// AiKeysService -- BYOK provider key registration and inference-side
// fetch.
//
// Customers register their own provider key (e.g. an OpenAI API key);
// the inference handler (and, in milestone C, the dataplane) fetches it
// over the internal subdomain and uses the customer's key when
// forwarding to the provider.
//
// Plan reference: B2 in check-ia-and-plan-optimized-cook.md.

// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        (unknown)
// source: tars/aikeys/v1/aikeys.proto

package aikeysv1

import (
	_ "github.com/tetrateio/agentrouter-go/genapi/api/tars/auth/v1"
	_ "github.com/tetrateio/agentrouter-go/genapi/api/tars/cli/v1"
	_ "github.com/tetrateio/agentrouter-go/genapi/api/tars/docs/v1"
	_ "google.golang.org/genproto/googleapis/api/annotations"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// Provider enumerates the upstream LLM providers TARS proxies. Adding a
// provider is a versioned change.
type Provider int32

const (
	Provider_PROVIDER_UNSPECIFIED   Provider = 0
	Provider_PROVIDER_OPENAI        Provider = 1
	Provider_PROVIDER_ANTHROPIC     Provider = 2
	Provider_PROVIDER_AZURE_OPENAI  Provider = 3
	Provider_PROVIDER_GOOGLE_VERTEX Provider = 4
	Provider_PROVIDER_AWS_BEDROCK   Provider = 5
)

// Enum value maps for Provider.
var (
	Provider_name = map[int32]string{
		0: "PROVIDER_UNSPECIFIED",
		1: "PROVIDER_OPENAI",
		2: "PROVIDER_ANTHROPIC",
		3: "PROVIDER_AZURE_OPENAI",
		4: "PROVIDER_GOOGLE_VERTEX",
		5: "PROVIDER_AWS_BEDROCK",
	}
	Provider_value = map[string]int32{
		"PROVIDER_UNSPECIFIED":   0,
		"PROVIDER_OPENAI":        1,
		"PROVIDER_ANTHROPIC":     2,
		"PROVIDER_AZURE_OPENAI":  3,
		"PROVIDER_GOOGLE_VERTEX": 4,
		"PROVIDER_AWS_BEDROCK":   5,
	}
)

func (x Provider) Enum() *Provider {
	p := new(Provider)
	*p = x
	return p
}

func (x Provider) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (Provider) Descriptor() protoreflect.EnumDescriptor {
	return file_tars_aikeys_v1_aikeys_proto_enumTypes[0].Descriptor()
}

func (Provider) Type() protoreflect.EnumType {
	return &file_tars_aikeys_v1_aikeys_proto_enumTypes[0]
}

func (x Provider) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use Provider.Descriptor instead.
func (Provider) EnumDescriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{0}
}

