pidgr_proto/pidgr/v1/

pidgr.v1.rs

// @generated
// This file is @generated by prost-build.
// ─── Messages ───────────────────────────────────────────────────────────────

/// Request to submit a user action on a delivered message.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SubmitActionRequest {
    /// ID of the delivery the user is acting on.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub delivery_id: ::prost::alloc::string::String,
    /// ID of the action being performed (matches MessageAction.id).
    /// Constraints: Max length 100 characters.
    #[prost(string, tag="2")]
    pub action_id: ::prost::alloc::string::String,
    /// Optional action-specific payload (e.g. poll response data). Empty for ACK.
    /// Constraints: Max size 10000 bytes.
    #[prost(bytes="vec", tag="3")]
    pub payload: ::prost::alloc::vec::Vec<u8>,
}
/// Response after submitting an action.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SubmitActionResponse {
    /// Whether the action was successfully recorded and forwarded to the workflow.
    #[prost(bool, tag="1")]
    pub success: bool,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A single channel dispatch event for the audit trail. Append-only; the
/// receiver enforces idempotency on terminal states via a partial unique index
/// on (campaign_id, recipient_user_id, channel, step_kind).
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ChannelEvent {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub campaign_id: ::prost::alloc::string::String,
    #[prost(string, tag="3")]
    pub recipient_user_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="4")]
    pub channel: i32,
    #[prost(enumeration="ChannelStepKind", tag="5")]
    pub step_kind: i32,
    #[prost(enumeration="ChannelEventStatus", tag="6")]
    pub status: i32,
    /// Set only when status = SKIPPED. UNSPECIFIED in all other cases.
    #[prost(enumeration="ChannelSkipReason", tag="7")]
    pub skip_reason: i32,
    /// Provider's identifier for this dispatch. Empty for SKIPPED events.
    #[prost(string, tag="8")]
    pub provider_message_id: ::prost::alloc::string::String,
    /// Cost in micros (1/1000000 of a USD). Zero for absorbed channels.
    /// Negative is invalid.
    #[prost(int64, tag="9")]
    pub cost_micros: i64,
    /// Free-form provider error payload on FAILED. JSON-encoded; opaque to
    /// the platform.
    #[prost(string, tag="10")]
    pub metadata_json: ::prost::alloc::string::String,
    #[prost(message, optional, tag="11")]
    pub occurred_at: ::core::option::Option<::prost_types::Timestamp>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RecordChannelEventRequest {
    #[prost(message, optional, tag="1")]
    pub event: ::core::option::Option<ChannelEvent>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RecordChannelEventResponse {
    /// True if the row was inserted. False if rejected as a duplicate of an
    /// existing terminal-state row.
    #[prost(bool, tag="1")]
    pub accepted: bool,
    /// "duplicate" when accepted=false and the partial unique index rejected
    /// the insert. Empty when accepted=true.
    #[prost(string, tag="2")]
    pub reason: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct RecordChannelEventBatchRequest {
    #[prost(message, repeated, tag="1")]
    pub events: ::prost::alloc::vec::Vec<ChannelEvent>,
}
/// Per-event result inside a batch. Order matches the request's events list.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RecordChannelEventBatchResult {
    #[prost(bool, tag="1")]
    pub accepted: bool,
    #[prost(string, tag="2")]
    pub reason: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct RecordChannelEventBatchResponse {
    #[prost(message, repeated, tag="1")]
    pub results: ::prost::alloc::vec::Vec<RecordChannelEventBatchResult>,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Third-party notification channel for reminder + escalation dispatch.
///
/// Push is intentionally NOT in this enum. Push is the primary channel; it
/// always fires alongside any third-party channels. The third-party channels
/// here are additive. Channels carry only a deeplink notification — message
/// content stays in the platform.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ChannelName {
    Unspecified = 0,
    Email = 1,
    Webhook = 2,
    Telegram = 3,
    Slack = 4,
    Sms = 5,
    Whatsapp = 6,
    MicrosoftTeams = 7,
    Line = 8,
    GoogleChat = 9,
}
impl ChannelName {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "CHANNEL_NAME_UNSPECIFIED",
            Self::Email => "CHANNEL_NAME_EMAIL",
            Self::Webhook => "CHANNEL_NAME_WEBHOOK",
            Self::Telegram => "CHANNEL_NAME_TELEGRAM",
            Self::Slack => "CHANNEL_NAME_SLACK",
            Self::Sms => "CHANNEL_NAME_SMS",
            Self::Whatsapp => "CHANNEL_NAME_WHATSAPP",
            Self::MicrosoftTeams => "CHANNEL_NAME_MICROSOFT_TEAMS",
            Self::Line => "CHANNEL_NAME_LINE",
            Self::GoogleChat => "CHANNEL_NAME_GOOGLE_CHAT",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "CHANNEL_NAME_UNSPECIFIED" => Some(Self::Unspecified),
            "CHANNEL_NAME_EMAIL" => Some(Self::Email),
            "CHANNEL_NAME_WEBHOOK" => Some(Self::Webhook),
            "CHANNEL_NAME_TELEGRAM" => Some(Self::Telegram),
            "CHANNEL_NAME_SLACK" => Some(Self::Slack),
            "CHANNEL_NAME_SMS" => Some(Self::Sms),
            "CHANNEL_NAME_WHATSAPP" => Some(Self::Whatsapp),
            "CHANNEL_NAME_MICROSOFT_TEAMS" => Some(Self::MicrosoftTeams),
            "CHANNEL_NAME_LINE" => Some(Self::Line),
            "CHANNEL_NAME_GOOGLE_CHAT" => Some(Self::GoogleChat),
            _ => None,
        }
    }
}
/// Workflow step kind that triggered the channel dispatch. Different step
/// kinds for the same (campaign, recipient, channel) tuple are treated as
/// distinct dispatch events for idempotency purposes.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ChannelStepKind {
    Unspecified = 0,
    Reminder = 1,
    Escalation = 2,
}
impl ChannelStepKind {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "CHANNEL_STEP_KIND_UNSPECIFIED",
            Self::Reminder => "CHANNEL_STEP_KIND_REMINDER",
            Self::Escalation => "CHANNEL_STEP_KIND_ESCALATION",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "CHANNEL_STEP_KIND_UNSPECIFIED" => Some(Self::Unspecified),
            "CHANNEL_STEP_KIND_REMINDER" => Some(Self::Reminder),
            "CHANNEL_STEP_KIND_ESCALATION" => Some(Self::Escalation),
            _ => None,
        }
    }
}
/// Status of a channel dispatch attempt. The table is append-only — each state
/// transition (e.g. SENT → DELIVERED via provider webhook) is its own row keyed
/// off provider_message_id, not an UPDATE.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ChannelEventStatus {
    Unspecified = 0,
    Sent = 1,
    Delivered = 2,
    Opened = 3,
    Clicked = 4,
    Bounced = 5,
    Failed = 6,
    Skipped = 7,
}
impl ChannelEventStatus {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "CHANNEL_EVENT_STATUS_UNSPECIFIED",
            Self::Sent => "CHANNEL_EVENT_STATUS_SENT",
            Self::Delivered => "CHANNEL_EVENT_STATUS_DELIVERED",
            Self::Opened => "CHANNEL_EVENT_STATUS_OPENED",
            Self::Clicked => "CHANNEL_EVENT_STATUS_CLICKED",
            Self::Bounced => "CHANNEL_EVENT_STATUS_BOUNCED",
            Self::Failed => "CHANNEL_EVENT_STATUS_FAILED",
            Self::Skipped => "CHANNEL_EVENT_STATUS_SKIPPED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "CHANNEL_EVENT_STATUS_UNSPECIFIED" => Some(Self::Unspecified),
            "CHANNEL_EVENT_STATUS_SENT" => Some(Self::Sent),
            "CHANNEL_EVENT_STATUS_DELIVERED" => Some(Self::Delivered),
            "CHANNEL_EVENT_STATUS_OPENED" => Some(Self::Opened),
            "CHANNEL_EVENT_STATUS_CLICKED" => Some(Self::Clicked),
            "CHANNEL_EVENT_STATUS_BOUNCED" => Some(Self::Bounced),
            "CHANNEL_EVENT_STATUS_FAILED" => Some(Self::Failed),
            "CHANNEL_EVENT_STATUS_SKIPPED" => Some(Self::Skipped),
            _ => None,
        }
    }
}
/// Reason a dispatch was SKIPPED rather than attempted. Set when status is
/// CHANNEL_EVENT_STATUS_SKIPPED; UNSPECIFIED otherwise.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ChannelSkipReason {
    Unspecified = 0,
    OptedOut = 1,
    RegionBlocked = 2,
    CostCapExceeded = 3,
    NoIdentifier = 4,
    OrgSuspended = 5,
}
impl ChannelSkipReason {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "CHANNEL_SKIP_REASON_UNSPECIFIED",
            Self::OptedOut => "CHANNEL_SKIP_REASON_OPTED_OUT",
            Self::RegionBlocked => "CHANNEL_SKIP_REASON_REGION_BLOCKED",
            Self::CostCapExceeded => "CHANNEL_SKIP_REASON_COST_CAP_EXCEEDED",
            Self::NoIdentifier => "CHANNEL_SKIP_REASON_NO_IDENTIFIER",
            Self::OrgSuspended => "CHANNEL_SKIP_REASON_ORG_SUSPENDED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "CHANNEL_SKIP_REASON_UNSPECIFIED" => Some(Self::Unspecified),
            "CHANNEL_SKIP_REASON_OPTED_OUT" => Some(Self::OptedOut),
            "CHANNEL_SKIP_REASON_REGION_BLOCKED" => Some(Self::RegionBlocked),
            "CHANNEL_SKIP_REASON_COST_CAP_EXCEEDED" => Some(Self::CostCapExceeded),
            "CHANNEL_SKIP_REASON_NO_IDENTIFIER" => Some(Self::NoIdentifier),
            "CHANNEL_SKIP_REASON_ORG_SUSPENDED" => Some(Self::OrgSuspended),
            _ => None,
        }
    }
}
/// A named role within an organization with a set of permissions.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Role {
    /// Unique identifier for the role.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// URL-safe slug (unique within the organization, e.g. "admin", "manager").
    #[prost(string, tag="2")]
    pub slug: ::prost::alloc::string::String,
    /// Human-readable display name.
    #[prost(string, tag="3")]
    pub name: ::prost::alloc::string::String,
    /// Whether this role was seeded by the system on organization creation.
    #[prost(bool, tag="4")]
    pub is_default: bool,
    /// Permissions granted to users with this role.
    #[prost(enumeration="Permission", repeated, tag="5")]
    pub permissions: ::prost::alloc::vec::Vec<i32>,
    /// Whether this role is system-managed and immutable (e.g. super_admin).
    #[prost(bool, tag="6")]
    pub is_system: bool,
}
// ─── Pagination ─────────────────────────────────────────────────────────────

/// Cursor-based pagination parameters for list requests.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Pagination {
    /// Maximum number of items to return per page.
    #[prost(int32, tag="1")]
    pub page_size: i32,
    /// Opaque token from a previous response to fetch the next page.
    #[prost(string, tag="2")]
    pub page_token: ::prost::alloc::string::String,
}
/// Pagination metadata returned alongside list responses.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct PaginationMeta {
    /// Token to pass in the next request to get the following page. Empty if no more pages.
    #[prost(string, tag="1")]
    pub next_page_token: ::prost::alloc::string::String,
    /// Total number of items matching the query (across all pages).
    #[prost(int32, tag="2")]
    pub total_count: i32,
}
// ─── Message & Action Model ─────────────────────────────────────────────────

/// An action button attached to a message that a recipient can interact with.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct MessageAction {
    /// Unique identifier for this action within the message.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// The type of action (e.g. ACK).
    #[prost(enumeration="ActionType", tag="2")]
    pub r#type: i32,
    /// Display label shown to the recipient (e.g. "Got it").
    /// Constraints: Max length 50 characters.
    #[prost(string, tag="3")]
    pub label: ::prost::alloc::string::String,
}
/// Canonical message type used across rendering, inbox, and delivery.
/// Represents the fully rendered content delivered to a recipient.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Message {
    /// SHA-256 hash of the rendered content, used as a content-addressable ID.
    #[prost(string, tag="1")]
    pub content_id: ::prost::alloc::string::String,
    /// ID of the campaign this message belongs to.
    #[prost(string, tag="2")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Display name of the sender (e.g. organization or campaign name).
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="3")]
    pub sender_name: ::prost::alloc::string::String,
    /// Short one-line summary shown in notification banners.
    /// Constraints: Max length 500 characters.
    #[prost(string, tag="4")]
    pub summary: ::prost::alloc::string::String,
    /// Preview text shown in inbox list views.
    /// Constraints: Max length 500 characters.
    #[prost(string, tag="5")]
    pub preview: ::prost::alloc::string::String,
    /// Full message body content.
    /// Constraints: Max length 100000 characters.
    #[prost(string, tag="6")]
    pub body: ::prost::alloc::string::String,
    /// Whether this message requires immediate attention from the recipient.
    #[prost(bool, tag="7")]
    pub critical: bool,
    /// Actions available to the recipient (e.g. acknowledge button).
    #[prost(message, repeated, tag="8")]
    pub actions: ::prost::alloc::vec::Vec<MessageAction>,
    /// Timestamp when the message was created.
    #[prost(message, optional, tag="9")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// User-facing title of the message (resolved from campaign or template).
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="10")]
    pub title: ::prost::alloc::string::String,
}
// ─── Workflow Definition Model ──────────────────────────────────────────────

/// A data-driven workflow represented as a directed acyclic graph (DAG) of steps.
/// Defines the automation logic for a campaign's lifecycle.
/// Backend MUST validate the graph is a DAG (no cycles) before execution.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct WorkflowDefinition {
    /// Ordered list of steps in the workflow DAG.
    /// Constraints: Max 100 steps. Backend MUST validate the graph is a DAG (no cycles).
    #[prost(message, repeated, tag="1")]
    pub steps: ::prost::alloc::vec::Vec<WorkflowStep>,
}
/// A single step in a workflow DAG with typed configuration and transitions.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct WorkflowStep {
    /// Unique identifier for this step within the workflow.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// The type of operation this step performs.
    #[prost(enumeration="StepType", tag="2")]
    pub r#type: i32,
    /// Map of outcome labels to the next step ID (e.g. "completed" -> "step_3").
    /// Constraints: Max 10 transitions per step.
    #[prost(map="string, string", tag="7")]
    pub transitions: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
    /// Step-specific configuration — exactly one must be set, matching the type.
    #[prost(oneof="workflow_step::Config", tags="3, 4, 5, 6, 8")]
    pub config: ::core::option::Option<workflow_step::Config>,
}
/// Nested message and enum types in `WorkflowStep`.
pub mod workflow_step {
    /// Step-specific configuration — exactly one must be set, matching the type.
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum Config {
        /// Configuration for SEND_NOTIFICATION steps.
        #[prost(message, tag="3")]
        SendNotification(super::SendNotificationConfig),
        /// Configuration for DEADLINE_CHECK steps.
        #[prost(message, tag="4")]
        DeadlineCheck(super::DeadlineCheckConfig),
        /// Configuration for SEND_REMINDER steps.
        #[prost(message, tag="5")]
        SendReminder(super::SendReminderConfig),
        /// Configuration for CALL_WEBHOOK steps.
        #[prost(message, tag="6")]
        CallWebhook(super::CallWebhookConfig),
        /// Configuration for STEP_TYPE_ESCALATE steps.
        #[prost(message, tag="8")]
        EscalateConfig(super::EscalateConfig),
    }
}
/// Configuration for a step that sends the initial push notification.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SendNotificationConfig {
    /// Notification delivery type (e.g. "push").
    /// Constraints: Accepted values: "push". Max length 50 characters.
    #[prost(string, tag="1")]
    pub r#type: ::prost::alloc::string::String,
    /// ID of the template to use for this step's notification.
    /// Empty falls back to campaign-level template_id.
    /// Constraints: Max length 36 characters (UUID).
    #[prost(string, tag="2")]
    pub template_id: ::prost::alloc::string::String,
    /// Pinned template version for this step.
    /// 0 falls back to campaign-level template_version.
    #[prost(int32, tag="3")]
    pub template_version: i32,
    /// Display label for the action button (e.g. "Acknowledge", "Got it").
    /// Constraints: Max length 50 characters.
    #[prost(string, tag="4")]
    pub action_label: ::prost::alloc::string::String,
    /// Action type for this step's message button.
    #[prost(enumeration="ActionType", tag="5")]
    pub action_type: i32,
    /// Values for custom-sourced template variables specific to this step.
    /// Constraints: Max 100 entries. Key max length 100 characters, value max length 10000 characters.
    #[prost(map="string, string", tag="6")]
    pub custom_variables: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
}
/// Configuration for a deadline-based timer step that sleeps for a configured
/// delay before proceeding. Acknowledgments happen independently at the delivery
/// level and are evaluated by subsequent steps (e.g. SEND_REMINDER).
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeadlineCheckConfig {
    /// Duration string for the deadline delay (e.g. "120h", "72h").
    /// Constraints: Valid range 1m to 8760h (1 year).
    #[prost(string, tag="1")]
    pub delay: ::prost::alloc::string::String,
}
/// Configuration for a step that sends a one-time reminder to non-responsive recipients.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SendReminderConfig {
    /// Reminder delivery type (e.g. "push").
    /// Constraints: Accepted values: "push". Max length 50 characters.
    #[prost(string, tag="1")]
    pub r#type: ::prost::alloc::string::String,
    /// Additional third-party channels to dispatch the reminder through
    /// alongside the primary push notification. Empty = push-only behaviour
    /// (the platform's historical default; no surprise for existing
    /// workflows). Each entry produces an independent dispatch attempt
    /// recorded in `channel_events`; per-org configuration in
    /// pidgr-integrations decides which channels are eligible at runtime.
    #[prost(enumeration="ChannelName", repeated, tag="4")]
    pub third_party_channels: ::prost::alloc::vec::Vec<i32>,
    /// Third parties to loop in when this reminder fires. Each resolved
    /// target receives a passive inbox delivery (no action button) plus a
    /// fan-out via the same `third_party_channels` list as the employee
    /// reminder. The delivery auto-dismisses when the original recipient
    /// acknowledges the campaign.
    ///
    /// Each entry reuses the existing `EscalationTarget` shape
    /// (USER / GROUP / MANAGER / ROLE). When `type` is MANAGER, `target_id`
    /// is empty and is resolved at runtime from the original recipient's
    /// `manager_id`. Self-targets (resolved user_id == original recipient)
    /// are dropped at dispatch time.
    /// Constraints: Max 5 entries.
    #[prost(message, repeated, tag="5")]
    pub notify_targets: ::prost::alloc::vec::Vec<EscalationTarget>,
}
/// Configuration for a step that calls an external webhook.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CallWebhookConfig {
    /// Human-readable name for this webhook (for logging/display).
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// URL to POST campaign context to.
    /// Constraints: Max length 2048 characters.
    /// Security: HTTPS required in production. Backend MUST reject private,
    /// loopback, and link-local addresses to prevent SSRF attacks.
    #[prost(string, tag="2")]
    pub url: ::prost::alloc::string::String,
    /// Additional HTTP headers to include in the webhook request.
    /// Constraints: Max 20 entries. Key max length 200 characters, value max length 2000 characters.
    #[prost(map="string, string", tag="3")]
    pub headers: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
}
/// A target for escalation — who should be notified when escalation fires.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct EscalationTarget {
    /// Type of target.
    #[prost(enumeration="EscalationTargetType", tag="1")]
    pub r#type: i32,
    /// ID of the target (user_id, group_id, or role_id).
    /// Empty for MANAGER type (resolved at runtime from recipient's manager_id).
    #[prost(string, tag="2")]
    pub target_id: ::prost::alloc::string::String,
}
/// Configuration for an escalation step in the workflow DAG.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct EscalateConfig {
    /// Condition that triggers escalation.
    #[prost(enumeration="EscalationCondition", tag="1")]
    pub condition: i32,
    /// Targets to notify when escalation fires.
    #[prost(message, repeated, tag="2")]
    pub targets: ::prost::alloc::vec::Vec<EscalationTarget>,
    /// Number of times to repeat this escalation before moving to the next step.
    /// Constraints: Max 5.
    #[prost(int32, tag="3")]
    pub repeat_count: i32,
    /// Minutes between repeat attempts.
    #[prost(int32, tag="4")]
    pub repeat_interval_minutes: i32,
    /// Behavior mode for this escalation. UNSPECIFIED is normalized to DELIVER.
    #[prost(enumeration="EscalateMode", tag="5")]
    pub mode: i32,
    /// Additional third-party channels to dispatch the escalation through
    /// alongside the primary push / delivery side effect. Empty = no
    /// third-party fan-out (existing behaviour). Each entry produces an
    /// independent dispatch attempt recorded in `channel_events`. ALERT_ONLY
    /// and DELIVER modes both support third-party fan-out — the channel
    /// adapters render the alert content from the campaign + a
    /// mode-aware copy variant.
    #[prost(enumeration="ChannelName", repeated, tag="6")]
    pub third_party_channels: ::prost::alloc::vec::Vec<i32>,
}
// ─── Status Enums ───────────────────────────────────────────────────────────

