updated_by = 3;
+     */
+    updatedBy: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp updated_at = 4;
+     */
+    updatedAt?: Timestamp | undefined;
+};
+/**
+ * ProjectAdmission is a project's admission webhook. At each admission
+ * point of the project, once Toshi's own checks have passed, the control
+ * plane posts the admission document to url, signed under Standard Webhooks
+ * with secret, and waits at most 2 seconds for {"allow": true} or
+ * {"allow": false, "reason": "..."}. No answer, an error, a status other
+ * than 2xx or another body is a deny. A refused workload's error is
+ * FAILED_PRECONDITION with an ErrorInfo, reason ADMISSION_DENIED, whose
+ * metadata names the module and the reason.
+ *
+ * @generated from message toshi.workspace.v1.ProjectAdmission
+ */
+export type ProjectAdmissionJson = {
+    /**
+     * url is the https URL the document is posted to.
+     *
+     * @generated from field: string url = 1;
+     */
+    url?: string;
+    /**
+     * secret is the signing secret: "whsec_" and the base64 of 24 to 64
+     * bytes. Input only: no call returns it.
+     *
+     * @generated from field: string secret = 2;
+     */
+    secret?: string;
+    /**
+     * updated_by is who set it last, as the audit log names them.
+     *
+     * @generated from field: string updated_by = 3;
+     */
+    updatedBy?: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp updated_at = 4;
+     */
+    updatedAt?: TimestampJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.ProjectAdmission.
+ * Use `create(ProjectAdmissionSchema)` to create a new message.
+ */
+export declare const ProjectAdmissionSchema: GenMessage<ProjectAdmission, {
+    jsonType: ProjectAdmissionJson;
+}>;
 /**
  * ProjectEnvironment is one of a project's environments.
  *
@@ -66,6 +161,52 @@ export type ProjectEnvironment = Message<"toshi.workspace.v1.ProjectEnvironment"
      * @generated from field: string kind = 2;
      */
     kind: string;
+    /**
+     * The names of the project's volumes the environment's services and
+     * sandboxes may attach, sorted; empty when any of them may. Set with
+     * UpdateEnvironment or SetEnvironmentVolumes.
+     *
+     * @generated from field: repeated string volumes = 3;
+     */
+    volumes: string[];
+    /**
+     * Who manages this object: "manifest" when the project manifest declares
+     * it, empty when nothing does. A manifest apply sets managed_by,
+     * manifest_digest, manifest_origin and managed_fields together.
+     *
+     * @generated from field: string managed_by = 4;
+     */
+    managedBy: string;
+    /**
+     * The SHA-256 of the manifest file that last set this object, as 64
+     * lowercase hex characters. Empty when managed_by is empty.
+     *
+     * @generated from field: string manifest_digest = 5;
+     */
+    manifestDigest: string;
+    /**
+     * The fields of this object the manifest declares, as update mask paths.
+     * Empty when managed_by is empty.
+     *
+     * @generated from field: repeated string managed_fields = 6;
+     */
+    managedFields: string[];
+    /**
+     * How the manifest came to manage this object: "created" when a manifest
+     * apply created it, "adopted" when an apply took over an object that
+     * already existed. Empty when managed_by is empty.
+     *
+     * @generated from field: string manifest_origin = 7;
+     */
+    manifestOrigin: string;
+    /**
+     * The environment's retention override as stored; empty when it
+     * follows the workspace. Set with UpdateEnvironment or
+     * SetEnvironmentRetention.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention retention = 8;
+     */
+    retention?: EnvironmentRetention | undefined;
 };
 /**
  * ProjectEnvironment is one of a project's environments.
@@ -83,6 +224,52 @@ export type ProjectEnvironmentJson = {
      * @generated from field: string kind = 2;
      */
     kind?: string;
+    /**
+     * The names of the project's volumes the environment's services and
+     * sandboxes may attach, sorted; empty when any of them may. Set with
+     * UpdateEnvironment or SetEnvironmentVolumes.
+     *
+     * @generated from field: repeated string volumes = 3;
+     */
+    volumes?: string[];
+    /**
+     * Who manages this object: "manifest" when the project manifest declares
+     * it, empty when nothing does. A manifest apply sets managed_by,
+     * manifest_digest, manifest_origin and managed_fields together.
+     *
+     * @generated from field: string managed_by = 4;
+     */
+    managedBy?: string;
+    /**
+     * The SHA-256 of the manifest file that last set this object, as 64
+     * lowercase hex characters. Empty when managed_by is empty.
+     *
+     * @generated from field: string manifest_digest = 5;
+     */
+    manifestDigest?: string;
+    /**
+     * The fields of this object the manifest declares, as update mask paths.
+     * Empty when managed_by is empty.
+     *
+     * @generated from field: repeated string managed_fields = 6;
+     */
+    managedFields?: string[];
+    /**
+     * How the manifest came to manage this object: "created" when a manifest
+     * apply created it, "adopted" when an apply took over an object that
+     * already existed. Empty when managed_by is empty.
+     *
+     * @generated from field: string manifest_origin = 7;
+     */
+    manifestOrigin?: string;
+    /**
+     * The environment's retention override as stored; empty when it
+     * follows the workspace. Set with UpdateEnvironment or
+     * SetEnvironmentRetention.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention retention = 8;
+     */
+    retention?: EnvironmentRetentionJson;
 };
 /**
  * Describes the message toshi.workspace.v1.ProjectEnvironment.
@@ -387,6 +574,10 @@ export type CreateProjectRequest = Message<"toshi.workspace.v1.CreateProjectRequ
      * @generated from field: string name = 1;
      */
     name: string;
+    /**
+     * @generated from field: string request_key = 2;
+     */
+    requestKey: string;
 };
 /**
  * @generated from message toshi.workspace.v1.CreateProjectRequest
@@ -396,6 +587,10 @@ export type CreateProjectRequestJson = {
      * @generated from field: string name = 1;
      */
     name?: string;
+    /**
+     * @generated from field: string request_key = 2;
+     */
+    requestKey?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.CreateProjectRequest.
@@ -429,6 +624,70 @@ export type CreateProjectResponseJson = {
 export declare const CreateProjectResponseSchema: GenMessage<CreateProjectResponse, {
     jsonType: CreateProjectResponseJson;
 }>;
+/**
+ * @generated from message toshi.workspace.v1.UpdateProjectRequest
+ */
+export type UpdateProjectRequest = Message<"toshi.workspace.v1.UpdateProjectRequest"> & {
+    /**
+     * name names the project; the fields update_mask names carry the new
+     * values.
+     *
+     * @generated from field: toshi.workspace.v1.Project project = 1;
+     */
+    project?: Project | undefined;
+    /**
+     * @generated from field: google.protobuf.FieldMask update_mask = 2;
+     */
+    updateMask?: FieldMask | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.UpdateProjectRequest
+ */
+export type UpdateProjectRequestJson = {
+    /**
+     * name names the project; the fields update_mask names carry the new
+     * values.