// AiKey is the BYOK record. The plaintext is never returned after
// registration; the inference handler fetches the secret-svc handle
// and decrypts on demand.
//
// Storage / ownership model (table: ai_keys): user_id holds the user who
// created the key; key_address holds the "customer::project" scope.
//
// Two scopes share the same (customer, project) address:
//   - PROJECT-level keys have scope_user_id = NULL. Every project member
//     sees them and the project owner manages them. These are the
//     project's shared BYOK keys.
//   - USER-level keys have scope_user_id = <caller>. A member sets their
//     OWN key; it is private to that user and OVERRIDES the project key
//     for that user's inference traffic for the same provider.
//
// At inference time the resolver prefers the caller's user-scoped key for
// the provider and falls back to the project-level key. The legacy
// per-user "/byok" dashboard view instead filters on user_id.
type AiKey struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// byok_<ulid>. Server-assigned.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Customer that owns the project this key is scoped to.
	CustomerId string `protobuf:"bytes,2,opt,name=customer_id,json=customerId,proto3" json:"customer_id,omitempty"`
	// Project this key is registered under; List/Get/Revoke filter on it.
	ProjectId string `protobuf:"bytes,3,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
	// Upstream LLM provider this key authenticates against.
	Provider Provider `protobuf:"varint,4,opt,name=provider,proto3,enum=tars.aikeys.v1.Provider" json:"provider,omitempty"`
	// Operator-supplied label, e.g. "openai-prod".
	Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"`
	// Last 4 chars of the registered plaintext, for human-friendly
	// display.
	DisplaySuffix string `protobuf:"bytes,6,opt,name=display_suffix,json=displaySuffix,proto3" json:"display_suffix,omitempty"`
	// user_scope is true when this is a per-user key (private to, and
	// managed by, scope_user_id) that overrides the project key for that
	// user. False for shared project-level keys.
	UserScope bool `protobuf:"varint,7,opt,name=user_scope,json=userScope,proto3" json:"user_scope,omitempty"`
	// scope_user_id is the owning user for a user-scoped key; empty for a
	// project-level key.
	ScopeUserId string `protobuf:"bytes,8,opt,name=scope_user_id,json=scopeUserId,proto3" json:"scope_user_id,omitempty"`
	// When the key was registered.
	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,50,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	// When the key's metadata was last modified.
	UpdatedAt *timestamppb.Timestamp `protobuf:"bytes,51,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
	// When the key was revoked; unset while the key is active.
	RevokedAt *timestamppb.Timestamp `protobuf:"bytes,52,opt,name=revoked_at,json=revokedAt,proto3" json:"revoked_at,omitempty"`
	// Reference to the secrets-svc record holding the wrapped plaintext.
	SecretRef     string `protobuf:"bytes,60,opt,name=secret_ref,json=secretRef,proto3" json:"secret_ref,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AiKey) Reset() {
	*x = AiKey{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AiKey) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AiKey) ProtoMessage() {}

func (x *AiKey) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AiKey.ProtoReflect.Descriptor instead.
func (*AiKey) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{0}
}

func (x *AiKey) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *AiKey) GetCustomerId() string {
	if x != nil {
		return x.CustomerId
	}
	return ""
}

func (x *AiKey) GetProjectId() string {
	if x != nil {
		return x.ProjectId
	}
	return ""
}

func (x *AiKey) GetProvider() Provider {
	if x != nil {
		return x.Provider
	}
	return Provider_PROVIDER_UNSPECIFIED
}

func (x *AiKey) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *AiKey) GetDisplaySuffix() string {
	if x != nil {
		return x.DisplaySuffix
	}
	return ""
}

func (x *AiKey) GetUserScope() bool {
	if x != nil {
		return x.UserScope
	}
	return false
}

func (x *AiKey) GetScopeUserId() string {
	if x != nil {
		return x.ScopeUserId
	}
	return ""
}

func (x *AiKey) GetCreatedAt() *timestamppb.Timestamp {
	if x != nil {
		return x.CreatedAt
	}
	return nil
}

func (x *AiKey) GetUpdatedAt() *timestamppb.Timestamp {
	if x != nil {
		return x.UpdatedAt
	}
	return nil
}

func (x *AiKey) GetRevokedAt() *timestamppb.Timestamp {
	if x != nil {
		return x.RevokedAt
	}
	return nil
}

func (x *AiKey) GetSecretRef() string {
	if x != nil {
		return x.SecretRef
	}
	return ""
}

type RegisterRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Defaults to the caller's session customer when empty.
	CustomerId string `protobuf:"bytes,1,opt,name=customer_id,json=customerId,proto3" json:"customer_id,omitempty"`
	// Defaults to the caller's session project when empty.
	ProjectId string `protobuf:"bytes,2,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
	// Provider this key authenticates against.
	Provider Provider `protobuf:"varint,3,opt,name=provider,proto3,enum=tars.aikeys.v1.Provider" json:"provider,omitempty"`
	// Operator-supplied label for the key, e.g. "openai-prod".
	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
	// Plaintext provider key, e.g. sk-.... Sent over TLS only; the server
	// immediately wraps with secrets-svc and discards the plaintext.
	Secret string `protobuf:"bytes,5,opt,name=secret,proto3" json:"secret,omitempty"`
	// user_scope registers a per-user key private to the caller that
	// overrides the project key for the caller's inference traffic. When
	// false (default) the key is project-level (shared) and requires the
	// caller to be the project owner.
	UserScope     bool `protobuf:"varint,6,opt,name=user_scope,json=userScope,proto3" json:"user_scope,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RegisterRequest) Reset() {
	*x = RegisterRequest{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RegisterRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RegisterRequest) ProtoMessage() {}

func (x *RegisterRequest) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RegisterRequest.ProtoReflect.Descriptor instead.
func (*RegisterRequest) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{1}
}

func (x *RegisterRequest) GetCustomerId() string {
	if x != nil {
		return x.CustomerId
	}
	return ""
}

func (x *RegisterRequest) GetProjectId() string {
	if x != nil {
		return x.ProjectId
	}
	return ""
}

func (x *RegisterRequest) GetProvider() Provider {
	if x != nil {
		return x.Provider
	}
	return Provider_PROVIDER_UNSPECIFIED
}

func (x *RegisterRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *RegisterRequest) GetSecret() string {
	if x != nil {
		return x.Secret
	}
	return ""
}

func (x *RegisterRequest) GetUserScope() bool {
	if x != nil {
		return x.UserScope
	}
	return false
}

type RegisterResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The newly registered key's metadata record (no plaintext).
	Key           *AiKey `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RegisterResponse) Reset() {
	*x = RegisterResponse{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RegisterResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RegisterResponse) ProtoMessage() {}

func (x *RegisterResponse) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RegisterResponse.ProtoReflect.Descriptor instead.
func (*RegisterResponse) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{2}
}

func (x *RegisterResponse) GetKey() *AiKey {
	if x != nil {
		return x.Key
	}
	return nil
}

type GetRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Defaults to the caller's session customer when empty.
	CustomerId string `protobuf:"bytes,1,opt,name=customer_id,json=customerId,proto3" json:"customer_id,omitempty"`
	// Defaults to the caller's session project when empty.
	ProjectId string `protobuf:"bytes,2,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
	// byok_<ulid> identifying the key to fetch.
	Id            string `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetRequest) Reset() {
	*x = GetRequest{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetRequest) ProtoMessage() {}

func (x *GetRequest) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetRequest.ProtoReflect.Descriptor instead.
func (*GetRequest) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{3}
}

func (x *GetRequest) GetCustomerId() string {
	if x != nil {
		return x.CustomerId
	}
	return ""
}

func (x *GetRequest) GetProjectId() string {
	if x != nil {
		return x.ProjectId
	}
	return ""
}

func (x *GetRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

type GetResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The requested key's metadata record (no plaintext).
	Key           *AiKey `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetResponse) Reset() {
	*x = GetResponse{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetResponse) ProtoMessage() {}

func (x *GetResponse) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetResponse.ProtoReflect.Descriptor instead.
func (*GetResponse) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{4}
}

func (x *GetResponse) GetKey() *AiKey {
	if x != nil {
		return x.Key
	}
	return nil
}

type ListRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Defaults to the caller's session customer when empty.
	CustomerId string `protobuf:"bytes,1,opt,name=customer_id,json=customerId,proto3" json:"customer_id,omitempty"`
	// Defaults to the caller's session project when empty.
	ProjectId     string `protobuf:"bytes,2,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListRequest) Reset() {
	*x = ListRequest{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListRequest) ProtoMessage() {}

func (x *ListRequest) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListRequest.ProtoReflect.Descriptor instead.
func (*ListRequest) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{5}
}

func (x *ListRequest) GetCustomerId() string {
	if x != nil {
		return x.CustomerId
	}
	return ""
}

