// Code generated by tools/sdkgen. DO NOT EDIT.
//
// Proto-driven ergonomic wrappers for the TARS services that have no
// hand-written wrapper in services.go. Regenerate with: make sdk.wrappers.generate
package agentrouter

import (
	"context"

	"connectrpc.com/connect"

	adminv1 "github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1"
	adminv1connect "github.com/tetrateio/agentrouter-go/genapi/api/tars/admin/v1/adminv1connect"
	api_keysv1 "github.com/tetrateio/agentrouter-go/genapi/api/tars/api_keys/v1"
	api_keysv1connect "github.com/tetrateio/agentrouter-go/genapi/api/tars/api_keys/v1/api_keysv1connect"
	authv1 "github.com/tetrateio/agentrouter-go/genapi/api/tars/auth/v1"
	authv1connect "github.com/tetrateio/agentrouter-go/genapi/api/tars/auth/v1/authv1connect"
	configuratorv1 "github.com/tetrateio/agentrouter-go/genapi/api/tars/configurator/v1"
	configuratorv1connect "github.com/tetrateio/agentrouter-go/genapi/api/tars/configurator/v1/configuratorv1connect"
	insightsv1 "github.com/tetrateio/agentrouter-go/genapi/api/tars/insights/v1"
	insightsv1connect "github.com/tetrateio/agentrouter-go/genapi/api/tars/insights/v1/insightsv1connect"
	secretv1 "github.com/tetrateio/agentrouter-go/genapi/api/tars/secret/v1"
	secretv1connect "github.com/tetrateio/agentrouter-go/genapi/api/tars/secret/v1/secretv1connect"
	tokensv1 "github.com/tetrateio/agentrouter-go/genapi/api/tars/tokens/v1"
	tokensv1connect "github.com/tetrateio/agentrouter-go/genapi/api/tars/tokens/v1/tokensv1connect"
)

// --- AdminService (tars.admin.v1) ---

// AdminClient wraps the AdminService generated Connect client.
type AdminClient struct {
	c adminv1connect.AdminServiceClient
}