+     *
+     * @generated from field: toshi.workspace.v1.Project project = 1;
+     */
+    project?: ProjectJson;
+    /**
+     * @generated from field: google.protobuf.FieldMask update_mask = 2;
+     */
+    updateMask?: FieldMaskJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.UpdateProjectRequest.
+ * Use `create(UpdateProjectRequestSchema)` to create a new message.
+ */
+export declare const UpdateProjectRequestSchema: GenMessage<UpdateProjectRequest, {
+    jsonType: UpdateProjectRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.UpdateProjectResponse
+ */
+export type UpdateProjectResponse = Message<"toshi.workspace.v1.UpdateProjectResponse"> & {
+    /**
+     * @generated from field: toshi.workspace.v1.Project project = 1;
+     */
+    project?: Project | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.UpdateProjectResponse
+ */
+export type UpdateProjectResponseJson = {
+    /**
+     * @generated from field: toshi.workspace.v1.Project project = 1;
+     */
+    project?: ProjectJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.UpdateProjectResponse.
+ * Use `create(UpdateProjectResponseSchema)` to create a new message.
+ */
+export declare const UpdateProjectResponseSchema: GenMessage<UpdateProjectResponse, {
+    jsonType: UpdateProjectResponseJson;
+}>;
 /**
  * @generated from message toshi.workspace.v1.ClaimRepositoryRequest
  */
@@ -580,6 +839,10 @@ export type CreateEnvironmentRequest = Message<"toshi.workspace.v1.CreateEnviron
      * @generated from field: string kind = 2;
      */
     kind: string;
+    /**
+     * @generated from field: string request_key = 3;
+     */
+    requestKey: string;
 };
 /**
  * @generated from message toshi.workspace.v1.CreateEnvironmentRequest
@@ -598,6 +861,10 @@ export type CreateEnvironmentRequestJson = {
      * @generated from field: string kind = 2;
      */
     kind?: string;
+    /**
+     * @generated from field: string request_key = 3;
+     */
+    requestKey?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.CreateEnvironmentRequest.
@@ -925,140 +1192,215 @@ export declare const SetBranchRulesResponseSchema: GenMessage<SetBranchRulesResp
     jsonType: SetBranchRulesResponseJson;
 }>;
 /**
- * EmbedToken is one of a project's embed tokens, without the token itself.
+ * NetworkPolicy is where a project's or an environment's workloads may
+ * connect outbound. The first rule that matches a destination decides;
+ * one no rule matches gets default_action.
  *
- * @generated from message toshi.workspace.v1.EmbedToken
+ * @generated from message toshi.workspace.v1.NetworkPolicy
  */
-export type EmbedToken = Message<"toshi.workspace.v1.EmbedToken"> & {
+export type NetworkPolicy = Message<"toshi.workspace.v1.NetworkPolicy"> & {
     /**
-     * Assigned by the server.
+     * "allow" or "deny".
      *
-     * @generated from field: string id = 1;
+     * @generated from field: string default_action = 1;
      */
-    id: string;
+    defaultAction: string;
     /**
-     * The project's name.
+     * At most 100 rules, read in order.
      *
-     * @generated from field: string project = 2;
+     * @generated from field: repeated toshi.workspace.v1.EgressRule egress = 2;
      */
-    project: string;
+    egress: EgressRule[];
+};
+/**
+ * NetworkPolicy is where a project's or an environment's workloads may
+ * connect outbound. The first rule that matches a destination decides;
+ * one no rule matches gets default_action.
+ *
+ * @generated from message toshi.workspace.v1.NetworkPolicy
+ */
+export type NetworkPolicyJson = {
     /**
-     * The origins of the pages that may spend it, such as
-     * https://app.example.com.
+     * "allow" or "deny".
      *
-     * @generated from field: repeated string origins = 3;
-     */
-    origins: string[];
-    /**
-     * @generated from field: toshi.workspace.v1.EmbedTokenState state = 4;
-     */
-    state: EmbedTokenState;
-    /**
-     * @generated from field: google.protobuf.Timestamp created_at = 5;
+     * @generated from field: string default_action = 1;
      */
-    createdAt?: Timestamp | undefined;
+    defaultAction?: string;
     /**
-     * @generated from field: google.protobuf.Timestamp expires_at = 6;
+     * At most 100 rules, read in order.
+     *
+     * @generated from field: repeated toshi.workspace.v1.EgressRule egress = 2;
      */
-    expiresAt?: Timestamp | undefined;
+    egress?: EgressRuleJson[];
+};
+/**
+ * Describes the message toshi.workspace.v1.NetworkPolicy.
+ * Use `create(NetworkPolicySchema)` to create a new message.
+ */
+export declare const NetworkPolicySchema: GenMessage<NetworkPolicy, {
+    jsonType: NetworkPolicyJson;
+}>;
+/**
+ * EgressRule allows or denies outbound connections to one destination.
+ *
+ * @generated from message toshi.workspace.v1.EgressRule
+ */
+export type EgressRule = Message<"toshi.workspace.v1.EgressRule"> & {
     /**
-     * Unset until a page spends it.
+     * "allow" or "deny".
      *
-     * @generated from field: google.protobuf.Timestamp used_at = 7;
+     * @generated from field: string action = 1;
      */
-    usedAt?: Timestamp | undefined;
+    action: string;
     /**
-     * The recording it was spent on; empty until then.
+     * An IPv4 or IPv6 address, a CIDR prefix, or a DNS name such as
+     * "api.example.com". A name is resolved by the host that runs the
+     * workload, so it matches the addresses the name had when last
+     * resolved; it does not check a TLS server name. Stored in canonical
+     * form: a prefix masked, a name in lower case.
      *
-     * @generated from field: string recording_id = 8;
+     * @generated from field: string destination = 2;
      */
-    recordingId: string;
+    destination: string;
     /**
-     * Unset unless it was revoked.
+     * A port such as "443", a range such as "8000-8100", or empty for every
+     * port.
      *
-     * @generated from field: google.protobuf.Timestamp revoked_at = 9;
+     * @generated from field: string ports = 3;
      */
-    revokedAt?: Timestamp | undefined;
+    ports: string;
     /**
-     * Who minted it: a person's sign-in or an API token, as in the audit.
+     * "tcp", "udp", or empty for both; empty with no ports covers every
+     * protocol, ICMP included.
      *
-     * @generated from field: string created_by = 10;
+     * @generated from field: string protocol = 4;
      */
-    createdBy: string;
+    protocol: string;
 };
 /**
- * EmbedToken is one of a project's embed tokens, without the token itself.