func (x *ListRequest) GetProjectId() string {
	if x != nil {
		return x.ProjectId
	}
	return ""
}

type ListResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// All keys registered under the project (metadata only, no plaintext).
	Keys          []*AiKey `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListResponse) Reset() {
	*x = ListResponse{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListResponse) ProtoMessage() {}

func (x *ListResponse) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListResponse.ProtoReflect.Descriptor instead.
func (*ListResponse) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{6}
}

func (x *ListResponse) GetKeys() []*AiKey {
	if x != nil {
		return x.Keys
	}
	return nil
}

type RevokeRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Defaults to the caller's session customer when empty.
	CustomerId string `protobuf:"bytes,1,opt,name=customer_id,json=customerId,proto3" json:"customer_id,omitempty"`
	// Defaults to the caller's session project when empty.
	ProjectId string `protobuf:"bytes,2,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
	// byok_<ulid> identifying the key to revoke.
	Id            string `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RevokeRequest) Reset() {
	*x = RevokeRequest{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[7]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RevokeRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RevokeRequest) ProtoMessage() {}

func (x *RevokeRequest) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[7]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RevokeRequest.ProtoReflect.Descriptor instead.
func (*RevokeRequest) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{7}
}

func (x *RevokeRequest) GetCustomerId() string {
	if x != nil {
		return x.CustomerId
	}
	return ""
}

func (x *RevokeRequest) GetProjectId() string {
	if x != nil {
		return x.ProjectId
	}
	return ""
}

func (x *RevokeRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

type RevokeResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RevokeResponse) Reset() {
	*x = RevokeResponse{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[8]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RevokeResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RevokeResponse) ProtoMessage() {}

func (x *RevokeResponse) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[8]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RevokeResponse.ProtoReflect.Descriptor instead.
func (*RevokeResponse) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{8}
}

type FetchRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// byok_<ulid> of the active key to decrypt and return.
	Id            string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *FetchRequest) Reset() {
	*x = FetchRequest{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[9]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *FetchRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*FetchRequest) ProtoMessage() {}

func (x *FetchRequest) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[9]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use FetchRequest.ProtoReflect.Descriptor instead.
func (*FetchRequest) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{9}
}

func (x *FetchRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

type FetchResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Provider the returned key authenticates against.
	Provider Provider `protobuf:"varint,1,opt,name=provider,proto3,enum=tars.aikeys.v1.Provider" json:"provider,omitempty"`
	// Decrypted plaintext provider key for the inference hot path.
	Secret string `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
	// Last 4 chars of the plaintext, for human-friendly display.
	DisplaySuffix string `protobuf:"bytes,3,opt,name=display_suffix,json=displaySuffix,proto3" json:"display_suffix,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *FetchResponse) Reset() {
	*x = FetchResponse{}
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[10]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *FetchResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*FetchResponse) ProtoMessage() {}

func (x *FetchResponse) ProtoReflect() protoreflect.Message {
	mi := &file_tars_aikeys_v1_aikeys_proto_msgTypes[10]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use FetchResponse.ProtoReflect.Descriptor instead.
func (*FetchResponse) Descriptor() ([]byte, []int) {
	return file_tars_aikeys_v1_aikeys_proto_rawDescGZIP(), []int{10}
}

func (x *FetchResponse) GetProvider() Provider {
	if x != nil {
		return x.Provider
	}
	return Provider_PROVIDER_UNSPECIFIED
}

func (x *FetchResponse) GetSecret() string {
	if x != nil {
		return x.Secret
	}
	return ""
}

func (x *FetchResponse) GetDisplaySuffix() string {
	if x != nil {
		return x.DisplaySuffix
	}
	return ""
}