/// Lifecycle status of a campaign.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum CampaignStatus {
    /// Default value; not a valid status.
    Unspecified = 0,
    /// Campaign has been created but not yet started.
    Created = 1,
    /// Campaign is actively delivering messages and processing actions.
    Running = 2,
    /// All recipients have been processed; campaign is finished.
    Completed = 3,
    /// Campaign terminated due to an unrecoverable error.
    Failed = 4,
    /// Campaign was manually cancelled before completion.
    Cancelled = 5,
}
impl CampaignStatus {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "CAMPAIGN_STATUS_UNSPECIFIED",
            Self::Created => "CAMPAIGN_STATUS_CREATED",
            Self::Running => "CAMPAIGN_STATUS_RUNNING",
            Self::Completed => "CAMPAIGN_STATUS_COMPLETED",
            Self::Failed => "CAMPAIGN_STATUS_FAILED",
            Self::Cancelled => "CAMPAIGN_STATUS_CANCELLED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "CAMPAIGN_STATUS_UNSPECIFIED" => Some(Self::Unspecified),
            "CAMPAIGN_STATUS_CREATED" => Some(Self::Created),
            "CAMPAIGN_STATUS_RUNNING" => Some(Self::Running),
            "CAMPAIGN_STATUS_COMPLETED" => Some(Self::Completed),
            "CAMPAIGN_STATUS_FAILED" => Some(Self::Failed),
            "CAMPAIGN_STATUS_CANCELLED" => Some(Self::Cancelled),
            _ => None,
        }
    }
}
/// Delivery status for a single message sent to a recipient.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum DeliveryStatus {
    /// Default value; not a valid status.
    Unspecified = 0,
    /// Message is queued but has not been sent yet.
    Pending = 1,
    /// Push notification was sent to the delivery provider.
    Sent = 2,
    /// Message was confirmed delivered to the device.
    Delivered = 3,
    /// Recipient completed the required action (e.g. acknowledged).
    Acknowledged = 4,
    /// Recipient did not act before the deadline.
    Missed = 5,
    /// Recipient has no registered device; delivery was skipped.
    NoDevice = 6,
    /// Delivery failed due to a provider or system error.
    Failed = 7,
}
impl DeliveryStatus {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "DELIVERY_STATUS_UNSPECIFIED",
            Self::Pending => "DELIVERY_STATUS_PENDING",
            Self::Sent => "DELIVERY_STATUS_SENT",
            Self::Delivered => "DELIVERY_STATUS_DELIVERED",
            Self::Acknowledged => "DELIVERY_STATUS_ACKNOWLEDGED",
            Self::Missed => "DELIVERY_STATUS_MISSED",
            Self::NoDevice => "DELIVERY_STATUS_NO_DEVICE",
            Self::Failed => "DELIVERY_STATUS_FAILED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "DELIVERY_STATUS_UNSPECIFIED" => Some(Self::Unspecified),
            "DELIVERY_STATUS_PENDING" => Some(Self::Pending),
            "DELIVERY_STATUS_SENT" => Some(Self::Sent),
            "DELIVERY_STATUS_DELIVERED" => Some(Self::Delivered),
            "DELIVERY_STATUS_ACKNOWLEDGED" => Some(Self::Acknowledged),
            "DELIVERY_STATUS_MISSED" => Some(Self::Missed),
            "DELIVERY_STATUS_NO_DEVICE" => Some(Self::NoDevice),
            "DELIVERY_STATUS_FAILED" => Some(Self::Failed),
            _ => None,
        }
    }
}
/// Mobile platform for device registration.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum Platform {
    /// Default value; not a valid platform.
    Unspecified = 0,
    /// Apple iOS.
    Ios = 1,
    /// Google Android.
    Android = 2,
}
impl Platform {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "PLATFORM_UNSPECIFIED",
            Self::Ios => "PLATFORM_IOS",
            Self::Android => "PLATFORM_ANDROID",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "PLATFORM_UNSPECIFIED" => Some(Self::Unspecified),
            "PLATFORM_IOS" => Some(Self::Ios),
            "PLATFORM_ANDROID" => Some(Self::Android),
            _ => None,
        }
    }
}
/// Granular permission for authorization checks.
/// Stored in the database as enum names (e.g. "PERMISSION_ORG_READ").
/// New values MUST be appended with the next sequential number; existing values
/// MUST NOT be renumbered or removed (enforced by buf breaking).
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum Permission {
    /// Default value; not a valid permission.
    Unspecified = 0,
    /// View organization settings.
    OrgRead = 1,
    /// Modify organization settings.
    OrgWrite = 2,
    /// View organization members.
    MembersRead = 3,
    /// Invite new users to the organization.
    MembersInvite = 4,
    /// Change user roles, deactivate users.
    MembersManage = 5,
    /// View campaigns and deliveries.
    CampaignsRead = 6,
    /// Create and edit campaigns.
    CampaignsWrite = 7,
    /// Start campaign execution.
    CampaignsStart = 8,
    /// View templates.
    TemplatesRead = 9,
    /// Create and edit templates.
    TemplatesWrite = 10,
    /// View inbox messages and deliveries.
    InboxRead = 11,
    /// Submit actions on deliveries.
    InboxAct = 12,
    /// View all groups in the organization.
    GroupsAllRead = 13,
    /// Create, edit, delete groups the caller created, manage own group membership.
    GroupsWrite = 14,
    /// Create, edit, delete any group in the organization, manage any group membership.
    GroupsAllWrite = 15,
    /// View all teams (organizational units) in the organization.
    TeamsAllRead = 16,
    /// Create, edit, delete teams the caller created, manage own team membership.
    TeamsWrite = 17,
    /// Create, edit, delete any team in the organization, manage any team membership.
    TeamsAllWrite = 18,
    /// View privacy requests (exports, deletions) for the organization.
    PrivacyRead = 19,
    /// Schedule deletions, export user data, restrict processing.
    PrivacyWrite = 20,
    /// View audit trail events for the organization.
    AuditRead = 21,
    /// Review and approve template translations.
    TemplatesReview = 22,
    /// Cross-organization read access for platform-level support operations.
    /// Assignable only to roles within an ORG_TYPE_STAFF organization.
    PlatformSupport = 23,
    /// Manage platform access codes (generation, listing, revocation).
    /// Assignable only to roles within an ORG_TYPE_STAFF organization.
    PlatformAccessCodes = 24,
    /// Provision and manage organizations at the platform level.
    /// Assignable only to roles within an ORG_TYPE_STAFF organization.
    PlatformProvision = 25,
    /// Take abuse-response actions against organizations (suspend, revoke, quota overrides).
    /// Assignable only to roles within an ORG_TYPE_STAFF organization.
    PlatformAbuseResponse = 26,
    /// Write subprocessor and compliance records at the platform level.
    /// Assignable only to roles within an ORG_TYPE_STAFF organization.
    PlatformComplianceWrite = 27,
    /// Create synthetic (flagged) data on any org: seed resources and simulate
    /// campaign outcomes. Assignable only to roles within an ORG_TYPE_STAFF organization.
    PlatformSynthetic = 28,
    /// Dispatch notifications to third-party channels (Slack, Telegram, webhook, etc.).
    ChannelsDispatch = 29,
    /// Create, update, or remove a member's third-party channel reachability.
    ReachabilityWrite = 30,
    /// Triage security incidents (list, classify, mark-notified) at the platform level.
    /// Assignable only to roles within an ORG_TYPE_STAFF organization.
    PlatformIncidents = 31,
}
impl Permission {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "PERMISSION_UNSPECIFIED",
            Self::OrgRead => "PERMISSION_ORG_READ",
            Self::OrgWrite => "PERMISSION_ORG_WRITE",
            Self::MembersRead => "PERMISSION_MEMBERS_READ",
            Self::MembersInvite => "PERMISSION_MEMBERS_INVITE",
            Self::MembersManage => "PERMISSION_MEMBERS_MANAGE",
            Self::CampaignsRead => "PERMISSION_CAMPAIGNS_READ",
            Self::CampaignsWrite => "PERMISSION_CAMPAIGNS_WRITE",
            Self::CampaignsStart => "PERMISSION_CAMPAIGNS_START",
            Self::TemplatesRead => "PERMISSION_TEMPLATES_READ",
            Self::TemplatesWrite => "PERMISSION_TEMPLATES_WRITE",
            Self::InboxRead => "PERMISSION_INBOX_READ",
            Self::InboxAct => "PERMISSION_INBOX_ACT",
            Self::GroupsAllRead => "PERMISSION_GROUPS_ALL_READ",
            Self::GroupsWrite => "PERMISSION_GROUPS_WRITE",
            Self::GroupsAllWrite => "PERMISSION_GROUPS_ALL_WRITE",
            Self::TeamsAllRead => "PERMISSION_TEAMS_ALL_READ",
            Self::TeamsWrite => "PERMISSION_TEAMS_WRITE",
            Self::TeamsAllWrite => "PERMISSION_TEAMS_ALL_WRITE",
            Self::PrivacyRead => "PERMISSION_PRIVACY_READ",
            Self::PrivacyWrite => "PERMISSION_PRIVACY_WRITE",
            Self::AuditRead => "PERMISSION_AUDIT_READ",
            Self::TemplatesReview => "PERMISSION_TEMPLATES_REVIEW",
            Self::PlatformSupport => "PERMISSION_PLATFORM_SUPPORT",
            Self::PlatformAccessCodes => "PERMISSION_PLATFORM_ACCESS_CODES",
            Self::PlatformProvision => "PERMISSION_PLATFORM_PROVISION",
            Self::PlatformAbuseResponse => "PERMISSION_PLATFORM_ABUSE_RESPONSE",
            Self::PlatformComplianceWrite => "PERMISSION_PLATFORM_COMPLIANCE_WRITE",
            Self::PlatformSynthetic => "PERMISSION_PLATFORM_SYNTHETIC",
            Self::ChannelsDispatch => "PERMISSION_CHANNELS_DISPATCH",
            Self::ReachabilityWrite => "PERMISSION_REACHABILITY_WRITE",
            Self::PlatformIncidents => "PERMISSION_PLATFORM_INCIDENTS",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "PERMISSION_UNSPECIFIED" => Some(Self::Unspecified),
            "PERMISSION_ORG_READ" => Some(Self::OrgRead),
            "PERMISSION_ORG_WRITE" => Some(Self::OrgWrite),
            "PERMISSION_MEMBERS_READ" => Some(Self::MembersRead),
            "PERMISSION_MEMBERS_INVITE" => Some(Self::MembersInvite),
            "PERMISSION_MEMBERS_MANAGE" => Some(Self::MembersManage),
            "PERMISSION_CAMPAIGNS_READ" => Some(Self::CampaignsRead),
            "PERMISSION_CAMPAIGNS_WRITE" => Some(Self::CampaignsWrite),
            "PERMISSION_CAMPAIGNS_START" => Some(Self::CampaignsStart),
            "PERMISSION_TEMPLATES_READ" => Some(Self::TemplatesRead),
            "PERMISSION_TEMPLATES_WRITE" => Some(Self::TemplatesWrite),
            "PERMISSION_INBOX_READ" => Some(Self::InboxRead),
            "PERMISSION_INBOX_ACT" => Some(Self::InboxAct),
            "PERMISSION_GROUPS_ALL_READ" => Some(Self::GroupsAllRead),
            "PERMISSION_GROUPS_WRITE" => Some(Self::GroupsWrite),
            "PERMISSION_GROUPS_ALL_WRITE" => Some(Self::GroupsAllWrite),
            "PERMISSION_TEAMS_ALL_READ" => Some(Self::TeamsAllRead),
            "PERMISSION_TEAMS_WRITE" => Some(Self::TeamsWrite),
            "PERMISSION_TEAMS_ALL_WRITE" => Some(Self::TeamsAllWrite),
            "PERMISSION_PRIVACY_READ" => Some(Self::PrivacyRead),
            "PERMISSION_PRIVACY_WRITE" => Some(Self::PrivacyWrite),
            "PERMISSION_AUDIT_READ" => Some(Self::AuditRead),
            "PERMISSION_TEMPLATES_REVIEW" => Some(Self::TemplatesReview),
            "PERMISSION_PLATFORM_SUPPORT" => Some(Self::PlatformSupport),
            "PERMISSION_PLATFORM_ACCESS_CODES" => Some(Self::PlatformAccessCodes),
            "PERMISSION_PLATFORM_PROVISION" => Some(Self::PlatformProvision),
            "PERMISSION_PLATFORM_ABUSE_RESPONSE" => Some(Self::PlatformAbuseResponse),
            "PERMISSION_PLATFORM_COMPLIANCE_WRITE" => Some(Self::PlatformComplianceWrite),
            "PERMISSION_PLATFORM_SYNTHETIC" => Some(Self::PlatformSynthetic),
            "PERMISSION_CHANNELS_DISPATCH" => Some(Self::ChannelsDispatch),
            "PERMISSION_REACHABILITY_WRITE" => Some(Self::ReachabilityWrite),
            "PERMISSION_PLATFORM_INCIDENTS" => Some(Self::PlatformIncidents),
            _ => None,
        }
    }
}
/// Type of action a recipient can perform on a message.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ActionType {
    /// Default value; not a valid action type.
    Unspecified = 0,
    /// Simple acknowledgment — recipient confirms they received the message.
    Ack = 1,
}
impl ActionType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "ACTION_TYPE_UNSPECIFIED",
            Self::Ack => "ACTION_TYPE_ACK",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "ACTION_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "ACTION_TYPE_ACK" => Some(Self::Ack),
            _ => None,
        }
    }
}
/// Type of step within a workflow definition DAG.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum StepType {
    /// Default value; not a valid step type.
    Unspecified = 0,
    /// Send the initial push notification to all recipients.
    SendNotification = 1,
    /// Sleep for a configurable deadline, then proceed to the next step.
    DeadlineCheck = 2,
    /// Send a follow-up reminder to recipients who have not acted.
    SendReminder = 3,
    /// Call an external webhook with campaign context.
    CallWebhook = 4,
    /// Mark unacknowledged deliveries (SENT/DELIVERED) as MISSED. No config required.
    MarkMissed = 5,
    /// Escalate unacknowledged deliveries to configured targets.
    Escalate = 6,
}
impl StepType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "STEP_TYPE_UNSPECIFIED",
            Self::SendNotification => "STEP_TYPE_SEND_NOTIFICATION",
            Self::DeadlineCheck => "STEP_TYPE_DEADLINE_CHECK",
            Self::SendReminder => "STEP_TYPE_SEND_REMINDER",
            Self::CallWebhook => "STEP_TYPE_CALL_WEBHOOK",
            Self::MarkMissed => "STEP_TYPE_MARK_MISSED",
            Self::Escalate => "STEP_TYPE_ESCALATE",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "STEP_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "STEP_TYPE_SEND_NOTIFICATION" => Some(Self::SendNotification),
            "STEP_TYPE_DEADLINE_CHECK" => Some(Self::DeadlineCheck),
            "STEP_TYPE_SEND_REMINDER" => Some(Self::SendReminder),
            "STEP_TYPE_CALL_WEBHOOK" => Some(Self::CallWebhook),
            "STEP_TYPE_MARK_MISSED" => Some(Self::MarkMissed),
            "STEP_TYPE_ESCALATE" => Some(Self::Escalate),
            _ => None,
        }
    }
}
/// Condition that must be met for an escalation to fire.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum EscalationCondition {
    Unspecified = 0,
    /// Escalate if the delivery has not been acknowledged.
    IfNotAcked = 1,
    /// Escalate if the campaign is still open (even if some deliveries are acknowledged).
    IfNotClosed = 2,
}
impl EscalationCondition {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "ESCALATION_CONDITION_UNSPECIFIED",
            Self::IfNotAcked => "ESCALATION_CONDITION_IF_NOT_ACKED",
            Self::IfNotClosed => "ESCALATION_CONDITION_IF_NOT_CLOSED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "ESCALATION_CONDITION_UNSPECIFIED" => Some(Self::Unspecified),
            "ESCALATION_CONDITION_IF_NOT_ACKED" => Some(Self::IfNotAcked),
            "ESCALATION_CONDITION_IF_NOT_CLOSED" => Some(Self::IfNotClosed),
            _ => None,
        }
    }
}
/// Type of escalation target.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum EscalationTargetType {
    Unspecified = 0,
    /// Escalate to a specific user by ID.
    User = 1,
    /// Escalate to all members of a group.
    Group = 2,
    /// Escalate to the recipient's direct manager (resolved from manager_id at runtime).
    Manager = 3,
    /// Escalate to all users with a specific role in the org.
    Role = 4,
}
impl EscalationTargetType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "ESCALATION_TARGET_TYPE_UNSPECIFIED",
            Self::User => "ESCALATION_TARGET_TYPE_USER",
            Self::Group => "ESCALATION_TARGET_TYPE_GROUP",
            Self::Manager => "ESCALATION_TARGET_TYPE_MANAGER",
            Self::Role => "ESCALATION_TARGET_TYPE_ROLE",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "ESCALATION_TARGET_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "ESCALATION_TARGET_TYPE_USER" => Some(Self::User),
            "ESCALATION_TARGET_TYPE_GROUP" => Some(Self::Group),
            "ESCALATION_TARGET_TYPE_MANAGER" => Some(Self::Manager),
            "ESCALATION_TARGET_TYPE_ROLE" => Some(Self::Role),
            _ => None,
        }
    }
}
/// The level of organizational unit a verification question is put at.
///
/// Verification asks somebody other than the audience whether the
/// behaviour changed for a unit. Which unit that is has two sides pulling
/// against each other.
///
/// A size floor pushes the choice upward: below a handful of people, an
/// answer about the unit is in practice an answer about each of its
/// members, and the whole reason for asking about a unit rather than about
/// individuals disappears. Sensitivity pushes the choice downward: a
/// measure is only worth reading when whoever answers can influence what
/// is being asked about, and a question put far above the work stops
/// reflecting anybody's effort while still looking like a measurement. The
/// level worth choosing is the smallest one that clears the floor.
///
/// Which levels exist is a fact about the organization and only the
/// organization can state it. A reporting line is not a map of meaningful
/// units — units that report to the same place may do unrelated work — so
/// a level is never inferred from one. When no level satisfies both sides,
/// the honest outcome is that the indicator gets no evidence by this
/// route, and this enum makes that expressible instead of leaving it
/// looking like a question that was asked.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum VerificationUnitLevel {
    /// No level chosen. On an indicator this means the organization's
    /// default applies; on the organization it means the platform default
    /// applies, which is VERIFICATION_UNIT_LEVEL_DERIVED_UNIT. Consumers
    /// MUST NOT present this value as a choice somebody made.
    Unspecified = 0,
    /// Ask at the unit the verifier derivation resolves to. The smallest
    /// level available, and therefore the one whose answers track the work
    /// most closely. The floor still applies here: a unit below it is not
    /// asked at this level and contributes nothing, so a reading covers only
    /// the units that cleared the floor and never every unit the derivation
    /// reached.
    DerivedUnit = 1,
    /// Ask at the wider unit the organization's declared structure places
    /// over the derived one. This is what rising above the floor looks like
    /// when the organization has somewhere to rise to, and the organization
    /// is the one that says so. The cost is paid in sensitivity: whoever
    /// answers is further from the work, and an answer covering a unit whose
    /// parts do unrelated things says less about any of them. Where the
    /// organization has declared no level above, or the wider unit is itself
    /// below the floor, no question is asked and no evidence is produced.
    EnclosingUnit = 2,
    /// Do not ask by this route at all. The indicator keeps whatever other
    /// evidence sources it has and simply gets none from verification. This
    /// is the outcome for an organization flat enough that no level clears
    /// the floor, and it is a decision rather than a failure: consumers MUST
    /// NOT show it as a collection that is pending, overdue or broken.
    None = 3,
}
impl VerificationUnitLevel {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "VERIFICATION_UNIT_LEVEL_UNSPECIFIED",
            Self::DerivedUnit => "VERIFICATION_UNIT_LEVEL_DERIVED_UNIT",
            Self::EnclosingUnit => "VERIFICATION_UNIT_LEVEL_ENCLOSING_UNIT",
            Self::None => "VERIFICATION_UNIT_LEVEL_NONE",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "VERIFICATION_UNIT_LEVEL_UNSPECIFIED" => Some(Self::Unspecified),
            "VERIFICATION_UNIT_LEVEL_DERIVED_UNIT" => Some(Self::DerivedUnit),
            "VERIFICATION_UNIT_LEVEL_ENCLOSING_UNIT" => Some(Self::EnclosingUnit),
            "VERIFICATION_UNIT_LEVEL_NONE" => Some(Self::None),
            _ => None,
        }
    }
}
/// Behavior mode controlling what an escalation produces for its targets.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum EscalateMode {
    /// Default value; servers normalize this to ESCALATE_MODE_DELIVER.
    Unspecified = 0,
    /// Targets receive a delivery for the campaign just like primary recipients.
    Deliver = 1,
    /// Targets receive an out-of-band alert only; no delivery is created.
    AlertOnly = 2,
}
impl EscalateMode {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "ESCALATE_MODE_UNSPECIFIED",
            Self::Deliver => "ESCALATE_MODE_DELIVER",
            Self::AlertOnly => "ESCALATE_MODE_ALERT_ONLY",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "ESCALATE_MODE_UNSPECIFIED" => Some(Self::Unspecified),
            "ESCALATE_MODE_DELIVER" => Some(Self::Deliver),
            "ESCALATE_MODE_ALERT_ONLY" => Some(Self::AlertOnly),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A scoped API key for programmatic access (MCP agents, service integrations).
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ApiKey {
    /// Unique identifier.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Human-friendly label (e.g. "MCP Production", "CI Pipeline").
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// Displayable prefix of the key (e.g. "pidgr_k_abc12345").
    /// Used for identification — the full key is only returned on creation.
    #[prost(string, tag="3")]
    pub key_prefix: ::prost::alloc::string::String,
    /// Permissions granted to this key.
    #[prost(enumeration="Permission", repeated, tag="4")]
    pub permissions: ::prost::alloc::vec::Vec<i32>,
    /// When the key was created.
    #[prost(message, optional, tag="5")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Last time the key was used to authenticate a request. Empty if never used.
    #[prost(message, optional, tag="6")]
    pub last_used_at: ::core::option::Option<::prost_types::Timestamp>,
    /// When the key expires. Empty means no expiration.
    #[prost(message, optional, tag="7")]
    pub expires_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Type of this key (API key or SCIM token).
    /// Defaults to KEY_TYPE_API_KEY for existing keys.
    #[prost(enumeration="KeyType", tag="8")]
    pub key_type: i32,
}
/// Request to create a new API key.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateApiKeyRequest {
    /// Human-friendly label. Required, max 200 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// Permissions to grant. Required, at least one.
    /// PERMISSION_UNSPECIFIED values are rejected.
    #[prost(enumeration="Permission", repeated, tag="2")]
    pub permissions: ::prost::alloc::vec::Vec<i32>,
    /// Optional expiration time. If omitted, the key does not expire.
    #[prost(message, optional, tag="3")]
    pub expires_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Type of key to create. Defaults to KEY_TYPE_API_KEY.
    /// SCIM tokens use the "pidgr_scim_" prefix instead of "pidgr_k_".
    #[prost(enumeration="KeyType", tag="4")]
    pub key_type: i32,
}
/// Response after creating an API key.
/// IMPORTANT: The full key is only returned here — it cannot be retrieved later.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateApiKeyResponse {
    /// The created API key metadata.
    #[prost(message, optional, tag="1")]
    pub api_key: ::core::option::Option<ApiKey>,
    /// The full secret key value (e.g. "pidgr_k_abc12345...").
    /// Store this securely — it is not retrievable after this response.
    #[prost(string, tag="2")]
    pub key: ::prost::alloc::string::String,
}
/// Request to list all API keys in the caller's organization.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListApiKeysRequest {
    /// Optional filter by key type. Unspecified returns all keys.
    #[prost(enumeration="KeyType", tag="1")]
    pub key_type: i32,
}
/// Response containing the organization's API keys.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListApiKeysResponse {
    /// All active (non-revoked) API keys. Full key values are not included.
    #[prost(message, repeated, tag="1")]
    pub api_keys: ::prost::alloc::vec::Vec<ApiKey>,
}
/// Request to revoke an API key.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RevokeApiKeyRequest {
    /// ID of the API key to revoke. Required.
    #[prost(string, tag="1")]
    pub api_key_id: ::prost::alloc::string::String,
}
/// Response after revoking an API key.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RevokeApiKeyResponse {
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Type of API key, distinguishing platform keys from SCIM provisioning tokens.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum KeyType {
    Unspecified = 0,
    ApiKey = 1,
    ScimToken = 2,
}
impl KeyType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "KEY_TYPE_UNSPECIFIED",
            Self::ApiKey => "KEY_TYPE_API_KEY",
            Self::ScimToken => "KEY_TYPE_SCIM_TOKEN",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "KEY_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "KEY_TYPE_API_KEY" => Some(Self::ApiKey),
            "KEY_TYPE_SCIM_TOKEN" => Some(Self::ScimToken),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// Request to export all personal data associated with a user.
/// Auth: Requires JWT. Callable by the user themselves or an org admin.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ExportUserDataRequest {
    /// Internal user ID whose data is being exported.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
}
/// Response containing the export status and download location.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ExportUserDataResponse {
    /// Current status of the export request.
    #[prost(enumeration="PrivacyRequestStatus", tag="1")]
    pub status: i32,
    /// Pre-signed S3 URL to download the exported data (ZIP format).
    /// Only populated when status is COMPLETED.
    #[prost(string, tag="2")]
    pub result_url: ::prost::alloc::string::String,
    /// Unique identifier for this export request.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="3")]
    pub export_id: ::prost::alloc::string::String,
}
/// Request to export all data associated with the calling organization
/// (GDPR Art. 20 data portability at the org level). The organization is
/// extracted from the JWT — it is never in the request message.
/// Auth: Requires JWT. Org admin only.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ExportOrgDataRequest {
}
/// Response containing the org export status and download location.
/// The export workflow assembles org configuration, users, campaigns,
/// deliveries, and audit events into an encrypted bundle delivered via a
/// pre-signed S3 URL.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ExportOrgDataResponse {
    /// Current status of the export request.
    #[prost(enumeration="PrivacyRequestStatus", tag="1")]
    pub status: i32,
    /// Pre-signed S3 URL to download the exported bundle (encrypted ZIP).
    /// Only populated when status is COMPLETED.
    #[prost(string, tag="2")]
    pub result_url: ::prost::alloc::string::String,
    /// Unique identifier for this export request.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="3")]
    pub export_id: ::prost::alloc::string::String,
}
/// Request to delete or anonymize all personal data associated with a user.
/// Auth: Requires JWT. Admin only.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteUserDataRequest {
    /// Internal user ID whose data is being deleted.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// When true, PII is replaced with placeholders instead of hard-deleted.
    /// This preserves audit trail integrity while removing personal data.
    #[prost(bool, tag="2")]
    pub anonymize: bool,
}
/// Response confirming the deletion request.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteUserDataResponse {
    /// Current status of the deletion request.
    #[prost(enumeration="PrivacyRequestStatus", tag="1")]
    pub status: i32,
    /// Timestamp when deletion was completed (or scheduled).
    /// Only populated when status is COMPLETED.
    #[prost(message, optional, tag="2")]
    pub deleted_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Unique identifier for this deletion request.
    #[prost(string, tag="3")]
    pub request_id: ::prost::alloc::string::String,
}
/// Request to list privacy requests for the organization.
/// Auth: Requires JWT. Admin only.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListPrivacyRequestsRequest {
    /// Maximum number of results per page.
    /// Constraints: 1–100, default 25.
    #[prost(int32, tag="1")]
    pub page_size: i32,
    /// Continuation token from a previous response.
    #[prost(string, tag="2")]
    pub page_token: ::prost::alloc::string::String,
    /// Filter by request type (export, delete, rectify, restrict). Empty = all.
    #[prost(string, tag="3")]
    pub request_type: ::prost::alloc::string::String,
    /// Filter by status. UNSPECIFIED = all.
    #[prost(enumeration="PrivacyRequestStatus", tag="4")]
    pub status: i32,
}
/// Response containing privacy requests.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListPrivacyRequestsResponse {
    /// The privacy requests matching the filters.
    #[prost(message, repeated, tag="1")]
    pub requests: ::prost::alloc::vec::Vec<PrivacyRequest>,
    /// Token for the next page. Empty if no more results.
    #[prost(string, tag="2")]
    pub next_page_token: ::prost::alloc::string::String,
}
/// A privacy request record.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct PrivacyRequest {
    /// Unique identifier.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// The user this request applies to.
    #[prost(string, tag="2")]
    pub user_id: ::prost::alloc::string::String,
    /// Email of the target user.
    #[prost(string, tag="3")]
    pub user_email: ::prost::alloc::string::String,
    /// Type of request (export, delete, rectify, restrict).
    #[prost(string, tag="4")]
    pub request_type: ::prost::alloc::string::String,
    /// Current status.
    #[prost(enumeration="PrivacyRequestStatus", tag="5")]
    pub status: i32,
    /// Whether to anonymize (true) or hard-delete (false). Only for delete requests.
    #[prost(bool, tag="6")]
    pub anonymize: bool,
    /// Email of the admin who initiated this request.
    #[prost(string, tag="7")]
    pub requested_by_email: ::prost::alloc::string::String,
    /// When the request was created.
    #[prost(message, optional, tag="8")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// When the request was completed (if applicable).
    #[prost(message, optional, tag="9")]
    pub completed_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Additional metadata (JSON).
    #[prost(map="string, string", tag="10")]
    pub metadata: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
}
/// Request to cancel a pending deletion.
/// Auth: Requires JWT. Admin only.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CancelDeletionRequest {
    /// The privacy request ID to cancel.
    #[prost(string, tag="1")]
    pub request_id: ::prost::alloc::string::String,
    /// Admin must type the target user's email to confirm.
    #[prost(string, tag="2")]
    pub confirmation_email: ::prost::alloc::string::String,
}
/// Response confirming the cancellation.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CancelDeletionResponse {
    /// Updated status (should be FAILED with reason cancelled).
    #[prost(enumeration="PrivacyRequestStatus", tag="1")]
    pub status: i32,
}
/// Request to skip the grace period and delete immediately.
/// Auth: Requires JWT. Admin only.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ImmediateDeleteRequest {
    /// The privacy request ID to expedite.
    #[prost(string, tag="1")]
    pub request_id: ::prost::alloc::string::String,
    /// Admin must type the target user's email to confirm.
    #[prost(string, tag="2")]
    pub confirmation_email: ::prost::alloc::string::String,
}
/// Response confirming the immediate deletion was triggered.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ImmediateDeleteResponse {
    /// Updated status (should be PROCESSING).
    #[prost(enumeration="PrivacyRequestStatus", tag="1")]
    pub status: i32,
}
/// Request to correct personal data for a user.
/// Auth: Requires JWT. Callable by the user themselves or an org admin.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct RectifyUserDataRequest {
    /// Internal user ID whose data is being corrected.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// Map of field names to corrected values.
    /// Corrections are propagated to all stored locations.
    /// Constraints: Max 50 corrections per request.
    #[prost(map="string, string", tag="2")]
    pub corrections: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
}
/// Response listing which fields were successfully corrected.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RectifyUserDataResponse {
    /// Names of fields that were rectified.
    #[prost(string, repeated, tag="1")]
    pub rectified_fields: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Request to restrict or unrestrict processing for a user.
/// Auth: Requires JWT. Admin only.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RestrictProcessingRequest {
    /// Internal user ID whose processing is being restricted.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// When true, processing is restricted. When false, restriction is lifted.
    #[prost(bool, tag="2")]
    pub restricted: bool,
}
/// Response confirming the processing restriction status.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RestrictProcessingResponse {
    /// Current restriction status.
    #[prost(bool, tag="1")]
    pub restricted: bool,
    /// Timestamp when the restriction was applied or removed.
    #[prost(message, optional, tag="2")]
    pub restricted_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to confirm whether personal data exists for a user.
/// LGPD-specific: confirmação de existência (Art. 18, I).
/// Auth: Requires JWT. Admin only.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetDataExistenceConfirmationRequest {
    /// Internal user ID to check.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
}
/// Response confirming data existence and listing data categories.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetDataExistenceConfirmationResponse {
    /// Whether any personal data exists for this user.
    #[prost(bool, tag="1")]
    pub exists: bool,
    /// Categories of data stored (e.g., "profile", "deliveries", "analytics").
    #[prost(string, repeated, tag="2")]
    pub data_categories: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Request to list the calling user's own privacy requests.
