@toshicloud/sdk 0.5.1 → 0.7.0

package/dist/gen/toshi/workspace/v1/workspace_pb.d.ts

@@ -575,7 +575,7 @@ export type Sandbox = Message<"toshi.workspace.v1.Sandbox"> & {
     shared?: SharedAccess | undefined;
     /**
      * The job of the sandbox's current run: the one created with it, then
-     * the one each StartSandbox creates. The channel and display calls take
+     * the one each StartSandbox creates. The endpoint and display calls take
      * it as job_id, and through a grant as well. Set by Toshi.
      *
      * @generated from field: string job_id = 12;
@@ -678,7 +678,7 @@ export type SandboxJson = {
     shared?: SharedAccessJson;
     /**
      * The job of the sandbox's current run: the one created with it, then
-     * the one each StartSandbox creates. The channel and display calls take
+     * the one each StartSandbox creates. The endpoint and display calls take
      * it as job_id, and through a grant as well. Set by Toshi.
      *
      * @generated from field: string job_id = 12;
@@ -761,10 +761,10 @@ export type SandboxStatus = Message<"toshi.workspace.v1.SandboxStatus"> & {
      */
     stopReason: StopReason;
     /**
-     * While it runs, its previews: one for each of its http channels served
-     * at a hostname of its own, the channel `preview` among them. Empty
-     * while the control plane serves no previews. Making or deleting such a
-     * channel changes the sandbox, so WatchSandboxes sends it again.
+     * While it runs, its previews: one for each of its http endpoints served
+     * at a hostname of its own, the endpoint `preview` among them. Empty
+     * while the control plane serves no previews. Making or deleting such an
+     * endpoint changes the sandbox, so WatchSandboxes sends it again.
      *
      * @generated from field: repeated toshi.workspace.v1.SandboxPreview previews = 10;
      */
@@ -790,6 +790,34 @@ export type SandboxStatus = Message<"toshi.workspace.v1.SandboxStatus"> & {
      * @generated from field: google.protobuf.Timestamp stopped_at = 13;
      */
     stoppedAt?: Timestamp | undefined;
+    /**
+     * The cause of a policy stop; unspecified for another stop.
+     *
+     * @generated from field: toshi.workspace.v1.StopCause stop_cause = 14;
+     */
+    stopCause: StopCause;
+    /**
+     * While held, its owner cannot start, wake or delete it and its public
+     * names answer a page naming the hold; only an operator releases it.
+     *
+     * @generated from field: toshi.workspace.v1.OperatorHold operator_hold = 15;
+     */
+    operatorHold: OperatorHold;
+    /**
+     * When the current operator hold was placed; unset when not held.
+     *
+     * @generated from field: google.protobuf.Timestamp held_at = 16;
+     */
+    heldAt?: Timestamp | undefined;
+    /**
+     * Where its owner writes about the hold, as the deployment's operator set
+     * it: an email address or a URL. Set only while the workload is held and
+     * the operator set one; empty otherwise. Set by Toshi; ignored in a
+     * request.
+     *
+     * @generated from field: string hold_contact = 17;
+     */
+    holdContact: string;
 };
 /**
  * SandboxStatus is a sandbox's state and when it got there.
@@ -844,10 +872,10 @@ export type SandboxStatusJson = {
      */
     stopReason?: StopReasonJson;
     /**
-     * While it runs, its previews: one for each of its http channels served
-     * at a hostname of its own, the channel `preview` among them. Empty
-     * while the control plane serves no previews. Making or deleting such a
-     * channel changes the sandbox, so WatchSandboxes sends it again.
+     * While it runs, its previews: one for each of its http endpoints served
+     * at a hostname of its own, the endpoint `preview` among them. Empty
+     * while the control plane serves no previews. Making or deleting such an
+     * endpoint changes the sandbox, so WatchSandboxes sends it again.
      *
      * @generated from field: repeated toshi.workspace.v1.SandboxPreview previews = 10;
      */
@@ -873,6 +901,34 @@ export type SandboxStatusJson = {
      * @generated from field: google.protobuf.Timestamp stopped_at = 13;
      */
     stoppedAt?: TimestampJson;
+    /**
+     * The cause of a policy stop; unspecified for another stop.
+     *
+     * @generated from field: toshi.workspace.v1.StopCause stop_cause = 14;
+     */
+    stopCause?: StopCauseJson;
+    /**
+     * While held, its owner cannot start, wake or delete it and its public
+     * names answer a page naming the hold; only an operator releases it.
+     *
+     * @generated from field: toshi.workspace.v1.OperatorHold operator_hold = 15;
+     */
+    operatorHold?: OperatorHoldJson;
+    /**
+     * When the current operator hold was placed; unset when not held.
+     *
+     * @generated from field: google.protobuf.Timestamp held_at = 16;
+     */
+    heldAt?: TimestampJson;
+    /**
+     * Where its owner writes about the hold, as the deployment's operator set
+     * it: an email address or a URL. Set only while the workload is held and
+     * the operator set one; empty otherwise. Set by Toshi; ignored in a
+     * request.
+     *
+     * @generated from field: string hold_contact = 17;
+     */
+    holdContact?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.SandboxStatus.
@@ -1297,9 +1353,9 @@ export type ServiceStatus = Message<"toshi.workspace.v1.ServiceStatus"> & {
      */
     liveRun?: ServiceRun | undefined;
     /**
-     * The names visitors reach the service's http channels at, one per
-     * channel of its current revision's recipe that has one: the front
-     * channel first, at "<service>.<workspace>.svc.<domain>", then every
+     * The names visitors reach the service's http endpoints at, one per
+     * endpoint of its current revision's recipe that has one: the front
+     * endpoint first, at "<service>.<workspace>.svc.<domain>", then every
      * other in recipe order at "<port>-<service>.<workspace>.svc.<domain>".
      * Empty while the
      * deployment hosts no names. Set by Toshi on GetService; ignored in a
@@ -1309,7 +1365,7 @@ export type ServiceStatus = Message<"toshi.workspace.v1.ServiceStatus"> & {
      */
     providedNames: ProvidedName[];
     /**
-     * Why a service with an http channel has no provided names, such as a
+     * Why a service with an http endpoint has no provided names, such as a
      * name that does not start with a letter; empty otherwise. Set by Toshi
      * on GetService.
      *
@@ -1324,6 +1380,40 @@ export type ServiceStatus = Message<"toshi.workspace.v1.ServiceStatus"> & {
      * @generated from field: toshi.workspace.v1.ServiceBackup backup = 12;
      */
     backup?: ServiceBackup | undefined;
+    /**
+     * Why it was stopped.
+     *
+     * @generated from field: toshi.workspace.v1.StopReason stop_reason = 13;
+     */
+    stopReason: StopReason;
+    /**
+     * The cause of a policy stop; unspecified for another stop.
+     *
+     * @generated from field: toshi.workspace.v1.StopCause stop_cause = 14;
+     */
+    stopCause: StopCause;
+    /**
+     * While held, its owner cannot start, wake or delete it and its public
+     * names answer a page naming the hold; only an operator releases it.
+     *
+     * @generated from field: toshi.workspace.v1.OperatorHold operator_hold = 15;
+     */
+    operatorHold: OperatorHold;
+    /**
+     * When the current operator hold was placed; unset when not held.
+     *
+     * @generated from field: google.protobuf.Timestamp held_at = 16;
+     */
+    heldAt?: Timestamp | undefined;
+    /**
+     * Where its owner writes about the hold, as the deployment's operator set
+     * it: an email address or a URL. Set only while the workload is held and
+     * the operator set one; empty otherwise. Set by Toshi; ignored in a
+     * request.
+     *
+     * @generated from field: string hold_contact = 17;
+     */
+    holdContact: string;
 };
 /**
  * ServiceStatus is a service's state and when it got there.