var File_tars_aikeys_v1_aikeys_proto protoreflect.FileDescriptor

const file_tars_aikeys_v1_aikeys_proto_rawDesc = "" +
	"\n" +
	"\x1btars/aikeys/v1/aikeys.proto\x12\x0etars.aikeys.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1ftars/auth/v1/auth_options.proto\x1a\x15tars/cli/v1/cli.proto\x1a\x17tars/docs/v1/docs.proto\"\x97\x04\n" +
	"\x05AiKey\x12\x13\n" +
	"\x02id\x18\x01 \x01(\tB\x03\xe0A\x03R\x02id\x12$\n" +
	"\vcustomer_id\x18\x02 \x01(\tB\x03\xe0A\x03R\n" +
	"customerId\x12\"\n" +
	"\n" +
	"project_id\x18\x03 \x01(\tB\x03\xe0A\x03R\tprojectId\x129\n" +
	"\bprovider\x18\x04 \x01(\x0e2\x18.tars.aikeys.v1.ProviderB\x03\xe0A\x02R\bprovider\x12\x17\n" +
	"\x04name\x18\x05 \x01(\tB\x03\xe0A\x02R\x04name\x12*\n" +
	"\x0edisplay_suffix\x18\x06 \x01(\tB\x03\xe0A\x03R\rdisplaySuffix\x12\"\n" +
	"\n" +
	"user_scope\x18\a \x01(\bB\x03\xe0A\x03R\tuserScope\x12'\n" +
	"\rscope_user_id\x18\b \x01(\tB\x03\xe0A\x03R\vscopeUserId\x12>\n" +
	"\n" +
	"created_at\x182 \x01(\v2\x1a.google.protobuf.TimestampB\x03\xe0A\x03R\tcreatedAt\x12>\n" +
	"\n" +
	"updated_at\x183 \x01(\v2\x1a.google.protobuf.TimestampB\x03\xe0A\x03R\tupdatedAt\x12>\n" +
	"\n" +
	"revoked_at\x184 \x01(\v2\x1a.google.protobuf.TimestampB\x03\xe0A\x03R\trevokedAt\x12\"\n" +
	"\n" +
	"secret_ref\x18< \x01(\tB\x03\xe0A\x03R\tsecretRef\"\x9b\x02\n" +
	"\x0fRegisterRequest\x12/\n" +
	"\vcustomer_id\x18\x01 \x01(\tB\x0e\x9a\xb5\x18\n" +
	"\n" +
	"\bcustomerR\n" +
	"customerId\x12,\n" +
	"\n" +
	"project_id\x18\x02 \x01(\tB\r\x9a\xb5\x18\t\n" +
	"\aprojectR\tprojectId\x129\n" +
	"\bprovider\x18\x03 \x01(\x0e2\x18.tars.aikeys.v1.ProviderB\x03\xe0A\x02R\bprovider\x12\x17\n" +
	"\x04name\x18\x04 \x01(\tB\x03\xe0A\x02R\x04name\x12$\n" +
	"\x06secret\x18\x05 \x01(\tB\f\xe0A\x02\x9a\xb5\x18\x05\n" +
	"\x03keyR\x06secret\x12/\n" +
	"\n" +