// Ping -- Ping endpoint for health checks and authentication testing
func (x *AdminClient) Ping(ctx context.Context, req *adminv1.PingRequest) (*adminv1.PingResponse, error) {
	resp, err := x.c.Ping(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// CreateWorkspace -- Create workspace
func (x *AdminClient) CreateWorkspace(ctx context.Context, req *adminv1.CreateWorkspaceRequest) (*adminv1.CreateWorkspaceResponse, error) {
	resp, err := x.c.CreateWorkspace(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ListWorkspaces -- List workspaces
func (x *AdminClient) ListWorkspaces(ctx context.Context, req *adminv1.ListWorkspacesRequest) (*adminv1.ListWorkspacesResponse, error) {
	resp, err := x.c.ListWorkspaces(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetWorkspace -- Get workspace
func (x *AdminClient) GetWorkspace(ctx context.Context, req *adminv1.GetWorkspaceRequest) (*adminv1.GetWorkspaceResponse, error) {
	resp, err := x.c.GetWorkspace(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// UpdateWorkspace -- Update workspace
func (x *AdminClient) UpdateWorkspace(ctx context.Context, req *adminv1.UpdateWorkspaceRequest) (*adminv1.UpdateWorkspaceResponse, error) {
	resp, err := x.c.UpdateWorkspace(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// SetWorkspaceURL -- Set the customer-facing gateway URL for a workspace data plane. Writes system_settings.dataplane-url:<workspace_id> and optionally fires a PROXY_URL config event.
func (x *AdminClient) SetWorkspaceURL(ctx context.Context, req *adminv1.SetWorkspaceURLRequest) (*adminv1.SetWorkspaceURLResponse, error) {
	resp, err := x.c.SetWorkspaceURL(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// SetWorkspaceProject -- Assign workspace to a project (or clear back to default project by omitting project_id)
func (x *AdminClient) SetWorkspaceProject(ctx context.Context, req *adminv1.SetWorkspaceProjectRequest) (*adminv1.SetWorkspaceProjectResponse, error) {
	resp, err := x.c.SetWorkspaceProject(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// DeleteWorkspace -- Delete workspace (soft delete)
func (x *AdminClient) DeleteWorkspace(ctx context.Context, req *adminv1.DeleteWorkspaceRequest) (*adminv1.DeleteWorkspaceResponse, error) {
	resp, err := x.c.DeleteWorkspace(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// CreateServiceAccount -- Create service account
func (x *AdminClient) CreateServiceAccount(ctx context.Context, req *adminv1.CreateServiceAccountRequest) (*adminv1.CreateServiceAccountResponse, error) {
	resp, err := x.c.CreateServiceAccount(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ListServiceAccounts -- List service accounts
func (x *AdminClient) ListServiceAccounts(ctx context.Context, req *adminv1.ListServiceAccountsRequest) (*adminv1.ListServiceAccountsResponse, error) {
	resp, err := x.c.ListServiceAccounts(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetServiceAccount -- Get service account
func (x *AdminClient) GetServiceAccount(ctx context.Context, req *adminv1.GetServiceAccountRequest) (*adminv1.GetServiceAccountResponse, error) {
	resp, err := x.c.GetServiceAccount(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// RevokeServiceAccount -- Revoke service account
func (x *AdminClient) RevokeServiceAccount(ctx context.Context, req *adminv1.RevokeServiceAccountRequest) (*adminv1.RevokeServiceAccountResponse, error) {
	resp, err := x.c.RevokeServiceAccount(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// RestoreServiceAccount -- Restore service account Restores a revoked service account to active status. Only one active service account per customer_id + workspace_id is allowed.
func (x *AdminClient) RestoreServiceAccount(ctx context.Context, req *adminv1.RestoreServiceAccountRequest) (*adminv1.RestoreServiceAccountResponse, error) {