@@ -1378,9 +1468,9 @@ export type ServiceStatusJson = {
      */
     liveRun?: ServiceRunJson;
     /**
-     * The names visitors reach the service's http channels at, one per
-     * channel of its current revision's recipe that has one: the front
-     * channel first, at "<service>.<workspace>.svc.<domain>", then every
+     * The names visitors reach the service's http endpoints at, one per
+     * endpoint of its current revision's recipe that has one: the front
+     * endpoint first, at "<service>.<workspace>.svc.<domain>", then every
      * other in recipe order at "<port>-<service>.<workspace>.svc.<domain>".
      * Empty while the
      * deployment hosts no names. Set by Toshi on GetService; ignored in a
@@ -1390,7 +1480,7 @@ export type ServiceStatusJson = {
      */
     providedNames?: ProvidedNameJson[];
     /**
-     * Why a service with an http channel has no provided names, such as a
+     * Why a service with an http endpoint has no provided names, such as a
      * name that does not start with a letter; empty otherwise. Set by Toshi
      * on GetService.
      *
@@ -1405,6 +1495,40 @@ export type ServiceStatusJson = {
      * @generated from field: toshi.workspace.v1.ServiceBackup backup = 12;
      */
     backup?: ServiceBackupJson;
+    /**
+     * Why it was stopped.
+     *
+     * @generated from field: toshi.workspace.v1.StopReason stop_reason = 13;
+     */
+    stopReason?: StopReasonJson;
+    /**
+     * The cause of a policy stop; unspecified for another stop.
+     *
+     * @generated from field: toshi.workspace.v1.StopCause stop_cause = 14;
+     */
+    stopCause?: StopCauseJson;
+    /**
+     * While held, its owner cannot start, wake or delete it and its public
+     * names answer a page naming the hold; only an operator releases it.
+     *
+     * @generated from field: toshi.workspace.v1.OperatorHold operator_hold = 15;
+     */
+    operatorHold?: OperatorHoldJson;
+    /**
+     * When the current operator hold was placed; unset when not held.
+     *
+     * @generated from field: google.protobuf.Timestamp held_at = 16;
+     */
+    heldAt?: TimestampJson;
+    /**
+     * Where its owner writes about the hold, as the deployment's operator set
+     * it: an email address or a URL. Set only while the workload is held and
+     * the operator set one; empty otherwise. Set by Toshi; ignored in a
+     * request.
+     *
+     * @generated from field: string hold_contact = 17;
+     */
+    holdContact?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.ServiceStatus.
@@ -1501,17 +1625,17 @@ export declare const ServiceBackupSchema: GenMessage<ServiceBackup, {
     jsonType: ServiceBackupJson;
 }>;
 /**
- * ProvidedName is the name one http channel of a service is reached at.
+ * ProvidedName is the name one http endpoint of a service is reached at.
  *
  * @generated from message toshi.workspace.v1.ProvidedName
  */
 export type ProvidedName = Message<"toshi.workspace.v1.ProvidedName"> & {
     /**
-     * The channel's name in the service's recipe.
+     * The endpoint's name in the service's recipe.
      *
-     * @generated from field: string channel = 1;
+     * @generated from field: string endpoint = 1;
      */
-    channel: string;
+    endpoint: string;
     /**
      * The full name, without a scheme or a port.
      *
@@ -1520,17 +1644,17 @@ export type ProvidedName = Message<"toshi.workspace.v1.ProvidedName"> & {
     host: string;
 };
 /**
- * ProvidedName is the name one http channel of a service is reached at.
+ * ProvidedName is the name one http endpoint of a service is reached at.
  *
  * @generated from message toshi.workspace.v1.ProvidedName
  */
 export type ProvidedNameJson = {
     /**
-     * The channel's name in the service's recipe.
+     * The endpoint's name in the service's recipe.
      *
-     * @generated from field: string channel = 1;
+     * @generated from field: string endpoint = 1;
      */
-    channel?: string;
+    endpoint?: string;
     /**
      * The full name, without a scheme or a port.
      *
@@ -1752,11 +1876,11 @@ export type Binding = Message<"toshi.workspace.v1.Binding"> & {
      */
     target: {
         /**
-         * A channel of a service of the workload's project and environment.
+         * An endpoint of a service of the workload's project and environment.
          *
-         * @generated from field: toshi.workspace.v1.ServiceChannel service = 2;
+         * @generated from field: toshi.workspace.v1.ServiceEndpoint service = 2;
          */
-        value: ServiceChannel;
+        value: ServiceEndpoint;
         case: "service";
     } | {
         /**
@@ -1794,11 +1918,11 @@ export type BindingJson = {
      */
     name?: string;
     /**
-     * A channel of a service of the workload's project and environment.
+     * An endpoint of a service of the workload's project and environment.
      *
-     * @generated from field: toshi.workspace.v1.ServiceChannel service = 2;
+     * @generated from field: toshi.workspace.v1.ServiceEndpoint service = 2;
      */
-    service?: ServiceChannelJson;
+    service?: ServiceEndpointJson;
     /**
      * The secret set of the workload's environment.
      *
@@ -1821,45 +1945,45 @@ export declare const BindingSchema: GenMessage<Binding, {
     jsonType: BindingJson;
 }>;
 /**
- * ServiceChannel is a channel of a service, by the service's name and the
- * channel's name in its recipe, as a recipe's uses names it:
- * "<service>.<channel>".
+ * ServiceEndpoint is an endpoint of a service, by the service's name and the
+ * endpoint's name in its recipe, as a recipe's uses names it:
+ * "<service>.<endpoint>".
  *
- * @generated from message toshi.workspace.v1.ServiceChannel
+ * @generated from message toshi.workspace.v1.ServiceEndpoint
  */
-export type ServiceChannel = Message<"toshi.workspace.v1.ServiceChannel"> & {
+export type ServiceEndpoint = Message<"toshi.workspace.v1.ServiceEndpoint"> & {
     /**
      * @generated from field: string service = 1;
      */
     service: string;
     /**
-     * @generated from field: string channel = 2;
+     * @generated from field: string endpoint = 2;
      */
-    channel: string;
+    endpoint: string;
 };
 /**
- * ServiceChannel is a channel of a service, by the service's name and the
- * channel's name in its recipe, as a recipe's uses names it:
- * "<service>.<channel>".
+ * ServiceEndpoint is an endpoint of a service, by the service's name and the
+ * endpoint's name in its recipe, as a recipe's uses names it:
+ * "<service>.<endpoint>".
  *
- * @generated from message toshi.workspace.v1.ServiceChannel
+ * @generated from message toshi.workspace.v1.ServiceEndpoint
  */
-export type ServiceChannelJson = {
+export type ServiceEndpointJson = {
     /**
      * @generated from field: string service = 1;
      */
     service?: string;
     /**
-     * @generated from field: string channel = 2;
+     * @generated from field: string endpoint = 2;
      */
-    channel?: string;
+    endpoint?: string;
 };
 /**
- * Describes the message toshi.workspace.v1.ServiceChannel.
- * Use `create(ServiceChannelSchema)` to create a new message.
+ * Describes the message toshi.workspace.v1.ServiceEndpoint.
+ * Use `create(ServiceEndpointSchema)` to create a new message.
  */
-export declare const ServiceChannelSchema: GenMessage<ServiceChannel, {
-    jsonType: ServiceChannelJson;
+export declare const ServiceEndpointSchema: GenMessage<ServiceEndpoint, {
+    jsonType: ServiceEndpointJson;
 }>;
 /**
  * EnvironmentSecrets binds the secret set of the workload's environment,
@@ -1984,7 +2108,7 @@ export declare const BoundBindingSchema: GenMessage<BoundBinding, {
     jsonType: BoundBindingJson;
 }>;
 /**
- * BoundService is a service channel as it was when the workload started.
+ * BoundService is a service endpoint as it was when the workload started.
  *
  * @generated from message toshi.workspace.v1.BoundService
  */
@@ -2006,11 +2130,11 @@ export type BoundService = Message<"toshi.workspace.v1.BoundService"> & {
      */
     revision: bigint;
     /**
-     * @generated from field: string channel = 4;
+     * @generated from field: string endpoint = 4;
      */
-    channel: string;
+    endpoint: string;
     /**
-     * The channel's shape and, for an http channel, its guest port.