	"user_scope\x18\x06 \x01(\bB\x10\x9a\xb5\x18\f\n" +
	"\n" +
	"user-scopeR\tuserScope\";\n" +
	"\x10RegisterResponse\x12'\n" +
	"\x03key\x18\x01 \x01(\v2\x15.tars.aikeys.v1.AiKeyR\x03key\"\x80\x01\n" +
	"\n" +
	"GetRequest\x12/\n" +
	"\vcustomer_id\x18\x01 \x01(\tB\x0e\x9a\xb5\x18\n" +
	"\n" +
	"\bcustomerR\n" +
	"customerId\x12,\n" +
	"\n" +
	"project_id\x18\x02 \x01(\tB\r\x9a\xb5\x18\t\n" +
	"\aprojectR\tprojectId\x12\x13\n" +
	"\x02id\x18\x03 \x01(\tB\x03\xe0A\x02R\x02id\"6\n" +
	"\vGetResponse\x12'\n" +
	"\x03key\x18\x01 \x01(\v2\x15.tars.aikeys.v1.AiKeyR\x03key\"l\n" +
	"\vListRequest\x12/\n" +
	"\vcustomer_id\x18\x01 \x01(\tB\x0e\x9a\xb5\x18\n" +
	"\n" +
	"\bcustomerR\n" +
	"customerId\x12,\n" +
	"\n" +
	"project_id\x18\x02 \x01(\tB\r\x9a\xb5\x18\t\n" +
	"\aprojectR\tprojectId\"9\n" +
	"\fListResponse\x12)\n" +
	"\x04keys\x18\x01 \x03(\v2\x15.tars.aikeys.v1.AiKeyR\x04keys\"\x83\x01\n" +
	"\rRevokeRequest\x12/\n" +
	"\vcustomer_id\x18\x01 \x01(\tB\x0e\x9a\xb5\x18\n" +
	"\n" +
	"\bcustomerR\n" +
	"customerId\x12,\n" +
	"\n" +
	"project_id\x18\x02 \x01(\tB\r\x9a\xb5\x18\t\n" +
	"\aprojectR\tprojectId\x12\x13\n" +
	"\x02id\x18\x03 \x01(\tB\x03\xe0A\x02R\x02id\"\x10\n" +
	"\x0eRevokeResponse\"#\n" +
	"\fFetchRequest\x12\x13\n" +
	"\x02id\x18\x01 \x01(\tB\x03\xe0A\x02R\x02id\"\x93\x01\n" +
	"\rFetchResponse\x129\n" +
	"\bprovider\x18\x01 \x01(\x0e2\x18.tars.aikeys.v1.ProviderB\x03\xe0A\x03R\bprovider\x12\x1b\n" +
	"\x06secret\x18\x02 \x01(\tB\x03\xe0A\x03R\x06secret\x12*\n" +
	"\x0edisplay_suffix\x18\x03 \x01(\tB\x03\xe0A\x03R\rdisplaySuffix*\xa2\x01\n" +
	"\bProvider\x12\x18\n" +
	"\x14PROVIDER_UNSPECIFIED\x10\x00\x12\x13\n" +
	"\x0fPROVIDER_OPENAI\x10\x01\x12\x16\n" +
	"\x12PROVIDER_ANTHROPIC\x10\x02\x12\x19\n" +
	"\x15PROVIDER_AZURE_OPENAI\x10\x03\x12\x1a\n" +
	"\x16PROVIDER_GOOGLE_VERTEX\x10\x04\x12\x18\n" +