	resp, err := x.c.RestoreServiceAccount(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// CreateUserToken -- Create user token Generates a JWT token for user authentication with gatekeeper.
func (x *AdminClient) CreateUserToken(ctx context.Context, req *adminv1.CreateUserTokenRequest) (*adminv1.CreateUserTokenResponse, error) {
	resp, err := x.c.CreateUserToken(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ListUserTokens -- List user tokens
func (x *AdminClient) ListUserTokens(ctx context.Context, req *adminv1.ListUserTokensRequest) (*adminv1.ListUserTokensResponse, error) {
	resp, err := x.c.ListUserTokens(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetUserToken -- Get user token
func (x *AdminClient) GetUserToken(ctx context.Context, req *adminv1.GetUserTokenRequest) (*adminv1.GetUserTokenResponse, error) {
	resp, err := x.c.GetUserToken(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// RevokeUserToken -- Revoke user token Revokes a user token by its JTI (JWT ID).
func (x *AdminClient) RevokeUserToken(ctx context.Context, req *adminv1.RevokeUserTokenRequest) (*adminv1.RevokeUserTokenResponse, error) {
	resp, err := x.c.RevokeUserToken(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// CreateTelemetryConfig -- Create telemetry config
func (x *AdminClient) CreateTelemetryConfig(ctx context.Context, req *adminv1.CreateTelemetryConfigRequest) (*adminv1.CreateTelemetryConfigResponse, error) {
	resp, err := x.c.CreateTelemetryConfig(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ListTelemetryConfigs -- List telemetry configs
func (x *AdminClient) ListTelemetryConfigs(ctx context.Context, req *adminv1.ListTelemetryConfigsRequest) (*adminv1.ListTelemetryConfigsResponse, error) {
	resp, err := x.c.ListTelemetryConfigs(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetTelemetryConfig -- Get telemetry config
func (x *AdminClient) GetTelemetryConfig(ctx context.Context, req *adminv1.GetTelemetryConfigRequest) (*adminv1.GetTelemetryConfigResponse, error) {
	resp, err := x.c.GetTelemetryConfig(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// UpdateTelemetryConfig -- Update telemetry config
func (x *AdminClient) UpdateTelemetryConfig(ctx context.Context, req *adminv1.UpdateTelemetryConfigRequest) (*adminv1.UpdateTelemetryConfigResponse, error) {
	resp, err := x.c.UpdateTelemetryConfig(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// DeleteTelemetryConfig -- Delete telemetry config
func (x *AdminClient) DeleteTelemetryConfig(ctx context.Context, req *adminv1.DeleteTelemetryConfigRequest) (*adminv1.DeleteTelemetryConfigResponse, error) {
	resp, err := x.c.DeleteTelemetryConfig(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) CreateCustomer(ctx context.Context, req *adminv1.CreateCustomerRequest) (*adminv1.CreateCustomerResponse, error) {
	resp, err := x.c.CreateCustomer(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) ListCustomers(ctx context.Context, req *adminv1.ListCustomersRequest) (*adminv1.ListCustomersResponse, error) {
	resp, err := x.c.ListCustomers(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) GetCustomer(ctx context.Context, req *adminv1.GetCustomerRequest) (*adminv1.GetCustomerResponse, error) {
	resp, err := x.c.GetCustomer(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) UpdateCustomer(ctx context.Context, req *adminv1.UpdateCustomerRequest) (*adminv1.UpdateCustomerResponse, error) {
	resp, err := x.c.UpdateCustomer(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) DeleteCustomer(ctx context.Context, req *adminv1.DeleteCustomerRequest) (*adminv1.DeleteCustomerResponse, error) {
	resp, err := x.c.DeleteCustomer(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) CreateProject(ctx context.Context, req *adminv1.CreateProjectRequest) (*adminv1.CreateProjectResponse, error) {