+ * EgressRule allows or denies outbound connections to one destination.
  *
- * @generated from message toshi.workspace.v1.EmbedToken
+ * @generated from message toshi.workspace.v1.EgressRule
  */
-export type EmbedTokenJson = {
+export type EgressRuleJson = {
     /**
-     * Assigned by the server.
+     * "allow" or "deny".
      *
-     * @generated from field: string id = 1;
+     * @generated from field: string action = 1;
      */
-    id?: string;
+    action?: string;
     /**
-     * The project's name.
+     * An IPv4 or IPv6 address, a CIDR prefix, or a DNS name such as
+     * "api.example.com". A name is resolved by the host that runs the
+     * workload, so it matches the addresses the name had when last
+     * resolved; it does not check a TLS server name. Stored in canonical
+     * form: a prefix masked, a name in lower case.
      *
-     * @generated from field: string project = 2;
+     * @generated from field: string destination = 2;
      */
-    project?: string;
+    destination?: string;
     /**
-     * The origins of the pages that may spend it, such as
-     * https://app.example.com.
+     * A port such as "443", a range such as "8000-8100", or empty for every
+     * port.
      *
-     * @generated from field: repeated string origins = 3;
+     * @generated from field: string ports = 3;
      */
-    origins?: string[];
+    ports?: string;
     /**
-     * @generated from field: toshi.workspace.v1.EmbedTokenState state = 4;
+     * "tcp", "udp", or empty for both; empty with no ports covers every
+     * protocol, ICMP included.
+     *
+     * @generated from field: string protocol = 4;
      */
-    state?: EmbedTokenStateJson;
+    protocol?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.EgressRule.
+ * Use `create(EgressRuleSchema)` to create a new message.
+ */
+export declare const EgressRuleSchema: GenMessage<EgressRule, {
+    jsonType: EgressRuleJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.GetProjectNetworkRequest
+ */
+export type GetProjectNetworkRequest = Message<"toshi.workspace.v1.GetProjectNetworkRequest"> & {
     /**
-     * @generated from field: google.protobuf.Timestamp created_at = 5;
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
      */
-    createdAt?: TimestampJson;
+    project: string;
+};
+/**
+ * @generated from message toshi.workspace.v1.GetProjectNetworkRequest
+ */
+export type GetProjectNetworkRequestJson = {
     /**
-     * @generated from field: google.protobuf.Timestamp expires_at = 6;
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
      */
-    expiresAt?: TimestampJson;
+    project?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.GetProjectNetworkRequest.
+ * Use `create(GetProjectNetworkRequestSchema)` to create a new message.
+ */
+export declare const GetProjectNetworkRequestSchema: GenMessage<GetProjectNetworkRequest, {
+    jsonType: GetProjectNetworkRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.GetProjectNetworkResponse
+ */
+export type GetProjectNetworkResponse = Message<"toshi.workspace.v1.GetProjectNetworkResponse"> & {
     /**
-     * Unset until a page spends it.
-     *
-     * @generated from field: google.protobuf.Timestamp used_at = 7;
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 1;
      */
-    usedAt?: TimestampJson;
+    network?: NetworkPolicy | undefined;
     /**
-     * The recording it was spent on; empty until then.
+     * The audit actor that last set it, "<kind>:<id>"; empty when it was
+     * never set.
      *
-     * @generated from field: string recording_id = 8;
+     * @generated from field: string updated_by = 2;
      */
-    recordingId?: string;
+    updatedBy: string;
     /**
-     * Unset unless it was revoked.
-     *
-     * @generated from field: google.protobuf.Timestamp revoked_at = 9;
+     * @generated from field: google.protobuf.Timestamp updated_at = 3;
      */
-    revokedAt?: TimestampJson;
+    updatedAt?: Timestamp | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.GetProjectNetworkResponse
+ */
+export type GetProjectNetworkResponseJson = {
     /**
-     * Who minted it: a person's sign-in or an API token, as in the audit.
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 1;
+     */
+    network?: NetworkPolicyJson;
+    /**
+     * The audit actor that last set it, "<kind>:<id>"; empty when it was
+     * never set.
      *
-     * @generated from field: string created_by = 10;
+     * @generated from field: string updated_by = 2;
      */
-    createdBy?: string;
+    updatedBy?: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp updated_at = 3;
+     */
+    updatedAt?: TimestampJson;
 };
 /**
- * Describes the message toshi.workspace.v1.EmbedToken.
- * Use `create(EmbedTokenSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.GetProjectNetworkResponse.
+ * Use `create(GetProjectNetworkResponseSchema)` to create a new message.
  */
-export declare const EmbedTokenSchema: GenMessage<EmbedToken, {
-    jsonType: EmbedTokenJson;
+export declare const GetProjectNetworkResponseSchema: GenMessage<GetProjectNetworkResponse, {
+    jsonType: GetProjectNetworkResponseJson;
 }>;
 /**
- * @generated from message toshi.workspace.v1.CreateEmbedTokenRequest
+ * @generated from message toshi.workspace.v1.SetProjectNetworkRequest
  */
-export type CreateEmbedTokenRequest = Message<"toshi.workspace.v1.CreateEmbedTokenRequest"> & {
+export type SetProjectNetworkRequest = Message<"toshi.workspace.v1.SetProjectNetworkRequest"> & {
     /**
      * The project's name.
      *
@@ -1066,25 +1408,14 @@ export type CreateEmbedTokenRequest = Message<"toshi.workspace.v1.CreateEmbedTok
      */
     project: string;
     /**
-     * The origins of the pages that may spend it, each a scheme and a host
-     * with an optional port: https, or http for localhost only. At least
-     * one, and more than the server's maximum is INVALID_ARGUMENT.
-     *
-     * @generated from field: repeated string origins = 2;
-     */
-    origins: string[];
-    /**
-     * How long the token stays valid; unset is the server's default, and
-     * more than its maximum is INVALID_ARGUMENT.
-     *
-     * @generated from field: google.protobuf.Duration expires_in = 3;
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 2;
      */
-    expiresIn?: Duration | undefined;
+    network?: NetworkPolicy | undefined;
 };
 /**
- * @generated from message toshi.workspace.v1.CreateEmbedTokenRequest
+ * @generated from message toshi.workspace.v1.SetProjectNetworkRequest
  */
-export type CreateEmbedTokenRequestJson = {
+export type SetProjectNetworkRequestJson = {
     /**
      * The project's name.
      *
@@ -1092,16 +1423,908 @@ export type CreateEmbedTokenRequestJson = {
      */
     project?: string;
     /**
-     * The origins of the pages that may spend it, each a scheme and a host
-     * with an optional port: https, or http for localhost only. At least
-     * one, and more than the server's maximum is INVALID_ARGUMENT.
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 2;
+     */
+    network?: NetworkPolicyJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.SetProjectNetworkRequest.