+     * The endpoint's shape and, for an http endpoint, its guest port.
      *
      * @generated from field: string shape = 5;
      */
@@ -2020,7 +2144,7 @@ export type BoundService = Message<"toshi.workspace.v1.BoundService"> & {
      */
     port: number;
     /**
-     * What the channel accepts from the caller: "workload_identity", a
+     * What the endpoint accepts from the caller: "workload_identity", a
      * connect credential signed by the workload identity issuer
      * naming audience and this binding. Minted when the job's command
      * starts, and passed only to that command.
@@ -2041,7 +2165,7 @@ export type BoundService = Message<"toshi.workspace.v1.BoundService"> & {
     credentialId: string;
 };
 /**
- * BoundService is a service channel as it was when the workload started.
+ * BoundService is a service endpoint as it was when the workload started.
  *
  * @generated from message toshi.workspace.v1.BoundService
  */
@@ -2063,11 +2187,11 @@ export type BoundServiceJson = {
      */
     revision?: string;
     /**
-     * @generated from field: string channel = 4;
+     * @generated from field: string endpoint = 4;
      */
-    channel?: string;
+    endpoint?: string;
     /**
-     * The channel's shape and, for an http channel, its guest port.
+     * The endpoint's shape and, for an http endpoint, its guest port.
      *
      * @generated from field: string shape = 5;
      */
@@ -2077,7 +2201,7 @@ export type BoundServiceJson = {
      */
     port?: number;
     /**
-     * What the channel accepts from the caller: "workload_identity", a
+     * What the endpoint accepts from the caller: "workload_identity", a
      * connect credential signed by the workload identity issuer
      * naming audience and this binding. Minted when the job's command
      * starts, and passed only to that command.
@@ -2303,11 +2427,11 @@ export type SandboxSpec = Message<"toshi.workspace.v1.SandboxSpec"> & {
     maxDuration?: Duration | undefined;
     /**
      * What in its workspace the sandbox uses: the secret set of its
-     * environment and the channels of its project's and environment's
+     * environment and the endpoints of its project's and environment's
      * services. Checked at create and fixed when the sandbox starts; each
      * Execute gets the secret set's fixed values in its command's
-     * environment, and reaches a bound http channel by the service's name,
-     * <service>.toshi, at the channel's port.
+     * environment, and reaches a bound http endpoint by the service's name,
+     * <service>.toshi, at the endpoint's port.
      *
      * @generated from field: repeated toshi.workspace.v1.Binding bindings = 3;
      */
@@ -2415,6 +2539,23 @@ export type SandboxSpec = Message<"toshi.workspace.v1.SandboxSpec"> & {
      * @generated from field: bool keep_vm = 14;
      */
     keepVm: boolean;
+    /**
+     * Create only: a command the sandbox's host runs in it at every stop
+     * but the loss of its host: StopSandbox, the duration cap, the spending
+     * cap, a policy stop, an operator's hold, the workspace's suspension and
+     * deletion. New executions are refused first; pre_stop runs while the
+     * running ones go on, and they are cancelled once it ends. It has two
+     * minutes at StopSandbox and the duration cap, and 15 seconds at the
+     * others; past that it is killed. It never keeps the sandbox from
+     * stopping: an exit other than 0, or the end of its time, is written on
+     * the stop's event as last_error.code "pre_stop_failed" and the stop
+     * goes on. It runs where and with the environment setup does. The
+     * sandbox is placed only on a host that runs workload hooks. Unset:
+     * none.
+     *
+     * @generated from field: toshi.workspace.v1.Command pre_stop = 15;
+     */
+    preStop?: Command | undefined;
 };
 /**
  * SandboxSpec is a sandbox: a VM that runs until its owner
@@ -2441,11 +2582,11 @@ export type SandboxSpecJson = {
     maxDuration?: DurationJson;
     /**
      * What in its workspace the sandbox uses: the secret set of its
-     * environment and the channels of its project's and environment's
+     * environment and the endpoints of its project's and environment's
      * services. Checked at create and fixed when the sandbox starts; each
      * Execute gets the secret set's fixed values in its command's
-     * environment, and reaches a bound http channel by the service's name,
-     * <service>.toshi, at the channel's port.
+     * environment, and reaches a bound http endpoint by the service's name,
+     * <service>.toshi, at the endpoint's port.
      *
      * @generated from field: repeated toshi.workspace.v1.Binding bindings = 3;
      */
@@ -2553,6 +2694,23 @@ export type SandboxSpecJson = {
      * @generated from field: bool keep_vm = 14;
      */
     keepVm?: boolean;
+    /**
+     * Create only: a command the sandbox's host runs in it at every stop
+     * but the loss of its host: StopSandbox, the duration cap, the spending
+     * cap, a policy stop, an operator's hold, the workspace's suspension and
+     * deletion. New executions are refused first; pre_stop runs while the
+     * running ones go on, and they are cancelled once it ends. It has two
+     * minutes at StopSandbox and the duration cap, and 15 seconds at the
+     * others; past that it is killed. It never keeps the sandbox from
+     * stopping: an exit other than 0, or the end of its time, is written on
+     * the stop's event as last_error.code "pre_stop_failed" and the stop
+     * goes on. It runs where and with the environment setup does. The
+     * sandbox is placed only on a host that runs workload hooks. Unset:
+     * none.
+     *
+     * @generated from field: toshi.workspace.v1.Command pre_stop = 15;
+     */
+    preStop?: CommandJson;
 };
 /**
  * Describes the message toshi.workspace.v1.SandboxSpec.
@@ -2697,7 +2855,7 @@ export type ServiceSpec = Message<"toshi.workspace.v1.ServiceSpec"> & {
     stateVolume?: StateVolumeSpec | undefined;
     /**
      * Create only: the service's bindings, a secret set or its project's
-     * and environment's services' channels. Answers leave them empty.
+     * and environment's services' endpoints. Answers leave them empty.
      *
      * @generated from field: repeated toshi.workspace.v1.Binding bindings = 8;
      */
@@ -2821,7 +2979,7 @@ export type ServiceSpecJson = {
     stateVolume?: StateVolumeSpecJson;
     /**
      * Create only: the service's bindings, a secret set or its project's
-     * and environment's services' channels. Answers leave them empty.
+     * and environment's services' endpoints. Answers leave them empty.
      *
      * @generated from field: repeated toshi.workspace.v1.Binding bindings = 8;
      */
@@ -2986,20 +3144,20 @@ export declare const CommandSchema: GenMessage<Command, {
     jsonType: CommandJson;
 }>;
 /**
- * SandboxPreview is where a browser opens one http channel of a sandbox.
+ * SandboxPreview is where a browser opens one http endpoint of a sandbox.
  *
  * @generated from message toshi.workspace.v1.SandboxPreview
  */
 export type SandboxPreview = Message<"toshi.workspace.v1.SandboxPreview"> & {
     /**
-     * The channel's name; `preview` for the port the sandbox's image
+     * The endpoint's name; `preview` for the port the sandbox's image
      * declares.
      *
-     * @generated from field: string channel = 1;
+     * @generated from field: string endpoint = 1;
      */
-    channel: string;
+    endpoint: string;
     /**
-     * The guest port the channel reaches.
+     * The guest port the endpoint reaches.
      *
      * @generated from field: int32 port = 2;
      */
@@ -3012,20 +3170,20 @@ export type SandboxPreview = Message<"toshi.workspace.v1.SandboxPreview"> & {
     url: string;
 };
 /**
- * SandboxPreview is where a browser opens one http channel of a sandbox.
+ * SandboxPreview is where a browser opens one http endpoint of a sandbox.
  *
  * @generated from message toshi.workspace.v1.SandboxPreview
  */
 export type SandboxPreviewJson = {
     /**
-     * The channel's name; `preview` for the port the sandbox's image
+     * The endpoint's name; `preview` for the port the sandbox's image
      * declares.