	resp, err := x.c.CreateProject(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) ListProjects(ctx context.Context, req *adminv1.ListProjectsRequest) (*adminv1.ListProjectsResponse, error) {
	resp, err := x.c.ListProjects(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) GetProject(ctx context.Context, req *adminv1.GetProjectRequest) (*adminv1.GetProjectResponse, error) {
	resp, err := x.c.GetProject(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) UpdateProject(ctx context.Context, req *adminv1.UpdateProjectRequest) (*adminv1.UpdateProjectResponse, error) {
	resp, err := x.c.UpdateProject(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) DeleteProject(ctx context.Context, req *adminv1.DeleteProjectRequest) (*adminv1.DeleteProjectResponse, error) {
	resp, err := x.c.DeleteProject(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) AddProjectMember(ctx context.Context, req *adminv1.AddProjectMemberRequest) (*adminv1.AddProjectMemberResponse, error) {
	resp, err := x.c.AddProjectMember(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) ListProjectMembers(ctx context.Context, req *adminv1.ListProjectMembersRequest) (*adminv1.ListProjectMembersResponse, error) {
	resp, err := x.c.ListProjectMembers(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) UpdateProjectMember(ctx context.Context, req *adminv1.UpdateProjectMemberRequest) (*adminv1.UpdateProjectMemberResponse, error) {
	resp, err := x.c.UpdateProjectMember(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) RemoveProjectMember(ctx context.Context, req *adminv1.RemoveProjectMemberRequest) (*adminv1.RemoveProjectMemberResponse, error) {
	resp, err := x.c.RemoveProjectMember(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) ListModels(ctx context.Context, req *adminv1.ListModelsRequest) (*adminv1.ListModelsResponse, error) {
	resp, err := x.c.ListModels(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) GetModel(ctx context.Context, req *adminv1.GetModelRequest) (*adminv1.GetModelResponse, error) {
	resp, err := x.c.GetModel(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) AddProjectModel(ctx context.Context, req *adminv1.AddProjectModelRequest) (*adminv1.AddProjectModelResponse, error) {
	resp, err := x.c.AddProjectModel(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) ListProjectModels(ctx context.Context, req *adminv1.ListProjectModelsRequest) (*adminv1.ListProjectModelsResponse, error) {
	resp, err := x.c.ListProjectModels(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) RemoveProjectModel(ctx context.Context, req *adminv1.RemoveProjectModelRequest) (*adminv1.RemoveProjectModelResponse, error) {
	resp, err := x.c.RemoveProjectModel(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) AddProjectProvider(ctx context.Context, req *adminv1.AddProjectProviderRequest) (*adminv1.AddProjectProviderResponse, error) {
	resp, err := x.c.AddProjectProvider(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) ListProjectProviders(ctx context.Context, req *adminv1.ListProjectProvidersRequest) (*adminv1.ListProjectProvidersResponse, error) {
	resp, err := x.c.ListProjectProviders(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) RemoveProjectProvider(ctx context.Context, req *adminv1.RemoveProjectProviderRequest) (*adminv1.RemoveProjectProviderResponse, error) {
	resp, err := x.c.RemoveProjectProvider(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) GetProjectSettings(ctx context.Context, req *adminv1.GetProjectSettingsRequest) (*adminv1.GetProjectSettingsResponse, error) {
	resp, err := x.c.GetProjectSettings(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) UpsertProjectSetting(ctx context.Context, req *adminv1.UpsertProjectSettingRequest) (*adminv1.UpsertProjectSettingResponse, error) {
	resp, err := x.c.UpsertProjectSetting(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