+ * Use `create(SetProjectNetworkRequestSchema)` to create a new message.
+ */
+export declare const SetProjectNetworkRequestSchema: GenMessage<SetProjectNetworkRequest, {
+    jsonType: SetProjectNetworkRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.SetProjectNetworkResponse
+ */
+export type SetProjectNetworkResponse = Message<"toshi.workspace.v1.SetProjectNetworkResponse"> & {
+    /**
+     * The policy as stored.
+     *
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 1;
+     */
+    network?: NetworkPolicy | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.SetProjectNetworkResponse
+ */
+export type SetProjectNetworkResponseJson = {
+    /**
+     * The policy as stored.
+     *
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 1;
+     */
+    network?: NetworkPolicyJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.SetProjectNetworkResponse.
+ * Use `create(SetProjectNetworkResponseSchema)` to create a new message.
+ */
+export declare const SetProjectNetworkResponseSchema: GenMessage<SetProjectNetworkResponse, {
+    jsonType: SetProjectNetworkResponseJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.GetEnvironmentNetworkRequest
+ */
+export type GetEnvironmentNetworkRequest = Message<"toshi.workspace.v1.GetEnvironmentNetworkRequest"> & {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment: string;
+};
+/**
+ * @generated from message toshi.workspace.v1.GetEnvironmentNetworkRequest
+ */
+export type GetEnvironmentNetworkRequestJson = {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project?: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.GetEnvironmentNetworkRequest.
+ * Use `create(GetEnvironmentNetworkRequestSchema)` to create a new message.
+ */
+export declare const GetEnvironmentNetworkRequestSchema: GenMessage<GetEnvironmentNetworkRequest, {
+    jsonType: GetEnvironmentNetworkRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.GetEnvironmentNetworkResponse
+ */
+export type GetEnvironmentNetworkResponse = Message<"toshi.workspace.v1.GetEnvironmentNetworkResponse"> & {
+    /**
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 1;
+     */
+    network?: NetworkPolicy | undefined;
+    /**
+     * The audit actor that last set it, "<kind>:<id>"; empty when it was
+     * never set.
+     *
+     * @generated from field: string updated_by = 2;
+     */
+    updatedBy: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp updated_at = 3;
+     */
+    updatedAt?: Timestamp | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.GetEnvironmentNetworkResponse
+ */
+export type GetEnvironmentNetworkResponseJson = {
+    /**
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 1;
+     */
+    network?: NetworkPolicyJson;
+    /**
+     * The audit actor that last set it, "<kind>:<id>"; empty when it was
+     * never set.
+     *
+     * @generated from field: string updated_by = 2;
+     */
+    updatedBy?: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp updated_at = 3;
+     */
+    updatedAt?: TimestampJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.GetEnvironmentNetworkResponse.
+ * Use `create(GetEnvironmentNetworkResponseSchema)` to create a new message.
+ */
+export declare const GetEnvironmentNetworkResponseSchema: GenMessage<GetEnvironmentNetworkResponse, {
+    jsonType: GetEnvironmentNetworkResponseJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentNetworkRequest
+ */
+export type SetEnvironmentNetworkRequest = Message<"toshi.workspace.v1.SetEnvironmentNetworkRequest"> & {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment: string;
+    /**
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 3;
+     */
+    network?: NetworkPolicy | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentNetworkRequest
+ */
+export type SetEnvironmentNetworkRequestJson = {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project?: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment?: string;
+    /**
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 3;
+     */
+    network?: NetworkPolicyJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.SetEnvironmentNetworkRequest.
+ * Use `create(SetEnvironmentNetworkRequestSchema)` to create a new message.
+ */
+export declare const SetEnvironmentNetworkRequestSchema: GenMessage<SetEnvironmentNetworkRequest, {
+    jsonType: SetEnvironmentNetworkRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentNetworkResponse
+ */
+export type SetEnvironmentNetworkResponse = Message<"toshi.workspace.v1.SetEnvironmentNetworkResponse"> & {
+    /**
+     * The policy as stored.
+     *
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 1;
+     */
+    network?: NetworkPolicy | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentNetworkResponse
+ */
+export type SetEnvironmentNetworkResponseJson = {
+    /**
+     * The policy as stored.
+     *
+     * @generated from field: toshi.workspace.v1.NetworkPolicy network = 1;
+     */
+    network?: NetworkPolicyJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.SetEnvironmentNetworkResponse.
+ * Use `create(SetEnvironmentNetworkResponseSchema)` to create a new message.
+ */
+export declare const SetEnvironmentNetworkResponseSchema: GenMessage<SetEnvironmentNetworkResponse, {
+    jsonType: SetEnvironmentNetworkResponseJson;
+}>;
+/**
+ * RetentionKeep is how long one kind of artifact is kept after it
+ * completes.
+ *
+ * @generated from message toshi.workspace.v1.RetentionKeep
+ */
+export type RetentionKeep = Message<"toshi.workspace.v1.RetentionKeep"> & {
+    /**
+     * The artifact kind: recording, recording-signed-in, trace or report.
+     *
+     * @generated from field: string kind = 1;
+     */
+    kind: string;
+    /**
+     * At least one hour.
+     *
+     * @generated from field: google.protobuf.Duration keep = 2;
+     */
+    keep?: Duration | undefined;
+};
+/**
+ * RetentionKeep is how long one kind of artifact is kept after it
+ * completes.
+ *
+ * @generated from message toshi.workspace.v1.RetentionKeep
+ */
+export type RetentionKeepJson = {
+    /**
+     * The artifact kind: recording, recording-signed-in, trace or report.
+     *
+     * @generated from field: string kind = 1;
+     */
+    kind?: string;
+    /**
+     * At least one hour.
+     *
+     * @generated from field: google.protobuf.Duration keep = 2;
+     */
+    keep?: DurationJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.RetentionKeep.
+ * Use `create(RetentionKeepSchema)` to create a new message.
+ */
+export declare const RetentionKeepSchema: GenMessage<RetentionKeep, {
+    jsonType: RetentionKeepJson;
+}>;
+/**
+ * EnvironmentRetention is how long an environment keeps its finished jobs
+ * and its artifacts. As an override, what it leaves out follows the
+ * workspace, and what it sets may only shorten the workspace's.
+ *
+ * @generated from message toshi.workspace.v1.EnvironmentRetention
+ */
+export type EnvironmentRetention = Message<"toshi.workspace.v1.EnvironmentRetention"> & {
+    /**
+     * Days the environment keeps its finished jobs. In an override, unset
+     * follows the workspace and the value is at least 1 and at most the
+     * workspace's period: an override cannot keep forever. In the retention
+     * that applies, 0 keeps forever.