/// Auth: Requires JWT. No admin permission required — returns only the caller's requests.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListMyPrivacyRequestsRequest {
    /// Maximum number of results per page.
    /// Constraints: 1–100, default 25.
    #[prost(int32, tag="1")]
    pub page_size: i32,
    /// Continuation token from a previous response.
    #[prost(string, tag="2")]
    pub page_token: ::prost::alloc::string::String,
    /// Filter by request type (export, rectify). Empty = all.
    #[prost(string, tag="3")]
    pub request_type: ::prost::alloc::string::String,
    /// Filter by status. UNSPECIFIED = all.
    #[prost(enumeration="PrivacyRequestStatus", tag="4")]
    pub status: i32,
}
/// Response containing the calling user's privacy requests.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListMyPrivacyRequestsResponse {
    /// The privacy requests belonging to the calling user.
    #[prost(message, repeated, tag="1")]
    pub requests: ::prost::alloc::vec::Vec<PrivacyRequest>,
    /// Token for the next page. Empty if no more results.
    #[prost(string, tag="2")]
    pub next_page_token: ::prost::alloc::string::String,
}
/// A security incident that touched the calling organization. Org-facing
/// read-only subset of the staff-side incident record — internal triage
/// fields (detector signal, classifier identity, evidence pointers) are
/// intentionally not exposed.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct OrgSecurityIncident {
    /// Unique identifier for the incident.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// When the observability platform detected the incident. The canonical
    /// anchor for the 72-hour GDPR Art. 33 notification clock.
    #[prost(message, optional, tag="2")]
    pub detected_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Detector-assigned severity.
    #[prost(enumeration="SecurityIncidentSeverity", tag="3")]
    pub severity: i32,
    /// Legal classification verdict. PENDING until staff triage completes.
    #[prost(enumeration="SecurityIncidentClassification", tag="4")]
    pub classification: i32,
    /// When the regulator was notified. Empty if no notification was required
    /// or it has not happened yet.
    #[prost(message, optional, tag="5")]
    pub notified_at: ::core::option::Option<::prost_types::Timestamp>,
    /// When the incident was resolved. Empty while still open.
    #[prost(message, optional, tag="6")]
    pub resolved_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to list security incidents that touched the calling organization.
/// The organization is extracted from the JWT — it is never in the request.
/// Auth: Requires JWT. Admin only.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListOrgSecurityIncidentsRequest {
    /// Maximum number of results per page.
    /// Constraints: 1–100, default 25.
    #[prost(int32, tag="1")]
    pub page_size: i32,
    /// Continuation token from a previous response.
    #[prost(string, tag="2")]
    pub page_token: ::prost::alloc::string::String,
}
/// Response containing the organization's security incident feed.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListOrgSecurityIncidentsResponse {
    /// Incidents that touched the organization, ordered by detected_at
    /// descending (newest first).
    #[prost(message, repeated, tag="1")]
    pub incidents: ::prost::alloc::vec::Vec<OrgSecurityIncident>,
    /// Token for the next page. Empty if no more results.
    #[prost(string, tag="2")]
    pub next_page_token: ::prost::alloc::string::String,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Status of a privacy request (export, delete, rectify, restrict).
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum PrivacyRequestStatus {
    /// Default value; should not be used explicitly.
    Unspecified = 0,
    /// Request has been created but not yet started.
    Pending = 1,
    /// Request is currently being processed.
    Processing = 2,
    /// Request completed successfully.
    Completed = 3,
    /// Request failed during processing.
    Failed = 4,
}
impl PrivacyRequestStatus {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "PRIVACY_REQUEST_STATUS_UNSPECIFIED",
            Self::Pending => "PRIVACY_REQUEST_STATUS_PENDING",
            Self::Processing => "PRIVACY_REQUEST_STATUS_PROCESSING",
            Self::Completed => "PRIVACY_REQUEST_STATUS_COMPLETED",
            Self::Failed => "PRIVACY_REQUEST_STATUS_FAILED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "PRIVACY_REQUEST_STATUS_UNSPECIFIED" => Some(Self::Unspecified),
            "PRIVACY_REQUEST_STATUS_PENDING" => Some(Self::Pending),
            "PRIVACY_REQUEST_STATUS_PROCESSING" => Some(Self::Processing),
            "PRIVACY_REQUEST_STATUS_COMPLETED" => Some(Self::Completed),
            "PRIVACY_REQUEST_STATUS_FAILED" => Some(Self::Failed),
            _ => None,
        }
    }
}
/// Detector-assigned severity of a security incident. Mirrors the staff-side
/// incident taxonomy; the org feed exposes the same values read-only.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum SecurityIncidentSeverity {
    /// Default value; should not be used explicitly.
    Unspecified = 0,
    /// Informational signal; no action expected.
    Info = 1,
    /// Anomalous signal under investigation.
    Warn = 2,
    /// Confirmed or suspected breach-grade signal.
    Breach = 3,
}
impl SecurityIncidentSeverity {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "SECURITY_INCIDENT_SEVERITY_UNSPECIFIED",
            Self::Info => "SECURITY_INCIDENT_SEVERITY_INFO",
            Self::Warn => "SECURITY_INCIDENT_SEVERITY_WARN",
            Self::Breach => "SECURITY_INCIDENT_SEVERITY_BREACH",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "SECURITY_INCIDENT_SEVERITY_UNSPECIFIED" => Some(Self::Unspecified),
            "SECURITY_INCIDENT_SEVERITY_INFO" => Some(Self::Info),
            "SECURITY_INCIDENT_SEVERITY_WARN" => Some(Self::Warn),
            "SECURITY_INCIDENT_SEVERITY_BREACH" => Some(Self::Breach),
            _ => None,
        }
    }
}
/// Legal classification verdict recorded by platform staff during triage.
/// Mirrors the staff-side incident taxonomy; immutable once set.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum SecurityIncidentClassification {
    /// Default value; should not be used explicitly.
    Unspecified = 0,
    /// Queued for triage; no verdict recorded yet.
    Pending = 1,
    /// Triage concluded the incident is not a breach.
    NotBreach = 2,
    /// Operational incident with no personal data involved.
    OperationalOnly = 10,
    /// Personal data breach (GDPR Art. 33 notification clock running).
    PersonalDataBreach = 11,
    /// Personal data breach with high risk to data subjects (GDPR Art. 34).
    PersonalDataBreachHighRisk = 12,
}
impl SecurityIncidentClassification {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "SECURITY_INCIDENT_CLASSIFICATION_UNSPECIFIED",
            Self::Pending => "SECURITY_INCIDENT_CLASSIFICATION_PENDING",
            Self::NotBreach => "SECURITY_INCIDENT_CLASSIFICATION_NOT_BREACH",
            Self::OperationalOnly => "SECURITY_INCIDENT_CLASSIFICATION_OPERATIONAL_ONLY",
            Self::PersonalDataBreach => "SECURITY_INCIDENT_CLASSIFICATION_PERSONAL_DATA_BREACH",
            Self::PersonalDataBreachHighRisk => "SECURITY_INCIDENT_CLASSIFICATION_PERSONAL_DATA_BREACH_HIGH_RISK",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "SECURITY_INCIDENT_CLASSIFICATION_UNSPECIFIED" => Some(Self::Unspecified),
            "SECURITY_INCIDENT_CLASSIFICATION_PENDING" => Some(Self::Pending),
            "SECURITY_INCIDENT_CLASSIFICATION_NOT_BREACH" => Some(Self::NotBreach),
            "SECURITY_INCIDENT_CLASSIFICATION_OPERATIONAL_ONLY" => Some(Self::OperationalOnly),
            "SECURITY_INCIDENT_CLASSIFICATION_PERSONAL_DATA_BREACH" => Some(Self::PersonalDataBreach),
            "SECURITY_INCIDENT_CLASSIFICATION_PERSONAL_DATA_BREACH_HIGH_RISK" => Some(Self::PersonalDataBreachHighRisk),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// An immutable audit event capturing a significant platform action.
/// Audit events are append-only — they cannot be updated or deleted.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct AuditEvent {
    /// Unique identifier for this audit event.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Organization in which the event occurred.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="2")]
    pub org_id: ::prost::alloc::string::String,
    /// User who performed the action. Empty for system-initiated events.
    /// Constraints: UUID format (36 characters) when present.
    #[prost(string, tag="3")]
    pub actor_id: ::prost::alloc::string::String,
    /// Type of action that was performed.
    #[prost(enumeration="AuditEventType", tag="4")]
    pub event_type: i32,
    /// Type of entity affected (e.g., "campaign", "user", "template").
    /// Constraints: Max length 50 characters.
    #[prost(string, tag="5")]
    pub entity_type: ::prost::alloc::string::String,
    /// Identifier of the entity affected.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="6")]
    pub entity_id: ::prost::alloc::string::String,
    /// Additional context about the event (e.g., old/new values for changes).
    /// Constraints: Max 20 key-value pairs, keys max 50 chars, values max 500 chars.
    #[prost(map="string, string", tag="7")]
    pub metadata: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
    /// True when this event is synthetic (artificially injected) data — used for
    /// demos, sandbox testing, or issue reproduction — rather than the record of
    /// a real user action.
    #[prost(bool, tag="8")]
    pub synthetic: bool,
    /// Classification of this event: MANAGEMENT for principal-initiated actions
    /// on the organization's configuration or operation, SYSTEM for high-volume
    /// data-plane events emitted during processing. The server derives the class
    /// from the event type, so events are never unclassified.
    #[prost(enumeration="AuditEventClass", tag="11")]
    pub event_class: i32,
    /// Timestamp when the event was recorded.
    #[prost(message, optional, tag="10")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to list audit events with optional filters.
/// Auth: Requires JWT. Admin only.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListAuditEventsRequest {
    /// Pagination token from a previous response.
    #[prost(string, tag="1")]
    pub page_token: ::prost::alloc::string::String,
    /// Maximum number of events to return.
    /// Constraints: Min 1, max 100. Default 50.
    #[prost(int32, tag="2")]
    pub page_size: i32,
    /// Optional filter: only return events of this type.
    #[prost(enumeration="AuditEventType", tag="3")]
    pub event_type: i32,
    /// Optional filter: only return events by this actor.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="4")]
    pub actor_id: ::prost::alloc::string::String,
    /// Optional filter: events after this timestamp (inclusive).
    #[prost(message, optional, tag="5")]
    pub start_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Optional filter: events before this timestamp (exclusive).
    #[prost(message, optional, tag="6")]
    pub end_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Optional filter: only return events in these classes.
    /// Empty means no filtering — events of all classes are returned. Because
    /// classification is derived from the event type, a non-empty filter also
    /// covers events recorded before classification existed.
    #[prost(enumeration="AuditEventClass", repeated, tag="7")]
    pub event_classes: ::prost::alloc::vec::Vec<i32>,
}
/// Response containing a paginated list of audit events.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListAuditEventsResponse {
    /// Audit events matching the request filters.
    #[prost(message, repeated, tag="1")]
    pub events: ::prost::alloc::vec::Vec<AuditEvent>,
    /// Token for fetching the next page. Empty when no more events.
    #[prost(string, tag="2")]
    pub next_page_token: ::prost::alloc::string::String,
}
/// Request to export the audit trail to S3 in a specified format.
/// Auth: Requires JWT. Admin only.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ExportAuditTrailRequest {
    /// Export format.
    #[prost(enumeration="AuditExportFormat", tag="1")]
    pub format: i32,
    /// Optional: export events after this timestamp.
    #[prost(message, optional, tag="2")]
    pub start_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Optional: export events before this timestamp.
    #[prost(message, optional, tag="3")]
    pub end_time: ::core::option::Option<::prost_types::Timestamp>,
}
/// Response containing the export download URL.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ExportAuditTrailResponse {
    /// Pre-signed S3 URL to download the exported audit trail.
    /// Only populated when status is COMPLETED.
    #[prost(string, tag="1")]
    pub export_url: ::prost::alloc::string::String,
    /// Current status of the export request.
    #[prost(enumeration="PrivacyRequestStatus", tag="2")]
    pub status: i32,
}
/// A persistent record of an audit trail export request.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AuditExport {
    /// Unique identifier.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Export format (csv, json).
    #[prost(string, tag="2")]
    pub format: ::prost::alloc::string::String,
    /// Current status.
    #[prost(enumeration="PrivacyRequestStatus", tag="3")]
    pub status: i32,
    /// Pre-signed download URL. Only populated when status is COMPLETED.
    #[prost(string, tag="4")]
    pub result_url: ::prost::alloc::string::String,
    /// Error message if the export failed.
    #[prost(string, tag="5")]
    pub error_message: ::prost::alloc::string::String,
    /// Email of the admin who requested the export.
    #[prost(string, tag="6")]
    pub requested_by_email: ::prost::alloc::string::String,
    /// When the export was requested.
    #[prost(message, optional, tag="7")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// When the export completed (if applicable).
    #[prost(message, optional, tag="8")]
    pub completed_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to list audit export history.
/// Auth: Requires JWT. Admin only.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListAuditExportsRequest {
}
/// Response containing the list of audit exports.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListAuditExportsResponse {
    /// Audit export records, newest first.
    #[prost(message, repeated, tag="1")]
    pub exports: ::prost::alloc::vec::Vec<AuditExport>,
}
/// Request to append a single audit event from an internal service.
///
/// Auth: INTERNAL-mTLS ONLY. Unlike the read-side RPCs which authenticate
/// via Cognito JWT and infer `org_id` from the caller's claim, this RPC is
/// invoked by sibling services (e.g. pidgr-integrations) over the internal
/// mTLS mesh and therefore carries `org_id` in the request payload. The
/// server MUST reject any caller presenting only a JWT.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct AppendRequest {
    /// String form of the event type. Sibling services use a stable string
    /// identifier (e.g. "REACHABILITY_UPSERT", "REACHABILITY_REMOVE") so a
    /// new event type does not require a coordinated proto release across
    /// every internal service before it can be recorded. The audit server
    /// is responsible for mapping the string into its internal taxonomy.
    #[prost(string, tag="1")]
    pub event_type: ::prost::alloc::string::String,
    /// Organization in which the event occurred. UUID.
    #[prost(string, tag="2")]
    pub org_id: ::prost::alloc::string::String,
    /// User the audit event is about, if applicable. UUID. Unset when the
    /// event is not subject-bound (e.g. an org-wide policy change).
    #[prost(string, optional, tag="3")]
    pub subject_user_id: ::core::option::Option<::prost::alloc::string::String>,
    /// Actor who initiated the action, if any. UUID. Unset for system-initiated
    /// or sibling-service-initiated events.
    #[prost(string, optional, tag="4")]
    pub actor_id: ::core::option::Option<::prost::alloc::string::String>,
    /// Structured event-specific payload. Used in lieu of the rigid
    /// `map<string, string> metadata` on `AuditEvent` so sibling services
    /// can record nested objects (e.g. a `prefetch_signals` block) without
    /// string-encoding every value. Servers SHOULD redact PII before persist
    /// and MUST NOT log this field at INFO or above. Sensitive cryptographic
    /// material (plaintext identifiers, envelope ciphertext, raw HMAC keys)
    /// MUST NOT be placed here.
    #[prost(message, optional, tag="5")]
    pub details: ::core::option::Option<::prost_types::Struct>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AppendResponse {
    /// Server-assigned audit event identifier (UUID).
    #[prost(string, tag="1")]
    pub event_id: ::prost::alloc::string::String,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Type of auditable platform action.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum AuditEventType {
    /// Default value; should not be used explicitly.
    Unspecified = 0,
    /// ── Campaign lifecycle ───────────────────────────────────────────────────
    /// A campaign was created.
    CampaignCreated = 1,
    /// A message was sent to a recipient.
    MessageSent = 2,
    /// A message was opened by a recipient.
    MessageOpened = 3,
    /// A recipient acknowledged a campaign.
    AckRegistered = 4,
    /// An escalation was triggered by the workflow.
    EscalationExecuted = 5,
    /// A campaign was started.
    CampaignStarted = 12,
    /// A campaign was cancelled.
    CampaignCancelled = 13,
    /// A campaign was updated.
    CampaignUpdated = 14,
    /// ── User lifecycle ───────────────────────────────────────────────────────
    /// A user was invited to the organization.
    UserInvited = 6,
    /// A user was deactivated.
    UserDeactivated = 7,
    /// A user was reactivated.
    UserReactivated = 15,
    /// A user's role was changed (assigned to a different role).
    RoleChanged = 10,
    /// A user's invite was revoked.
    InviteRevoked = 16,
    /// A user's profile was updated.
    ProfileUpdated = 17,
    /// A user's settings were updated.
    SettingsUpdated = 18,
    /// A user enrolled a passkey.
    PasskeyEnrolled = 19,
    /// ── GDPR / Privacy ──────────────────────────────────────────────────────
    /// A data export was requested (GDPR Art. 15).
    DataExportRequested = 8,
    /// A data deletion was requested (GDPR Art. 17).
    DataDeletionRequested = 9,
    /// User data was rectified (GDPR Art. 16).
    DataRectified = 20,
    /// Data processing was restricted (GDPR Art. 18).
    ProcessingRestricted = 21,
    /// A scheduled deletion was cancelled.
    DeletionCancelled = 22,
    /// An immediate deletion was executed.
    DeletionImmediate = 23,
    /// ── Organization / SSO ───────────────────────────────────────────────────
    /// An SSO provider was configured.
    SsoConfigured = 11,
    /// An SSO provider was created.
    SsoProviderCreated = 24,
    /// An SSO provider was deleted.
    SsoProviderDeleted = 25,
    /// Organization settings were updated.
    OrgUpdated = 26,
    /// ── Roles ────────────────────────────────────────────────────────────────
    /// A role was created.
    RoleCreated = 27,
    /// A role's name or permissions were updated.
    RoleUpdated = 28,
    /// A role was deleted.
    RoleDeleted = 29,
    /// ── Templates ────────────────────────────────────────────────────────────
    /// A template was created.
    TemplateCreated = 30,
    /// A template was updated.
    TemplateUpdated = 31,
    /// ── API Keys ─────────────────────────────────────────────────────────────
    /// An API key was created.
    ApiKeyCreated = 32,
    /// An API key was revoked.
    ApiKeyRevoked = 33,
    /// ── Invite Links ─────────────────────────────────────────────────────────
    /// An invite link was created.
    InviteLinkCreated = 34,
    /// An invite link was revoked.
    InviteLinkRevoked = 35,
    /// ── Groups ───────────────────────────────────────────────────────────────
    /// A group was created.
    GroupCreated = 36,
    /// A group was updated.
    GroupUpdated = 37,
    /// A group was deleted.
    GroupDeleted = 38,
    /// Members were added to a group.
    GroupMembersAdded = 39,
    /// Members were removed from a group.
    GroupMembersRemoved = 40,
    /// ── Teams ────────────────────────────────────────────────────────────────
    /// A team was created.
    TeamCreated = 41,
    /// A team was updated.
    TeamUpdated = 42,
    /// A team was deleted.
    TeamDeleted = 43,
    /// Members were added to a team.
    TeamMembersAdded = 44,
    /// Members were removed from a team.
    TeamMembersRemoved = 45,
    /// ── SCIM Provisioning ───────────────────────────────────────────────────
    /// A user was provisioned via SCIM.
    ScimUserProvisioned = 46,
    /// A user was deprovisioned via SCIM.
    ScimUserDeprovisioned = 47,
    /// A user was updated via SCIM.
    ScimUserUpdated = 48,
    /// ── Translations ────────────────────────────────────────────────────────
    /// A template translation was created.
    TranslationCreated = 49,
    /// A template translation was approved.
    TranslationApproved = 50,
    /// ── Sandbox Orgs ────────────────────────────────────────────────────────
    /// A sandbox organization was created.
    SandboxCreated = 51,
    /// A sandbox organization expired and was deleted.
    SandboxExpired = 52,
    /// ── AI/Insights ─────────────────────────────────────────────────────────
    /// An AI prediction was served and logged (EU AI Act Art. 12).
    AiPredictionLogged = 53,
    /// The ML pipeline (archetype clustering + enrichment) was manually triggered.
    MlPipelineTriggered = 54,
    /// Per-group archetype clustering was manually triggered.
    ArchetypeClusteringTriggered = 55,
    /// ── Org lifecycle ───────────────────────────────────────────────────────
    /// An organization was created.
    OrgCreated = 56,
    /// An organization was deleted (sandbox cleanup or manual deletion).
    OrgDeleted = 57,
    /// ── Reachability registry (pidgr-integrations) ──────────────────────────
    /// A reachability identifier (email, phone, Slack ID, etc.) was upserted.
    /// GDPR-relevant per Chikorita audit classification.
    ReachabilityUpsert = 58,
    /// A reachability identifier was removed. GDPR Art. 17 "right to erasure"
    /// event; written BEFORE the registry row is deleted per Recital 30.
    ReachabilityRemove = 59,
    /// ── KMS envelope encryption ─────────────────────────────────────────────
    /// A payload was envelope-encrypted with a KMS-managed key.
    KmsEncrypt = 60,
    /// A payload was decrypted with a KMS-managed key.
    KmsDecrypt = 61,
}
impl AuditEventType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "AUDIT_EVENT_TYPE_UNSPECIFIED",
            Self::CampaignCreated => "AUDIT_EVENT_TYPE_CAMPAIGN_CREATED",
            Self::MessageSent => "AUDIT_EVENT_TYPE_MESSAGE_SENT",
            Self::MessageOpened => "AUDIT_EVENT_TYPE_MESSAGE_OPENED",
            Self::AckRegistered => "AUDIT_EVENT_TYPE_ACK_REGISTERED",
            Self::EscalationExecuted => "AUDIT_EVENT_TYPE_ESCALATION_EXECUTED",
            Self::CampaignStarted => "AUDIT_EVENT_TYPE_CAMPAIGN_STARTED",
            Self::CampaignCancelled => "AUDIT_EVENT_TYPE_CAMPAIGN_CANCELLED",
            Self::CampaignUpdated => "AUDIT_EVENT_TYPE_CAMPAIGN_UPDATED",
            Self::UserInvited => "AUDIT_EVENT_TYPE_USER_INVITED",
            Self::UserDeactivated => "AUDIT_EVENT_TYPE_USER_DEACTIVATED",
            Self::UserReactivated => "AUDIT_EVENT_TYPE_USER_REACTIVATED",
            Self::RoleChanged => "AUDIT_EVENT_TYPE_ROLE_CHANGED",
            Self::InviteRevoked => "AUDIT_EVENT_TYPE_INVITE_REVOKED",
            Self::ProfileUpdated => "AUDIT_EVENT_TYPE_PROFILE_UPDATED",
            Self::SettingsUpdated => "AUDIT_EVENT_TYPE_SETTINGS_UPDATED",
            Self::PasskeyEnrolled => "AUDIT_EVENT_TYPE_PASSKEY_ENROLLED",
            Self::DataExportRequested => "AUDIT_EVENT_TYPE_DATA_EXPORT_REQUESTED",
            Self::DataDeletionRequested => "AUDIT_EVENT_TYPE_DATA_DELETION_REQUESTED",
            Self::DataRectified => "AUDIT_EVENT_TYPE_DATA_RECTIFIED",
            Self::ProcessingRestricted => "AUDIT_EVENT_TYPE_PROCESSING_RESTRICTED",
            Self::DeletionCancelled => "AUDIT_EVENT_TYPE_DELETION_CANCELLED",
            Self::DeletionImmediate => "AUDIT_EVENT_TYPE_DELETION_IMMEDIATE",
            Self::SsoConfigured => "AUDIT_EVENT_TYPE_SSO_CONFIGURED",
            Self::SsoProviderCreated => "AUDIT_EVENT_TYPE_SSO_PROVIDER_CREATED",
            Self::SsoProviderDeleted => "AUDIT_EVENT_TYPE_SSO_PROVIDER_DELETED",
            Self::OrgUpdated => "AUDIT_EVENT_TYPE_ORG_UPDATED",
            Self::RoleCreated => "AUDIT_EVENT_TYPE_ROLE_CREATED",
            Self::RoleUpdated => "AUDIT_EVENT_TYPE_ROLE_UPDATED",
            Self::RoleDeleted => "AUDIT_EVENT_TYPE_ROLE_DELETED",
            Self::TemplateCreated => "AUDIT_EVENT_TYPE_TEMPLATE_CREATED",
            Self::TemplateUpdated => "AUDIT_EVENT_TYPE_TEMPLATE_UPDATED",
            Self::ApiKeyCreated => "AUDIT_EVENT_TYPE_API_KEY_CREATED",
            Self::ApiKeyRevoked => "AUDIT_EVENT_TYPE_API_KEY_REVOKED",
            Self::InviteLinkCreated => "AUDIT_EVENT_TYPE_INVITE_LINK_CREATED",
            Self::InviteLinkRevoked => "AUDIT_EVENT_TYPE_INVITE_LINK_REVOKED",
            Self::GroupCreated => "AUDIT_EVENT_TYPE_GROUP_CREATED",
            Self::GroupUpdated => "AUDIT_EVENT_TYPE_GROUP_UPDATED",
            Self::GroupDeleted => "AUDIT_EVENT_TYPE_GROUP_DELETED",
            Self::GroupMembersAdded => "AUDIT_EVENT_TYPE_GROUP_MEMBERS_ADDED",
            Self::GroupMembersRemoved => "AUDIT_EVENT_TYPE_GROUP_MEMBERS_REMOVED",
            Self::TeamCreated => "AUDIT_EVENT_TYPE_TEAM_CREATED",
            Self::TeamUpdated => "AUDIT_EVENT_TYPE_TEAM_UPDATED",
            Self::TeamDeleted => "AUDIT_EVENT_TYPE_TEAM_DELETED",
            Self::TeamMembersAdded => "AUDIT_EVENT_TYPE_TEAM_MEMBERS_ADDED",
            Self::TeamMembersRemoved => "AUDIT_EVENT_TYPE_TEAM_MEMBERS_REMOVED",
            Self::ScimUserProvisioned => "AUDIT_EVENT_TYPE_SCIM_USER_PROVISIONED",
            Self::ScimUserDeprovisioned => "AUDIT_EVENT_TYPE_SCIM_USER_DEPROVISIONED",
            Self::ScimUserUpdated => "AUDIT_EVENT_TYPE_SCIM_USER_UPDATED",
            Self::TranslationCreated => "AUDIT_EVENT_TYPE_TRANSLATION_CREATED",
            Self::TranslationApproved => "AUDIT_EVENT_TYPE_TRANSLATION_APPROVED",
            Self::SandboxCreated => "AUDIT_EVENT_TYPE_SANDBOX_CREATED",
            Self::SandboxExpired => "AUDIT_EVENT_TYPE_SANDBOX_EXPIRED",
            Self::AiPredictionLogged => "AUDIT_EVENT_TYPE_AI_PREDICTION_LOGGED",
            Self::MlPipelineTriggered => "AUDIT_EVENT_TYPE_ML_PIPELINE_TRIGGERED",
            Self::ArchetypeClusteringTriggered => "AUDIT_EVENT_TYPE_ARCHETYPE_CLUSTERING_TRIGGERED",
            Self::OrgCreated => "AUDIT_EVENT_TYPE_ORG_CREATED",
            Self::OrgDeleted => "AUDIT_EVENT_TYPE_ORG_DELETED",
            Self::ReachabilityUpsert => "AUDIT_EVENT_TYPE_REACHABILITY_UPSERT",
            Self::ReachabilityRemove => "AUDIT_EVENT_TYPE_REACHABILITY_REMOVE",
            Self::KmsEncrypt => "AUDIT_EVENT_TYPE_KMS_ENCRYPT",
            Self::KmsDecrypt => "AUDIT_EVENT_TYPE_KMS_DECRYPT",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "AUDIT_EVENT_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "AUDIT_EVENT_TYPE_CAMPAIGN_CREATED" => Some(Self::CampaignCreated),
            "AUDIT_EVENT_TYPE_MESSAGE_SENT" => Some(Self::MessageSent),
            "AUDIT_EVENT_TYPE_MESSAGE_OPENED" => Some(Self::MessageOpened),
            "AUDIT_EVENT_TYPE_ACK_REGISTERED" => Some(Self::AckRegistered),
            "AUDIT_EVENT_TYPE_ESCALATION_EXECUTED" => Some(Self::EscalationExecuted),
            "AUDIT_EVENT_TYPE_CAMPAIGN_STARTED" => Some(Self::CampaignStarted),
            "AUDIT_EVENT_TYPE_CAMPAIGN_CANCELLED" => Some(Self::CampaignCancelled),
            "AUDIT_EVENT_TYPE_CAMPAIGN_UPDATED" => Some(Self::CampaignUpdated),
            "AUDIT_EVENT_TYPE_USER_INVITED" => Some(Self::UserInvited),
            "AUDIT_EVENT_TYPE_USER_DEACTIVATED" => Some(Self::UserDeactivated),
            "AUDIT_EVENT_TYPE_USER_REACTIVATED" => Some(Self::UserReactivated),
            "AUDIT_EVENT_TYPE_ROLE_CHANGED" => Some(Self::RoleChanged),
            "AUDIT_EVENT_TYPE_INVITE_REVOKED" => Some(Self::InviteRevoked),
            "AUDIT_EVENT_TYPE_PROFILE_UPDATED" => Some(Self::ProfileUpdated),
            "AUDIT_EVENT_TYPE_SETTINGS_UPDATED" => Some(Self::SettingsUpdated),
            "AUDIT_EVENT_TYPE_PASSKEY_ENROLLED" => Some(Self::PasskeyEnrolled),
            "AUDIT_EVENT_TYPE_DATA_EXPORT_REQUESTED" => Some(Self::DataExportRequested),
            "AUDIT_EVENT_TYPE_DATA_DELETION_REQUESTED" => Some(Self::DataDeletionRequested),
            "AUDIT_EVENT_TYPE_DATA_RECTIFIED" => Some(Self::DataRectified),
            "AUDIT_EVENT_TYPE_PROCESSING_RESTRICTED" => Some(Self::ProcessingRestricted),
            "AUDIT_EVENT_TYPE_DELETION_CANCELLED" => Some(Self::DeletionCancelled),
            "AUDIT_EVENT_TYPE_DELETION_IMMEDIATE" => Some(Self::DeletionImmediate),
            "AUDIT_EVENT_TYPE_SSO_CONFIGURED" => Some(Self::SsoConfigured),
            "AUDIT_EVENT_TYPE_SSO_PROVIDER_CREATED" => Some(Self::SsoProviderCreated),
            "AUDIT_EVENT_TYPE_SSO_PROVIDER_DELETED" => Some(Self::SsoProviderDeleted),
            "AUDIT_EVENT_TYPE_ORG_UPDATED" => Some(Self::OrgUpdated),
            "AUDIT_EVENT_TYPE_ROLE_CREATED" => Some(Self::RoleCreated),
            "AUDIT_EVENT_TYPE_ROLE_UPDATED" => Some(Self::RoleUpdated),
            "AUDIT_EVENT_TYPE_ROLE_DELETED" => Some(Self::RoleDeleted),
            "AUDIT_EVENT_TYPE_TEMPLATE_CREATED" => Some(Self::TemplateCreated),
            "AUDIT_EVENT_TYPE_TEMPLATE_UPDATED" => Some(Self::TemplateUpdated),
            "AUDIT_EVENT_TYPE_API_KEY_CREATED" => Some(Self::ApiKeyCreated),
            "AUDIT_EVENT_TYPE_API_KEY_REVOKED" => Some(Self::ApiKeyRevoked),
            "AUDIT_EVENT_TYPE_INVITE_LINK_CREATED" => Some(Self::InviteLinkCreated),
            "AUDIT_EVENT_TYPE_INVITE_LINK_REVOKED" => Some(Self::InviteLinkRevoked),
            "AUDIT_EVENT_TYPE_GROUP_CREATED" => Some(Self::GroupCreated),
            "AUDIT_EVENT_TYPE_GROUP_UPDATED" => Some(Self::GroupUpdated),
            "AUDIT_EVENT_TYPE_GROUP_DELETED" => Some(Self::GroupDeleted),
            "AUDIT_EVENT_TYPE_GROUP_MEMBERS_ADDED" => Some(Self::GroupMembersAdded),
            "AUDIT_EVENT_TYPE_GROUP_MEMBERS_REMOVED" => Some(Self::GroupMembersRemoved),
            "AUDIT_EVENT_TYPE_TEAM_CREATED" => Some(Self::TeamCreated),
            "AUDIT_EVENT_TYPE_TEAM_UPDATED" => Some(Self::TeamUpdated),
            "AUDIT_EVENT_TYPE_TEAM_DELETED" => Some(Self::TeamDeleted),
            "AUDIT_EVENT_TYPE_TEAM_MEMBERS_ADDED" => Some(Self::TeamMembersAdded),
            "AUDIT_EVENT_TYPE_TEAM_MEMBERS_REMOVED" => Some(Self::TeamMembersRemoved),
            "AUDIT_EVENT_TYPE_SCIM_USER_PROVISIONED" => Some(Self::ScimUserProvisioned),
            "AUDIT_EVENT_TYPE_SCIM_USER_DEPROVISIONED" => Some(Self::ScimUserDeprovisioned),
            "AUDIT_EVENT_TYPE_SCIM_USER_UPDATED" => Some(Self::ScimUserUpdated),
            "AUDIT_EVENT_TYPE_TRANSLATION_CREATED" => Some(Self::TranslationCreated),
            "AUDIT_EVENT_TYPE_TRANSLATION_APPROVED" => Some(Self::TranslationApproved),
            "AUDIT_EVENT_TYPE_SANDBOX_CREATED" => Some(Self::SandboxCreated),
            "AUDIT_EVENT_TYPE_SANDBOX_EXPIRED" => Some(Self::SandboxExpired),
            "AUDIT_EVENT_TYPE_AI_PREDICTION_LOGGED" => Some(Self::AiPredictionLogged),
            "AUDIT_EVENT_TYPE_ML_PIPELINE_TRIGGERED" => Some(Self::MlPipelineTriggered),
            "AUDIT_EVENT_TYPE_ARCHETYPE_CLUSTERING_TRIGGERED" => Some(Self::ArchetypeClusteringTriggered),
            "AUDIT_EVENT_TYPE_ORG_CREATED" => Some(Self::OrgCreated),
            "AUDIT_EVENT_TYPE_ORG_DELETED" => Some(Self::OrgDeleted),
            "AUDIT_EVENT_TYPE_REACHABILITY_UPSERT" => Some(Self::ReachabilityUpsert),
            "AUDIT_EVENT_TYPE_REACHABILITY_REMOVE" => Some(Self::ReachabilityRemove),
            "AUDIT_EVENT_TYPE_KMS_ENCRYPT" => Some(Self::KmsEncrypt),
            "AUDIT_EVENT_TYPE_KMS_DECRYPT" => Some(Self::KmsDecrypt),
            _ => None,
        }
    }
}
/// Classification of an audit event by origin and volume profile, separating
/// management actions (human-initiated configuration changes) from high-volume
/// system events emitted automatically during processing.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum AuditEventClass {
    /// Default value; should not be used explicitly.
    Unspecified = 0,
    /// An action initiated by a principal against the organization's
    /// configuration or operation (e.g. creating a campaign, changing a role).
    Management = 1,
    /// A high-volume data-plane event emitted by the system during processing
    /// (e.g. per-payload encryption or decryption).
    System = 2,
}
impl AuditEventClass {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "AUDIT_EVENT_CLASS_UNSPECIFIED",
            Self::Management => "AUDIT_EVENT_CLASS_MANAGEMENT",
            Self::System => "AUDIT_EVENT_CLASS_SYSTEM",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "AUDIT_EVENT_CLASS_UNSPECIFIED" => Some(Self::Unspecified),
            "AUDIT_EVENT_CLASS_MANAGEMENT" => Some(Self::Management),
            "AUDIT_EVENT_CLASS_SYSTEM" => Some(Self::System),
            _ => None,
        }
    }
}
/// Format for audit trail export.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum AuditExportFormat {
    /// Default value; should not be used explicitly.
    Unspecified = 0,
    /// Comma-separated values.
    Csv = 1,
    /// JSON lines format.
    Json = 2,
    /// Apache Parquet columnar format.
    Parquet = 3,
}
impl AuditExportFormat {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "AUDIT_EXPORT_FORMAT_UNSPECIFIED",
            Self::Csv => "AUDIT_EXPORT_FORMAT_CSV",
            Self::Json => "AUDIT_EXPORT_FORMAT_JSON",
            Self::Parquet => "AUDIT_EXPORT_FORMAT_PARQUET",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "AUDIT_EXPORT_FORMAT_UNSPECIFIED" => Some(Self::Unspecified),
            "AUDIT_EXPORT_FORMAT_CSV" => Some(Self::Csv),
            "AUDIT_EXPORT_FORMAT_JSON" => Some(Self::Json),
            "AUDIT_EXPORT_FORMAT_PARQUET" => Some(Self::Parquet),
            _ => None,
        }
    }
}
// ─── Messages ─────────────────────────────────────────────────────────────────