func (x *AdminClient) DeleteProjectSetting(ctx context.Context, req *adminv1.DeleteProjectSettingRequest) (*adminv1.DeleteProjectSettingResponse, error) {
	resp, err := x.c.DeleteProjectSetting(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// --- ConfiguratorService (tars.configurator.v1) ---

// ConfiguratorClient wraps the ConfiguratorService generated Connect client.
type ConfiguratorClient struct {
	c configuratorv1connect.ConfiguratorServiceClient
}

// GetConfiguration -- GetConfiguration retrieves the latest configuration for a user. Returns configuration only if the version is newer than the provided version. Supports batch queries for multiple users for efficiency.
func (x *ConfiguratorClient) GetConfiguration(ctx context.Context, req *configuratorv1.GetConfigurationRequest) (*configuratorv1.GetConfigurationResponse, error) {
	resp, err := x.c.GetConfiguration(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// TriggerUpdate -- TriggerUpdate triggers a configuration update for a specific user and config type. This is called by the dashboard when configuration changes.
func (x *ConfiguratorClient) TriggerUpdate(ctx context.Context, req *configuratorv1.TriggerUpdateRequest) (*configuratorv1.TriggerUpdateResponse, error) {
	resp, err := x.c.TriggerUpdate(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ListConfigurations -- ListConfigurations lists all configurations with optional filtering. Used for debugging and monitoring.
func (x *ConfiguratorClient) ListConfigurations(ctx context.Context, req *configuratorv1.ListConfigurationsRequest) (*configuratorv1.ListConfigurationsResponse, error) {
	resp, err := x.c.ListConfigurations(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ListPendingEvents -- ListPendingEvents returns configuration events that need processing. Used by workers to discover which configurations have updates.
func (x *ConfiguratorClient) ListPendingEvents(ctx context.Context, req *configuratorv1.ListPendingEventsRequest) (*configuratorv1.ListPendingEventsResponse, error) {
	resp, err := x.c.ListPendingEvents(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ReconcileWorkspace -- ReconcileWorkspace re-enqueues missing or stale slot events for the caller's workspace by cloning the latest sibling event of each slot the workspace has not yet converged on. Used by the worker's periodic drift sweep. Workspace is resolved from the caller's auth claims; callers without a workspace claim are rejected.
func (x *ConfiguratorClient) ReconcileWorkspace(ctx context.Context, req *configuratorv1.ReconcileWorkspaceRequest) (*configuratorv1.ReconcileWorkspaceResponse, error) {
	resp, err := x.c.ReconcileWorkspace(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// FullSyncWorkspace -- FullSyncWorkspace is the heavier "last resort" replay path: walks `liaison_configurations` directly rather than sibling events, so it can recover legacy unscoped events the drift sweep can't see. Worker calls this once on startup and every Nth drift sweep tick. Workspace and customer are resolved from the caller's auth claims.
func (x *ConfiguratorClient) FullSyncWorkspace(ctx context.Context, req *configuratorv1.FullSyncWorkspaceRequest) (*configuratorv1.FullSyncWorkspaceResponse, error) {
	resp, err := x.c.FullSyncWorkspace(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// AcknowledgeEvent -- AcknowledgeEvent marks an event as acknowledged by a worker. This prevents other workers from processing the same event.
func (x *ConfiguratorClient) AcknowledgeEvent(ctx context.Context, req *configuratorv1.AcknowledgeEventRequest) (*configuratorv1.AcknowledgeEventResponse, error) {
	resp, err := x.c.AcknowledgeEvent(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// SetDataplaneURL -- SetDataplaneURL persists the customer-facing gateway URL for a data plane (workspace). Called by `tare install` to register the URL at install time and by the management-plane dashboard when an admin edits it later. trigger_update=false (install path) only writes the system_settings row. trigger_update=true (admin-edit path) additionally fires a PROXY_URL configuration event so the running data plane converges on the new URL via the worker's existing event-handling loop.
func (x *ConfiguratorClient) SetDataplaneURL(ctx context.Context, req *configuratorv1.SetDataplaneURLRequest) (*configuratorv1.SetDataplaneURLResponse, error) {
	resp, err := x.c.SetDataplaneURL(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// UpsertMCPCatalogServer -- UpsertMCPCatalogServer wires a deployed in-cluster MCP server into the customer's catalog. Used by `tare mcp enable <server>`: the CLI looks up the server's seed entry in mcp-catalog-tare-mcp-with-tools.json, asks the operator for the in-cluster URL, and submits this RPC to set is_enabled=true on the corresponding mcp_catalog_servers row. Default behaviour (force_overwrite=false): if the row exists, only url + is_enabled (+updated_at) are updated; dashboard-set fields (description / icon / categories / tools / etc.) are preserved. If the row is new, the seed-provided fields are used to populate it. force_overwrite=true: every seed field is written, clobbering any dashboard edits. Use sparingly — intended for "reset this row to seed defaults" repairs.
func (x *ConfiguratorClient) UpsertMCPCatalogServer(ctx context.Context, req *configuratorv1.UpsertMCPCatalogServerRequest) (*configuratorv1.UpsertMCPCatalogServerResponse, error) {