+     *
+     * @generated from field: optional int32 history_days = 1;
+     */
+    historyDays?: number | undefined;
+    /**
+     * Each kind's keep, by kind. In an override, a kind left out follows the
+     * workspace. In the retention that applies, a kind left out is kept
+     * forever.
+     *
+     * @generated from field: repeated toshi.workspace.v1.RetentionKeep keeps = 2;
+     */
+    keeps: RetentionKeep[];
+};
+/**
+ * EnvironmentRetention is how long an environment keeps its finished jobs
+ * and its artifacts. As an override, what it leaves out follows the
+ * workspace, and what it sets may only shorten the workspace's.
+ *
+ * @generated from message toshi.workspace.v1.EnvironmentRetention
+ */
+export type EnvironmentRetentionJson = {
+    /**
+     * Days the environment keeps its finished jobs. In an override, unset
+     * follows the workspace and the value is at least 1 and at most the
+     * workspace's period: an override cannot keep forever. In the retention
+     * that applies, 0 keeps forever.
+     *
+     * @generated from field: optional int32 history_days = 1;
+     */
+    historyDays?: number;
+    /**
+     * Each kind's keep, by kind. In an override, a kind left out follows the
+     * workspace. In the retention that applies, a kind left out is kept
+     * forever.
+     *
+     * @generated from field: repeated toshi.workspace.v1.RetentionKeep keeps = 2;
+     */
+    keeps?: RetentionKeepJson[];
+};
+/**
+ * Describes the message toshi.workspace.v1.EnvironmentRetention.
+ * Use `create(EnvironmentRetentionSchema)` to create a new message.
+ */
+export declare const EnvironmentRetentionSchema: GenMessage<EnvironmentRetention, {
+    jsonType: EnvironmentRetentionJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.GetEnvironmentRetentionRequest
+ */
+export type GetEnvironmentRetentionRequest = Message<"toshi.workspace.v1.GetEnvironmentRetentionRequest"> & {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment: string;
+};
+/**
+ * @generated from message toshi.workspace.v1.GetEnvironmentRetentionRequest
+ */
+export type GetEnvironmentRetentionRequestJson = {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project?: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.GetEnvironmentRetentionRequest.
+ * Use `create(GetEnvironmentRetentionRequestSchema)` to create a new message.
+ */
+export declare const GetEnvironmentRetentionRequestSchema: GenMessage<GetEnvironmentRetentionRequest, {
+    jsonType: GetEnvironmentRetentionRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.GetEnvironmentRetentionResponse
+ */
+export type GetEnvironmentRetentionResponse = Message<"toshi.workspace.v1.GetEnvironmentRetentionResponse"> & {
+    /**
+     * The override as stored; empty when none is set.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention retention = 1;
+     */
+    retention?: EnvironmentRetention | undefined;
+    /**
+     * What applies to the environment's jobs and artifacts: each value of the
+     * override that is shorter than the workspace's, else the workspace's.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention effective = 2;
+     */
+    effective?: EnvironmentRetention | undefined;
+    /**
+     * The audit actor that last set it, "<kind>:<id>"; empty when it was
+     * never set.
+     *
+     * @generated from field: string updated_by = 3;
+     */
+    updatedBy: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp updated_at = 4;
+     */
+    updatedAt?: Timestamp | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.GetEnvironmentRetentionResponse
+ */
+export type GetEnvironmentRetentionResponseJson = {
+    /**
+     * The override as stored; empty when none is set.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention retention = 1;
+     */
+    retention?: EnvironmentRetentionJson;
+    /**
+     * What applies to the environment's jobs and artifacts: each value of the
+     * override that is shorter than the workspace's, else the workspace's.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention effective = 2;
+     */
+    effective?: EnvironmentRetentionJson;
+    /**
+     * The audit actor that last set it, "<kind>:<id>"; empty when it was
+     * never set.
+     *
+     * @generated from field: string updated_by = 3;
+     */
+    updatedBy?: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp updated_at = 4;
+     */
+    updatedAt?: TimestampJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.GetEnvironmentRetentionResponse.
+ * Use `create(GetEnvironmentRetentionResponseSchema)` to create a new message.
+ */
+export declare const GetEnvironmentRetentionResponseSchema: GenMessage<GetEnvironmentRetentionResponse, {
+    jsonType: GetEnvironmentRetentionResponseJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentRetentionRequest
+ */
+export type SetEnvironmentRetentionRequest = Message<"toshi.workspace.v1.SetEnvironmentRetentionRequest"> & {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment: string;
+    /**
+     * The whole override; empty clears it.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention retention = 3;
+     */
+    retention?: EnvironmentRetention | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentRetentionRequest
+ */
+export type SetEnvironmentRetentionRequestJson = {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project?: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment?: string;
+    /**
+     * The whole override; empty clears it.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention retention = 3;
+     */
+    retention?: EnvironmentRetentionJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.SetEnvironmentRetentionRequest.
+ * Use `create(SetEnvironmentRetentionRequestSchema)` to create a new message.
+ */
+export declare const SetEnvironmentRetentionRequestSchema: GenMessage<SetEnvironmentRetentionRequest, {
+    jsonType: SetEnvironmentRetentionRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentRetentionResponse
+ */
+export type SetEnvironmentRetentionResponse = Message<"toshi.workspace.v1.SetEnvironmentRetentionResponse"> & {
+    /**
+     * The override as stored.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention retention = 1;
+     */
+    retention?: EnvironmentRetention | undefined;
+    /**
+     * What applies after it, as GetEnvironmentRetention reports it.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention effective = 2;
+     */
+    effective?: EnvironmentRetention | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentRetentionResponse
+ */
+export type SetEnvironmentRetentionResponseJson = {
+    /**
+     * The override as stored.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention retention = 1;
+     */
+    retention?: EnvironmentRetentionJson;
+    /**
+     * What applies after it, as GetEnvironmentRetention reports it.
+     *
+     * @generated from field: toshi.workspace.v1.EnvironmentRetention effective = 2;
+     */
+    effective?: EnvironmentRetentionJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.SetEnvironmentRetentionResponse.
+ * Use `create(SetEnvironmentRetentionResponseSchema)` to create a new message.
+ */
+export declare const SetEnvironmentRetentionResponseSchema: GenMessage<SetEnvironmentRetentionResponse, {
+    jsonType: SetEnvironmentRetentionResponseJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentVolumesRequest
+ */
+export type SetEnvironmentVolumesRequest = Message<"toshi.workspace.v1.SetEnvironmentVolumesRequest"> & {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment: string;
+    /**
+     * The whole list of volume names; empty lifts the limit.
+     *
+     * @generated from field: repeated string volumes = 3;
+     */
+    volumes: string[];
+};
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentVolumesRequest
+ */
+export type SetEnvironmentVolumesRequestJson = {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project?: string;
+    /**
+     * The environment's name.