	"\x14PROVIDER_AWS_BEDROCK\x10\x052\x8b\a\n" +
	"\rAiKeysService\x12\xca\x01\n" +
	"\bRegister\x12\x1f.tars.aikeys.v1.RegisterRequest\x1a .tars.aikeys.v1.RegisterResponse\"{\x8a\xb5\x18\x04\n" +
	"\x02\x03\x01\x92\xb5\x18\v:\x04byok:\x03add\xa2\xb5\x18\x12Register an AI key\xaa\xb5\x18\aAI Keys\x82\xd3\xe4\x93\x02=:\x01*\"8/v1/customers/{customer_id}/projects/{project_id}/aikeys\x12\xbf\x01\n" +
	"\x03Get\x12\x1a.tars.aikeys.v1.GetRequest\x1a\x1b.tars.aikeys.v1.GetResponse\"\x7f\x8a\xb5\x18\x04\n" +
	"\x02\x03\x01\x92\xb5\x18\x0f\x1a\x02id:\x04byok:\x03get\xa2\xb5\x18\rGet an AI key\xaa\xb5\x18\aAI Keys\x82\xd3\xe4\x93\x02?\x12=/v1/customers/{customer_id}/projects/{project_id}/aikeys/{id}\x90\x02\x01\x12\xb9\x01\n" +
	"\x04List\x12\x1b.tars.aikeys.v1.ListRequest\x1a\x1c.tars.aikeys.v1.ListResponse\"v\x8a\xb5\x18\x04\n" +
	"\x02\x03\x01\x92\xb5\x18\f:\x04byok:\x04list\xa2\xb5\x18\fList AI keys\xaa\xb5\x18\aAI Keys\x82\xd3\xe4\x93\x02:\x128/v1/customers/{customer_id}/projects/{project_id}/aikeys\x90\x02\x01\x12\xcc\x01\n" +
	"\x06Revoke\x12\x1d.tars.aikeys.v1.RevokeRequest\x1a\x1e.tars.aikeys.v1.RevokeResponse\"\x82\x01\x8a\xb5\x18\x04\n" +
	"\x02\x03\x01\x92\xb5\x18\x12\x1a\x02id:\x04byok:\x06remove\xa2\xb5\x18\x10Revoke an AI key\xaa\xb5\x18\aAI Keys\x82\xd3\xe4\x93\x02?*=/v1/customers/{customer_id}/projects/{project_id}/aikeys/{id}\x12`\n" +
	"\x05Fetch\x12\x1c.tars.aikeys.v1.FetchRequest\x1a\x1d.tars.aikeys.v1.FetchResponse\"\x1a\x8a\xb5\x18\r\n" +
	"\x01\x02\x12\binternal\x92\xb5\x18\x02(\x01\x90\x02\x01B\xb4\x01\n" +
	"\x12com.tars.aikeys.v1B\vAikeysProtoP\x01Z7github.com/tetrateio/fraser/api/tars/aikeys/v1;aikeysv1\xa2\x02\x03TAX\xaa\x02\x0eTars.Aikeys.V1\xca\x02\x0eTars\\Aikeys\\V1\xe2\x02\x1aTars\\Aikeys\\V1\\GPBMetadata\xea\x02\x10Tars::Aikeys::V1b\x06proto3"