	resp, err := x.c.UpsertMCPCatalogServer(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ValidateDataplane -- ValidateDataplane lets a data plane's filter confirm that this DP is still a valid (non-revoked) member of the customer and fetch the customer's current gatekeeper public keys. Authentication is via the caller's service-account JWT signed with its DP keypair (kid=`instance-<...>`). When the DP keypair has been soft-deleted at MP, the auth layer rejects the call with Unauthenticated — the filter treats that as "revoked" without needing a separate response field. On success, the response carries the customer's gatekeeper public keys so the filter can repopulate its in-memory cache (and the worker can repopulate `tars-config[gatekeeper-public-keys]`).
func (x *ConfiguratorClient) ValidateDataplane(ctx context.Context, req *configuratorv1.ValidateDataplaneRequest) (*configuratorv1.ValidateDataplaneResponse, error) {
	resp, err := x.c.ValidateDataplane(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// CompleteEvent -- CompleteEvent marks an event as successfully applied or failed.
func (x *ConfiguratorClient) CompleteEvent(ctx context.Context, req *configuratorv1.CompleteEventRequest) (*configuratorv1.CompleteEventResponse, error) {
	resp, err := x.c.CompleteEvent(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ListActiveUsers -- ListActiveUsers returns a list of user IDs that have active configurations. Used for monitoring and debugging.
func (x *ConfiguratorClient) ListActiveUsers(ctx context.Context, req *configuratorv1.ListActiveUsersRequest) (*configuratorv1.ListActiveUsersResponse, error) {
	resp, err := x.c.ListActiveUsers(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ListActiveProviders -- ListActiveProviders returns a list of active (enabled) AI providers. Used for monitoring, debugging, and querying available provider configurations.
func (x *ConfiguratorClient) ListActiveProviders(ctx context.Context, req *configuratorv1.ListActiveProvidersRequest) (*configuratorv1.ListActiveProvidersResponse, error) {
	resp, err := x.c.ListActiveProviders(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// SaveBYOKBackends -- SaveBYOKBackends saves BYOK provider backends configuration. Used by workers to persist BYOK backend metadata to database.
func (x *ConfiguratorClient) SaveBYOKBackends(ctx context.Context, req *configuratorv1.SaveBYOKBackendsRequest) (*configuratorv1.SaveBYOKBackendsResponse, error) {
	resp, err := x.c.SaveBYOKBackends(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// DeleteBYOKBackends -- DeleteBYOKBackends deletes BYOK provider backends configuration. Used by workers to remove BYOK backend metadata from database.
func (x *ConfiguratorClient) DeleteBYOKBackends(ctx context.Context, req *configuratorv1.DeleteBYOKBackendsRequest) (*configuratorv1.DeleteBYOKBackendsResponse, error) {
	resp, err := x.c.DeleteBYOKBackends(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// RevokeUserToken -- RevokeUserToken revokes a user token by JTI. Used by workers in enterprise mode to revoke tokens when API keys are deleted.
func (x *ConfiguratorClient) RevokeUserToken(ctx context.Context, req *configuratorv1.RevokeUserTokenRequest) (*configuratorv1.RevokeUserTokenResponse, error) {
	resp, err := x.c.RevokeUserToken(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// UpdateEventMetadata -- Replaces metadata JSON on an existing liaison_configuration_events row. Lets workers push mid-flight progress onto an event without changing its status (AcknowledgeEvent/CompleteEvent are terminal-only). Worker writes are scoped to the caller's workspace claim.
func (x *ConfiguratorClient) UpdateEventMetadata(ctx context.Context, req *configuratorv1.UpdateEventMetadataRequest) (*configuratorv1.UpdateEventMetadataResponse, error) {
	resp, err := x.c.UpdateEventMetadata(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// SubmitDataplaneUpgradeCredentials -- SubmitDataplaneUpgradeCredentials stores operator-provided registry credentials for a DATAPLANE_UPGRADE event parked in NeedsCredentials. Payload is KEK-envelope encrypted at MP and stored in dataplane_upgrade_credentials. Dashboard (admin) is the only caller.
func (x *ConfiguratorClient) SubmitDataplaneUpgradeCredentials(ctx context.Context, req *configuratorv1.SubmitDataplaneUpgradeCredentialsRequest) (*configuratorv1.SubmitDataplaneUpgradeCredentialsResponse, error) {
	resp, err := x.c.SubmitDataplaneUpgradeCredentials(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetDataplaneUpgradeCredentials -- GetDataplaneUpgradeCredentials returns the operator-submitted credentials for an upgrade event. MP decrypts server-side and returns plaintext over TLS — the worker (DP cluster) never has KEK access. Caller's workspace claim must match the event's workspace. Read-only — no state change until AckDataplaneUpgradeCredentials.
func (x *ConfiguratorClient) GetDataplaneUpgradeCredentials(ctx context.Context, req *configuratorv1.GetDataplaneUpgradeCredentialsRequest) (*configuratorv1.GetDataplaneUpgradeCredentialsResponse, error) {
	resp, err := x.c.GetDataplaneUpgradeCredentials(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// AckDataplaneUpgradeCredentials -- AckDataplaneUpgradeCredentials confirms the worker successfully materialised the credentials Secret in-cluster. MP DELETEs the ciphertext row immediately — no 30-day retention. Workspace claim must match. Idempotent: a second Ack on an already-deleted row returns success.
func (x *ConfiguratorClient) AckDataplaneUpgradeCredentials(ctx context.Context, req *configuratorv1.AckDataplaneUpgradeCredentialsRequest) (*configuratorv1.AckDataplaneUpgradeCredentialsResponse, error) {
	resp, err := x.c.AckDataplaneUpgradeCredentials(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// --- SecretService (tars.secret.v1) ---