      *
-     * @generated from field: string channel = 1;
+     * @generated from field: string endpoint = 1;
      */
-    channel?: string;
+    endpoint?: string;
     /**
-     * The guest port the channel reaches.
+     * The guest port the endpoint reaches.
      *
      * @generated from field: int32 port = 2;
      */
@@ -4851,6 +5009,46 @@ export type Event = Message<"toshi.workspace.v1.Event"> & {
          */
         value: KeptVMDiscardedEvent;
         case: "keptVmDiscarded";
+    } | {
+        /**
+         * For ENDPOINT_ACP_PERMISSION_REQUESTED and ENDPOINT_ACP_TURN_ENDED.
+         *
+         * @generated from field: toshi.workspace.v1.EndpointACPEvent endpoint_acp = 25;
+         */
+        value: EndpointACPEvent;
+        case: "endpointAcp";
+    } | {
+        /**
+         * For SERVICE_RESTORED.
+         *
+         * @generated from field: toshi.workspace.v1.ServiceRestoredEvent service_restored = 26;
+         */
+        value: ServiceRestoredEvent;
+        case: "serviceRestored";
+    } | {
+        /**
+         * For SERVICE_SNAPSHOT_FAILED.
+         *
+         * @generated from field: toshi.workspace.v1.ServiceSnapshotFailedEvent service_snapshot_failed = 27;
+         */
+        value: ServiceSnapshotFailedEvent;
+        case: "serviceSnapshotFailed";
+    } | {
+        /**
+         * For SERVICE_SIGNIN and SERVICE_SIGNOUT.
+         *
+         * @generated from field: toshi.workspace.v1.ServiceSignInEvent service_sign_in = 28;
+         */
+        value: ServiceSignInEvent;
+        case: "serviceSignIn";
+    } | {
+        /**
+         * For MAIL_BOUNCED and MAIL_COMPLAINED.
+         *
+         * @generated from field: toshi.workspace.v1.MailNoticeEvent mail_notice = 29;
+         */
+        value: MailNoticeEvent;
+        case: "mailNotice";
     } | {
         case: undefined;
         value?: undefined;
@@ -5001,6 +5199,36 @@ export type EventJson = {
      * @generated from field: toshi.workspace.v1.KeptVMDiscardedEvent kept_vm_discarded = 24;
      */
     keptVmDiscarded?: KeptVMDiscardedEventJson;
+    /**
+     * For ENDPOINT_ACP_PERMISSION_REQUESTED and ENDPOINT_ACP_TURN_ENDED.
+     *
+     * @generated from field: toshi.workspace.v1.EndpointACPEvent endpoint_acp = 25;
+     */
+    endpointAcp?: EndpointACPEventJson;
+    /**
+     * For SERVICE_RESTORED.
+     *
+     * @generated from field: toshi.workspace.v1.ServiceRestoredEvent service_restored = 26;
+     */
+    serviceRestored?: ServiceRestoredEventJson;
+    /**
+     * For SERVICE_SNAPSHOT_FAILED.
+     *
+     * @generated from field: toshi.workspace.v1.ServiceSnapshotFailedEvent service_snapshot_failed = 27;
+     */
+    serviceSnapshotFailed?: ServiceSnapshotFailedEventJson;
+    /**
+     * For SERVICE_SIGNIN and SERVICE_SIGNOUT.
+     *
+     * @generated from field: toshi.workspace.v1.ServiceSignInEvent service_sign_in = 28;
+     */
+    serviceSignIn?: ServiceSignInEventJson;
+    /**
+     * For MAIL_BOUNCED and MAIL_COMPLAINED.
+     *
+     * @generated from field: toshi.workspace.v1.MailNoticeEvent mail_notice = 29;
+     */
+    mailNotice?: MailNoticeEventJson;
     /**
      * The project the workload or the connection's event belongs to; set on
      * every event.
@@ -5029,6 +5257,79 @@ export type EventJson = {
 export declare const EventSchema: GenMessage<Event, {
     jsonType: EventJson;
 }>;
+/**
+ * MailNoticeEvent is what the mail provider reported about one recipient of
+ * a message the workload sent. It never holds the message.
+ *
+ * @generated from message toshi.workspace.v1.MailNoticeEvent
+ */
+export type MailNoticeEvent = Message<"toshi.workspace.v1.MailNoticeEvent"> & {
+    /**
+     * The message's Message-ID header, without its angle brackets.
+     *
+     * @generated from field: string message_id = 1;
+     */
+    messageId: string;
+    /**
+     * The id the mail provider gave the message.
+     *
+     * @generated from field: string provider_message_id = 2;
+     */
+    providerMessageId: string;
+    /**
+     * The recipient the notice is about.
+     *
+     * @generated from field: string recipient = 3;
+     */
+    recipient: string;
+    /**
+     * The provider's own kind of bounce or complaint, as it reported it,
+     * such as "Permanent/General"; empty when it gave none.
+     *
+     * @generated from field: string detail = 4;
+     */
+    detail: string;
+};
+/**
+ * MailNoticeEvent is what the mail provider reported about one recipient of
+ * a message the workload sent. It never holds the message.
+ *
+ * @generated from message toshi.workspace.v1.MailNoticeEvent
+ */
+export type MailNoticeEventJson = {
+    /**
+     * The message's Message-ID header, without its angle brackets.
+     *
+     * @generated from field: string message_id = 1;
+     */
+    messageId?: string;
+    /**
+     * The id the mail provider gave the message.
+     *
+     * @generated from field: string provider_message_id = 2;
+     */
+    providerMessageId?: string;
+    /**
+     * The recipient the notice is about.
+     *
+     * @generated from field: string recipient = 3;
+     */
+    recipient?: string;
+    /**
+     * The provider's own kind of bounce or complaint, as it reported it,
+     * such as "Permanent/General"; empty when it gave none.
+     *
+     * @generated from field: string detail = 4;
+     */
+    detail?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.MailNoticeEvent.
+ * Use `create(MailNoticeEventSchema)` to create a new message.
+ */
+export declare const MailNoticeEventSchema: GenMessage<MailNoticeEvent, {
+    jsonType: MailNoticeEventJson;
+}>;
 /**
  * KeptVMDiscardedEvent records a kept VM discarded before a fresh run.
  *
@@ -5074,6 +5375,199 @@ export type KeptVMDiscardedEventJson = {
 export declare const KeptVMDiscardedEventSchema: GenMessage<KeptVMDiscardedEvent, {
     jsonType: KeptVMDiscardedEventJson;
 }>;
+/**
+ * ServiceRestoredEvent records a service run restored from a snapshot.
+ *
+ * @generated from message toshi.workspace.v1.ServiceRestoredEvent
+ */
+export type ServiceRestoredEvent = Message<"toshi.workspace.v1.ServiceRestoredEvent"> & {
+    /**
+     * The job ID of the restored run.
+     *
+     * @generated from field: string run_id = 1;
+     */
+    runId: string;
+    /**
+     * The snapshot it was restored from.
+     *
+     * @generated from field: string snapshot_id = 2;
+     */
+    snapshotId: string;
+    /**
+     * When the snapshot was taken: the run before it went to sleep then.
+     *
+     * @generated from field: google.protobuf.Timestamp snapshot_taken_at = 3;
+     */
+    snapshotTakenAt?: Timestamp | undefined;
+    /**
+     * When the run was restored.
+     *
+     * @generated from field: google.protobuf.Timestamp restored_at = 4;
+     */
+    restoredAt?: Timestamp | undefined;
+    /**
+     * The time between the two: how long the service's process was
+     * stopped.
+     *
+     * @generated from field: google.protobuf.Duration lost = 5;
+     */
+    lost?: Duration | undefined;
+};
+/**
+ * ServiceRestoredEvent records a service run restored from a snapshot.
+ *
+ * @generated from message toshi.workspace.v1.ServiceRestoredEvent
+ */
+export type ServiceRestoredEventJson = {
+    /**
+     * The job ID of the restored run.
+     *
+     * @generated from field: string run_id = 1;
+     */
+    runId?: string;
+    /**
+     * The snapshot it was restored from.