+     *
+     * @generated from field: string environment = 2;
+     */
+    environment?: string;
+    /**
+     * The whole list of volume names; empty lifts the limit.
+     *
+     * @generated from field: repeated string volumes = 3;
+     */
+    volumes?: string[];
+};
+/**
+ * Describes the message toshi.workspace.v1.SetEnvironmentVolumesRequest.
+ * Use `create(SetEnvironmentVolumesRequestSchema)` to create a new message.
+ */
+export declare const SetEnvironmentVolumesRequestSchema: GenMessage<SetEnvironmentVolumesRequest, {
+    jsonType: SetEnvironmentVolumesRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentVolumesResponse
+ */
+export type SetEnvironmentVolumesResponse = Message<"toshi.workspace.v1.SetEnvironmentVolumesResponse"> & {
+    /**
+     * The environment with its list as stored.
+     *
+     * @generated from field: toshi.workspace.v1.ProjectEnvironment environment = 1;
+     */
+    environment?: ProjectEnvironment | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.SetEnvironmentVolumesResponse
+ */
+export type SetEnvironmentVolumesResponseJson = {
+    /**
+     * The environment with its list as stored.
+     *
+     * @generated from field: toshi.workspace.v1.ProjectEnvironment environment = 1;
+     */
+    environment?: ProjectEnvironmentJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.SetEnvironmentVolumesResponse.
+ * Use `create(SetEnvironmentVolumesResponseSchema)` to create a new message.
+ */
+export declare const SetEnvironmentVolumesResponseSchema: GenMessage<SetEnvironmentVolumesResponse, {
+    jsonType: SetEnvironmentVolumesResponseJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.UpdateEnvironmentRequest
+ */
+export type UpdateEnvironmentRequest = Message<"toshi.workspace.v1.UpdateEnvironmentRequest"> & {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * name names the environment; the fields update_mask names carry the
+     * new values.
+     *
+     * @generated from field: toshi.workspace.v1.ProjectEnvironment environment = 2;
+     */
+    environment?: ProjectEnvironment | undefined;
+    /**
+     * retention, volumes, or both. The paths managed_by, manifest_digest,
+     * manifest_origin and managed_fields set the management mark and go
+     * together: all four or none, and on their own; managed_by "manifest"
+     * needs the digest, an origin and at least one field path, and an empty
+     * managed_by clears all four. An unset mask never sets the mark.
+     *
+     * @generated from field: google.protobuf.FieldMask update_mask = 3;
+     */
+    updateMask?: FieldMask | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.UpdateEnvironmentRequest
+ */
+export type UpdateEnvironmentRequestJson = {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project?: string;
+    /**
+     * name names the environment; the fields update_mask names carry the
+     * new values.
+     *
+     * @generated from field: toshi.workspace.v1.ProjectEnvironment environment = 2;
+     */
+    environment?: ProjectEnvironmentJson;
+    /**
+     * retention, volumes, or both. The paths managed_by, manifest_digest,
+     * manifest_origin and managed_fields set the management mark and go
+     * together: all four or none, and on their own; managed_by "manifest"
+     * needs the digest, an origin and at least one field path, and an empty
+     * managed_by clears all four. An unset mask never sets the mark.
+     *
+     * @generated from field: google.protobuf.FieldMask update_mask = 3;
+     */
+    updateMask?: FieldMaskJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.UpdateEnvironmentRequest.
+ * Use `create(UpdateEnvironmentRequestSchema)` to create a new message.
+ */
+export declare const UpdateEnvironmentRequestSchema: GenMessage<UpdateEnvironmentRequest, {
+    jsonType: UpdateEnvironmentRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.UpdateEnvironmentResponse
+ */
+export type UpdateEnvironmentResponse = Message<"toshi.workspace.v1.UpdateEnvironmentResponse"> & {
+    /**
+     * The environment as stored.
+     *
+     * @generated from field: toshi.workspace.v1.ProjectEnvironment environment = 1;
+     */
+    environment?: ProjectEnvironment | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.UpdateEnvironmentResponse
+ */
+export type UpdateEnvironmentResponseJson = {
+    /**
+     * The environment as stored.
+     *
+     * @generated from field: toshi.workspace.v1.ProjectEnvironment environment = 1;
+     */
+    environment?: ProjectEnvironmentJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.UpdateEnvironmentResponse.
+ * Use `create(UpdateEnvironmentResponseSchema)` to create a new message.
+ */
+export declare const UpdateEnvironmentResponseSchema: GenMessage<UpdateEnvironmentResponse, {
+    jsonType: UpdateEnvironmentResponseJson;
+}>;
+/**
+ * EmbedToken is one of a project's embed tokens, without the token itself.
+ *
+ * @generated from message toshi.workspace.v1.EmbedToken
+ */
+export type EmbedToken = Message<"toshi.workspace.v1.EmbedToken"> & {
+    /**
+     * Assigned by the server.
+     *
+     * @generated from field: string id = 1;
+     */
+    id: string;
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 2;
+     */
+    project: string;
+    /**
+     * The origins of the pages that may spend it, such as
+     * https://app.example.com.
+     *
+     * @generated from field: repeated string origins = 3;
+     */
+    origins: string[];
+    /**
+     * @generated from field: toshi.workspace.v1.EmbedTokenState state = 4;
+     */
+    state: EmbedTokenState;
+    /**
+     * @generated from field: google.protobuf.Timestamp created_at = 5;
+     */
+    createdAt?: Timestamp | undefined;
+    /**
+     * @generated from field: google.protobuf.Timestamp expires_at = 6;
+     */
+    expiresAt?: Timestamp | undefined;
+    /**
+     * Unset until a page spends it.
+     *
+     * @generated from field: google.protobuf.Timestamp used_at = 7;
+     */
+    usedAt?: Timestamp | undefined;
+    /**
+     * The recording it was spent on; empty until then.
+     *
+     * @generated from field: string recording_id = 8;
+     */
+    recordingId: string;
+    /**
+     * Unset unless it was revoked.
+     *
+     * @generated from field: google.protobuf.Timestamp revoked_at = 9;
+     */
+    revokedAt?: Timestamp | undefined;
+    /**
+     * Who minted it: a person's sign-in or an API token, as in the audit.
+     *
+     * @generated from field: string created_by = 10;
+     */
+    createdBy: string;
+    /**
+     * Where the recording it was spent on lives, copied from the recording
+     * when it was spent, so they stay after the recording is deleted: its
+     * workload, as ListRecordings takes it, that workload's kind ("job",
+     * "sandbox" or "service") and its environment, as Recording names them.
+     * Empty until spent.