// SecretClient wraps the SecretService generated Connect client.
type SecretClient struct {
	c secretv1connect.SecretServiceClient
}

// CreateSecret -- CreateSecret creates or updates a secret. If a secret with the same name exists, it will be updated.
func (x *SecretClient) CreateSecret(ctx context.Context, req *secretv1.CreateSecretRequest) (*secretv1.CreateSecretResponse, error) {
	resp, err := x.c.CreateSecret(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetSecret -- GetSecret retrieves a secret by name. Returns metadata only, not the plaintext value.
func (x *SecretClient) GetSecret(ctx context.Context, req *secretv1.GetSecretRequest) (*secretv1.GetSecretResponse, error) {
	resp, err := x.c.GetSecret(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ListSecrets -- ListSecrets lists all secrets for the authenticated user. Returns metadata only, not plaintext values.
func (x *SecretClient) ListSecrets(ctx context.Context, req *secretv1.ListSecretsRequest) (*secretv1.ListSecretsResponse, error) {
	resp, err := x.c.ListSecrets(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// DeleteSecret -- DeleteSecret deletes a secret by name.
func (x *SecretClient) DeleteSecret(ctx context.Context, req *secretv1.DeleteSecretRequest) (*secretv1.DeleteSecretResponse, error) {
	resp, err := x.c.DeleteSecret(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// RotateSecret -- RotateSecret rotates a secret by creating a new version. The old version is marked as rotated_pending for graceful transition.
func (x *SecretClient) RotateSecret(ctx context.Context, req *secretv1.RotateSecretRequest) (*secretv1.RotateSecretResponse, error) {
	resp, err := x.c.RotateSecret(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// ValidateSecret -- ValidateSecret validates that a secret can be decrypted. Used for health checks and troubleshooting.
func (x *SecretClient) ValidateSecret(ctx context.Context, req *secretv1.ValidateSecretRequest) (*secretv1.ValidateSecretResponse, error) {
	resp, err := x.c.ValidateSecret(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetSecretValue -- GetSecretValue retrieves the plaintext value of a secret. INTERNAL USE ONLY - This endpoint decrypts and returns the actual secret value. Should only be called by internal services (Liaison, Butler2, etc.)
func (x *SecretClient) GetSecretValue(ctx context.Context, req *secretv1.GetSecretValueRequest) (*secretv1.GetSecretValueResponse, error) {
	resp, err := x.c.GetSecretValue(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// --- ApiKeysService (tars.api_keys.v1) ---

// ApiKeysClient wraps the ApiKeysService generated Connect client.
type ApiKeysClient struct {
	c api_keysv1connect.ApiKeysServiceClient
}

// CreateApiKey -- CreateApiKey creates a new JWT user-token API key for a user and returns the plaintext token exactly once.
func (x *ApiKeysClient) CreateApiKey(ctx context.Context, req *api_keysv1.CreateApiKeyRequest) (*api_keysv1.CreateApiKeyResponse, error) {
	resp, err := x.c.CreateApiKey(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// UpdateApiKey -- UpdateApiKey updates mutable fields of an API key (name and/or active state).
func (x *ApiKeysClient) UpdateApiKey(ctx context.Context, req *api_keysv1.UpdateApiKeyRequest) (*api_keysv1.UpdateApiKeyResponse, error) {
	resp, err := x.c.UpdateApiKey(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// DeleteApiKey -- DeleteApiKey soft-deletes an API key (sets deleted_at).
func (x *ApiKeysClient) DeleteApiKey(ctx context.Context, req *api_keysv1.DeleteApiKeyRequest) (*api_keysv1.DeleteApiKeyResponse, error) {
	resp, err := x.c.DeleteApiKey(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// --- CustomerRequestLogsService (tars.insights.v1) ---

// CustomerRequestLogsClient wraps the CustomerRequestLogsService generated Connect client.
type CustomerRequestLogsClient struct {
	c insightsv1connect.CustomerRequestLogsServiceClient
}