+     *
+     * @generated from field: string snapshot_id = 2;
+     */
+    snapshotId?: string;
+    /**
+     * When the snapshot was taken: the run before it went to sleep then.
+     *
+     * @generated from field: google.protobuf.Timestamp snapshot_taken_at = 3;
+     */
+    snapshotTakenAt?: TimestampJson;
+    /**
+     * When the run was restored.
+     *
+     * @generated from field: google.protobuf.Timestamp restored_at = 4;
+     */
+    restoredAt?: TimestampJson;
+    /**
+     * The time between the two: how long the service's process was
+     * stopped.
+     *
+     * @generated from field: google.protobuf.Duration lost = 5;
+     */
+    lost?: DurationJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.ServiceRestoredEvent.
+ * Use `create(ServiceRestoredEventSchema)` to create a new message.
+ */
+export declare const ServiceRestoredEventSchema: GenMessage<ServiceRestoredEvent, {
+    jsonType: ServiceRestoredEventJson;
+}>;
+/**
+ * ServiceSnapshotFailedEvent records a snapshot a service run could not
+ * keep at sleep or restore at wake. The service's next wake, or this one,
+ * starts cold.
+ *
+ * @generated from message toshi.workspace.v1.ServiceSnapshotFailedEvent
+ */
+export type ServiceSnapshotFailedEvent = Message<"toshi.workspace.v1.ServiceSnapshotFailedEvent"> & {
+    /**
+     * The job ID of the run.
+     *
+     * @generated from field: string run_id = 1;
+     */
+    runId: string;
+    /**
+     * The snapshot that could not be restored; empty when none was taken.
+     *
+     * @generated from field: string snapshot_id = 2;
+     */
+    snapshotId: string;
+    /**
+     * "snapshot" when the sleep kept none, "restore" when the wake started
+     * cold.
+     *
+     * @generated from field: string step = 3;
+     */
+    step: string;
+    /**
+     * Why.
+     *
+     * @generated from field: string error = 4;
+     */
+    error: string;
+};
+/**
+ * ServiceSnapshotFailedEvent records a snapshot a service run could not
+ * keep at sleep or restore at wake. The service's next wake, or this one,
+ * starts cold.
+ *
+ * @generated from message toshi.workspace.v1.ServiceSnapshotFailedEvent
+ */
+export type ServiceSnapshotFailedEventJson = {
+    /**
+     * The job ID of the run.
+     *
+     * @generated from field: string run_id = 1;
+     */
+    runId?: string;
+    /**
+     * The snapshot that could not be restored; empty when none was taken.
+     *
+     * @generated from field: string snapshot_id = 2;
+     */
+    snapshotId?: string;
+    /**
+     * "snapshot" when the sleep kept none, "restore" when the wake started
+     * cold.
+     *
+     * @generated from field: string step = 3;
+     */
+    step?: string;
+    /**
+     * Why.
+     *
+     * @generated from field: string error = 4;
+     */
+    error?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.ServiceSnapshotFailedEvent.
+ * Use `create(ServiceSnapshotFailedEventSchema)` to create a new message.
+ */
+export declare const ServiceSnapshotFailedEventSchema: GenMessage<ServiceSnapshotFailedEvent, {
+    jsonType: ServiceSnapshotFailedEventJson;
+}>;
+/**
+ * ServiceSignInEvent is a service's sign-in or sign-out. The service is the
+ * event's workload and the time is the event's time.
+ *
+ * @generated from message toshi.workspace.v1.ServiceSignInEvent
+ */
+export type ServiceSignInEvent = Message<"toshi.workspace.v1.ServiceSignInEvent"> & {
+    /**
+     * The sign-in program's name, as the recipe declares it.
+     *
+     * @generated from field: string program = 1;
+     */
+    program: string;
+};
+/**
+ * ServiceSignInEvent is a service's sign-in or sign-out. The service is the
+ * event's workload and the time is the event's time.
+ *
+ * @generated from message toshi.workspace.v1.ServiceSignInEvent
+ */
+export type ServiceSignInEventJson = {
+    /**
+     * The sign-in program's name, as the recipe declares it.
+     *
+     * @generated from field: string program = 1;
+     */
+    program?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.ServiceSignInEvent.
+ * Use `create(ServiceSignInEventSchema)` to create a new message.
+ */
+export declare const ServiceSignInEventSchema: GenMessage<ServiceSignInEvent, {
+    jsonType: ServiceSignInEventJson;
+}>;
 /**
  * UpgradeRolledBackEvent is a service upgrade that failed in its window and
  * was rolled back.
@@ -5420,7 +5914,7 @@ export declare const EgressDenialSchema: GenMessage<EgressDenial, {
 /**
  * TriggerResult is the payload of a trigger's events: the trigger, the key
  * its event named, the workload it made for the key, the event that caused
- * it, the link of the workload's channel once it is ready, why it failed or
+ * it, the link of the workload's endpoint once it is ready, why it failed or
  * was removed, and the commit it was made from.
  *
  * @generated from message toshi.workspace.v1.TriggerResult
@@ -5453,7 +5947,7 @@ export type TriggerResult = Message<"toshi.workspace.v1.TriggerResult"> & {
      */
     eventId: string;
     /**
-     * The link of the workload's channel, once it is ready.
+     * The link of the workload's endpoint, once it is ready.
      *
      * @generated from field: string link = 6;
      */
@@ -5490,7 +5984,7 @@ export type TriggerResult = Message<"toshi.workspace.v1.TriggerResult"> & {
 /**
  * TriggerResult is the payload of a trigger's events: the trigger, the key
  * its event named, the workload it made for the key, the event that caused
- * it, the link of the workload's channel once it is ready, why it failed or
+ * it, the link of the workload's endpoint once it is ready, why it failed or
  * was removed, and the commit it was made from.
  *
  * @generated from message toshi.workspace.v1.TriggerResult
@@ -5523,7 +6017,7 @@ export type TriggerResultJson = {
      */
     eventId?: string;
     /**
-     * The link of the workload's channel, once it is ready.
+     * The link of the workload's endpoint, once it is ready.
      *
      * @generated from field: string link = 6;
      */
@@ -5772,6 +6266,79 @@ export type MailSentEventJson = {
 export declare const MailSentEventSchema: GenMessage<MailSentEvent, {
     jsonType: MailSentEventJson;
 }>;
+/**
+ * EndpointACPEvent is an event of an ACP endpoint: the endpoint, its ACP
+ * session, and the tool call's kind a permission request named or the reason
+ * a turn ended. It carries no title, content or path.
+ *
+ * @generated from message toshi.workspace.v1.EndpointACPEvent
+ */
+export type EndpointACPEvent = Message<"toshi.workspace.v1.EndpointACPEvent"> & {
+    /**
+     * The endpoint's name on its job.
+     *
+     * @generated from field: string endpoint = 1;
+     */
+    endpoint: string;
+    /**
+     * The ACP session the event belongs to.
+     *
+     * @generated from field: string session_id = 2;
+     */
+    sessionId: string;
+    /**
+     * The tool call's kind, on a permission request.
+     *
+     * @generated from field: string tool_kind = 3;
+     */
+    toolKind: string;
+    /**
+     * The prompt response's stopReason, at a turn's end.
+     *
+     * @generated from field: string stop_reason = 4;
+     */
+    stopReason: string;
+};
+/**
+ * EndpointACPEvent is an event of an ACP endpoint: the endpoint, its ACP
+ * session, and the tool call's kind a permission request named or the reason
+ * a turn ended. It carries no title, content or path.
+ *
+ * @generated from message toshi.workspace.v1.EndpointACPEvent
+ */
+export type EndpointACPEventJson = {
+    /**
+     * The endpoint's name on its job.
+     *
+     * @generated from field: string endpoint = 1;
+     */
+    endpoint?: string;
+    /**
+     * The ACP session the event belongs to.
+     *
+     * @generated from field: string session_id = 2;
+     */
+    sessionId?: string;
+    /**
+     * The tool call's kind, on a permission request.