+     *
+     * @generated from field: string workload_id = 11;
+     */
+    workloadId: string;
+    /**
+     * @generated from field: string workload_kind = 12;
+     */
+    workloadKind: string;
+    /**
+     * @generated from field: string environment_id = 13;
+     */
+    environmentId: string;
+};
+/**
+ * EmbedToken is one of a project's embed tokens, without the token itself.
+ *
+ * @generated from message toshi.workspace.v1.EmbedToken
+ */
+export type EmbedTokenJson = {
+    /**
+     * Assigned by the server.
+     *
+     * @generated from field: string id = 1;
+     */
+    id?: string;
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 2;
+     */
+    project?: string;
+    /**
+     * The origins of the pages that may spend it, such as
+     * https://app.example.com.
+     *
+     * @generated from field: repeated string origins = 3;
+     */
+    origins?: string[];
+    /**
+     * @generated from field: toshi.workspace.v1.EmbedTokenState state = 4;
+     */
+    state?: EmbedTokenStateJson;
+    /**
+     * @generated from field: google.protobuf.Timestamp created_at = 5;
+     */
+    createdAt?: TimestampJson;
+    /**
+     * @generated from field: google.protobuf.Timestamp expires_at = 6;
+     */
+    expiresAt?: TimestampJson;
+    /**
+     * Unset until a page spends it.
+     *
+     * @generated from field: google.protobuf.Timestamp used_at = 7;
+     */
+    usedAt?: TimestampJson;
+    /**
+     * The recording it was spent on; empty until then.
+     *
+     * @generated from field: string recording_id = 8;
+     */
+    recordingId?: string;
+    /**
+     * Unset unless it was revoked.
+     *
+     * @generated from field: google.protobuf.Timestamp revoked_at = 9;
+     */
+    revokedAt?: TimestampJson;
+    /**
+     * Who minted it: a person's sign-in or an API token, as in the audit.
+     *
+     * @generated from field: string created_by = 10;
+     */
+    createdBy?: string;
+    /**
+     * Where the recording it was spent on lives, copied from the recording
+     * when it was spent, so they stay after the recording is deleted: its
+     * workload, as ListRecordings takes it, that workload's kind ("job",
+     * "sandbox" or "service") and its environment, as Recording names them.
+     * Empty until spent.
+     *
+     * @generated from field: string workload_id = 11;
+     */
+    workloadId?: string;
+    /**
+     * @generated from field: string workload_kind = 12;
+     */
+    workloadKind?: string;
+    /**
+     * @generated from field: string environment_id = 13;
+     */
+    environmentId?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.EmbedToken.
+ * Use `create(EmbedTokenSchema)` to create a new message.
+ */
+export declare const EmbedTokenSchema: GenMessage<EmbedToken, {
+    jsonType: EmbedTokenJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.CreateEmbedTokenRequest
+ */
+export type CreateEmbedTokenRequest = Message<"toshi.workspace.v1.CreateEmbedTokenRequest"> & {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * The origins of the pages that may spend it, each a scheme and a host
+     * with an optional port: https, or http for localhost only. At least
+     * one, and more than the server's maximum is INVALID_ARGUMENT.
+     *
+     * @generated from field: repeated string origins = 2;
+     */
+    origins: string[];
+    /**
+     * How long the token stays valid; unset is the server's default, or the
+     * workspace's plan's maximum when that is shorter, and more than the
+     * plan's maximum is RESOURCE_EXHAUSTED with the reason PLAN_LIMIT.
+     *
+     * @generated from field: google.protobuf.Duration expires_in = 3;
+     */
+    expiresIn?: Duration | undefined;
+};
+/**
+ * @generated from message toshi.workspace.v1.CreateEmbedTokenRequest
+ */
+export type CreateEmbedTokenRequestJson = {
+    /**
+     * The project's name.
+     *
+     * @generated from field: string project = 1;
+     */
+    project?: string;
+    /**
+     * The origins of the pages that may spend it, each a scheme and a host
+     * with an optional port: https, or http for localhost only. At least
+     * one, and more than the server's maximum is INVALID_ARGUMENT.
      *
      * @generated from field: repeated string origins = 2;
      */
     origins?: string[];
     /**
-     * How long the token stays valid; unset is the server's default, and
-     * more than its maximum is INVALID_ARGUMENT.
+     * How long the token stays valid; unset is the server's default, or the
+     * workspace's plan's maximum when that is shorter, and more than the
+     * plan's maximum is RESOURCE_EXHAUSTED with the reason PLAN_LIMIT.
      *
      * @generated from field: google.protobuf.Duration expires_in = 3;
      */
@@ -1347,8 +2570,10 @@ export declare const EmbedTokenStateSchema: GenEnum<EmbedTokenState, EmbedTokenS
 /**
  * ProjectService reads a workspace's projects and the repositories they
  * claim, creates a project, creates or deletes an environment of one, moves a
- * repository's claim and sets the branch rules that choose a CI job's
- * environment. A workspace holds projects, and a project holds environments.
+ * repository's claim, sets the branch rules that choose a CI job's
+ * environment, sets the network policies a project's workloads connect out
+ * under and sets how long an environment keeps its jobs and artifacts. A
+ * workspace holds projects, and a project holds environments.
  *
  * The caller's credential names the workspace, as for WorkloadService.
  * Nothing of another workspace is visible.
@@ -1410,6 +2635,24 @@ export declare const ProjectService: GenService<{
         input: typeof CreateProjectRequestSchema;
         output: typeof CreateProjectResponseSchema;
     };
+    /**
+     * UpdateProject sets the fields of project.name's project that
+     * update_mask names. The one field it sets is admission, the project's
+     * admission webhook: its url and secret, both required, or an empty url
+     * to remove it. An unset update_mask names the fields project carries.
+     * An empty one, an unset one with no admission, "*" and a path of
+     * another field are INVALID_ARGUMENT. The secret is sealed under the
+     * workspace's data key and never returned; a deployment with no keyring
+     * refuses it with FAILED_PRECONDITION. A token limited to environments
+     * is PERMISSION_DENIED.
+     *
+     * @generated from rpc toshi.workspace.v1.ProjectService.UpdateProject
+     */
+    updateProject: {
+        methodKind: "unary";
+        input: typeof UpdateProjectRequestSchema;
+        output: typeof UpdateProjectResponseSchema;
+    };
     /**
      * ClaimRepository puts a repository in a project: it claims a repository
      * no project claims, or moves the claim from another project. A CI job
@@ -1446,8 +2689,9 @@ export declare const ProjectService: GenService<{
      * production environment is FAILED_PRECONDITION, and so is an
      * environment that anything live still refers to, with each kind and
      * its count in the message: secret sets, API tokens that are neither
-     * revoked nor expired, unfinished jobs, workloads that are not deleted
-     * and artifacts still being uploaded. Finished jobs and complete
+     * revoked nor expired, unfinished jobs, workloads that are not deleted,
+     * artifacts still being uploaded, the project's branch rules that choose
+     * it and its triggers that are not deleted. Finished jobs and complete
      * artifacts keep the environment as history. A project or environment
      * the workspace does not have is NOT_FOUND. A token limited to a
      * project deletes only in that project, and a token limited to an
@@ -1498,6 +2742,137 @@ export declare const ProjectService: GenService<{
         input: typeof SetBranchRulesRequestSchema;
         output: typeof SetBranchRulesResponseSchema;
     };
+    /**
+     * GetProjectNetwork returns a project's network policy: where its
+     * workloads may connect outbound. A project that never set one allows
+     * every destination. A project the workspace does not have is NOT_FOUND.