// ListCustomerRequestLogs -- ListCustomerRequestLogs returns the caller's own request logs, filtered by the supplied tenancy scope. Forced filter: `user_id = caller.UserID`.
func (x *CustomerRequestLogsClient) ListCustomerRequestLogs(ctx context.Context, req *insightsv1.ListCustomerRequestLogsRequest) (*insightsv1.ListCustomerRequestLogsResponse, error) {
	resp, err := x.c.ListCustomerRequestLogs(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetCustomerRequestLog -- GetCustomerRequestLog returns a single request log row owned by the calling user. Cross-user NotFound: the user cannot read another user's log even within the same customer/project.
func (x *CustomerRequestLogsClient) GetCustomerRequestLog(ctx context.Context, req *insightsv1.GetCustomerRequestLogRequest) (*insightsv1.RequestLog, error) {
	resp, err := x.c.GetCustomerRequestLog(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetCustomerRequestLogStats -- GetCustomerRequestLogStats returns aggregated statistics over the calling user's request logs within the supplied tenancy scope.
func (x *CustomerRequestLogsClient) GetCustomerRequestLogStats(ctx context.Context, req *insightsv1.GetCustomerRequestLogStatsRequest) (*insightsv1.RequestLogStatsResponse, error) {
	resp, err := x.c.GetCustomerRequestLogStats(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// --- RequestLogsService (tars.insights.v1) ---

// RequestLogsClient wraps the RequestLogsService generated Connect client.
type RequestLogsClient struct {
	c insightsv1connect.RequestLogsServiceClient
}

// QueryRequestLogs -- QueryRequestLogs retrieves request logs with filtering and pagination.
func (x *RequestLogsClient) QueryRequestLogs(ctx context.Context, req *insightsv1.QueryRequestLogsRequest) (*insightsv1.QueryRequestLogsResponse, error) {
	resp, err := x.c.QueryRequestLogs(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetRequestLog -- GetRequestLog retrieves a single request log by request ID.
func (x *RequestLogsClient) GetRequestLog(ctx context.Context, req *insightsv1.GetRequestLogRequest) (*insightsv1.RequestLog, error) {
	resp, err := x.c.GetRequestLog(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// GetRequestLogStats -- GetRequestLogStats returns aggregated statistics for request logs.
func (x *RequestLogsClient) GetRequestLogStats(ctx context.Context, req *insightsv1.GetRequestLogStatsRequest) (*insightsv1.RequestLogStatsResponse, error) {
	resp, err := x.c.GetRequestLogStats(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// --- AuthService (tars.auth.v1) ---

// AuthClient wraps the AuthService generated Connect client.
type AuthClient struct {
	c authv1connect.AuthServiceClient
}

// GetJWKS -- JWKS endpoint. Public endpoint - no authentication required. Returns JSON Web Key Set for verifying JWT tokens.
func (x *AuthClient) GetJWKS(ctx context.Context, req *authv1.GetJWKSRequest) (*authv1.GetJWKSResponse, error) {
	resp, err := x.c.GetJWKS(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// --- TokensService (tars.tokens.v1) ---

// TokensClient wraps the TokensService generated Connect client.
type TokensClient struct {
	c tokensv1connect.TokensServiceClient
}

// GetRevocationList -- GetRevocationList returns a list of revoked token JTIs. This is used by dataplane to cache and check token revocations locally.
func (x *TokensClient) GetRevocationList(ctx context.Context, req *tokensv1.GetRevocationListRequest) (*tokensv1.GetRevocationListResponse, error) {
	resp, err := x.c.GetRevocationList(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}

// UpdateLastUsed -- UpdateLastUsed updates the last used timestamp for a token. Called by dataplane when a token is used for authentication.
func (x *TokensClient) UpdateLastUsed(ctx context.Context, req *tokensv1.UpdateLastUsedRequest) (*tokensv1.UpdateLastUsedResponse, error) {
	resp, err := x.c.UpdateLastUsed(ctx, connect.NewRequest(req))
	if err != nil {
		return nil, wrap(err)
	}
	return resp.Msg, nil
}