+     *
+     * @generated from field: string tool_kind = 3;
+     */
+    toolKind?: string;
+    /**
+     * The prompt response's stopReason, at a turn's end.
+     *
+     * @generated from field: string stop_reason = 4;
+     */
+    stopReason?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.EndpointACPEvent.
+ * Use `create(EndpointACPEventSchema)` to create a new message.
+ */
+export declare const EndpointACPEventSchema: GenMessage<EndpointACPEvent, {
+    jsonType: EndpointACPEventJson;
+}>;
 /**
  * AgentPrompt is a question or an approval an agent workload asked that
  * nobody has answered yet. AnswerPrompt answers it.
@@ -6370,14 +6937,14 @@ export type PreviewShareLink = Message<"toshi.workspace.v1.PreviewShareLink"> &
      */
     endedAt?: Timestamp | undefined;
     /**
-     * The channel whose preview the link opens: `preview` for the sandbox's
-     * own hostname, or another of its http channels.
+     * The endpoint whose preview the link opens: `preview` for the sandbox's
+     * own hostname, or another of its http endpoints.
      *
-     * @generated from field: string channel = 11;
+     * @generated from field: string endpoint = 11;
      */
-    channel: string;
+    endpoint: string;
     /**
-     * The guest port that channel reaches.
+     * The guest port that endpoint reaches.
      *
      * @generated from field: int32 port = 12;
      */
@@ -6445,14 +7012,14 @@ export type PreviewShareLinkJson = {
      */
     endedAt?: TimestampJson;
     /**
-     * The channel whose preview the link opens: `preview` for the sandbox's
-     * own hostname, or another of its http channels.
+     * The endpoint whose preview the link opens: `preview` for the sandbox's
+     * own hostname, or another of its http endpoints.
      *
-     * @generated from field: string channel = 11;
+     * @generated from field: string endpoint = 11;
      */
-    channel?: string;
+    endpoint?: string;
     /**
-     * The guest port that channel reaches.
+     * The guest port that endpoint reaches.
      *
      * @generated from field: int32 port = 12;
      */
@@ -6498,17 +7065,17 @@ export type CreatePreviewShareLinkRequest = Message<"toshi.workspace.v1.CreatePr
      */
     maxBytes: bigint;
     /**
-     * The preview the link opens: one of the sandbox's http channels, by
-     * its name or by its guest port. Neither set is the channel `preview`.
+     * The preview the link opens: one of the sandbox's http endpoints, by
+     * its name or by its guest port. Neither set is the endpoint `preview`.
      *
-     * @generated from oneof toshi.workspace.v1.CreatePreviewShareLinkRequest.channel_ref
+     * @generated from oneof toshi.workspace.v1.CreatePreviewShareLinkRequest.endpoint_ref
      */
-    channelRef: {
+    endpointRef: {
         /**
-         * @generated from field: string channel = 6;
+         * @generated from field: string endpoint = 6;
          */
         value: string;
-        case: "channel";
+        case: "endpoint";
     } | {
         /**
          * @generated from field: int32 port = 7;
@@ -6553,9 +7120,9 @@ export type CreatePreviewShareLinkRequestJson = {
      */
     maxBytes?: string;
     /**
-     * @generated from field: string channel = 6;
+     * @generated from field: string endpoint = 6;
      */
-    channel?: string;
+    endpoint?: string;
     /**
      * @generated from field: int32 port = 7;
      */
@@ -6804,12 +7371,12 @@ export type ServiceShareLink = Message<"toshi.workspace.v1.ServiceShareLink"> &
      */
     serviceId: string;
     /**
-     * The http channel of the service's recipe whose provided name the link
+     * The http endpoint of the service's recipe whose provided name the link
      * opens.
      *
-     * @generated from field: string channel = 3;
+     * @generated from field: string endpoint = 3;
      */
-    channel: string;
+    endpoint: string;
     /**
      * @generated from field: toshi.workspace.v1.PreviewShareLinkState state = 4;
      */
@@ -6874,12 +7441,12 @@ export type ServiceShareLinkJson = {
      */
     serviceId?: string;
     /**
-     * The http channel of the service's recipe whose provided name the link
+     * The http endpoint of the service's recipe whose provided name the link
      * opens.
      *
-     * @generated from field: string channel = 3;
+     * @generated from field: string endpoint = 3;
      */
-    channel?: string;
+    endpoint?: string;
     /**
      * @generated from field: toshi.workspace.v1.PreviewShareLinkState state = 4;
      */
@@ -6949,12 +7516,12 @@ export type CreateServiceShareLinkRequest = Message<"toshi.workspace.v1.CreateSe
      */
     serviceId: string;
     /**
-     * The http channel whose provided name the link opens; empty is the
-     * service's front channel, the one at the service's own name.
+     * The http endpoint whose provided name the link opens; empty is the
+     * service's front endpoint, the one at the service's own name.
      *
-     * @generated from field: string channel = 4;
+     * @generated from field: string endpoint = 4;
      */
-    channel: string;
+    endpoint: string;
     /**
      * How long the link stays valid, at most the plan's maximum; unset is
      * 24 hours, or the plan's maximum when that is shorter.
@@ -6989,12 +7556,12 @@ export type CreateServiceShareLinkRequestJson = {
      */
     serviceId?: string;
     /**
-     * The http channel whose provided name the link opens; empty is the
-     * service's front channel, the one at the service's own name.
+     * The http endpoint whose provided name the link opens; empty is the
+     * service's front endpoint, the one at the service's own name.
      *
-     * @generated from field: string channel = 4;
+     * @generated from field: string endpoint = 4;
      */
-    channel?: string;
+    endpoint?: string;
     /**
      * How long the link stays valid, at most the plan's maximum; unset is
      * 24 hours, or the plan's maximum when that is shorter.
@@ -7716,6 +8283,134 @@ export type WakeServiceResponseJson = {
 export declare const WakeServiceResponseSchema: GenMessage<WakeServiceResponse, {
     jsonType: WakeServiceResponseJson;
 }>;
+/**
+ * HoldWorkloadRequest names the sandbox or service and its operator hold.
+ *
+ * @generated from message toshi.workspace.v1.HoldWorkloadRequest
+ */
+export type HoldWorkloadRequest = Message<"toshi.workspace.v1.HoldWorkloadRequest"> & {
+    /**
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * @generated from field: string environment = 2;
+     */
+    environment: string;
+    /**
+     * @generated from field: string workload_id = 3;
+     */
+    workloadId: string;
+    /**
+     * @generated from field: toshi.workspace.v1.OperatorHold hold = 4;
+     */
+    hold: OperatorHold;
+};
+/**
+ * HoldWorkloadRequest names the sandbox or service and its operator hold.
+ *
+ * @generated from message toshi.workspace.v1.HoldWorkloadRequest
+ */
+export type HoldWorkloadRequestJson = {
+    /**
+     * @generated from field: string project = 1;
+     */
+    project?: string;
+    /**
+     * @generated from field: string environment = 2;
+     */
+    environment?: string;
+    /**
+     * @generated from field: string workload_id = 3;
+     */
+    workloadId?: string;
+    /**
+     * @generated from field: toshi.workspace.v1.OperatorHold hold = 4;
+     */
+    hold?: OperatorHoldJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.HoldWorkloadRequest.
+ * Use `create(HoldWorkloadRequestSchema)` to create a new message.
+ */
+export declare const HoldWorkloadRequestSchema: GenMessage<HoldWorkloadRequest, {
+    jsonType: HoldWorkloadRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.HoldWorkloadResponse
+ */
+export type HoldWorkloadResponse = Message<"toshi.workspace.v1.HoldWorkloadResponse"> & {};
+/**
+ * @generated from message toshi.workspace.v1.HoldWorkloadResponse
+ */
+export type HoldWorkloadResponseJson = {};
+/**
+ * Describes the message toshi.workspace.v1.HoldWorkloadResponse.
+ * Use `create(HoldWorkloadResponseSchema)` to create a new message.