/// Request to resolve the effective permission set for one principal.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ResolvePrincipalPermissionsRequest {
    /// UUID of the subject whose permissions are being resolved (user or
    /// principal identifier).
    #[prost(string, tag="1")]
    pub subject: ::prost::alloc::string::String,
    /// Organization the resolution is scoped to.
    #[prost(string, tag="2")]
    pub org_id: ::prost::alloc::string::String,
    /// Kind of principal identified by `subject`.
    #[prost(enumeration="PrincipalType", tag="3")]
    pub principal_type: i32,
}
/// Effective permissions resolved for the requested principal.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ResolvePrincipalPermissionsResponse {
    /// Flattened, deduplicated set of permissions granted to the principal in
    /// the requested organization. Empty when the principal has no grants.
    #[prost(enumeration="Permission", repeated, tag="1")]
    pub permissions: ::prost::alloc::vec::Vec<i32>,
}
/// Request to check the current suspension state of one organization.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CheckOrgSuspendedRequest {
    /// Organization whose suspension state is being checked.
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
}
/// Current suspension state of the requested organization.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CheckOrgSuspendedResponse {
    /// True when the organization is currently suspended.
    #[prost(bool, tag="1")]
    pub suspended: bool,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Kind of principal whose permissions are being resolved.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum PrincipalType {
    Unspecified = 0,
    /// An end user identified by their user UUID, scoped to one organization.
    User = 1,
    /// An organization acting as its own principal (e.g. a service identity
    /// operating on behalf of the whole org rather than a member).
    Org = 2,
    /// A platform staff principal whose permissions derive from a role within
    /// the ORG_TYPE_STAFF organization.
    Staff = 3,
}
impl PrincipalType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "PRINCIPAL_TYPE_UNSPECIFIED",
            Self::User => "PRINCIPAL_TYPE_USER",
            Self::Org => "PRINCIPAL_TYPE_ORG",
            Self::Staff => "PRINCIPAL_TYPE_STAFF",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "PRINCIPAL_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "PRINCIPAL_TYPE_USER" => Some(Self::User),
            "PRINCIPAL_TYPE_ORG" => Some(Self::Org),
            "PRINCIPAL_TYPE_STAFF" => Some(Self::Staff),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A campaign that delivers structured messages to a set of recipients
/// and tracks their engagement through a workflow.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Campaign {
    /// Unique identifier for the campaign.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Human-readable campaign name.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// ID of the template used to render messages.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="3")]
    pub template_id: ::prost::alloc::string::String,
    /// Pinned version of the template used for this campaign.
    #[prost(int32, tag="4")]
    pub template_version: i32,
    /// Object storage reference to the audience snapshot taken at campaign creation.
    #[prost(string, tag="5")]
    pub audience_snapshot_ref: ::prost::alloc::string::String,
    /// Current lifecycle status of the campaign.
    #[prost(enumeration="CampaignStatus", tag="6")]
    pub status: i32,
    /// Workflow DAG that drives the campaign's automation logic.
    #[prost(message, optional, tag="7")]
    pub workflow: ::core::option::Option<WorkflowDefinition>,
    /// Total number of recipients in the audience snapshot.
    #[prost(int32, tag="8")]
    pub total_recipients: i32,
    /// Number of recipients who completed the required action.
    #[prost(int32, tag="9")]
    pub action_completed_count: i32,
    /// Number of recipients who did not act before the deadline.
    #[prost(int32, tag="10")]
    pub missed_count: i32,
    /// Timestamp when the campaign was created.
    #[prost(message, optional, tag="11")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the campaign was started (workflow execution began).
    #[prost(message, optional, tag="12")]
    pub started_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the campaign finished (completed, failed, or cancelled).
    #[prost(message, optional, tag="13")]
    pub completed_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Display name of the sender shown to recipients (e.g. "HR Team").
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="14")]
    pub sender_name: ::prost::alloc::string::String,
    /// Optional user-facing title override. If set, takes precedence over the template title.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="15")]
    pub title: ::prost::alloc::string::String,
    /// Whether this campaign's notifications break through Do Not Disturb / Focus mode.
    #[prost(bool, tag="16")]
    pub critical: bool,
    /// Optional locale override for all recipients in this campaign.
    /// When set, all recipients receive the campaign in this locale regardless of
    /// their preferred_locale. Empty means per-recipient locale resolution.
    /// Valid values: en, es, pt-BR, zh, ja.
    #[prost(string, tag="17")]
    pub default_locale: ::prost::alloc::string::String,
    /// Whether the campaign deadline waits for users without registered devices.
    /// When true, NO_DEVICE users remain in pending_count and can acknowledge
    /// via inbox after installing the app. Default false preserves current behavior.
    #[prost(bool, tag="18")]
    pub wait_for_enrollment: bool,
    /// Optional. Set when the campaign was created from a Compass archetype CTA.
    /// Drives post-campaign archetype-response analytics.
    #[prost(message, optional, tag="19")]
    pub originating_archetype: ::core::option::Option<CampaignOriginatingArchetype>,
    /// True when this campaign contains synthetic (artificially injected) data —
    /// created or populated for demos, sandbox testing, or issue reproduction.
    #[prost(bool, tag="20")]
    pub synthetic: bool,
    /// Number of recipients frozen in the audience snapshot at creation time.
    /// Unlike total_recipients (which counts deliveries and is 0 until the
    /// campaign starts), this is known as soon as the campaign exists.
    /// 0 when the campaign predates snapshot-size tracking.
    #[prost(int32, tag="21")]
    pub audience_snapshot_size: i32,
    /// Number of members currently eligible for this campaign's audience,
    /// computed at read time. Compare with audience_snapshot_size to see how far
    /// the frozen audience has drifted from the present membership.
    #[prost(int32, tag="22")]
    pub current_audience_size: i32,
    /// True when the frozen audience no longer covers the current eligible
    /// membership (current_audience_size > audience_snapshot_size). Clients
    /// should surface this before the campaign is started: recipients added
    /// after creation are NOT reached unless the campaign is recreated.
    #[prost(bool, tag="23")]
    pub audience_snapshot_stale: bool,
    /// Live execution position of the campaign's workflow. Unset until the
    /// campaign starts and after it reaches a terminal state. Distinct from
    /// per-recipient delivery state: this reports which workflow step the
    /// engine is executing (or waiting on), independent of whether any
    /// recipient has acted.
    #[prost(message, optional, tag="24")]
    pub workflow_progress: ::core::option::Option<CampaignWorkflowProgress>,
    /// Objectives this campaign serves, as declared at creation or linked
    /// afterwards. Empty is allowed and carries no penalty: a campaign
    /// with no declared objective behaves exactly like one that predates
    /// objectives entirely.
    #[prost(string, repeated, tag="25")]
    pub objective_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Live execution position of a running campaign's workflow, recorded by
/// the campaign worker as steps transition. Lets clients render true
/// engine progress (e.g. "waiting on a deadline until T") instead of
/// inferring it from recipient delivery activity, which never observes
/// timer-only steps.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CampaignWorkflowProgress {
    /// Workflow-definition step id (WorkflowStep.id) currently executing or
    /// being waited on.
    #[prost(string, tag="1")]
    pub current_step_id: ::prost::alloc::string::String,
    /// When the workflow entered the current step.
    #[prost(message, optional, tag="2")]
    pub step_entered_at: ::core::option::Option<::prost_types::Timestamp>,
    /// For timer-backed steps (e.g. deadline checks): when the pending timer
    /// fires. Unset for steps that complete without waiting.
    #[prost(message, optional, tag="3")]
    pub next_wake_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Identifies the archetype that motivated the creation of a campaign.
/// The audience is NOT filtered by archetype membership — this is metadata
/// about the campaign's authoring intent only. See OpenSpec change
/// archetype-targeted-campaign-cta.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CampaignOriginatingArchetype {
    /// UUID of the group whose archetype set the label belongs to.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
    /// Stable archetype label (e.g., "Swift Acknowledger"). Labels are stable
    /// across clustering retrains; archetype IDs are not.
    #[prost(string, tag="2")]
    pub archetype_label: ::prost::alloc::string::String,
}
/// A single audience member with optional per-user template variables.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct AudienceMember {
    /// User ID (UUID).
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// Template variable values for this user (e.g. {"name": "Alice"}).
    #[prost(map="string, string", tag="2")]
    pub variables: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
}
/// Request to create a new campaign.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateCampaignRequest {
    /// Human-readable campaign name (admin-facing label).
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// ID of the template to use for rendering messages.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="2")]
    pub template_id: ::prost::alloc::string::String,
    /// Version of the template to pin for this campaign.
    #[prost(int32, tag="3")]
    pub template_version: i32,
    /// List of user IDs that form the campaign audience.
    /// Constraints: Max 100000 items.
    #[prost(string, repeated, tag="4")]
    pub user_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// Workflow DAG defining the campaign's automation steps.
    /// Required: CreateCampaign rejects a request with no workflow
    /// (INVALID_ARGUMENT) and does not substitute a default. The definition
    /// MUST validate as an acyclic graph of well-formed steps.
    #[prost(message, optional, tag="5")]
    pub workflow: ::core::option::Option<WorkflowDefinition>,
    /// Display name of the sender shown to recipients (e.g. "HR Team").
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="6")]
    pub sender_name: ::prost::alloc::string::String,
    /// Optional user-facing title override. If empty, the template title is used.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="7")]
    pub title: ::prost::alloc::string::String,
    /// Rich audience with per-user template variables.
    /// When set, takes precedence over user_ids.
    /// Constraints: Max 100000 items.
    #[prost(message, repeated, tag="8")]
    pub audience: ::prost::alloc::vec::Vec<AudienceMember>,
    /// Whether to include users with processing_restricted=true in the audience.
    /// Default false: restricted users are excluded. Set true only with Art. 18(2) legal basis.
    #[prost(bool, tag="9")]
    pub include_restricted: bool,
    /// Whether this campaign's notifications break through Do Not Disturb / Focus mode.
    #[prost(bool, tag="10")]
    pub critical: bool,
    /// Optional locale override for all recipients.
    #[prost(string, tag="11")]
    pub default_locale: ::prost::alloc::string::String,
    /// Whether the campaign deadline should wait for users without registered devices.
    /// When true, NO_DEVICE users are not decremented from pending_count,
    /// allowing them to acknowledge via inbox after installing the app.
    #[prost(bool, tag="12")]
    pub wait_for_enrollment: bool,
    /// Optional. Set when the campaign is created from a Compass archetype CTA.
    /// The server validates the caller has access to group_id and that
    /// archetype_label exists in the group's current archetype set; cross-org
    /// group_id returns PERMISSION_DENIED, unknown label returns NOT_FOUND.
    #[prost(message, optional, tag="13")]
    pub originating_archetype: ::core::option::Option<CampaignOriginatingArchetype>,
    /// Objectives this campaign serves. Declaring the objective at
    /// creation is the point at which a response rate stops being the
    /// result and becomes evidence about something the organization was
    /// trying to achieve. Empty is allowed and changes nothing about how
    /// the campaign runs. Unknown or cross-org IDs return NOT_FOUND.
    #[prost(string, repeated, tag="14")]
    pub objective_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Response after creating a campaign.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateCampaignResponse {
    /// The newly created campaign.
    #[prost(message, optional, tag="1")]
    pub campaign: ::core::option::Option<Campaign>,
}
/// Request to start a campaign's workflow execution.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct StartCampaignRequest {
    /// ID of the campaign to start.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
}
/// Response after starting a campaign.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct StartCampaignResponse {
    /// The campaign with updated status.
    #[prost(message, optional, tag="1")]
    pub campaign: ::core::option::Option<Campaign>,
}
/// Request to retrieve a single campaign by ID.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCampaignRequest {
    /// ID of the campaign to retrieve.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
}
/// Response containing the requested campaign.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetCampaignResponse {
    /// The requested campaign.
    #[prost(message, optional, tag="1")]
    pub campaign: ::core::option::Option<Campaign>,
}
/// Request to list campaigns with pagination.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListCampaignsRequest {
    /// Pagination parameters.
    #[prost(message, optional, tag="1")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of campaigns.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListCampaignsResponse {
    /// List of campaigns in this page.
    #[prost(message, repeated, tag="1")]
    pub campaigns: ::prost::alloc::vec::Vec<Campaign>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to cancel a running campaign.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CancelCampaignRequest {
    /// ID of the campaign to cancel.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
}
/// Response after cancelling a campaign.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CancelCampaignResponse {
    /// The campaign with updated status (CANCELLED).
    #[prost(message, optional, tag="1")]
    pub campaign: ::core::option::Option<Campaign>,
}
/// Request to update a draft campaign (status must be CREATED).
/// Only non-empty/non-zero fields are updated; omitted fields remain unchanged.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateCampaignRequest {
    /// ID of the campaign to update.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Updated campaign name. Empty string means no change.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// Updated sender display name. Empty string means no change.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="3")]
    pub sender_name: ::prost::alloc::string::String,
    /// Updated title override. Empty string means no change.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="4")]
    pub title: ::prost::alloc::string::String,
    /// Updated template ID. Empty string means no change.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="5")]
    pub template_id: ::prost::alloc::string::String,
    /// Updated template version. Zero means no change.
    #[prost(int32, tag="6")]
    pub template_version: i32,
    /// Updated workflow DAG. Null/omitted means no change.
    #[prost(message, optional, tag="7")]
    pub workflow: ::core::option::Option<WorkflowDefinition>,
    /// Replaces the campaign's frozen audience snapshot. Omitted means no
    /// change; PRESENT means replace — including with an empty member list
    /// (a campaign with no recipients is a valid state). The wrapper message
    /// exists exactly for that presence distinction, which a bare repeated
    /// field cannot express. Only valid while the campaign is in CREATED
    /// status; the server rejects the replacement once the campaign has
    /// started, since deliveries were already created from the old snapshot.
    #[prost(message, optional, tag="8")]
    pub audience_replacement: ::core::option::Option<AudienceReplacement>,
}
/// A full replacement for a campaign's frozen audience. Presence of this
/// message (not its member count) signals the replace intent.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct AudienceReplacement {
    /// The new complete audience. Replaces the previous snapshot wholesale.
    #[prost(message, repeated, tag="1")]
    pub members: ::prost::alloc::vec::Vec<AudienceMember>,
}
/// Response after updating a campaign.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateCampaignResponse {
    /// The campaign with updated fields.
    #[prost(message, optional, tag="1")]
    pub campaign: ::core::option::Option<Campaign>,
}
/// Request to read a campaign's frozen audience snapshot.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCampaignAudienceRequest {
    /// ID of the campaign whose audience to read.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
}
/// One member of a campaign's frozen audience, enriched with the identity
/// fields a client needs to render the member without further lookups.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CampaignAudienceEntry {
    /// The frozen audience row exactly as it will be delivered to: user id
    /// plus per-user template variables.
    #[prost(message, optional, tag="1")]
    pub member: ::core::option::Option<AudienceMember>,
    /// The member's email at read time. Empty when the user no longer
    /// resolves (deactivated or erased since the audience was frozen).
    #[prost(string, tag="2")]
    pub email: ::prost::alloc::string::String,
    /// The member's display name at read time. Empty when unresolvable.
    #[prost(string, tag="3")]
    pub display_name: ::prost::alloc::string::String,
    /// False when the user is no longer an active or invited member of the
    /// organization — a frozen recipient that would not be reachable today.
    #[prost(bool, tag="4")]
    pub active: bool,
}
/// A campaign's frozen audience. Empty when the campaign has no audience
/// snapshot (legacy campaigns predating snapshot tracking) or the snapshot
/// is empty.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetCampaignAudienceResponse {
    /// The frozen audience, enriched per entry.
    #[prost(message, repeated, tag="1")]
    pub entries: ::prost::alloc::vec::Vec<CampaignAudienceEntry>,
}
/// A single delivery record tracking message delivery to one recipient.
/// Out-of-band context attached to a delivery beyond its canonical
/// recipient + status + content payload. Optional; fields are populated
/// per delivery kind. Currently only REMINDER_FYI children carry values,
/// to snapshot context from the parent delivery so clients can render
/// without fetching additional resources.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct DeliveryMetadata {
    /// REMINDER_FYI: the rendered Message payload from the parent delivery,
    /// used to render the blockquoted "Original message" panel on the
    /// notify-target's inbox card.
    #[prost(message, optional, tag="1")]
    pub original_message: ::core::option::Option<Message>,
    /// REMINDER_FYI: display name of the original recipient (the employee
    /// who hasn't responded). Used to interpolate the FYI title and banner.
    #[prost(string, tag="2")]
    pub original_recipient_name: ::prost::alloc::string::String,
    /// REMINDER_FYI: campaign title, denormalized so the notify-target's
    /// client can render without a separate campaign lookup.
    #[prost(string, tag="3")]
    pub campaign_title: ::prost::alloc::string::String,
    /// REMINDER_FYI: when the parent reminder step fired, used to render
    /// the "fired X ago" footer on the FYI card.
    #[prost(message, optional, tag="4")]
    pub reminder_fired_at: ::core::option::Option<::prost_types::Timestamp>,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Delivery {
    /// Unique identifier for this delivery.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// ID of the recipient user.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="2")]
    pub user_id: ::prost::alloc::string::String,
    /// ID of the campaign this delivery belongs to.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="3")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Current delivery status.
    #[prost(enumeration="DeliveryStatus", tag="4")]
    pub status: i32,
    /// Timestamp when the message was delivered to the device.
    #[prost(message, optional, tag="5")]
    pub delivered_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the recipient read the message.
    #[prost(message, optional, tag="6")]
    pub read_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the recipient performed the required action.
    #[prost(message, optional, tag="7")]
    pub acted_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Email address of the recipient, populated from the users table on read.
    #[prost(string, tag="8")]
    pub recipient_email: ::prost::alloc::string::String,
    /// Discriminator distinguishing primary recipient deliveries from
    /// deliveries generated by downstream workflow steps.
    #[prost(enumeration="delivery::Kind", tag="12")]
    pub kind: i32,
    /// For non-primary deliveries, the UUID of the originating delivery this
    /// row was derived from. Empty for primary deliveries.
    /// Constraints: UUID format (36 characters) when set.
    #[prost(string, tag="13")]
    pub parent_delivery_id: ::prost::alloc::string::String,
    /// The locale this delivery's body was actually rendered in after fallback
    /// resolution (recipient preference, campaign override, template default).
    /// Valid values: en, es, pt-BR, zh, ja.
    #[prost(string, tag="14")]
    pub rendered_locale: ::prost::alloc::string::String,
    /// Optional out-of-band context. See `DeliveryMetadata` for which
    /// delivery kinds populate which fields. Empty for legacy / PRIMARY
    /// deliveries.
    #[prost(message, optional, tag="15")]
    pub metadata: ::core::option::Option<DeliveryMetadata>,
    /// True when this delivery's outcome is synthetic (artificially injected)
    /// data rather than the result of a real delivery and user response.
    #[prost(bool, tag="9")]
    pub synthetic: bool,
}
/// Nested message and enum types in `Delivery`.
pub mod delivery {
    /// Discriminator describing what produced this delivery row.
    #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
    #[repr(i32)]
    pub enum Kind {
        /// Default value; not a valid kind.
        Unspecified = 0,
        /// Delivery generated for an audience recipient at campaign start.
        Primary = 1,
        /// Delivery generated by an escalation step targeting a non-audience user.
        Escalation = 2,
        /// Passive heads-up delivery generated when a reminder step fans out to
        /// its `notify_targets`. Carries no action button; auto-dismisses when
        /// the parent delivery is acknowledged. See
        /// `SendReminderConfig.notify_targets`.
        ReminderFyi = 3,
    }
    impl Kind {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "KIND_UNSPECIFIED",
                Self::Primary => "KIND_PRIMARY",
                Self::Escalation => "KIND_ESCALATION",
                Self::ReminderFyi => "KIND_REMINDER_FYI",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "KIND_UNSPECIFIED" => Some(Self::Unspecified),
                "KIND_PRIMARY" => Some(Self::Primary),
                "KIND_ESCALATION" => Some(Self::Escalation),
                "KIND_REMINDER_FYI" => Some(Self::ReminderFyi),
                _ => None,
            }
        }
    }
}
/// Request to list deliveries for a campaign with optional status filtering.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListDeliveriesRequest {
    /// ID of the campaign to list deliveries for.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Optional filter by delivery status. UNSPECIFIED returns all.
    #[prost(enumeration="DeliveryStatus", tag="2")]
    pub status_filter: i32,
    /// Pagination parameters.
    #[prost(message, optional, tag="3")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of delivery records.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListDeliveriesResponse {
    /// List of deliveries in this page.
    #[prost(message, repeated, tag="1")]
    pub deliveries: ::prost::alloc::vec::Vec<Delivery>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to compute the archetype-tendency-shift surface for a campaign:
/// how each archetype's share of the originating group has moved between
/// the snapshot closest to campaign-creation time and the most recent
/// snapshot. Only valid for campaigns whose originating_archetype is set.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCampaignArchetypeBreakdownRequest {
    /// ID of the campaign to break down.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
}
/// Movement in one archetype's share of the originating group between the
/// "before" and "after" archetype-clustering snapshots. Cohort-level only;
/// no joining to user identity. The `is_origin` row is the archetype the
/// campaign was authored for.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ArchetypeShareShift {
    /// Stable archetype label, e.g. "Swift Acknowledger".
    #[prost(string, tag="1")]
    pub label: ::prost::alloc::string::String,
    /// Archetype's share of the group at the snapshot closest to (but not
    /// after) the campaign's created_at. Range 0.0 – 1.0.
    #[prost(double, tag="2")]
    pub share_before: f64,
    /// Archetype's share of the group at the most recent snapshot. Range
    /// 0.0 – 1.0. Equals share_before when no clustering has run since.
    #[prost(double, tag="3")]
    pub share_after: f64,
    /// True when this row's label matches the campaign's
    /// originating_archetype.archetype_label.
    #[prost(bool, tag="4")]
    pub is_origin: bool,
    /// Count of email DELIVERED events recorded for this archetype's members
    /// across the campaign window. Denominator for both open-rate fields.
    #[prost(uint64, tag="5")]
    pub email_delivered_count: u64,
    /// Open rate excluding events flagged as Apple-MPP prefetches
    /// (prefetch_suspected=true). Range 0.0 – 1.0.
    #[prost(double, tag="6")]
    pub email_open_rate_real: f64,
    /// Open rate including all OPENED events, prefetches included.
    /// Range 0.0 – 1.0.
    #[prost(double, tag="7")]
    pub email_open_rate_raw: f64,
}
/// Response containing per-archetype share shifts. The admin renders
/// these as a comparison table — origin row marked, others as peers, so
/// the admin can tell campaign-coincident drift apart from background
/// drift across the rest of the group.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetCampaignArchetypeBreakdownResponse {
    /// One entry per archetype in the originating group. Empty when
    /// insufficient_history is true.
    #[prost(message, repeated, tag="1")]
    pub shifts: ::prost::alloc::vec::Vec<ArchetypeShareShift>,
    /// When the "before" sample was taken (closest snapshot at or before
    /// campaign creation).
    #[prost(message, optional, tag="2")]
    pub before_snapshot_at: ::core::option::Option<::prost_types::Timestamp>,
    /// When the "after" sample was taken (most recent snapshot).
    #[prost(message, optional, tag="3")]
    pub after_snapshot_at: ::core::option::Option<::prost_types::Timestamp>,
    /// True when fewer than two clustering snapshots exist for the group,
    /// so no shift can be computed yet. Admin renders an "awaiting next
    /// clustering cycle" empty state.
    #[prost(bool, tag="4")]
    pub insufficient_history: bool,
}
// ─── Short-code messages ────────────────────────────────────────────────────