+     * A token limited to a project reads only that project's policy, and a
+     * token limited to an environment is PERMISSION_DENIED.
+     *
+     * @generated from rpc toshi.workspace.v1.ProjectService.GetProjectNetwork
+     */
+    getProjectNetwork: {
+        methodKind: "unary";
+        input: typeof GetProjectNetworkRequestSchema;
+        output: typeof GetProjectNetworkResponseSchema;
+    };
+    /**
+     * SetProjectNetwork replaces a project's network policy whole: the
+     * default and the ordered rules. It has at most 100 rules, each an allow
+     * or a deny of an address, a CIDR prefix or a DNS name, with an optional
+     * port or port range and protocol. Any other policy is INVALID_ARGUMENT
+     * and changes nothing. A workload keeps the policy it was admitted with;
+     * the new one applies to workloads admitted after it. A project the
+     * workspace does not have is NOT_FOUND. A token limited to a project
+     * sets only that project's policy, and a token limited to an environment
+     * is PERMISSION_DENIED.
+     *
+     * @generated from rpc toshi.workspace.v1.ProjectService.SetProjectNetwork
+     */
+    setProjectNetwork: {
+        methodKind: "unary";
+        input: typeof SetProjectNetworkRequestSchema;
+        output: typeof SetProjectNetworkResponseSchema;
+    };
+    /**
+     * GetEnvironmentNetwork returns an environment's network policy, which
+     * narrows its project's: a destination is reached only when both allow
+     * it. An environment that never set one allows every destination its
+     * project allows. A project or environment the workspace does not have is
+     * NOT_FOUND. A token limited to an environment reads only that
+     * environment's policy.
+     *
+     * @generated from rpc toshi.workspace.v1.ProjectService.GetEnvironmentNetwork
+     */
+    getEnvironmentNetwork: {
+        methodKind: "unary";
+        input: typeof GetEnvironmentNetworkRequestSchema;
+        output: typeof GetEnvironmentNetworkResponseSchema;
+    };
+    /**
+     * SetEnvironmentNetwork replaces an environment's network policy whole,
+     * checked as SetProjectNetwork checks a project's. It can only narrow
+     * the project's policy: an allow the project denies stays denied. A
+     * workload keeps the policy it was admitted with. A project or
+     * environment the workspace does not have is NOT_FOUND. A token limited
+     * to an environment sets only that environment's policy.
+     *
+     * @generated from rpc toshi.workspace.v1.ProjectService.SetEnvironmentNetwork
+     */
+    setEnvironmentNetwork: {
+        methodKind: "unary";
+        input: typeof SetEnvironmentNetworkRequestSchema;
+        output: typeof SetEnvironmentNetworkResponseSchema;
+    };
+    /**
+     * GetEnvironmentRetention returns an environment's retention override,
+     * as stored, and the retention that applies to it: the override where it
+     * shortens the workspace's, else the workspace's. An environment that
+     * never set one follows its workspace. A project or environment the
+     * workspace does not have is NOT_FOUND. A token limited to an
+     * environment reads only that environment's.
+     *
+     * @generated from rpc toshi.workspace.v1.ProjectService.GetEnvironmentRetention
+     */
+    getEnvironmentRetention: {
+        methodKind: "unary";
+        input: typeof GetEnvironmentRetentionRequestSchema;
+        output: typeof GetEnvironmentRetentionResponseSchema;
+    };
+    /**
+     * SetEnvironmentRetention replaces an environment's retention override
+     * whole; an empty retention clears it. An override may only shorten the
+     * workspace's: history_days above the workspace's period, or a keep
+     * longer than the workspace's keep of that kind, is INVALID_ARGUMENT
+     * naming the field and the limit, and so is a recording-signed-in keep
+     * longer than the recording keep that applies after it. A project or
+     * environment the workspace does not have is NOT_FOUND. A token limited
+     * to an environment sets only that environment's.
+     *
+     * @generated from rpc toshi.workspace.v1.ProjectService.SetEnvironmentRetention
+     */
+    setEnvironmentRetention: {
+        methodKind: "unary";
+        input: typeof SetEnvironmentRetentionRequestSchema;
+        output: typeof SetEnvironmentRetentionResponseSchema;
+    };
+    /**
+     * SetEnvironmentVolumes replaces the list of the project's volumes an
+     * environment's services and sandboxes may attach; an empty list lets
+     * them attach any. An attach of a volume the list leaves out, by
+     * AttachVolume or at sandbox create, is FAILED_PRECONDITION naming the
+     * environment and the volume; a volume attached before stays. A name
+     * that is no volume of the project is INVALID_ARGUMENT naming it. A
+     * project or environment the workspace does not have is NOT_FOUND. A
+     * token limited to an environment sets only that environment's.
+     *
+     * @generated from rpc toshi.workspace.v1.ProjectService.SetEnvironmentVolumes
+     */
+    setEnvironmentVolumes: {
+        methodKind: "unary";
+        input: typeof SetEnvironmentVolumesRequestSchema;
+        output: typeof SetEnvironmentVolumesResponseSchema;
+    };
+    /**
+     * UpdateEnvironment sets the fields update_mask names on an environment:
+     * retention replaces its retention override whole, as
+     * SetEnvironmentRetention does, and volumes replaces the list of the
+     * project's volumes its services and sandboxes may attach, as
+     * SetEnvironmentVolumes does. Each is checked as that call checks it,
+     * and both are written together or not at all. An omitted mask means
+     * the fields the request sets; clearing the override or the list needs
+     * its path in the mask. "*" and a path of any other field are
+     * INVALID_ARGUMENT. A project or environment the workspace does not have
+     * is NOT_FOUND. A token limited to an environment updates only that
+     * environment.
+     *
+     * @generated from rpc toshi.workspace.v1.ProjectService.UpdateEnvironment
+     */
+    updateEnvironment: {
+        methodKind: "unary";
+        input: typeof UpdateEnvironmentRequestSchema;
+        output: typeof UpdateEnvironmentResponseSchema;
+    };
     /**
      * CreateEmbedToken mints an embed token for a project: a credential for
      * a web page on one of the token's origins, which spends it once to