+ */
+export declare const HoldWorkloadResponseSchema: GenMessage<HoldWorkloadResponse, {
+    jsonType: HoldWorkloadResponseJson;
+}>;
+/**
+ * ReleaseWorkloadRequest names the sandbox or service to release.
+ *
+ * @generated from message toshi.workspace.v1.ReleaseWorkloadRequest
+ */
+export type ReleaseWorkloadRequest = Message<"toshi.workspace.v1.ReleaseWorkloadRequest"> & {
+    /**
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * @generated from field: string environment = 2;
+     */
+    environment: string;
+    /**
+     * @generated from field: string workload_id = 3;
+     */
+    workloadId: string;
+};
+/**
+ * ReleaseWorkloadRequest names the sandbox or service to release.
+ *
+ * @generated from message toshi.workspace.v1.ReleaseWorkloadRequest
+ */
+export type ReleaseWorkloadRequestJson = {
+    /**
+     * @generated from field: string project = 1;
+     */
+    project?: string;
+    /**
+     * @generated from field: string environment = 2;
+     */
+    environment?: string;
+    /**
+     * @generated from field: string workload_id = 3;
+     */
+    workloadId?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.ReleaseWorkloadRequest.
+ * Use `create(ReleaseWorkloadRequestSchema)` to create a new message.
+ */
+export declare const ReleaseWorkloadRequestSchema: GenMessage<ReleaseWorkloadRequest, {
+    jsonType: ReleaseWorkloadRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.ReleaseWorkloadResponse
+ */
+export type ReleaseWorkloadResponse = Message<"toshi.workspace.v1.ReleaseWorkloadResponse"> & {};
+/**
+ * @generated from message toshi.workspace.v1.ReleaseWorkloadResponse
+ */
+export type ReleaseWorkloadResponseJson = {};
+/**
+ * Describes the message toshi.workspace.v1.ReleaseWorkloadResponse.
+ * Use `create(ReleaseWorkloadResponseSchema)` to create a new message.
+ */
+export declare const ReleaseWorkloadResponseSchema: GenMessage<ReleaseWorkloadResponse, {
+    jsonType: ReleaseWorkloadResponseJson;
+}>;
 /**
  * @generated from message toshi.workspace.v1.HoldServiceRequest
  */
@@ -9658,6 +10353,14 @@ export type ServiceRun = Message<"toshi.workspace.v1.ServiceRun"> & {
      * @generated from field: string error = 10;
      */
     error: string;
+    /**
+     * The snapshot the run was restored from: the VM of the run before it,
+     * as it was when that run went to sleep. Empty for a run that started
+     * cold.
+     *
+     * @generated from field: string restored_from = 11;
+     */
+    restoredFrom: string;
 };
 /**
  * ServiceRun is one run of a service: a job on a host.
@@ -9727,6 +10430,14 @@ export type ServiceRunJson = {
      * @generated from field: string error = 10;
      */
     error?: string;
+    /**
+     * The snapshot the run was restored from: the VM of the run before it,
+     * as it was when that run went to sleep. Empty for a run that started
+     * cold.
+     *
+     * @generated from field: string restored_from = 11;
+     */
+    restoredFrom?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.ServiceRun.
@@ -9790,7 +10501,7 @@ export type EndReasonJson = "END_REASON_UNSPECIFIED" | "END_REASON_EXITED" | "EN
  */
 export declare const EndReasonSchema: GenEnum<EndReason, EndReasonJson>;
 /**
- * StopReason is why a sandbox was stopped.
+ * StopReason is why a sandbox or service was stopped.
  *
  * @generated from enum toshi.workspace.v1.StopReason
  */
@@ -9834,18 +10545,114 @@ export declare enum StopReason {
      *
      * @generated from enum value: STOP_REASON_OPERATOR = 6;
      */
-    OPERATOR = 6
+    OPERATOR = 6,
+    /**
+     * Toshi stopped it for a policy; stop_cause says which.
+     *
+     * @generated from enum value: STOP_REASON_POLICY = 7;
+     */
+    POLICY = 7
 }
 /**
- * StopReason is why a sandbox was stopped.
+ * StopReason is why a sandbox or service was stopped.
  *
  * @generated from enum toshi.workspace.v1.StopReason
  */
-export type StopReasonJson = "STOP_REASON_UNSPECIFIED" | "STOP_REASON_OWNER" | "STOP_REASON_MAX_DURATION" | "STOP_REASON_SPEND_CAP" | "STOP_REASON_TENANT_SUSPENDED" | "STOP_REASON_TENANT_DELETED" | "STOP_REASON_OPERATOR";
+export type StopReasonJson = "STOP_REASON_UNSPECIFIED" | "STOP_REASON_OWNER" | "STOP_REASON_MAX_DURATION" | "STOP_REASON_SPEND_CAP" | "STOP_REASON_TENANT_SUSPENDED" | "STOP_REASON_TENANT_DELETED" | "STOP_REASON_OPERATOR" | "STOP_REASON_POLICY";
 /**
  * Describes the enum toshi.workspace.v1.StopReason.
  */
 export declare const StopReasonSchema: GenEnum<StopReason, StopReasonJson>;
+/**
+ * StopCause identifies the policy behind a stop.
+ *
+ * @generated from enum toshi.workspace.v1.StopCause
+ */
+export declare enum StopCause {
+    /**
+     * @generated from enum value: STOP_CAUSE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Executions exceeded their rate.
+     *
+     * @generated from enum value: STOP_CAUSE_EXEC_RATE = 1;
+     */
+    EXEC_RATE = 1,
+    /**
+     * Outbound connections exceeded their rate.
+     *
+     * @generated from enum value: STOP_CAUSE_CONNECTION_RATE = 2;
+     */
+    CONNECTION_RATE = 2,
+    /**
+     * Requests at its public names exceeded their rate.
+     *
+     * @generated from enum value: STOP_CAUSE_REQUEST_RATE = 3;
+     */
+    REQUEST_RATE = 3,
+    /**
+     * Its CPU and traffic looked like mining.
+     *
+     * @generated from enum value: STOP_CAUSE_MINING = 4;
+     */
+    MINING = 4,
+    /**
+     * An operator stopped it.
+     *
+     * @generated from enum value: STOP_CAUSE_OPERATOR = 5;
+     */
+    OPERATOR = 5,
+    /**
+     * a job from a pull request from a fork was handed a runner whose VM could not be narrowed before it started
+     *
+     * @generated from enum value: STOP_CAUSE_RUNNER_SWAP = 6;
+     */
+    RUNNER_SWAP = 6
+}
+/**
+ * StopCause identifies the policy behind a stop.
+ *
+ * @generated from enum toshi.workspace.v1.StopCause
+ */
+export type StopCauseJson = "STOP_CAUSE_UNSPECIFIED" | "STOP_CAUSE_EXEC_RATE" | "STOP_CAUSE_CONNECTION_RATE" | "STOP_CAUSE_REQUEST_RATE" | "STOP_CAUSE_MINING" | "STOP_CAUSE_OPERATOR" | "STOP_CAUSE_RUNNER_SWAP";
+/**
+ * Describes the enum toshi.workspace.v1.StopCause.
+ */
+export declare const StopCauseSchema: GenEnum<StopCause, StopCauseJson>;
+/**
+ * OperatorHold is an operator's hold on a workload.
+ *
+ * @generated from enum toshi.workspace.v1.OperatorHold
+ */
+export declare enum OperatorHold {
+    /**
+     * @generated from enum value: OPERATOR_HOLD_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Abuse is suspected.
+     *
+     * @generated from enum value: OPERATOR_HOLD_ABUSE_SUSPECTED = 1;
+     */
+    ABUSE_SUSPECTED = 1,
+    /**
+     * Abuse is confirmed.
+     *
+     * @generated from enum value: OPERATOR_HOLD_ABUSE_CONFIRMED = 2;
+     */
+    ABUSE_CONFIRMED = 2
+}
+/**
+ * OperatorHold is an operator's hold on a workload.