var (
	file_tars_aikeys_v1_aikeys_proto_rawDescOnce sync.Once
	file_tars_aikeys_v1_aikeys_proto_rawDescData []byte
)

func file_tars_aikeys_v1_aikeys_proto_rawDescGZIP() []byte {
	file_tars_aikeys_v1_aikeys_proto_rawDescOnce.Do(func() {
		file_tars_aikeys_v1_aikeys_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_tars_aikeys_v1_aikeys_proto_rawDesc), len(file_tars_aikeys_v1_aikeys_proto_rawDesc)))
	})
	return file_tars_aikeys_v1_aikeys_proto_rawDescData
}

var file_tars_aikeys_v1_aikeys_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
var file_tars_aikeys_v1_aikeys_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
var file_tars_aikeys_v1_aikeys_proto_goTypes = []any{
	(Provider)(0),                 // 0: tars.aikeys.v1.Provider
	(*AiKey)(nil),                 // 1: tars.aikeys.v1.AiKey
	(*RegisterRequest)(nil),       // 2: tars.aikeys.v1.RegisterRequest
	(*RegisterResponse)(nil),      // 3: tars.aikeys.v1.RegisterResponse
	(*GetRequest)(nil),            // 4: tars.aikeys.v1.GetRequest
	(*GetResponse)(nil),           // 5: tars.aikeys.v1.GetResponse
	(*ListRequest)(nil),           // 6: tars.aikeys.v1.ListRequest
	(*ListResponse)(nil),          // 7: tars.aikeys.v1.ListResponse
	(*RevokeRequest)(nil),         // 8: tars.aikeys.v1.RevokeRequest
	(*RevokeResponse)(nil),        // 9: tars.aikeys.v1.RevokeResponse
	(*FetchRequest)(nil),          // 10: tars.aikeys.v1.FetchRequest
	(*FetchResponse)(nil),         // 11: tars.aikeys.v1.FetchResponse
	(*timestamppb.Timestamp)(nil), // 12: google.protobuf.Timestamp
}
var file_tars_aikeys_v1_aikeys_proto_depIdxs = []int32{
	0,  // 0: tars.aikeys.v1.AiKey.provider:type_name -> tars.aikeys.v1.Provider
	12, // 1: tars.aikeys.v1.AiKey.created_at:type_name -> google.protobuf.Timestamp
	12, // 2: tars.aikeys.v1.AiKey.updated_at:type_name -> google.protobuf.Timestamp
	12, // 3: tars.aikeys.v1.AiKey.revoked_at:type_name -> google.protobuf.Timestamp
	0,  // 4: tars.aikeys.v1.RegisterRequest.provider:type_name -> tars.aikeys.v1.Provider
	1,  // 5: tars.aikeys.v1.RegisterResponse.key:type_name -> tars.aikeys.v1.AiKey
	1,  // 6: tars.aikeys.v1.GetResponse.key:type_name -> tars.aikeys.v1.AiKey
	1,  // 7: tars.aikeys.v1.ListResponse.keys:type_name -> tars.aikeys.v1.AiKey
	0,  // 8: tars.aikeys.v1.FetchResponse.provider:type_name -> tars.aikeys.v1.Provider
	2,  // 9: tars.aikeys.v1.AiKeysService.Register:input_type -> tars.aikeys.v1.RegisterRequest
	4,  // 10: tars.aikeys.v1.AiKeysService.Get:input_type -> tars.aikeys.v1.GetRequest
	6,  // 11: tars.aikeys.v1.AiKeysService.List:input_type -> tars.aikeys.v1.ListRequest
	8,  // 12: tars.aikeys.v1.AiKeysService.Revoke:input_type -> tars.aikeys.v1.RevokeRequest
	10, // 13: tars.aikeys.v1.AiKeysService.Fetch:input_type -> tars.aikeys.v1.FetchRequest
	3,  // 14: tars.aikeys.v1.AiKeysService.Register:output_type -> tars.aikeys.v1.RegisterResponse
	5,  // 15: tars.aikeys.v1.AiKeysService.Get:output_type -> tars.aikeys.v1.GetResponse
	7,  // 16: tars.aikeys.v1.AiKeysService.List:output_type -> tars.aikeys.v1.ListResponse
	9,  // 17: tars.aikeys.v1.AiKeysService.Revoke:output_type -> tars.aikeys.v1.RevokeResponse
	11, // 18: tars.aikeys.v1.AiKeysService.Fetch:output_type -> tars.aikeys.v1.FetchResponse
	14, // [14:19] is the sub-list for method output_type
	9,  // [9:14] is the sub-list for method input_type
	9,  // [9:9] is the sub-list for extension type_name
	9,  // [9:9] is the sub-list for extension extendee
	0,  // [0:9] is the sub-list for field type_name
}

func init() { file_tars_aikeys_v1_aikeys_proto_init() }
func file_tars_aikeys_v1_aikeys_proto_init() {
	if File_tars_aikeys_v1_aikeys_proto != nil {
		return
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_tars_aikeys_v1_aikeys_proto_rawDesc), len(file_tars_aikeys_v1_aikeys_proto_rawDesc)),
			NumEnums:      1,
			NumMessages:   11,
			NumExtensions: 0,
			NumServices:   1,
		},
		GoTypes:           file_tars_aikeys_v1_aikeys_proto_goTypes,
		DependencyIndexes: file_tars_aikeys_v1_aikeys_proto_depIdxs,
		EnumInfos:         file_tars_aikeys_v1_aikeys_proto_enumTypes,
		MessageInfos:      file_tars_aikeys_v1_aikeys_proto_msgTypes,
	}.Build()
	File_tars_aikeys_v1_aikeys_proto = out.File
	file_tars_aikeys_v1_aikeys_proto_goTypes = nil
	file_tars_aikeys_v1_aikeys_proto_depIdxs = nil
}