/// Request to resolve a campaign's short-code, lazily generating one on
/// first call. Used by internal-service callers (the dispatch layer)
/// when assembling a third-party-channel deeplink:
/// `links.pidgr.com/c/{short_code}?t={token}`.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ResolveOrCreateShortCodeRequest {
    /// The campaign whose short-code is being resolved.
    /// Constraints: Required, must be a UUID and exist within the caller's organization.
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
}
/// Response carrying the resolved short-code. The same campaign always
/// resolves to the same code for its lifetime; the value is safe to
/// cache by the caller.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ResolveOrCreateShortCodeResponse {
    /// 8-character base62 short-code stable for the campaign's lifetime.
    #[prost(string, tag="1")]
    pub short_code: ::prost::alloc::string::String,
}
/// Request to look up a campaign by its public short-code. Called by the
/// native app when the recipient taps a third-party-channel deeplink and
/// the URL handler needs to route to the right campaign card. Designed to
/// be safe to call without authentication — the response carries no PII
/// and only enough context for the app to route correctly and show org
/// branding before the auth gate.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCampaignByShortCodeRequest {
    /// The 8-character short-code from the deeplink path.
    /// Constraints: Required, exactly 8 base62 characters.
    #[prost(string, tag="1")]
    pub short_code: ::prost::alloc::string::String,
}
/// Response carrying the minimum metadata the native app needs to route
/// the deeplink. Subject is the campaign's title text (already visible
/// in the recipient's inbox after dispatch — no new PII exposure). Body
/// content, audience size, delivery status and any other operational
/// fields are NOT included; the app fetches those via authenticated
/// `GetCampaign` after the recipient signs in.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCampaignByShortCodeResponse {
    /// Campaign UUID — the app uses this for the authenticated `GetCampaign`
    /// follow-up after the deeplink token validates.
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Organization UUID owning the campaign — lets the app pick the
    /// correct SSO / sign-in flow when the recipient is logged out.
    #[prost(string, tag="2")]
    pub org_id: ::prost::alloc::string::String,
    /// Display name of the organization for sign-in branding ("Sign in to
    /// Acme Inc to view this campaign"). Public information; the
    /// organization's profile already exposes it elsewhere.
    #[prost(string, tag="3")]
    pub organization_name: ::prost::alloc::string::String,
    /// Campaign subject (title). Same string the recipient already saw in
    /// their inbox; included so the deeplink interstitial can show
    /// "Acme Inc — All-hands Q3" before the auth gate.
    #[prost(string, tag="4")]
    pub subject: ::prost::alloc::string::String,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A registered device that can receive push notifications.
/// INTERNAL: This message is for server-side use only. Use DeviceSummary for API responses.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Device {
    /// Unique identifier for this device.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub device_id: ::prost::alloc::string::String,
    /// ID of the user who owns this device.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="2")]
    pub user_id: ::prost::alloc::string::String,
    /// Mobile platform (iOS or Android).
    #[prost(enumeration="Platform", tag="3")]
    pub platform: i32,
    /// Push token used to send notifications to this device.
    #[prost(string, tag="4")]
    pub push_token: ::prost::alloc::string::String,
    /// Whether the device is currently active and eligible for push delivery.
    #[prost(bool, tag="5")]
    pub active: bool,
    /// Timestamp of the last activity from this device.
    #[prost(message, optional, tag="6")]
    pub last_seen: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the device was first registered.
    #[prost(message, optional, tag="7")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// A device summary safe for API responses — excludes sensitive push_token.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeviceSummary {
    /// Unique identifier for this device.
    #[prost(string, tag="1")]
    pub device_id: ::prost::alloc::string::String,
    /// ID of the user who owns this device.
    #[prost(string, tag="2")]
    pub user_id: ::prost::alloc::string::String,
    /// Mobile platform (iOS or Android).
    #[prost(enumeration="Platform", tag="3")]
    pub platform: i32,
    /// Whether the device is currently active and eligible for push delivery.
    #[prost(bool, tag="4")]
    pub active: bool,
    /// Timestamp of the last activity from this device.
    #[prost(message, optional, tag="5")]
    pub last_seen: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the device was first registered.
    #[prost(message, optional, tag="6")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to register a device for push notifications.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RegisterRequest {
    /// Client-generated unique device identifier.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub device_id: ::prost::alloc::string::String,
    /// Mobile platform of the device.
    #[prost(enumeration="Platform", tag="2")]
    pub platform: i32,
    /// Push token obtained from the push notification provider on the client.
    /// Constraints: Max length 4096 characters.
    #[prost(string, tag="3")]
    pub push_token: ::prost::alloc::string::String,
}
/// Response after registering a device.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RegisterResponse {
    /// The registered device summary (excludes push_token).
    #[prost(message, optional, tag="1")]
    pub device: ::core::option::Option<DeviceSummary>,
}
/// Request to deactivate a device, stopping push notifications.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeactivateRequest {
    /// ID of the device to deactivate.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub device_id: ::prost::alloc::string::String,
}
/// Response after deactivating a device.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeactivateResponse {
    /// Whether the device was successfully deactivated.
    #[prost(bool, tag="1")]
    pub success: bool,
}
/// Request to list all devices for the authenticated user.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListDevicesRequest {
}
/// Response containing all devices for the user.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListDevicesResponse {
    /// List of devices registered to the authenticated user.
    #[prost(message, repeated, tag="1")]
    pub devices: ::prost::alloc::vec::Vec<DeviceSummary>,
}
/// Request to list devices for a specific member (admin use).
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListMemberDevicesRequest {
    /// ID of the user whose devices to list.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
}
/// Response containing all devices for the specified member.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListMemberDevicesResponse {
    /// List of devices registered to the specified user.
    #[prost(message, repeated, tag="1")]
    pub devices: ::prost::alloc::vec::Vec<DeviceSummary>,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// User-configurable platform settings that apply across all clients.
/// All fields use their UNSPECIFIED/zero value to mean "no change" in updates.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UserSettings {
    /// Preferred color scheme for the UI.
    #[prost(enumeration="ThemePreference", tag="1")]
    pub theme_preference: i32,
    /// User's preferred language for the UI and push notifications.
    /// Empty string means "use organization default" or "auto-detect".
    /// Valid values: en, es, pt-BR, zh, ja.
    #[prost(string, tag="2")]
    pub preferred_locale: ::prost::alloc::string::String,
}
/// Structured profile attributes for a user within an organization.
/// Populated through admin invitation, mobile onboarding, or SSO attribute sync.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UserProfile {
    /// User's given name.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub first_name: ::prost::alloc::string::String,
    /// User's family name.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub last_name: ::prost::alloc::string::String,
    /// Department or team within the organization.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="3")]
    pub department: ::prost::alloc::string::String,
    /// Job title.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="4")]
    pub title: ::prost::alloc::string::String,
    /// Phone number.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="5")]
    pub phone: ::prost::alloc::string::String,
    /// Office or geographic location.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="6")]
    pub location: ::prost::alloc::string::String,
    /// Organization-specific employee identifier.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="7")]
    pub employee_id: ::prost::alloc::string::String,
    /// Display name of the user's direct manager.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="8")]
    pub manager_name: ::prost::alloc::string::String,
    /// Employment start date in ISO 8601 format (YYYY-MM-DD).
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="9")]
    pub start_date: ::prost::alloc::string::String,
    /// Organization-defined custom attributes for fields not covered by the fixed schema.
    /// Constraints: Max 50 entries. Key max length 100 characters, value max length 1000 characters.
    #[prost(map="string, string", tag="10")]
    pub custom_attributes: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
    /// UUID of the user's direct manager within the same organization.
    /// Populated from SCIM enterprise extension (manager.value), manual admin
    /// assignment, or SSO attribute mapping. Empty if not set.
    #[prost(string, tag="11")]
    pub manager_id: ::prost::alloc::string::String,
}
/// A user within an organization.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct User {
    /// Unique identifier for the user (internal platform UUID, not identity provider subject ID).
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// User's email address.
    /// Constraints: Max length 254 characters (RFC 5321).
    #[prost(string, tag="2")]
    pub email: ::prost::alloc::string::String,
    /// User's display name.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="3")]
    pub name: ::prost::alloc::string::String,
    /// Current account status.
    #[prost(enumeration="UserStatus", tag="5")]
    pub status: i32,
    /// Timestamp when the user was created.
    #[prost(message, optional, tag="6")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// The user's role with its permission set.
    #[prost(message, optional, tag="7")]
    pub role: ::core::option::Option<Role>,
    /// ID of the user's role (for assignment operations).
    #[prost(string, tag="8")]
    pub role_id: ::prost::alloc::string::String,
    /// Structured profile attributes (department, title, etc.).
    /// May be empty if the user has not completed their profile.
    #[prost(message, optional, tag="9")]
    pub profile: ::core::option::Option<UserProfile>,
    /// Whether data processing is restricted for this user (GDPR Art. 18).
    /// When true, the user is excluded from campaign audiences by default.
    #[prost(bool, tag="10")]
    pub processing_restricted: bool,
    /// Data governance region override. Empty string means "inherit from org default".
    /// Valid values: EU, LATAM, BR, APAC, US.
    #[prost(string, tag="11")]
    pub data_governance_region: ::prost::alloc::string::String,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Lifecycle status of a user account.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum UserStatus {
    /// Default value; not a valid status.
    Unspecified = 0,
    /// User has been invited but has not completed onboarding.
    Invited = 1,
    /// User is active and can receive messages.
    Active = 2,
    /// User has been deactivated and will not receive messages.
    Deactivated = 3,
}
impl UserStatus {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "USER_STATUS_UNSPECIFIED",
            Self::Invited => "USER_STATUS_INVITED",
            Self::Active => "USER_STATUS_ACTIVE",
            Self::Deactivated => "USER_STATUS_DEACTIVATED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "USER_STATUS_UNSPECIFIED" => Some(Self::Unspecified),
            "USER_STATUS_INVITED" => Some(Self::Invited),
            "USER_STATUS_ACTIVE" => Some(Self::Active),
            "USER_STATUS_DEACTIVATED" => Some(Self::Deactivated),
            _ => None,
        }
    }
}
/// User's preferred color scheme.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ThemePreference {
    /// Default value; treated as SYSTEM when reading, "no change" when updating.
    Unspecified = 0,
    /// Always use light mode regardless of system setting.
    Light = 1,
    /// Always use dark mode regardless of system setting.
    Dark = 2,
    /// Follow the operating system or browser preference.
    System = 3,
}
impl ThemePreference {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "THEME_PREFERENCE_UNSPECIFIED",
            Self::Light => "THEME_PREFERENCE_LIGHT",
            Self::Dark => "THEME_PREFERENCE_DARK",
            Self::System => "THEME_PREFERENCE_SYSTEM",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "THEME_PREFERENCE_UNSPECIFIED" => Some(Self::Unspecified),
            "THEME_PREFERENCE_LIGHT" => Some(Self::Light),
            "THEME_PREFERENCE_DARK" => Some(Self::Dark),
            "THEME_PREFERENCE_SYSTEM" => Some(Self::System),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A named collection of users within an organization, used for campaign
/// audience targeting (recipient groups).
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Group {
    /// Unique identifier for the group.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Human-readable display name (unique within the organization).
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// Optional description of the group's purpose.
    /// Constraints: Max length 1000 characters.
    #[prost(string, tag="3")]
    pub description: ::prost::alloc::string::String,
    /// Number of users currently in the group.
    #[prost(int32, tag="4")]
    pub member_count: i32,
    /// Timestamp when the group was created.
    #[prost(message, optional, tag="5")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the group was last updated.
    #[prost(message, optional, tag="6")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Whether this is the organization's default group (cannot be deleted or renamed).
    #[prost(bool, tag="7")]
    pub is_default: bool,
    /// ID of the user who created this group. Empty for system-seeded defaults.
    #[prost(string, tag="8")]
    pub created_by: ::prost::alloc::string::String,
}
/// Request to create a new group.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateGroupRequest {
    /// Display name for the group. Required.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// Optional description.
    /// Constraints: Max length 1000 characters.
    #[prost(string, tag="2")]
    pub description: ::prost::alloc::string::String,
}
/// Response after creating a group.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateGroupResponse {
    /// The newly created group.
    #[prost(message, optional, tag="1")]
    pub group: ::core::option::Option<Group>,
}
/// Request to retrieve a group by ID.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetGroupRequest {
    /// ID of the group to retrieve. Required.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
}
/// Response containing the requested group.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetGroupResponse {
    /// The requested group.
    #[prost(message, optional, tag="1")]
    pub group: ::core::option::Option<Group>,
}
/// Request to list groups in the organization with pagination.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListGroupsRequest {
    /// Pagination parameters.
    #[prost(message, optional, tag="1")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of groups.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListGroupsResponse {
    /// Groups in this page.
    #[prost(message, repeated, tag="1")]
    pub groups: ::prost::alloc::vec::Vec<Group>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to update a group's name and/or description.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateGroupRequest {
    /// ID of the group to update. Required.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
    /// New display name. If empty, the name is not changed.
    /// Default groups cannot be renamed.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// New description. If empty, the description is not changed.
    /// Constraints: Max length 1000 characters.
    #[prost(string, tag="3")]
    pub description: ::prost::alloc::string::String,
}
/// Response after updating a group.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateGroupResponse {
    /// The updated group.
    #[prost(message, optional, tag="1")]
    pub group: ::core::option::Option<Group>,
}
/// Request to delete a group.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteGroupRequest {
    /// ID of the group to delete. Required.
    /// Default groups cannot be deleted.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
}
/// Response after deleting a group.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteGroupResponse {
}
/// Request to add users to a group.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AddGroupMembersRequest {
    /// ID of the group to add members to. Required.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
    /// IDs of users to add. Must belong to the same organization.
    /// Adding an existing member is a no-op (idempotent).
    /// Constraints: Max 100 user IDs per request.
    #[prost(string, repeated, tag="2")]
    pub user_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Response after adding group members.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AddGroupMembersResponse {
    /// The group with updated member_count.
    #[prost(message, optional, tag="1")]
    pub group: ::core::option::Option<Group>,
}
/// Request to remove users from a group.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveGroupMembersRequest {
    /// ID of the group to remove members from. Required.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
    /// IDs of users to remove. Removing a non-member is a no-op (idempotent).
    /// Constraints: Max 100 user IDs per request.
    #[prost(string, repeated, tag="2")]
    pub user_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Response after removing group members.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveGroupMembersResponse {
    /// The group with updated member_count.
    #[prost(message, optional, tag="1")]
    pub group: ::core::option::Option<Group>,
}
/// Request to list members of a group with pagination.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListGroupMembersRequest {
    /// ID of the group whose members to list. Required.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
    /// Pagination parameters.
    #[prost(message, optional, tag="2")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of group members.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListGroupMembersResponse {
    /// Users in this page.
    #[prost(message, repeated, tag="1")]
    pub users: ::prost::alloc::vec::Vec<User>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// A group membership entry for batch lookups.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UserGroupMembership {
    /// ID of the user.
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// Groups the user belongs to.
    #[prost(message, repeated, tag="2")]
    pub groups: ::prost::alloc::vec::Vec<Group>,
}
/// Request to get group memberships for a batch of users.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetUserGroupMembershipsRequest {
    /// IDs of users to look up. Required.
    /// Constraints: Max 200 user IDs per request.
    #[prost(string, repeated, tag="1")]
    pub user_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Response containing group memberships for the requested users.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetUserGroupMembershipsResponse {
    /// Group memberships per user. Only users with at least one group are included.
    #[prost(message, repeated, tag="1")]
    pub memberships: ::prost::alloc::vec::Vec<UserGroupMembership>,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A single touch event captured from the mobile app.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct TouchEvent {
    /// Screen name from React Navigation route.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub screen_name: ::prost::alloc::string::String,
    /// Horizontal coordinate as a percentage of screen width (0.0–1.0).
    /// Constraints: Range 0.0 to 1.0 inclusive.
    #[prost(float, tag="2")]
    pub x_pct: f32,
    /// Vertical coordinate as a percentage of screen height (0.0–1.0).
    /// Constraints: Range 0.0 to 1.0 inclusive.
    #[prost(float, tag="3")]
    pub y_pct: f32,
    /// Type of touch event.
    #[prost(enumeration="TouchEventType", tag="4")]
    pub event_type: i32,
    /// Screen width in device pixels at the time of capture.
    #[prost(int32, tag="5")]
    pub screen_width: i32,
    /// Screen height in device pixels at the time of capture.
    #[prost(int32, tag="6")]
    pub screen_height: i32,
    /// Client-side timestamp when the touch occurred.
    #[prost(message, optional, tag="7")]
    pub client_timestamp: ::core::option::Option<::prost_types::Timestamp>,
    /// Campaign ID if the touch occurred during a campaign message view.
    /// Empty string for organic (non-campaign) navigation.
    #[prost(string, tag="8")]
    pub campaign_id: ::prost::alloc::string::String,
}
/// Request to ingest a batch of touch events from the mobile app.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct IngestTouchEventsRequest {
    /// Batch of touch events to ingest.
    /// Constraints: Max 100 events per batch.
    #[prost(message, repeated, tag="1")]
    pub events: ::prost::alloc::vec::Vec<TouchEvent>,
}
/// Response after ingesting touch events.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct IngestTouchEventsResponse {
    /// Number of events successfully ingested.
    #[prost(int32, tag="1")]
    pub ingested_count: i32,
}
/// A single aggregated data point in a heatmap grid cell.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct HeatmapDataPoint {
    /// Grid cell horizontal center as a percentage (0.0–1.0).
    #[prost(float, tag="1")]
    pub x_pct: f32,
    /// Grid cell vertical center as a percentage (0.0–1.0).
    #[prost(float, tag="2")]
    pub y_pct: f32,
    /// Aggregated value for this cell (count, median, or z-score depending on mode).
    #[prost(float, tag="3")]
    pub value: f32,
}
/// Request to query aggregated heatmap data for a screen.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct QueryHeatmapDataRequest {
    /// Screen name to query.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub screen_name: ::prost::alloc::string::String,
    /// Start of the time range filter (inclusive).
    #[prost(message, optional, tag="2")]
    pub date_from: ::core::option::Option<::prost_types::Timestamp>,
    /// End of the time range filter (inclusive).
    #[prost(message, optional, tag="3")]
    pub date_to: ::core::option::Option<::prost_types::Timestamp>,
    /// Optional: filter by campaign ID.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="4")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Grid resolution for coordinate rounding. Default: 0.02 (50×50 grid).
    /// Constraints: Range 0.005 to 0.1.
    #[prost(float, tag="6")]
    pub grid_resolution: f32,
    /// Aggregation mode (TOTAL or MEDIAN).
    #[prost(enumeration="HeatmapMode", tag="7")]
    pub mode: i32,
    /// Optional: filter by event types. Empty list means all types.
    #[prost(enumeration="TouchEventType", repeated, tag="8")]
    pub event_types: ::prost::alloc::vec::Vec<i32>,
}
/// Response containing aggregated heatmap data.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct QueryHeatmapDataResponse {
    /// Aggregated data points for heatmap rendering.
    #[prost(message, repeated, tag="1")]
    pub data_points: ::prost::alloc::vec::Vec<HeatmapDataPoint>,
    /// URL to a mobile-captured screenshot for this screen, if available.
    /// Empty string when no screenshot exists.
    #[prost(string, tag="3")]
    pub screenshot_url: ::prost::alloc::string::String,
    /// Whether per-cohort bucket breakdowns are available (k >= 5).
    #[prost(bool, tag="4")]
    pub cohort_enabled: bool,
}
/// Request to upload a screenshot captured from the mobile app.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UploadScreenshotRequest {
    /// Screen name matching React Navigation route (e.g. "MessageDetail::<campaign_uuid>").
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub screen_name: ::prost::alloc::string::String,
    /// App version that captured the screenshot (e.g. "1.15.0").
    #[prost(string, tag="2")]
    pub app_version: ::prost::alloc::string::String,
    /// PNG image data.
    /// Constraints: Max 512KB.
    #[prost(bytes="vec", tag="3")]
    pub image_data: ::prost::alloc::vec::Vec<u8>,
}
/// Response after uploading a screenshot.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UploadScreenshotResponse {
    /// S3 URL where the screenshot was stored.
    #[prost(string, tag="1")]
    pub url: ::prost::alloc::string::String,
}
/// A screen screenshot stored as a static asset.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ScreenScreenshot {
    /// Screen name matching React Navigation route.
    #[prost(string, tag="1")]
    pub screen_name: ::prost::alloc::string::String,
    /// S3 URL to the screenshot image.
    #[prost(string, tag="2")]
    pub url: ::prost::alloc::string::String,
    /// App version this screenshot corresponds to.
    #[prost(string, tag="3")]
    pub app_version: ::prost::alloc::string::String,
}
/// Request to list available screen screenshots.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListScreenshotsRequest {
}
/// Response containing available screen screenshots.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListScreenshotsResponse {
    /// Available screen screenshots with their URLs and versions.
    #[prost(message, repeated, tag="1")]
    pub screenshots: ::prost::alloc::vec::Vec<ScreenScreenshot>,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Type of touch event captured on the mobile app.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum TouchEventType {
    /// Default value; not a valid event type.
    Unspecified = 0,
    /// A single tap on the screen.
    Tap = 1,
    /// A long press (held for 500ms+).
    LongPress = 2,
    /// A periodic scroll position sample (viewport midpoint every 2s).
    Scroll = 3,
    /// The user tapped an action button (e.g. "Acknowledge").
    ActionClick = 4,
}
impl TouchEventType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "TOUCH_EVENT_TYPE_UNSPECIFIED",
            Self::Tap => "TOUCH_EVENT_TYPE_TAP",
            Self::LongPress => "TOUCH_EVENT_TYPE_LONG_PRESS",
            Self::Scroll => "TOUCH_EVENT_TYPE_SCROLL",
            Self::ActionClick => "TOUCH_EVENT_TYPE_ACTION_CLICK",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "TOUCH_EVENT_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "TOUCH_EVENT_TYPE_TAP" => Some(Self::Tap),
            "TOUCH_EVENT_TYPE_LONG_PRESS" => Some(Self::LongPress),
            "TOUCH_EVENT_TYPE_SCROLL" => Some(Self::Scroll),
            "TOUCH_EVENT_TYPE_ACTION_CLICK" => Some(Self::ActionClick),
            _ => None,
        }
    }
}
/// Aggregation mode for heatmap data queries.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum HeatmapMode {
    /// Default value; not a valid mode.
    Unspecified = 0,
    /// Sum of all cohort buckets' touches per grid cell (default).
    Total = 1,
    /// Median touch count per grid cell across cohort buckets.
    Median = 2,
}
impl HeatmapMode {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "HEATMAP_MODE_UNSPECIFIED",
            Self::Total => "HEATMAP_MODE_TOTAL",
            Self::Median => "HEATMAP_MODE_MEDIAN",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "HEATMAP_MODE_UNSPECIFIED" => Some(Self::Unspecified),
            "HEATMAP_MODE_TOTAL" => Some(Self::Total),
            "HEATMAP_MODE_MEDIAN" => Some(Self::Median),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A single entry in a user's inbox, combining a message with its delivery state.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct InboxEntry {
    /// ID of the delivery record for this inbox entry.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub delivery_id: ::prost::alloc::string::String,
    /// The fully rendered message content.
    #[prost(message, optional, tag="2")]
    pub message: ::core::option::Option<Message>,
    /// Current delivery status (e.g. DELIVERED, ACKNOWLEDGED).
    #[prost(enumeration="DeliveryStatus", tag="3")]
    pub status: i32,
    /// Whether the user has read this message.
    #[prost(bool, tag="4")]
    pub read: bool,
    /// Timestamp when the message was received in the inbox.
    #[prost(message, optional, tag="5")]
    pub received_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Discriminator: PRIMARY for normal deliveries, ESCALATION for delivery-grade
    /// escalations. Mirrors Delivery.kind so inbox-sync clients can branch on the
    /// same dimension as listDeliveries clients.
    #[prost(enumeration="delivery::Kind", tag="6")]
    pub kind: i32,
    /// For ESCALATION entries, the UUID of the unacked delivery that triggered this
    /// entry. Empty for PRIMARY entries.
    #[prost(string, tag="7")]
    pub parent_delivery_id: ::prost::alloc::string::String,
    /// The locale the body actually rendered in after fallback resolution. Empty
    /// for legacy/PRIMARY entries.
    #[prost(string, tag="8")]
    pub rendered_locale: ::prost::alloc::string::String,
    /// Optional out-of-band context mirrored from the underlying delivery.
    /// See `DeliveryMetadata` for which delivery kinds populate which fields.
    /// Empty for PRIMARY entries.
    #[prost(message, optional, tag="9")]
    pub metadata: ::core::option::Option<DeliveryMetadata>,
}
/// Request to sync inbox entries since a given timestamp.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SyncRequest {
    /// Fetch entries newer than this timestamp. Omit for initial sync.
    #[prost(message, optional, tag="1")]
    pub since: ::core::option::Option<::prost_types::Timestamp>,
    /// Maximum number of entries to return.
    /// Constraints: Valid range 1 to 200.
    #[prost(int32, tag="2")]
    pub limit: i32,
}
/// Response containing synced inbox entries.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SyncResponse {
    /// Inbox entries newer than the requested timestamp.
    #[prost(message, repeated, tag="1")]
    pub entries: ::prost::alloc::vec::Vec<InboxEntry>,
    /// Cursor timestamp to use for the next sync call.
    #[prost(message, optional, tag="2")]
    pub next_since: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to mark a message as read.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct MarkReadRequest {
    /// ID of the delivery to mark as read.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub delivery_id: ::prost::alloc::string::String,
}
/// Response after marking a message as read.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct MarkReadResponse {
    /// Whether the read status was successfully updated.
    #[prost(bool, tag="1")]
    pub success: bool,
}
/// Request to retrieve a single message by delivery ID.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetMessageRequest {
    /// ID of the delivery to retrieve.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub delivery_id: ::prost::alloc::string::String,
}
/// Response containing the requested inbox entry.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetMessageResponse {
    /// The inbox entry for the requested delivery.
    #[prost(message, optional, tag="1")]
    pub entry: ::core::option::Option<InboxEntry>,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A behavioral archetype describing a cohort pattern (never an individual).
/// Derived from k-anonymized, DP-noised behavioral feature vectors.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Archetype {
    /// Human-readable label (e.g., "Swift Acknowledger", "Thorough Reader").
    #[prost(string, tag="1")]
    pub label: ::prost::alloc::string::String,
    /// Description of the behavioral pattern this archetype represents.
    #[prost(string, tag="2")]
    pub description: ::prost::alloc::string::String,
    /// Proportion of the group that belongs to this archetype (0.0-1.0).
    #[prost(float, tag="3")]
    pub percentage: f32,
    /// Centroid of the behavioral feature vector for this archetype.
    /// Keys are stable dimension names from the feature extractor
    /// vocabulary (e.g., "tap_density", "engagement_depth",
    /// "scroll_velocity_p50", "idle_gap_p75"). Single-letter keys are
    /// reserved for backward compatibility with pre-v0.64 servers and
    /// SHALL be ignored by clients.
    #[prost(map="string, double", tag="4")]
    pub feature_centroid: ::std::collections::HashMap<::prost::alloc::string::String, f64>,
    /// Per-dimension distribution of the archetype's members. Lets the
    /// admin render percentile bands instead of single-point centroids.
    /// Absent until at least k members exist in the cluster. Keys mirror
    /// `feature_centroid` keys.
    #[prost(map="string, message", tag="5")]
    pub feature_breakdown: ::std::collections::HashMap<::prost::alloc::string::String, DimensionStats>,
    /// Tap density heatmap aggregated across sessions for this
    /// archetype. Cohort-level only — never per-session timing.
    /// Absent when fewer than k sessions have tap data.
    #[prost(message, optional, tag="6")]
    pub tap_heatmap: ::core::option::Option<TapHeatmap>,
    /// Forecast of cluster share at fixed horizons (7/14/30/90 days).
    /// Absent during cold start before historical clustering runs exist
    /// to extrapolate from.
    #[prost(message, optional, tag="7")]
    pub forecast: ::core::option::Option<ArchetypeForecast>,
    /// Sessions that sit at the median and quartiles of the archetype's
    /// centroid distance, ranked by distance. Bounded at three entries.
    /// Absent until at least 50 sessions have been scored.
    /// Sessions can come from any client that emits to ReplayService —
    /// mobile (iOS, Android) or desktop (macOS, Windows, Linux).
    #[prost(message, repeated, tag="8")]
    pub exemplar_sessions: ::prost::alloc::vec::Vec<ExemplarSession>,
    /// Per-screen dwell time distribution, derived from session replay.
    /// Absent when fewer than k sessions per screen exist.
    #[prost(message, optional, tag="9")]
    pub screen_dwell: ::core::option::Option<ScreenDwell>,
    /// End-to-end response latencies (push delivered → read → ack) for
    /// members of this archetype, as percentiles. Absent until at least
    /// k campaign deliveries have been recorded for this archetype.
    #[prost(message, optional, tag="10")]
    pub response_timeline: ::core::option::Option<ResponseTimeline>,
    /// Where this archetype came from. UNSPECIFIED on responses from
    /// pre-v0.81 servers; clients SHOULD treat UNSPECIFIED as ML for
    /// backward compatibility (provisional output is always labelled).
    #[prost(enumeration="ArchetypeSource", tag="11")]
    pub source: i32,
}
/// Per-dimension distribution stats for one feature dimension within
/// an archetype's cohort. All values are in the same units as
/// `Archetype.feature_centroid`. Used to render percentile bands on
/// the admin's behavioral profile panel.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct DimensionStats {
    /// Centroid value (same as Archetype.feature_centroid\[key\]).
    #[prost(double, tag="1")]
    pub centroid: f64,
    /// 25th percentile across the archetype's members.
    #[prost(double, tag="2")]
    pub p25: f64,
    /// Median across the archetype's members.
    #[prost(double, tag="3")]
    pub p50: f64,
    /// 75th percentile across the archetype's members.
    #[prost(double, tag="4")]
    pub p75: f64,
    /// Median across the entire group (all archetypes), included so the
    /// admin can render "this archetype is X% above group median".
    #[prost(double, tag="5")]
    pub group_p50: f64,
}
/// A density grid of tap activity for one archetype, normalized to
/// \[0.0, 1.0\] where 1.0 is the hottest cell in the cohort. Cohort-
/// level only.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct TapHeatmap {
    /// Width of the density grid in cells.
    #[prost(int32, tag="1")]
    pub width: i32,
    /// Height of the density grid in cells.
    #[prost(int32, tag="2")]
    pub height: i32,
    /// Row-major density values, length must equal width*height. All in
    /// \[0.0, 1.0\].
    #[prost(double, repeated, tag="3")]
    pub values: ::prost::alloc::vec::Vec<f64>,
    /// Number of sessions aggregated. Always >= MinFeatureVectorsForClustering
    /// when the field is present.
    #[prost(int32, tag="4")]
    pub session_count: i32,
    /// Optional per-event-type breakdown. When present, the writer
    /// SHALL emit one entry for each event type in the source data
    /// (TAP, LONG_PRESS, SCROLL, ACTION_CLICK).
    #[prost(message, repeated, tag="5")]
    pub layers: ::prost::alloc::vec::Vec<TapHeatmapLayer>,
}
/// One per-event-type layer of a TapHeatmap.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct TapHeatmapLayer {
    /// Event type this layer represents (e.g., "TAP", "LONG_PRESS",
    /// "SCROLL", "ACTION_CLICK").
    #[prost(string, tag="1")]
    pub event_type: ::prost::alloc::string::String,
    /// Row-major density values, same dimensions as the parent
    /// TapHeatmap. Independently normalized to \[0.0, 1.0\].
    #[prost(double, repeated, tag="2")]
    pub values: ::prost::alloc::vec::Vec<f64>,
}
/// Predicted cluster share at fixed horizons with confidence bands.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ArchetypeForecast {
    /// Horizons in increasing days. Always one entry each for 7, 14,
    /// 30, and 90 days when the field is present.
    #[prost(message, repeated, tag="1")]
    pub horizons: ::prost::alloc::vec::Vec<ForecastHorizon>,
}
/// Predicted share at one horizon with a 90% prediction interval.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct ForecastHorizon {
    /// Horizon length in days (one of: 7, 14, 30, 90).
    #[prost(int32, tag="1")]
    pub days: i32,
    /// Predicted fraction of the group falling in this archetype at the
    /// horizon (0.0-1.0).
    #[prost(double, tag="2")]
    pub predicted_share: f64,
    /// 5th-percentile lower bound of the prediction interval.
    #[prost(double, tag="3")]
    pub lower: f64,
    /// 95th-percentile upper bound of the prediction interval.
    #[prost(double, tag="4")]
    pub upper: f64,
    /// Confidence in this horizon's prediction.
    #[prost(enumeration="ConfidenceLevel", tag="5")]
    pub confidence: i32,
}
/// Pointer to a representative session for one archetype, ranked by
/// distance to the archetype centroid.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ExemplarSession {
    /// Session recording ID retrievable via ReplayService for the same
    /// org. Linkable from the admin regardless of originating platform.
    #[prost(string, tag="1")]
    pub session_id: ::prost::alloc::string::String,
    /// Quantile rank within the archetype: 25, 50, or 75. The writer
    /// emits at most one session per rank.
    #[prost(int32, tag="2")]
    pub rank: i32,
    /// L2 distance from the session's feature vector to the centroid.
    #[prost(double, tag="3")]
    pub distance: f64,
    /// Optional duration metadata for quick admin labelling.
    #[prost(int32, tag="4")]
    pub duration_seconds: i32,
    /// Optional platform identifier from the vocabulary
    /// {"ios", "android", "macos", "windows", "linux"}. The admin
    /// renders unknown values verbatim for forward compatibility.
    #[prost(string, tag="5")]
    pub platform: ::prost::alloc::string::String,
}
/// Per-screen dwell distribution within an archetype. Lets the admin
/// surface "this archetype lingers 8.2s on the Message Detail screen
/// vs 0.4s on the Inbox list".
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ScreenDwell {
    /// One entry per screen. Screens with fewer than k members in the
    /// archetype are dropped from the list (not marked as absent).
    #[prost(message, repeated, tag="1")]
    pub entries: ::prost::alloc::vec::Vec<ScreenDwellEntry>,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ScreenDwellEntry {
    /// Stable screen identifier (e.g., "MessageDetail", "Inbox",
    /// "ProfileSettings"). Sourced from the same screen_name vocabulary
    /// used by heatmap_cells.
    #[prost(string, tag="1")]
    pub screen_name: ::prost::alloc::string::String,
    /// Median dwell time in seconds for this archetype on this screen.
    #[prost(double, tag="2")]
    pub median_seconds: f64,
    /// 75th-percentile dwell time in seconds.
    #[prost(double, tag="3")]
    pub p75_seconds: f64,
    /// Number of distinct sessions aggregated for this screen.
    #[prost(int32, tag="4")]
    pub session_count: i32,
}
/// End-to-end response latencies for members of one archetype, in
/// seconds. Each percentile is computed across all qualifying campaign
/// deliveries for the archetype's members within the rolling window.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct ResponseTimeline {
    /// Time from `delivered_at` to `read_at`, in seconds.
    #[prost(message, optional, tag="1")]
    pub read_after_delivered: ::core::option::Option<LatencyPercentiles>,
    /// Time from `read_at` to `acknowledged_at`, in seconds. Only
    /// includes deliveries that were both read and acknowledged.
    #[prost(message, optional, tag="2")]
    pub ack_after_read: ::core::option::Option<LatencyPercentiles>,
    /// End-to-end time from `delivered_at` to `acknowledged_at`, in
    /// seconds. Only includes deliveries that were acknowledged.
    #[prost(message, optional, tag="3")]
    pub ack_after_delivered: ::core::option::Option<LatencyPercentiles>,
    /// Number of deliveries the timeline is computed over.
    #[prost(int32, tag="4")]
    pub delivery_count: i32,
}
/// Latency distribution stats. Values are in seconds.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct LatencyPercentiles {
    #[prost(double, tag="1")]
    pub p50: f64,
    #[prost(double, tag="2")]
    pub p75: f64,
    #[prost(double, tag="3")]
    pub p95: f64,
}
/// A cohort-level prediction for campaign acknowledgment rate.
/// Never targets or scores individuals — always represents an audience aggregate.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct CohortPrediction {
    /// Predicted ACK rate for the audience (0.0-1.0).
    #[prost(float, tag="1")]
    pub predicted_ack_rate: f32,
    /// Lower bound of the confidence interval.
    #[prost(float, tag="2")]
    pub confidence_low: f32,
    /// Upper bound of the confidence interval.
    #[prost(float, tag="3")]
    pub confidence_high: f32,
    /// Confidence level based on available data volume.
    #[prost(enumeration="ConfidenceLevel", tag="4")]
    pub confidence_level: i32,
    /// Number of anonymous data points used for this prediction.
    #[prost(int32, tag="5")]
    pub data_point_count: i32,
}
/// Advisory information for campaign configuration, combining predictions and archetypes.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CampaignAdvisory {
    /// Cohort-level ACK prediction for the target audience.
    #[prost(message, optional, tag="1")]
    pub predicted_ack: ::core::option::Option<CohortPrediction>,
    /// Suggested escalation delay in minutes based on historical cohort patterns.
    /// 0 if insufficient data.
    #[prost(int32, tag="2")]
    pub suggested_escalation_delay_minutes: i32,
    /// Behavioral archetypes for the target audience.
    #[prost(message, repeated, tag="3")]
    pub archetypes: ::prost::alloc::vec::Vec<Archetype>,
}
/// Request to retrieve behavioral archetypes for a group.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetGroupArchetypesRequest {
    /// ID of the group to query archetypes for. Required.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
}
/// Response containing behavioral archetypes for a group.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetGroupArchetypesResponse {
    /// Behavioral archetypes for the group (empty if insufficient data).
    #[prost(message, repeated, tag="1")]
    pub archetypes: ::prost::alloc::vec::Vec<Archetype>,
    /// Number of anonymous feature vectors used for clustering.
    #[prost(int32, tag="2")]
    pub data_point_count: i32,
    /// Why `archetypes` looks the way it does. Lets the UI render a
    /// distinct empty-state affordance for "never trained" vs
    /// "below threshold" vs "no clusters" vs "ready". See PipelineState.
    #[prost(enumeration="PipelineState", tag="3")]
    pub pipeline_state: i32,
    /// Confidence in the returned archetypes, derived from available data
    /// volume. Always CONFIDENCE_LEVEL_LOW when provisional archetypes
    /// are returned — clients use this plus `Archetype.source` to render
    /// the low-confidence disclaimer.
    #[prost(enumeration="ConfidenceLevel", tag="4")]
    pub confidence_level: i32,
}
/// Request to predict cohort-level ACK rate for a campaign configuration.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct PredictCampaignAckRequest {
    /// ID of the target audience group. Required.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
    /// Template type (optional, for prediction refinement).
    #[prost(string, tag="2")]
    pub template_type: ::prost::alloc::string::String,
    /// Number of workflow steps (optional, for prediction refinement).
    #[prost(int32, tag="3")]
    pub workflow_step_count: i32,
}
/// Response containing a cohort-level ACK prediction.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct PredictCampaignAckResponse {
    /// Cohort-level prediction.
    #[prost(message, optional, tag="1")]
    pub prediction: ::core::option::Option<CohortPrediction>,
}
/// Request for campaign configuration advisory.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCampaignAdvisoryRequest {
    /// ID of the target audience group. Required.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
    /// Template ID (optional, for advisory context).
    #[prost(string, tag="2")]
    pub template_id: ::prost::alloc::string::String,
    /// Template version (optional).
    #[prost(int32, tag="3")]
    pub template_version: i32,
    /// Number of workflow steps (optional).
    #[prost(int32, tag="4")]
    pub workflow_step_count: i32,
}
/// Response containing campaign advisory information.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetCampaignAdvisoryResponse {
    /// Campaign advisory with prediction, suggested escalation, and archetypes.
    #[prost(message, optional, tag="1")]
    pub advisory: ::core::option::Option<CampaignAdvisory>,
}
/// Request to generate an AI narrative for a group's insights.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetInsightNarrativeRequest {
    /// ID of the group to generate a narrative for. Required.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
    /// Name of the prompt template to use (e.g., "campaign-advisory", "archetype-explanation").
    #[prost(string, tag="2")]
    pub prompt_name: ::prost::alloc::string::String,
}
/// Response containing an AI-generated narrative.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetInsightNarrativeResponse {
    /// AI-generated narrative text (Markdown formatted).
    #[prost(string, tag="1")]
    pub narrative: ::prost::alloc::string::String,
    /// Timestamp when the narrative was generated.
    #[prost(message, optional, tag="2")]
    pub generated_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Model identifier used for generation.
    #[prost(string, tag="3")]
    pub model_id: ::prost::alloc::string::String,
}
/// Request to manually trigger the ML training pipeline.
/// Empty — organization is extracted from the JWT.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TriggerMlPipelineRequest {
}
/// Response after triggering the ML pipeline.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TriggerMlPipelineResponse {
    /// Remaining manual retrains allowed this month.
    #[prost(int32, tag="1")]
    pub remaining_this_month: i32,
    /// Timestamp of the last successful training (null if never trained).
    #[prost(message, optional, tag="2")]
    pub last_trained_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to manually retrigger archetype clustering for a single group
/// without rerunning the full SageMaker training pipeline. Reuses the
/// already-deployed clustering model.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TriggerArchetypeClusteringRequest {
    /// Group to recluster. Org is extracted from the JWT.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
}
/// Response after triggering archetype clustering for one group.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TriggerArchetypeClusteringResponse {
    /// Temporal workflow id — useful for client-side dedupe + operator
    /// debugging via the Temporal UI.
    #[prost(string, tag="1")]
    pub workflow_id: ::prost::alloc::string::String,
    /// Remaining manual retrains allowed this month. Shares the same
    /// monthly counter as TriggerMLPipeline (ml_manual_limit_monthly).
    #[prost(int32, tag="2")]
    pub remaining_this_month: i32,
    /// Timestamp of the last successful archetype clustering for this
    /// (org, group), null if never clustered.
    #[prost(message, optional, tag="3")]
    pub last_clustered_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to draft a campaign body for a given archetype using Bedrock.
/// Used by the Compass "Target this archetype in a new campaign" CTA to
/// pre-fill the campaign creation wizard's body field.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GenerateCampaignBodyDraftRequest {
    /// UUID of the source group whose archetype set the label belongs to.
    #[prost(string, tag="1")]
    pub group_id: ::prost::alloc::string::String,
    /// Stable archetype label, e.g. "Swift Acknowledger".
    #[prost(string, tag="2")]
    pub archetype_label: ::prost::alloc::string::String,
    /// Lane-recommended action copy passed through from the admin (e.g.
    /// "Simplify the call-to-action"). Used as a tone hint for the prompt.
    #[prost(string, tag="3")]
    pub lane_action: ::prost::alloc::string::String,
}
/// Response containing the generated draft body in Markdown.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GenerateCampaignBodyDraftResponse {
    /// Draft Markdown body, 3-5 sentences. Authored as if written for the
    /// recipient — does not mention the archetype name.
    #[prost(string, tag="1")]
    pub body_markdown: ::prost::alloc::string::String,
}
/// Share of an organization's campaigns exercising one lever.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct LeverShare {
    #[prost(enumeration="Lever", tag="1")]
    pub lever: i32,
    #[prost(int32, tag="2")]
    pub count: i32,
    /// Fraction of classified campaigns, 0..1.
    #[prost(float, tag="3")]
    pub share: f32,
    /// Where the majority of this lever's classifications came from.
    /// Consumers use this together with `avg_confidence` to present
    /// rule-derived mixes as estimates rather than model-grade
    /// classifications.
    #[prost(enumeration="LeverSource", tag="4")]
    pub dominant_source: i32,
    /// Mean classifier confidence across the campaigns counted here, 0..1.
    #[prost(float, tag="5")]
    pub avg_confidence: f32,
}
/// How much messaging lands on a single person over the observed window.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct RecipientLoad {
    #[prost(float, tag="1")]
    pub median_per_week: f32,
    #[prost(float, tag="2")]
    pub p90_per_week: f32,
    #[prost(int32, tag="3")]
    pub users_reached: i32,
    #[prost(int32, tag="4")]
    pub window_days: i32,
    /// Median number of distinct senders reaching one recipient within
    /// the same window.
    #[prost(float, tag="5")]
    pub median_distinct_senders: f32,
    /// 90th-percentile number of distinct senders reaching one recipient
    /// within the same window.
    #[prost(float, tag="6")]
    pub p90_distinct_senders: f32,
    /// Median number of distinct channels one recipient is reached on
    /// within the same window.
    #[prost(float, tag="7")]
    pub median_distinct_channels: f32,
    /// 90th-percentile number of distinct channels one recipient is
    /// reached on within the same window.
    #[prost(float, tag="8")]
    pub p90_distinct_channels: f32,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetOrgCommunicationProfileRequest {
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetOrgCommunicationProfileResponse {
    #[prost(message, repeated, tag="1")]
    pub lever_mix: ::prost::alloc::vec::Vec<LeverShare>,
    #[prost(message, optional, tag="2")]
    pub load: ::core::option::Option<RecipientLoad>,
    #[prost(int32, tag="3")]
    pub campaigns_analyzed: i32,
    /// Fraction of active objectives that have at least one indicator
    /// whose evidence comes from outside the product, 0..1.
    ///
    /// It says how much the rest of the board is worth: an objective
    /// observed only through what people answered inside the app has
    /// evidence that they said they did it, not evidence that the work
    /// changed.
    ///
    /// Absent when `active_objectives` is zero, because a fraction with no
    /// denominator has no value and a present 0.0 would be
    /// indistinguishable from genuine coverage of none — opposite facts
    /// with opposite consequences. The two counts below travel with it as
    /// the second half of the same guarantee.
    #[prost(float, optional, tag="4")]
    pub evidence_coverage: ::core::option::Option<f32>,
    /// Numerator of `evidence_coverage`: active objectives with at least
    /// one indicator sourced outside the product.
    #[prost(int32, tag="5")]
    pub objectives_with_external_evidence: i32,
    /// Denominator of `evidence_coverage`: active objectives. Zero means
    /// the organization has declared none, which is a supported way to use
    /// the product and not an incomplete setup.
    #[prost(int32, tag="6")]
    pub active_objectives: i32,
    /// Median number of days since the organization's indicators were last
    /// revised, measured from each indicator's last update.
    ///
    /// Indicators are rarely revisited when the strategy they serve moves
    /// on, and this is the plainest measurable form of that: an ageing
    /// median means the board is describing an older intent than the
    /// objectives do.
    ///
    /// Absent when the organization has no indicators. An age of zero
    /// would claim they were all just reviewed.
    #[prost(int64, optional, tag="7")]
    pub median_indicator_review_age_days: ::core::option::Option<i64>,
}
/// One observation in a diagnosis.
///
/// Every finding carries the records it was derived from. That is not
/// decoration: a statement about an organization that cannot be traced
/// back to the campaigns, objectives and indicators that produced it is
/// indistinguishable from an opinion, and the reader has no way to
/// disagree with it on the facts. At least one of the three reference
/// lists is always non-empty.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DiagnosisFinding {
    /// Unique identifier for the finding, stable within the diagnosis.
    /// Lets a surface show a finding once at the level where it can be
    /// acted on instead of repeating it as a loose warning elsewhere.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Which pattern produced it.
    #[prost(enumeration="DiagnosisFindingKind", tag="2")]
    pub kind: i32,
    /// What was observed, in the organization's own terms. Plain language
    /// and free of the vocabulary of the framework the pattern comes from.
    #[prost(string, tag="3")]
    pub detail: ::prost::alloc::string::String,
    /// Campaigns the finding was derived from.
    #[prost(string, repeated, tag="4")]
    pub campaign_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// Objectives the finding was derived from.
    #[prost(string, repeated, tag="5")]
    pub objective_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// Indicators the finding was derived from.
    #[prost(string, repeated, tag="6")]
    pub indicator_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// True when a model wrote `detail`. A model only ever phrases a
    /// finding that was already established from the records above; it
    /// never decides that there is one. Consumers use this the way they
    /// use lever provenance — to present a phrasing as a phrasing.
    #[prost(bool, tag="7")]
    pub model_assisted: bool,
}
/// The organization-level metrics as they stood when a diagnosis was
/// produced, stored with it.
///
/// Kept rather than recomputed because two of the four cannot be
/// recovered afterwards. Evidence coverage and the indicator review age
/// are read off the objectives and indicators as they are configured at
/// that moment, and configuration has no history: an objective archived
/// or an indicator revised next month silently rewrites what last
/// month's answer would have been. A diagnosis stored without its
/// snapshot therefore loses the comparison permanently, and the
/// comparison is most of why the diagnosis is stored at all.
///
/// Fields carry presence on the same terms as the profile response they
/// mirror: absent means there was nothing to measure, never zero.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct OrgMetricsSnapshot {
    /// Distribution of the classified history across control mechanisms.
    #[prost(message, repeated, tag="1")]
    pub lever_mix: ::prost::alloc::vec::Vec<LeverShare>,
    /// How much messaging landed on one person over the observed window.
    #[prost(message, optional, tag="2")]
    pub load: ::core::option::Option<RecipientLoad>,
    /// Fraction of active objectives with at least one indicator sourced
    /// outside the product, 0..1. Absent when there were no active
    /// objectives.
    #[prost(float, optional, tag="3")]
    pub evidence_coverage: ::core::option::Option<f32>,
    /// Numerator of `evidence_coverage` at generation time.
    #[prost(int32, tag="4")]
    pub objectives_with_external_evidence: i32,
    /// Denominator of `evidence_coverage` at generation time.
    #[prost(int32, tag="5")]
    pub active_objectives: i32,
    /// Median days since the organization's indicators were last revised.
    /// Absent when there were no indicators.
    #[prost(int64, optional, tag="6")]
    pub median_indicator_review_age_days: ::core::option::Option<i64>,
}
/// A dated, stored reading of the organization's own measurement system:
/// what it has declared it wants, how it observes it, and what it has
/// actually been communicating.
///
/// Stored rather than computed on request because the useful statements
/// are comparisons — that the mix of messages moved over a quarter, that
/// three objectives still have no outcome evidence months later — and a
/// stateless query cannot make them. It is also the only shape in which a
/// recurring review has something to review.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct OrgDiagnosis {
    /// Unique identifier for this run.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// When the run was produced.
    #[prost(message, optional, tag="2")]
    pub generated_at: ::core::option::Option<::prost_types::Timestamp>,
    /// What the run found. Empty when the configuration and the history
    /// gave nothing to say, which is a real result: a system that always
    /// has an opinion stops being read. Empty carries that meaning only
    /// when `findings_evaluated` is true.
    #[prost(message, repeated, tag="3")]
    pub findings: ::prost::alloc::vec::Vec<DiagnosisFinding>,
    /// The previous run, when there is one. What changed between the two
    /// is the part of a diagnosis that no single run can carry.
    #[prost(string, tag="4")]
    pub previous_diagnosis_id: ::prost::alloc::string::String,
    /// Objectives read by the run.
    #[prost(int32, tag="5")]
    pub objectives_analyzed: i32,
    /// Campaigns read by the run.
    #[prost(int32, tag="6")]
    pub campaigns_analyzed: i32,
    /// The metrics as they stood at generation time. What moved between
    /// two runs is the part of a diagnosis that no single run can state,
    /// and this is what makes it recoverable later.
    #[prost(message, optional, tag="7")]
    pub metrics: ::core::option::Option<OrgMetricsSnapshot>,
    /// Whether the patterns that produce findings were evaluated for this
    /// diagnosis.
    ///
    /// A run freezes its metrics whether or not the interpretation half
    /// completes, because measurement cannot be recovered afterwards and
    /// interpretation can. When it did not complete, `findings` is empty
    /// for a reason that says nothing about the organization: nothing
    /// looked.
    ///
    /// An empty `findings` list is evidence that nothing was found only
    /// when this is true; otherwise it is evidence of nothing at all, and
    /// a consumer MUST NOT present it as a clean bill of health — no
    /// warnings shown, "no issues detected", a zero on a findings count,
    /// or a flat stretch in a findings-over-time series are all the same
    /// false claim.
    ///
    /// False is the safe default: a producer that does not set it is taken
    /// to have looked at nothing.
    #[prost(bool, tag="8")]
    pub findings_evaluated: bool,
}
/// Request for a stored organization diagnosis.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetOrgDiagnosisRequest {
    /// Retrieve a specific run. Empty returns the most recent one.
    /// An id that does not exist returns NOT_FOUND.
    #[prost(string, tag="1")]
    pub diagnosis_id: ::prost::alloc::string::String,
}
/// Response containing an organization diagnosis.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetOrgDiagnosisResponse {
    /// The diagnosis. Absent when no run has ever been produced for the
    /// organization — a run needs declared objectives to have anything to
    /// read, and does not happen without them. Absence is presented as
    /// absence, never as a diagnosis with no findings, which would say
    /// something quite different.
    #[prost(message, optional, tag="1")]
    pub diagnosis: ::core::option::Option<OrgDiagnosis>,
}
/// Request to list an organization's diagnoses with pagination.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListOrgDiagnosesRequest {
    /// Pagination parameters.
    #[prost(message, optional, tag="1")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of diagnoses.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListOrgDiagnosesResponse {
    /// Diagnoses in this page, newest first. Each carries its own metrics
    /// snapshot, so a page is enough to plot how the organization's
    /// measurement system moved without walking the chain of previous
    /// runs one fetch at a time.
    ///
    /// Entries whose `findings_evaluated` is false are not quiet months.
    /// Leave them out of any count or series built on findings, and say
    /// they were left out; kept in, the series reports when evaluation
    /// succeeded rather than how the organization moved.
    #[prost(message, repeated, tag="1")]
    pub diagnoses: ::prost::alloc::vec::Vec<OrgDiagnosis>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to run a diagnosis now.
/// Empty — organization is extracted from the JWT.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TriggerOrgDiagnosisRequest {
}
/// Response after triggering a diagnosis run.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TriggerOrgDiagnosisResponse {
    /// Remaining manual runs allowed this month.
    #[prost(int32, tag="1")]
    pub remaining_this_month: i32,
    /// Timestamp of the last diagnosis produced, null if never run.
    #[prost(message, optional, tag="2")]
    pub last_generated_at: ::core::option::Option<::prost_types::Timestamp>,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Confidence level for cohort-level predictions, based on available data volume.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ConfidenceLevel {
    Unspecified = 0,
    /// Fewer than 50 campaigns — predictions based on heuristics/industry benchmarks.
    Low = 1,
    /// 50-200 campaigns — basic clustering available, wide confidence intervals.
    Medium = 2,
    /// 200+ campaigns — full ML pipeline, narrow confidence intervals.
    High = 3,
}
impl ConfidenceLevel {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "CONFIDENCE_LEVEL_UNSPECIFIED",
            Self::Low => "CONFIDENCE_LEVEL_LOW",
            Self::Medium => "CONFIDENCE_LEVEL_MEDIUM",
            Self::High => "CONFIDENCE_LEVEL_HIGH",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "CONFIDENCE_LEVEL_UNSPECIFIED" => Some(Self::Unspecified),
            "CONFIDENCE_LEVEL_LOW" => Some(Self::Low),
            "CONFIDENCE_LEVEL_MEDIUM" => Some(Self::Medium),
            "CONFIDENCE_LEVEL_HIGH" => Some(Self::High),
            _ => None,
        }
    }
}
/// Pipeline state for a group's archetypes. Lets the admin UI render
/// distinct empty-state affordances ("run clustering" vs "need N more
/// sessions" vs "pipeline ran but audience was too homogeneous") instead
/// of treating every empty archetype list the same. Populated by
/// InsightsService.GetGroupArchetypes.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum PipelineState {
    Unspecified = 0,
    /// The ML pipeline has never fired for this org. Archetypes are
    /// empty because nothing ran, not because of data shape.
    NeverRun = 1,
    /// The pipeline ran but the group had fewer than the k-anonymization
    /// minimum feature vectors (50), so clustering was skipped. UI
    /// renders "keep running campaigns" affordance.
    BelowThreshold = 2,
    /// The pipeline ran with enough vectors but the clustering provider
    /// returned zero clusters — typically means the audience is too
    /// homogeneous to separate into distinct archetypes.
    NoClusters = 3,
    /// Archetypes are populated and ready to render.
    Ready = 4,
}
impl PipelineState {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "PIPELINE_STATE_UNSPECIFIED",
            Self::NeverRun => "PIPELINE_STATE_NEVER_RUN",
            Self::BelowThreshold => "PIPELINE_STATE_BELOW_THRESHOLD",
            Self::NoClusters => "PIPELINE_STATE_NO_CLUSTERS",
            Self::Ready => "PIPELINE_STATE_READY",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "PIPELINE_STATE_UNSPECIFIED" => Some(Self::Unspecified),
            "PIPELINE_STATE_NEVER_RUN" => Some(Self::NeverRun),
            "PIPELINE_STATE_BELOW_THRESHOLD" => Some(Self::BelowThreshold),
            "PIPELINE_STATE_NO_CLUSTERS" => Some(Self::NoClusters),
            "PIPELINE_STATE_READY" => Some(Self::Ready),
            _ => None,
        }
    }
}
/// Where an archetype came from. Lets clients distinguish trained ML
/// clustering output from low-confidence provisional output generated
/// for sandboxes and opted-in organizations before enough engagement
/// data exists. Clients MUST render a low-confidence disclaimer for
/// PROVISIONAL archetypes.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ArchetypeSource {
    Unspecified = 0,
    /// Produced by the trained ML clustering pipeline (k-anonymized,
    /// DP-noised behavioral feature vectors).
    Ml = 1,
    /// Rule-based provisional output derived from coarse delivery/read/
    /// ack activity (or a stable starter distribution for sandboxes with
    /// no activity). Low confidence, never written to the ML artifact
    /// path, and always superseded by ML output once available.
    Provisional = 2,
}
impl ArchetypeSource {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "ARCHETYPE_SOURCE_UNSPECIFIED",
            Self::Ml => "ARCHETYPE_SOURCE_ML",
            Self::Provisional => "ARCHETYPE_SOURCE_PROVISIONAL",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "ARCHETYPE_SOURCE_UNSPECIFIED" => Some(Self::Unspecified),
            "ARCHETYPE_SOURCE_ML" => Some(Self::Ml),
            "ARCHETYPE_SOURCE_PROVISIONAL" => Some(Self::Provisional),
            _ => None,
        }
    }
}
/// Which control mechanism a message exercises. Names are technical; clients
/// render plain-language labels from their own catalog.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum Lever {
    Unspecified = 0,
    Boundaries = 1,
    Diagnostic = 2,
    Beliefs = 3,
    Interactive = 4,
}
impl Lever {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "LEVER_UNSPECIFIED",
            Self::Boundaries => "LEVER_BOUNDARIES",
            Self::Diagnostic => "LEVER_DIAGNOSTIC",
            Self::Beliefs => "LEVER_BELIEFS",
            Self::Interactive => "LEVER_INTERACTIVE",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "LEVER_UNSPECIFIED" => Some(Self::Unspecified),
            "LEVER_BOUNDARIES" => Some(Self::Boundaries),
            "LEVER_DIAGNOSTIC" => Some(Self::Diagnostic),
            "LEVER_BELIEFS" => Some(Self::Beliefs),
            "LEVER_INTERACTIVE" => Some(Self::Interactive),
            _ => None,
        }
    }
}
/// How a lever classification was produced.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum LeverSource {
    Unspecified = 0,
    /// Produced by a trained classification model.
    Model = 1,
    /// Produced by deterministic rules over campaign metadata.
    Rules = 2,
}
impl LeverSource {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "LEVER_SOURCE_UNSPECIFIED",
            Self::Model => "LEVER_SOURCE_MODEL",
            Self::Rules => "LEVER_SOURCE_RULES",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "LEVER_SOURCE_UNSPECIFIED" => Some(Self::Unspecified),
            "LEVER_SOURCE_MODEL" => Some(Self::Model),
            "LEVER_SOURCE_RULES" => Some(Self::Rules),
            _ => None,
        }
    }
}
/// Which pattern a finding came from. The scope a pattern is entitled to
/// speak at is fixed per kind and not a separate field: mutual exclusivity
/// and lever mix are properties of the whole declared set, board size and
/// drift are properties of one objective, and encouraged behaviour is a
/// property of one indicator. Evaluating any of them at another scope is a
/// category error rather than a partial view.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum DiagnosisFindingKind {
    Unspecified = 0,
    /// An indicator whose evidence source structurally fails one of the
    /// qualities a measure needs, and the behaviour that tends to follow.
    PerverseConductRisk = 1,
    /// The organization's messages concentrate in some control mechanisms
    /// and leave others unused, with the consequences the missing ones
    /// would have covered.
    LeverImbalance = 2,
    /// The declared objectives overlap each other or leave gaps, so the
    /// set does not partition what the organization is trying to hold
    /// true.
    NonExclusiveSet = 3,
    /// An objective carries more indicators than anyone reads, or several
    /// that measure the same thing by different routes.
    InflatedBoard = 4,
    /// An objective's wording changed and none of its indicators was
    /// revisited afterwards.
    ObjectiveIndicatorDrift = 5,
}
impl DiagnosisFindingKind {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "DIAGNOSIS_FINDING_KIND_UNSPECIFIED",
            Self::PerverseConductRisk => "DIAGNOSIS_FINDING_KIND_PERVERSE_CONDUCT_RISK",
            Self::LeverImbalance => "DIAGNOSIS_FINDING_KIND_LEVER_IMBALANCE",
            Self::NonExclusiveSet => "DIAGNOSIS_FINDING_KIND_NON_EXCLUSIVE_SET",
            Self::InflatedBoard => "DIAGNOSIS_FINDING_KIND_INFLATED_BOARD",
            Self::ObjectiveIndicatorDrift => "DIAGNOSIS_FINDING_KIND_OBJECTIVE_INDICATOR_DRIFT",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "DIAGNOSIS_FINDING_KIND_UNSPECIFIED" => Some(Self::Unspecified),
            "DIAGNOSIS_FINDING_KIND_PERVERSE_CONDUCT_RISK" => Some(Self::PerverseConductRisk),
            "DIAGNOSIS_FINDING_KIND_LEVER_IMBALANCE" => Some(Self::LeverImbalance),
            "DIAGNOSIS_FINDING_KIND_NON_EXCLUSIVE_SET" => Some(Self::NonExclusiveSet),
            "DIAGNOSIS_FINDING_KIND_INFLATED_BOARD" => Some(Self::InflatedBoard),
            "DIAGNOSIS_FINDING_KIND_OBJECTIVE_INDICATOR_DRIFT" => Some(Self::ObjectiveIndicatorDrift),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A single reachability registry row, returned by `GetReachability` and
/// `ListReachabilityForUser`. The plaintext identifier and envelope ciphertext
/// are NEVER returned over the wire — only metadata. The dispatch worker reads
/// the plaintext directly from the database and decrypts via KMS.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Reachability {
    /// Server-assigned row identifier (UUID).
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Organization that owns this reachability entry.
    #[prost(string, tag="2")]
    pub org_id: ::prost::alloc::string::String,
    /// User this reachability entry is for.
    #[prost(string, tag="3")]
    pub user_id: ::prost::alloc::string::String,
    /// Channel for which this entry stores a contact identifier.
    #[prost(enumeration="ChannelName", tag="4")]
    pub channel: i32,
    /// When the row was first written.
    #[prost(message, optional, tag="5")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// When the row was last upserted.
    #[prost(message, optional, tag="6")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Optional AWS region identifier (e.g. "eu-west-1") this user's data must
    /// remain in for GDPR/residency reasons. Unset means "no constraint."
    /// Enforcement happens at dispatch time, not write time.
    #[prost(string, optional, tag="7")]
    pub region_constraint: ::core::option::Option<::prost::alloc::string::String>,
}
/// Per-(org, channel) region allowlist used by the dispatch worker to enforce
/// data-residency policy. An empty `allowed_regions` list means "no policy
/// configured" — NOT "no regions allowed."
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RegionPolicy {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="2")]
    pub channel: i32,
    /// AWS region identifiers (e.g. "eu-west-1", "us-east-1"). Empty list ==
    /// "no policy configured" — the dispatch worker SHALL NOT block on empty.
    #[prost(string, repeated, tag="3")]
    pub allowed_regions: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    #[prost(message, optional, tag="4")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Terminal status of a single dispatch attempt as returned by the worker-mode
/// `DispatchToChannel` RPC. Distinct from the richer `ChannelEventStatus` in
/// `channel_events.proto`, which models the audit-trail row for every state
/// transition (SENT → DELIVERED → OPENED → …). DispatchStatus is the immediate
/// outcome of one worker call.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum DispatchStatus {
    /// Default value; should not be used explicitly.
    Unspecified = 0,
    /// The adapter accepted the message for delivery (provider returned success).
    Sent = 1,
    /// The adapter returned a terminal error (e.g. recipient blocked, domain not
    /// verified). Retries SHALL NOT be attempted; consult `failure_reason`.
    Failed = 2,
    /// An existing `(dispatch_id, SENT)` row was found by the idempotency guard
    /// before the adapter was called; the prior receipt was returned without a
    /// second provider call.
    Deduped = 3,
}
impl DispatchStatus {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "DISPATCH_STATUS_UNSPECIFIED",
            Self::Sent => "DISPATCH_STATUS_SENT",
            Self::Failed => "DISPATCH_STATUS_FAILED",
            Self::Deduped => "DISPATCH_STATUS_DEDUPED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "DISPATCH_STATUS_UNSPECIFIED" => Some(Self::Unspecified),
            "DISPATCH_STATUS_SENT" => Some(Self::Sent),
            "DISPATCH_STATUS_FAILED" => Some(Self::Failed),
            "DISPATCH_STATUS_DEDUPED" => Some(Self::Deduped),
            _ => None,
        }
    }
}
// ─── DispatchToChannel ──────────────────────────────────────────────────────