+ *
+ * @generated from enum toshi.workspace.v1.OperatorHold
+ */
+export type OperatorHoldJson = "OPERATOR_HOLD_UNSPECIFIED" | "OPERATOR_HOLD_ABUSE_SUSPECTED" | "OPERATOR_HOLD_ABUSE_CONFIRMED";
+/**
+ * Describes the enum toshi.workspace.v1.OperatorHold.
+ */
+export declare const OperatorHoldSchema: GenEnum<OperatorHold, OperatorHoldJson>;
 /**
  * JobState is where a job is in its life. A job can skip a state: one
  * cancelled while queued ends without running.
@@ -10184,7 +10991,7 @@ export declare enum ServiceMode {
     ALWAYS_ON = 1,
     /**
      * Runs while it is awake: woken by WakeService, a hold or a connect on
-     * one of its channels, and asleep again after its recipe's idle period
+     * one of its endpoints, and asleep again after its recipe's idle period
      * with no hold.
      *
      * @generated from enum value: SERVICE_MODE_ON_DEMAND = 2;
@@ -10281,7 +11088,7 @@ export declare enum EventType {
      */
     SECRET_WITHHELD = 10,
     /**
-     * A workload a trigger made is ready, with the link of its channel. Name:
+     * A workload a trigger made is ready, with the link of its endpoint. Name:
      * "trigger.ready".
      *
      * @generated from enum value: EVENT_TYPE_TRIGGER_READY = 11;
@@ -10335,7 +11142,68 @@ export declare enum EventType {
      *
      * @generated from enum value: EVENT_TYPE_KEPT_VM_DISCARDED = 18;
      */
-    KEPT_VM_DISCARDED = 18
+    KEPT_VM_DISCARDED = 18,
+    /**
+     * An ACP endpoint's agent asked the client's permission to use a tool.
+     * Name: "endpoint.acp.permission_requested". Payload: EndpointACPEvent.
+     *
+     * @generated from enum value: EVENT_TYPE_ENDPOINT_ACP_PERMISSION_REQUESTED = 19;
+     */
+    ENDPOINT_ACP_PERMISSION_REQUESTED = 19,
+    /**
+     * An ACP endpoint's agent finished a prompt. Name:
+     * "endpoint.acp.turn_ended". Payload: EndpointACPEvent.
+     *
+     * @generated from enum value: EVENT_TYPE_ENDPOINT_ACP_TURN_ENDED = 20;
+     */
+    ENDPOINT_ACP_TURN_ENDED = 20,
+    /**
+     * A service's run was restored from the snapshot its VM left when the
+     * run before it went to sleep, with when the snapshot was taken and how
+     * much time passed since. Name: "service.restored". Payload:
+     * ServiceRestoredEvent.
+     *
+     * @generated from enum value: EVENT_TYPE_SERVICE_RESTORED = 21;
+     */
+    SERVICE_RESTORED = 21,
+    /**
+     * A service's run could not keep a snapshot when it went to sleep, or
+     * its snapshot could not be restored and the run started cold, with
+     * why. Name: "service.snapshot_failed" or "service.restore_failed".
+     * Payload: ServiceSnapshotFailedEvent.
+     *
+     * @generated from enum value: EVENT_TYPE_SERVICE_SNAPSHOT_FAILED = 22;
+     */
+    SERVICE_SNAPSHOT_FAILED = 22,
+    /**
+     * A service's sign-in program signed the service in. Name:
+     * "service.signin". Payload: ServiceSignInEvent.
+     *
+     * @generated from enum value: EVENT_TYPE_SERVICE_SIGNIN = 23;
+     */
+    SERVICE_SIGNIN = 23,
+    /**
+     * A status command found a service's sign-in program signed out after
+     * Toshi recorded its sign-in. Name: "service.signout". Payload:
+     * ServiceSignInEvent.
+     *
+     * @generated from enum value: EVENT_TYPE_SERVICE_SIGNOUT = 24;
+     */
+    SERVICE_SIGNOUT = 24,
+    /**
+     * The mail provider reported that a message the workload sent did not
+     * reach a recipient. Name: "mail.bounced". Payload: MailNoticeEvent.
+     *
+     * @generated from enum value: EVENT_TYPE_MAIL_BOUNCED = 25;
+     */
+    MAIL_BOUNCED = 25,
+    /**
+     * A recipient of a message the workload sent reported it to their mail
+     * provider as unwanted. Name: "mail.complained". Payload: MailNoticeEvent.
+     *
+     * @generated from enum value: EVENT_TYPE_MAIL_COMPLAINED = 26;
+     */
+    MAIL_COMPLAINED = 26
 }
 /**
  * EventType is the closed set of event types. Built-in event names are
@@ -10345,7 +11213,7 @@ export declare enum EventType {
  *
  * @generated from enum toshi.workspace.v1.EventType
  */
-export type EventTypeJson = "EVENT_TYPE_UNSPECIFIED" | "EVENT_TYPE_WORKLOAD_CREATED" | "EVENT_TYPE_WORKLOAD_STATE_CHANGED" | "EVENT_TYPE_WORKLOAD_UPDATED" | "EVENT_TYPE_WORKLOAD_DELETED" | "EVENT_TYPE_EXECUTION_STARTED" | "EVENT_TYPE_EXECUTION_ENDED" | "EVENT_TYPE_EMITTED" | "EVENT_TYPE_RECORDING_READY" | "EVENT_TYPE_CONNECTION" | "EVENT_TYPE_SECRET_WITHHELD" | "EVENT_TYPE_TRIGGER_READY" | "EVENT_TYPE_TRIGGER_FAILED" | "EVENT_TYPE_TRIGGER_REMOVED" | "EVENT_TYPE_UPGRADE_ROLLED_BACK" | "EVENT_TYPE_AGENT_ANSWERED" | "EVENT_TYPE_EGRESS_DENIED" | "EVENT_TYPE_MAIL_SENT" | "EVENT_TYPE_KEPT_VM_DISCARDED";
+export type EventTypeJson = "EVENT_TYPE_UNSPECIFIED" | "EVENT_TYPE_WORKLOAD_CREATED" | "EVENT_TYPE_WORKLOAD_STATE_CHANGED" | "EVENT_TYPE_WORKLOAD_UPDATED" | "EVENT_TYPE_WORKLOAD_DELETED" | "EVENT_TYPE_EXECUTION_STARTED" | "EVENT_TYPE_EXECUTION_ENDED" | "EVENT_TYPE_EMITTED" | "EVENT_TYPE_RECORDING_READY" | "EVENT_TYPE_CONNECTION" | "EVENT_TYPE_SECRET_WITHHELD" | "EVENT_TYPE_TRIGGER_READY" | "EVENT_TYPE_TRIGGER_FAILED" | "EVENT_TYPE_TRIGGER_REMOVED" | "EVENT_TYPE_UPGRADE_ROLLED_BACK" | "EVENT_TYPE_AGENT_ANSWERED" | "EVENT_TYPE_EGRESS_DENIED" | "EVENT_TYPE_MAIL_SENT" | "EVENT_TYPE_KEPT_VM_DISCARDED" | "EVENT_TYPE_ENDPOINT_ACP_PERMISSION_REQUESTED" | "EVENT_TYPE_ENDPOINT_ACP_TURN_ENDED" | "EVENT_TYPE_SERVICE_RESTORED" | "EVENT_TYPE_SERVICE_SNAPSHOT_FAILED" | "EVENT_TYPE_SERVICE_SIGNIN" | "EVENT_TYPE_SERVICE_SIGNOUT" | "EVENT_TYPE_MAIL_BOUNCED" | "EVENT_TYPE_MAIL_COMPLAINED";
 /**
  * Describes the enum toshi.workspace.v1.EventType.
  */
@@ -10377,7 +11245,7 @@ export declare enum PreviewShareLinkState {
      */
     REVOKED = 3,
     /**
-     * Its connections carried its byte cap, or its channel was deleted.
+     * Its connections carried its byte cap, or its endpoint was deleted.
      *
      * @generated from enum value: PREVIEW_SHARE_LINK_STATE_ENDED = 4;
      */