/// Worker-mode entry point invoked by the Temporal worker for one recipient.
/// Idempotent on `dispatch_id`: if a `(dispatch_id, SENT)` row already exists
/// in `channel_dispatches`, the worker SHALL return DISPATCH_STATUS_DEDUPED
/// without re-invoking the channel adapter.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct DispatchToChannelRequest {
    /// Idempotency key. Must be stable across retries from pidgr-api side.
    #[prost(string, tag="1")]
    pub dispatch_id: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(string, tag="3")]
    pub user_id: ::prost::alloc::string::String,
    /// Which channel adapter to invoke (EMAIL is the Wave 1 implementation).
    #[prost(enumeration="ChannelName", tag="4")]
    pub channel: i32,
    /// Template to render before dispatch.
    #[prost(string, tag="5")]
    pub template_id: ::prost::alloc::string::String,
    /// Per-recipient template variables.
    #[prost(map="string, string", tag="6")]
    pub template_vars: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
    /// BCP-47 locale used to select the template translation.
    #[prost(string, tag="7")]
    pub locale: ::prost::alloc::string::String,
    /// Optional AWS region the worker MUST dispatch from (typically copied from
    /// the recipient's reachability row). Unset means "no constraint."
    #[prost(string, optional, tag="8")]
    pub region_constraint: ::core::option::Option<::prost::alloc::string::String>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DispatchToChannelResponse {
    /// Echoes back the request's `dispatch_id`.
    #[prost(string, tag="1")]
    pub dispatch_id: ::prost::alloc::string::String,
    /// Terminal outcome of this call.
    #[prost(enumeration="DispatchStatus", tag="2")]
    pub status: i32,
    /// Human-readable failure reason; set only when `status` is
    /// DISPATCH_STATUS_FAILED.
    #[prost(string, optional, tag="3")]
    pub failure_reason: ::core::option::Option<::prost::alloc::string::String>,
}
// ─── UpsertReachability ─────────────────────────────────────────────────────

/// Records a recipient identifier for a (user, channel) tuple. The plaintext
/// identifier is column-level KMS-encrypted on insert and never logged or
/// returned. The server computes the org-scoped HMAC lookup hash so opt-out
/// webhooks can find the row without decrypt.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpsertReachabilityRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub user_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="3")]
    pub channel: i32,
    /// The plaintext identifier (email address, phone number, Slack user ID,
    /// Telegram chat ID, etc.). Encrypted at rest server-side. Servers MUST NOT
    /// log this field. Clients SHOULD treat this message as sensitive.
    #[prost(string, tag="4")]
    pub identifier_plaintext: ::prost::alloc::string::String,
    /// Optional AWS region this user's data must remain in (e.g. "eu-west-1").
    /// Recorded but NOT enforced at write time; enforcement is at dispatch.
    #[prost(string, optional, tag="5")]
    pub region_constraint: ::core::option::Option<::prost::alloc::string::String>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpsertReachabilityResponse {
    /// The metadata for the upserted row. Plaintext identifier and envelope
    /// ciphertext are intentionally absent.
    #[prost(message, optional, tag="1")]
    pub reachability: ::core::option::Option<Reachability>,
}
// ─── RemoveReachability ─────────────────────────────────────────────────────

/// Idempotent removal. GDPR Recital 30 audit row is appended via internal-mTLS
/// BEFORE the registry row is deleted (see AuditService.Append). If no row
/// existed, `removed = false` and no audit row is emitted.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveReachabilityRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub user_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="3")]
    pub channel: i32,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveReachabilityResponse {
    /// True if a row was deleted. False if no row existed for the tuple
    /// (idempotent success).
    #[prost(bool, tag="1")]
    pub removed: bool,
}
// ─── GetReachability ────────────────────────────────────────────────────────

/// Returns the reachability metadata for a single (user, channel) tuple.
/// Returns NOT_FOUND if no row exists.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetReachabilityRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub user_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="3")]
    pub channel: i32,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetReachabilityResponse {
    /// Plaintext identifier and envelope ciphertext are intentionally absent.
    #[prost(message, optional, tag="1")]
    pub reachability: ::core::option::Option<Reachability>,
}
// ─── ListReachabilityForUser ────────────────────────────────────────────────

/// Returns one Reachability entry per channel configured for a (org, user)
/// pair. Used by the admin-side per-user matrix view. Plaintext identifiers
/// and envelope ciphertext are intentionally absent — the admin UI only needs
/// to know which channels are configured.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListReachabilityForUserRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub user_id: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListReachabilityForUserResponse {
    /// One entry per channel that has a row for the (org_id, user_id) pair.
    #[prost(message, repeated, tag="1")]
    pub reachabilities: ::prost::alloc::vec::Vec<Reachability>,
}
// ─── GetRegionPolicy / SetRegionPolicy ──────────────────────────────────────

#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetRegionPolicyRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="2")]
    pub channel: i32,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetRegionPolicyResponse {
    /// Always populated. Empty `allowed_regions` means "no policy configured"
    /// — NOT "no regions allowed."
    #[prost(message, optional, tag="1")]
    pub policy: ::core::option::Option<RegionPolicy>,
}
/// Admin-only upsert. Empty `allowed_regions` clears the policy.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SetRegionPolicyRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="2")]
    pub channel: i32,
    /// AWS region identifiers (e.g. "eu-west-1"). Empty list == "no policy."
    #[prost(string, repeated, tag="3")]
    pub allowed_regions: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SetRegionPolicyResponse {
    #[prost(message, optional, tag="1")]
    pub policy: ::core::option::Option<RegionPolicy>,
}
// ─── GetCostCapPolicy / SetCostCapPolicy ────────────────────────────────────

/// Get the cost-cap state for the current calendar-month period (UTC). When
/// no row exists for `(org_id, channel, period_yyyymm)`, the server returns
/// the channel default cap from server config
/// (`COST_CAP_DEFAULT_${CHANNEL}_MICROS`) with `used_micros = 0`.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCostCapPolicyRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="2")]
    pub channel: i32,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCostCapPolicyResponse {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="2")]
    pub channel: i32,
    /// Current period's cap in micros (1/1_000_000 of a USD).
    #[prost(int64, tag="3")]
    pub cap_micros: i64,
    /// Current period's accumulated spend in micros.
    #[prost(int64, tag="4")]
    pub used_micros: i64,
    /// Calendar-month period in integer YYYYMM form (e.g. 202605 for May 2026).
    #[prost(int32, tag="5")]
    pub period_yyyymm: i32,
}
/// Admin-only upsert of the cap for the current calendar-month period. Future
/// periods inherit the most recent SetCostCapPolicy value until the next call.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SetCostCapPolicyRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="2")]
    pub channel: i32,
    #[prost(int64, tag="3")]
    pub cap_micros: i64,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SetCostCapPolicyResponse {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(enumeration="ChannelName", tag="2")]
    pub channel: i32,
    #[prost(int64, tag="3")]
    pub cap_micros: i64,
    #[prost(int64, tag="4")]
    pub used_micros: i64,
    #[prost(int32, tag="5")]
    pub period_yyyymm: i32,
}
// ─── GetOrgWebhookConfig / SetOrgWebhookConfig ──────────────────────────────

/// Get the org's generic-webhook channel configuration. The shared secret is
/// write-only and never returned — `has_secret` reports whether one is set.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetOrgWebhookConfigRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetOrgWebhookConfigResponse {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    /// Destination URL Pidgr POSTs notification events to. Empty when no
    /// configuration exists.
    #[prost(string, tag="2")]
    pub url: ::prost::alloc::string::String,
    /// Whether dispatch via the WEBHOOK channel is enabled for the org.
    #[prost(bool, tag="3")]
    pub enabled: bool,
    /// Whether a signing secret is currently configured. The secret itself is
    /// never returned.
    #[prost(bool, tag="4")]
    pub has_secret: bool,
    #[prost(message, optional, tag="5")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    #[prost(message, optional, tag="6")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Admin-only upsert of the org's generic-webhook configuration. The server
/// validates the URL (https-only, public addresses only) before persisting,
/// and envelope-encrypts the secret at rest. Setting a new `secret` rotates
/// it; leaving `secret` unset keeps the existing one.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SetOrgWebhookConfigRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    /// Destination URL. Constraints: https scheme; non-private, non-loopback
    /// host. Validation failures return `invalid_argument`.
    #[prost(string, tag="2")]
    pub url: ::prost::alloc::string::String,
    #[prost(bool, tag="3")]
    pub enabled: bool,
    /// Shared secret used for the `X-Pidgr-Signature` HMAC-SHA256 header.
    /// Write-only. Unset keeps the current secret; set rotates it.
    /// Constraints: 16–256 bytes when set.
    #[prost(string, optional, tag="4")]
    pub secret: ::core::option::Option<::prost::alloc::string::String>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SetOrgWebhookConfigResponse {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub url: ::prost::alloc::string::String,
    #[prost(bool, tag="3")]
    pub enabled: bool,
    #[prost(bool, tag="4")]
    pub has_secret: bool,
    #[prost(message, optional, tag="5")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    #[prost(message, optional, tag="6")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
}
// ─── CreateChannelConnectLink ───────────────────────────────────────────────

/// Mints a short-lived, HMAC-signed opt-in link a user follows to bind a
/// third-party channel to their (org, user). Only follow-style channels are
/// accepted: CHANNEL_NAME_TELEGRAM (bot-follow), CHANNEL_NAME_SLACK (OAuth),
/// CHANNEL_NAME_LINE (follow-code). Any other channel is rejected server-side
/// with `invalid_argument`. Wraps the pidgr-api `internal/linktoken` minter.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateChannelConnectLinkRequest {
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    /// Internal user UUID; resolved via UserResolver on the server. The minted
    /// token binds the resulting channel identifier to this (org, user).
    #[prost(string, tag="2")]
    pub user_id: ::prost::alloc::string::String,
    /// Channel to connect. Constraints: must be one of CHANNEL_NAME_TELEGRAM,
    /// CHANNEL_NAME_SLACK, CHANNEL_NAME_LINE. Other values return
    /// `invalid_argument`.
    #[prost(enumeration="ChannelName", tag="3")]
    pub channel: i32,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateChannelConnectLinkResponse {
    /// The deep link the client renders for the user to follow (e.g. a
    /// Telegram bot-follow URL, Slack OAuth authorize URL, or LINE follow URL).
    #[prost(string, tag="1")]
    pub connect_url: ::prost::alloc::string::String,
    /// The raw 64-char base64url opt-in token embedded in `connect_url`,
    /// surfaced separately so clients can render it as a QR code or copy
    /// button. Implementation detail — clients SHOULD NOT parse or mutate it.
    #[prost(string, tag="2")]
    pub token: ::prost::alloc::string::String,
    /// When the minted token expires. After this time the link no longer
    /// binds and the user must request a fresh one.
    #[prost(message, optional, tag="3")]
    pub expires_at: ::core::option::Option<::prost_types::Timestamp>,
}
// ─── CreateSlackWorkspaceInstallAuthorization ───────────────────────────────

/// Mints a short-lived, HMAC-signed token authorizing a Slack WORKSPACE
/// install into the caller's AUTHORIZED org. The admin passes the token to the
/// pidgr-integrations install-start endpoint, which verifies it and installs
/// into the org the token binds — not the caller's JWT home org. This is the
/// workspace-install analogue of CreateChannelConnectLink (which binds the
/// per-user link flow): without it, a multi-org admin who selects a non-home
/// org still installs the bot into their home org, because the install-start
/// endpoint has no Cognito-sub→internal-id resolver of its own and falls back
/// to the JWT org claim.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateSlackWorkspaceInstallAuthorizationRequest {
    /// Must equal the caller's authorized org (auth.OrgID) — cross-org minting is
    /// rejected with permission_denied.
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateSlackWorkspaceInstallAuthorizationResponse {
    /// The opaque HMAC token the client passes as the `token` query parameter to
    /// the integrations `/webhooks/slack/oauth/install/start` endpoint. It binds
    /// the authorized (org, internal user id) and an expiry. Implementation
    /// detail — clients SHOULD NOT parse or mutate it.
    #[prost(string, tag="1")]
    pub token: ::prost::alloc::string::String,
    /// When the minted token expires. After this the admin must request a fresh
    /// one before starting the install.
    #[prost(message, optional, tag="2")]
    pub expires_at: ::core::option::Option<::prost_types::Timestamp>,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A shareable invite link that allows users to self-join an organization.
/// Links carry a role assignment and optional usage/expiry constraints.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct InviteLink {
    /// Unique identifier for the invite link.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Cryptographically random base64url-encoded token (43 characters).
    #[prost(string, tag="2")]
    pub token: ::prost::alloc::string::String,
    /// ID of the role assigned to users who redeem this link.
    #[prost(string, tag="3")]
    pub role_id: ::prost::alloc::string::String,
    /// Maximum number of times this link can be redeemed.
    /// 0 means unlimited.
    #[prost(int32, tag="4")]
    pub max_uses: i32,
    /// Number of times this link has been redeemed.
    #[prost(int32, tag="5")]
    pub use_count: i32,
    /// When the link expires. Empty if no expiry.
    #[prost(message, optional, tag="6")]
    pub expires_at: ::core::option::Option<::prost_types::Timestamp>,
    /// When the link was revoked. Empty if not revoked.
    #[prost(message, optional, tag="7")]
    pub revoked_at: ::core::option::Option<::prost_types::Timestamp>,
    /// ID of the admin who created the link.
    #[prost(string, tag="8")]
    pub created_by: ::prost::alloc::string::String,
    /// When the link was created.
    #[prost(message, optional, tag="9")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Data governance region assigned to users who redeem this link. Empty means inherit from org default.
    /// Valid values: EU, LATAM, BR, APAC, US.
    #[prost(string, tag="10")]
    pub data_governance_region: ::prost::alloc::string::String,
}
/// Request to create a new invite link for the organization.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateInviteLinkRequest {
    /// ID of the role to assign. Defaults to the organization's employee role if empty.
    #[prost(string, tag="1")]
    pub role_id: ::prost::alloc::string::String,
    /// Maximum number of redemptions. 0 means unlimited.
    #[prost(int32, tag="2")]
    pub max_uses: i32,
    /// Number of hours until the link expires. 0 means no expiry.
    /// Constraints: Valid range 0 to 8760 (1 year).
    #[prost(int32, tag="3")]
    pub expires_in_hours: i32,
    /// Optional data governance region. Users who redeem this link inherit this region. Empty means inherit from org default.
    /// Valid values: EU, LATAM, BR, APAC, US.
    #[prost(string, tag="4")]
    pub data_governance_region: ::prost::alloc::string::String,
}
/// Response after creating an invite link.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateInviteLinkResponse {
    /// The newly created invite link.
    #[prost(message, optional, tag="1")]
    pub invite_link: ::core::option::Option<InviteLink>,
    /// Full URL for sharing (e.g. "<https://app.pidgr.com/join?token=<TOKEN>">).
    #[prost(string, tag="2")]
    pub url: ::prost::alloc::string::String,
}
/// Request to list all invite links for the organization.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListInviteLinksRequest {
}
/// Response containing all invite links for the organization.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListInviteLinksResponse {
    /// All invite links (active, expired, maxed-out, and revoked), ordered by creation date descending.
    #[prost(message, repeated, tag="1")]
    pub invite_links: ::prost::alloc::vec::Vec<InviteLink>,
}
/// Request to revoke an invite link.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RevokeInviteLinkRequest {
    /// ID of the invite link to revoke. Required.
    #[prost(string, tag="1")]
    pub invite_link_id: ::prost::alloc::string::String,
}
/// Response after revoking an invite link.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RevokeInviteLinkResponse {
}
/// Request to redeem an invite link (authenticated — email extracted from JWT).
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RedeemInviteLinkRequest {
    /// The invite link token from the URL query parameter.
    #[prost(string, tag="1")]
    pub token: ::prost::alloc::string::String,
}
/// Response after redeeming an invite link.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RedeemInviteLinkResponse {
    /// Name of the organization the user was added to.
    #[prost(string, tag="1")]
    pub organization_name: ::prost::alloc::string::String,
}
/// Request to validate an invite link and provision a user account if needed (unauthenticated).
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ValidateInviteLinkRequest {
    /// The invite link token from the URL query parameter.
    #[prost(string, tag="1")]
    pub token: ::prost::alloc::string::String,
    /// Email address of the user joining the organization.
    /// Constraints: Max length 254 characters (RFC 5321).
    #[prost(string, tag="2")]
    pub email: ::prost::alloc::string::String,
}
/// Response after validating an invite link.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ValidateInviteLinkResponse {
    /// Name of the organization the invite link belongs to.
    #[prost(string, tag="1")]
    pub organization_name: ::prost::alloc::string::String,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// Request to invite a new user to the organization.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct InviteUserRequest {
    /// Email address to send the invitation to.
    /// Constraints: Max length 254 characters (RFC 5321).
    #[prost(string, tag="1")]
    pub email: ::prost::alloc::string::String,
    /// Display name for the invited user.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// ID of the role to assign. Defaults to the organization's employee role if empty.
    #[prost(string, tag="4")]
    pub role_id: ::prost::alloc::string::String,
    /// Optional profile attributes to pre-fill at invitation time.
    #[prost(message, optional, tag="5")]
    pub profile: ::core::option::Option<UserProfile>,
    /// Optional data governance region for the invited user. Empty means inherit from org default.
    /// Valid values: EU, LATAM, BR, APAC, US.
    #[prost(string, tag="6")]
    pub data_governance_region: ::prost::alloc::string::String,
}
/// Response after inviting a user.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct InviteUserResponse {
    /// The newly created user (status: INVITED).
    #[prost(message, optional, tag="1")]
    pub user: ::core::option::Option<User>,
}
/// Request to retrieve a user by ID.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetUserRequest {
    /// ID of the user to retrieve.
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
}
/// Response containing the requested user.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetUserResponse {
    /// The requested user.
    #[prost(message, optional, tag="1")]
    pub user: ::core::option::Option<User>,
}
/// Request to list users in the organization with pagination.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListUsersRequest {
    /// Pagination parameters.
    #[prost(message, optional, tag="1")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of users.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListUsersResponse {
    /// List of users in this page.
    #[prost(message, repeated, tag="1")]
    pub users: ::prost::alloc::vec::Vec<User>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to change a user's role within the organization.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateUserRoleRequest {
    /// ID of the user whose role to update.
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// ID of the new role to assign.
    #[prost(string, tag="2")]
    pub role_id: ::prost::alloc::string::String,
}
/// Response after updating a user's role.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateUserRoleResponse {
    /// The updated user with the new role.
    #[prost(message, optional, tag="1")]
    pub user: ::core::option::Option<User>,
}
/// Request to deactivate a user within the organization.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeactivateUserRequest {
    /// ID of the user to deactivate.
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
}
/// Response after deactivating a user.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct DeactivateUserResponse {
    /// The deactivated user (status: DEACTIVATED).
    #[prost(message, optional, tag="1")]
    pub user: ::core::option::Option<User>,
}
/// Request to reactivate a deactivated user.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ReactivateUserRequest {
    /// ID of the user to reactivate.
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
}
/// Response after reactivating a user.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ReactivateUserResponse {
    /// The reactivated user (status: INVITED).
    #[prost(message, optional, tag="1")]
    pub user: ::core::option::Option<User>,
}
/// Request to revoke an invitation for a user who has not yet registered.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RevokeInviteRequest {
    /// ID of the invited user to remove.
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
}
/// Response after revoking an invitation. Empty on success.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RevokeInviteResponse {
}
/// Request to update a user's profile attributes.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateUserProfileRequest {
    /// ID of the user whose profile to update.
    /// Empty or matching the caller's own ID allows self-update without PERMISSION_MEMBERS_MANAGE.
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// Profile attributes to set. All provided fields overwrite existing values.
    #[prost(message, optional, tag="2")]
    pub profile: ::core::option::Option<UserProfile>,
}
/// Response after updating a user's profile.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateUserProfileResponse {
    /// The updated user with the new profile.
    #[prost(message, optional, tag="1")]
    pub user: ::core::option::Option<User>,
}
/// Request to retrieve the caller's platform settings.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetUserSettingsRequest {
}
/// Response containing the caller's platform settings.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetUserSettingsResponse {
    /// Current settings. Fields at their default value indicate the platform default.
    #[prost(message, optional, tag="1")]
    pub settings: ::core::option::Option<UserSettings>,
}
/// Request to update the caller's platform settings.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateUserSettingsRequest {
    /// Settings to update. Only fields with non-default (non-UNSPECIFIED) values
    /// are applied; default-valued fields are left unchanged.
    #[prost(message, optional, tag="1")]
    pub settings: ::core::option::Option<UserSettings>,
}
/// Response after updating the caller's platform settings.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateUserSettingsResponse {
    /// The full settings after the update.
    #[prost(message, optional, tag="1")]
    pub settings: ::core::option::Option<UserSettings>,
}
/// Request to invite multiple users to the organization in a single call.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct BulkInviteUsersRequest {
    /// Email addresses to invite.
    /// Constraints: Min 1, max 100 emails. Duplicates are deduplicated before processing.
    #[prost(string, repeated, tag="1")]
    pub emails: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// ID of the role to assign. Defaults to the organization's employee role if empty.
    #[prost(string, tag="2")]
    pub role_id: ::prost::alloc::string::String,
}
/// Per-email result within a bulk invite operation.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct BulkInviteResult {
    /// The email address that was processed.
    #[prost(string, tag="1")]
    pub email: ::prost::alloc::string::String,
    /// Whether the invitation succeeded.
    #[prost(bool, tag="2")]
    pub success: bool,
    /// Error message if the invitation failed (e.g. "user already exists").
    /// Empty on success.
    #[prost(string, tag="3")]
    pub error: ::prost::alloc::string::String,
    /// The created user. Only set on success.
    #[prost(message, optional, tag="4")]
    pub user: ::core::option::Option<User>,
}
/// Response after bulk inviting users.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct BulkInviteUsersResponse {
    /// Per-email results in the same order as the deduplicated input.
    #[prost(message, repeated, tag="1")]
    pub results: ::prost::alloc::vec::Vec<BulkInviteResult>,
    /// Number of users successfully invited.
    #[prost(int32, tag="2")]
    pub invited_count: i32,
    /// Number of emails that failed.
    #[prost(int32, tag="3")]
    pub failed_count: i32,
}
/// Request to confirm passkey enrollment after client-side WebAuthn registration.
/// The server verifies that the caller has at least one registered WebAuthn
/// credential before setting the enrollment attribute.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ConfirmPasskeyEnrollmentRequest {
}
/// Response after confirming passkey enrollment.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ConfirmPasskeyEnrollmentResponse {
    /// Whether enrollment was confirmed and the user attribute was updated.
    #[prost(bool, tag="1")]
    pub confirmed: bool,
}
/// Request to update a user's data governance region.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateUserRegionRequest {
    /// ID of the user whose region to update. Required.
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// New governance region, or empty to inherit from org default.
    /// Valid values: EU, LATAM, BR, APAC, US.
    #[prost(string, tag="2")]
    pub data_governance_region: ::prost::alloc::string::String,
}
/// Response after updating a user's governance region.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateUserRegionResponse {
    /// The updated user.
    #[prost(message, optional, tag="1")]
    pub user: ::core::option::Option<User>,
    /// Temporal workflow ID for the region migration, if a migration was triggered.
    /// Empty if the region didn't actually change.
    #[prost(string, tag="2")]
    pub migration_workflow_id: ::prost::alloc::string::String,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A qualitative statement of a state the organization wants to hold
/// true. Owned by the organization, never by a single campaign. Content
/// is always authored by the organization; the contract only carries
/// structure.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Objective {
    /// Unique identifier for the objective.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Whether this is a standing objective or a time-bounded initiative.
    #[prost(enumeration="ObjectiveKind", tag="2")]
    pub kind: i32,
    /// The statement itself. Required.
    /// Constraints: Max length 300 characters.
    #[prost(string, tag="3")]
    pub title: ::prost::alloc::string::String,
    /// Longer explanation of what the statement means and does not mean.
    /// Constraints: Max length 4000 characters.
    #[prost(string, tag="4")]
    pub description: ::prost::alloc::string::String,
    /// ID of the user accountable for the objective. Optional.
    #[prost(string, tag="5")]
    pub owner_user_id: ::prost::alloc::string::String,
    /// Lifecycle state.
    #[prost(enumeration="ObjectiveState", tag="6")]
    pub state: i32,
    /// For an initiative, the standing objective it contributes to. Empty
    /// when the initiative stands alone, and always empty for
    /// OBJECTIVE_KIND_OBJECTIVE.
    #[prost(string, tag="7")]
    pub parent_objective_id: ::prost::alloc::string::String,
    /// For an initiative, the date it is expected to end. Unset for a
    /// standing objective, which by definition does not have one.
    #[prost(message, optional, tag="8")]
    pub ends_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Number of indicators currently attached.
    #[prost(int32, tag="9")]
    pub indicator_count: i32,
    /// Timestamp when the objective was created.
    #[prost(message, optional, tag="10")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the objective was last updated.
    #[prost(message, optional, tag="11")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// A form problem found in an objective's wording, returned alongside the
/// stored objective. Never blocks the write.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ObjectiveAdvisory {
    /// Which form problem was detected.
    #[prost(enumeration="ObjectiveWritingIssue", tag="1")]
    pub issue: i32,
    /// Plain-language explanation of what was detected and why it matters.
    #[prost(string, tag="2")]
    pub detail: ::prost::alloc::string::String,
    /// A rewrite the author can accept or ignore. May be empty when no
    /// rewrite could be produced.
    #[prost(string, tag="3")]
    pub suggested_rewrite: ::prost::alloc::string::String,
}
/// Something the author should know before relying on a verification
/// campaign as an indicator's evidence, returned alongside the stored
/// indicator. Never blocks the write.
///
/// Asking a verifier about a unit rather than about each of its members
/// is what keeps a stored answer from being one person's judgement of
/// another. That protection is a function of size: below a handful of
/// people, a statement about the unit is in practice a statement about
/// each member, and the distinction reconstructs itself. The remedy is to
/// put the question at a wider level instead, and where there is no wider
/// level, to accept that the objective gets no evidence by this route.
///
/// The platform does not pick that level by itself. Which units are
/// meaningful is something only the organization can state, so the choice
/// is the organization's — defaulted organization-wide, overridable per
/// indicator — and this notice is what puts the facts in front of the
/// person making it, who is also the one who can decide the current shape
/// is acceptable. It is deliberately not a warning shown to the verifier
/// at the moment of answering: that would claim a safeguard that does not
/// exist, and would ask one person to accept a risk that runs to somebody
/// else.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct VerificationSetupNotice {
    /// What follows from the current configuration, in plain language.
    #[prost(string, tag="1")]
    pub detail: ::prost::alloc::string::String,
    /// How many of the units this derivation would reach are smaller than
    /// the floor.
    #[prost(int32, tag="2")]
    pub units_below_floor: i32,
    /// The size at or above which a unit is asked about on its own.
    #[prost(int32, tag="3")]
    pub unit_floor: i32,
    /// The level the question would be put at as things stand, with the
    /// indicator's own selection already resolved against the
    /// organization's default. Stated outright so that a reader never has
    /// to guess whether an inherited default or an explicit choice is in
    /// force, and never has to fetch the organization to find out.
    #[prost(enumeration="VerificationUnitLevel", tag="4")]
    pub effective_unit_level: i32,
    /// The levels that would actually reach somebody in this organization,
    /// given the structure it has declared. A level absent from this list
    /// resolves to no question being asked at all, so offering it as a
    /// remedy would trade a visible problem for a silent one.
    #[prost(enumeration="VerificationUnitLevel", repeated, tag="5")]
    pub selectable_unit_levels: ::prost::alloc::vec::Vec<i32>,
}
/// A declared way of observing whether an objective holds. Several per
/// objective is the intended shape: indicators are individually
/// incomplete and are meant to compensate for one another.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Indicator {
    /// Unique identifier for the indicator.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Objective this indicator hangs from.
    #[prost(string, tag="2")]
    pub objective_id: ::prost::alloc::string::String,
    /// Short name for the indicator. Required.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="3")]
    pub name: ::prost::alloc::string::String,
    /// Unit the readings are expressed in (e.g. "percent", "days",
    /// "incidents"). Free text so that existing measures can be carried
    /// over unchanged.
    /// Constraints: Max length 50 characters.
    #[prost(string, tag="4")]
    pub unit: ::prost::alloc::string::String,
    /// Which direction of movement is the desired one.
    #[prost(enumeration="IndicatorDirection", tag="5")]
    pub direction: i32,
    /// How often a reading is expected.
    #[prost(enumeration="IndicatorFrequency", tag="6")]
    pub frequency: i32,
    /// ID of the user accountable for the indicator. Optional.
    #[prost(string, tag="7")]
    pub owner_user_id: ::prost::alloc::string::String,
    /// Where readings come from. Required.
    #[prost(message, optional, tag="8")]
    pub evidence_source: ::core::option::Option<EvidenceSource>,
    /// Why this indicator was chosen over the alternatives.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="9")]
    pub rationale: ::prost::alloc::string::String,
    /// What the indicator is meant to say about the objective.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="10")]
    pub strategic_meaning: ::prost::alloc::string::String,
    /// How a reading should be read, including what it does not cover.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="11")]
    pub interpretation_guidance: ::prost::alloc::string::String,
    /// The behaviour this indicator could encourage if it were optimized
    /// on its own. Pre-filled by the server where a structural weakness in
    /// the evidence source implies one, always editable, never required.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="12")]
    pub perverse_behavior_note: ::prost::alloc::string::String,
    /// Whether any reading has ever corroborated this indicator.
    #[prost(enumeration="IndicatorVerificationState", tag="13")]
    pub verification_state: i32,
    /// Timestamp when the indicator was created.
    #[prost(message, optional, tag="14")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the indicator was last updated.
    #[prost(message, optional, tag="15")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
    /// The value the organization is aiming for, expressed in `unit` and
    /// read together with `direction`. Absent when no target has been set.
    ///
    /// Targets live here rather than inside the objective's wording, and
    /// they sit at the routine tier of change: revising a target is
    /// expected housekeeping, unlike rewriting the objective it serves.
    #[prost(double, optional, tag="16")]
    pub target: ::core::option::Option<f64>,
    /// The level of organizational unit a verification question about this
    /// indicator is put at.
    ///
    /// Unset is not a choice: it means this indicator follows the
    /// organization's default, and consumers MUST NOT render it as a level
    /// somebody selected. Any other value overrides the default for this
    /// indicator alone, which is what makes the field worth having — how
    /// close the respondent has to be to the work is a property of what is
    /// being measured, while the shape of the organization is not.
    ///
    /// Meaningful only while the evidence source is the
    /// verification-campaign kind, but kept across a switch to another kind
    /// so that switching back does not silently discard the selection.
    #[prost(enumeration="VerificationUnitLevel", tag="17")]
    pub verification_unit_level: i32,
}
/// Where an indicator's readings come from, plus the structural facts
/// that follow from that choice. The facts are descriptive, not a score:
/// they state what the configuration implies so the reader can judge it,
/// and are never combined into a single rating.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct EvidenceSource {
    /// Which adapter produces the readings.
    #[prost(enumeration="EvidenceSourceKind", tag="1")]
    pub kind: i32,
    /// True when whoever reports the reading is also whoever the reading
    /// is about. Self-reported readings can be negotiated rather than
    /// produced.
    #[prost(bool, tag="2")]
    pub reporter_is_subject: bool,
    /// Whether the source observes the whole population or a sample.
    #[prost(enumeration="EvidenceCoverage", tag="3")]
    pub coverage: i32,
    /// True when a party other than the reporter could check the reading
    /// against an independent record.
    #[prost(bool, tag="4")]
    pub third_party_verifiable: bool,
    /// Adapter-specific configuration. Must match `kind`.
    #[prost(oneof="evidence_source::Detail", tags="5, 6, 7, 8")]
    pub detail: ::core::option::Option<evidence_source::Detail>,
}
/// Nested message and enum types in `EvidenceSource`.
pub mod evidence_source {
    /// Adapter-specific configuration. Must match `kind`.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
    pub enum Detail {
        #[prost(message, tag="5")]
        InApp(super::InAppEvidence),
        #[prost(message, tag="6")]
        VerificationCampaign(super::VerificationCampaignEvidence),
        #[prost(message, tag="7")]
        Webhook(super::WebhookEvidence),
        #[prost(message, tag="8")]
        ManualEntry(super::ManualEntryEvidence),
    }
}
/// Configuration for readings produced inside the product by the
/// audience of the message itself.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct InAppEvidence {
    /// Which response counts as a reading. ActionType currently defines
    /// only ACK; poll answers, go-to confirmations and attestations become
    /// expressible here once message actions land in common.proto.
    #[prost(enumeration="ActionType", tag="1")]
    pub action_type: i32,
}
/// Configuration for readings produced by a deferred follow-up message
/// sent to someone other than the audience.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct VerificationCampaignEvidence {
    /// How the recipients of the follow-up are derived from the audience
    /// being verified. Kinds other than the ones enumerated are rejected
    /// with UNIMPLEMENTED.
    #[prost(enumeration="VerifierDerivation", tag="1")]
    pub verifier_derivation: i32,
    /// Days to wait after the original message before the follow-up is
    /// sent.
    #[prost(int32, tag="2")]
    pub delay_days: i32,
    /// Template used for the follow-up. Optional; a default is used when
    /// empty.
    #[prost(string, tag="3")]
    pub template_id: ::prost::alloc::string::String,
}
/// Configuration for readings the organization pushes from one of its
/// own systems.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct WebhookEvidence {
    /// Name of the system the readings come from. Required for this
    /// adapter.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub system_name: ::prost::alloc::string::String,
    /// How the reading is produced in that system, in the organization's
    /// own words.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="2")]
    pub description: ::prost::alloc::string::String,
}
/// Configuration for readings entered by hand or imported from a
/// spreadsheet. There is no originating system to name — a person is the
/// source.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ManualEntryEvidence {
    /// How the reading is arrived at before it is entered, in the
    /// organization's own words.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="1")]
    pub description: ::prost::alloc::string::String,
}
/// Declares which objective a campaign serves. The link is what turns a
/// campaign's response rate from a result in itself into evidence about
/// something the organization was trying to achieve.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CampaignObjectiveLink {
    /// Campaign that serves the objective.
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Objective the campaign serves.
    #[prost(string, tag="2")]
    pub objective_id: ::prost::alloc::string::String,
    /// How the link came to be.
    #[prost(enumeration="LinkOrigin", tag="3")]
    pub origin: i32,
    /// Timestamp when the link was recorded.
    #[prost(message, optional, tag="4")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to create an objective.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateObjectiveRequest {
    /// The statement. Required.
    /// Constraints: Max length 300 characters.
    #[prost(string, tag="1")]
    pub title: ::prost::alloc::string::String,
    /// Longer explanation. Optional.
    /// Constraints: Max length 4000 characters.
    #[prost(string, tag="2")]
    pub description: ::prost::alloc::string::String,
    /// Accountable user. Optional.
    #[prost(string, tag="3")]
    pub owner_user_id: ::prost::alloc::string::String,
    /// Standing objective or time-bounded initiative. Defaults to
    /// OBJECTIVE_KIND_OBJECTIVE when unspecified.
    #[prost(enumeration="ObjectiveKind", tag="4")]
    pub kind: i32,
    /// For an initiative, the standing objective it contributes to.
    /// Optional; must be empty for a standing objective.
    #[prost(string, tag="5")]
    pub parent_objective_id: ::prost::alloc::string::String,
    /// For an initiative, its expected end. Must be unset for a standing
    /// objective.
    #[prost(message, optional, tag="6")]
    pub ends_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Initial lifecycle state. Defaults to OBJECTIVE_STATE_DRAFT when
    /// unspecified. OBJECTIVE_STATE_ARCHIVED is rejected.
    #[prost(enumeration="ObjectiveState", tag="7")]
    pub state: i32,
}
/// Response after creating an objective.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateObjectiveResponse {
    /// The newly created objective. Always present, including when
    /// advisories were raised.
    #[prost(message, optional, tag="1")]
    pub objective: ::core::option::Option<Objective>,
    /// Form problems found in the wording. Advisory only — the objective
    /// was stored regardless.
    #[prost(message, repeated, tag="2")]
    pub advisories: ::prost::alloc::vec::Vec<ObjectiveAdvisory>,
}
/// Request to update an objective.
///
/// Every mutable field carries explicit presence and they all follow one
/// rule: a field left absent leaves the stored value untouched, and a
/// field that is present replaces it — including when the value sent is
/// empty. Clearing a field is therefore expressible, which matters for
/// text an author wants gone rather than merely reworded.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateObjectiveRequest {
    /// ID of the objective to update. Required.
    #[prost(string, tag="1")]
    pub objective_id: ::prost::alloc::string::String,
    /// New statement.
    /// Constraints: Max length 300 characters.
    #[prost(string, optional, tag="2")]
    pub title: ::core::option::Option<::prost::alloc::string::String>,
    /// New explanation.
    /// Constraints: Max length 4000 characters.
    #[prost(string, optional, tag="3")]
    pub description: ::core::option::Option<::prost::alloc::string::String>,
    /// New accountable user. Present and empty detaches the owner.
    #[prost(string, optional, tag="4")]
    pub owner_user_id: ::core::option::Option<::prost::alloc::string::String>,
    /// New lifecycle state. Archiving an objective is done here, by
    /// sending OBJECTIVE_STATE_ARCHIVED.
    #[prost(enumeration="ObjectiveState", optional, tag="5")]
    pub state: ::core::option::Option<i32>,
    /// New expected end for an initiative. Reclassifying to
    /// OBJECTIVE_KIND_OBJECTIVE clears it regardless of what is sent here,
    /// since a standing objective has no end.
    #[prost(message, optional, tag="6")]
    pub ends_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Reclassify between a standing objective and a time-bounded
    /// initiative, so that an OBJECTIVE_WRITING_ISSUE_PROJECT_FORM
    /// advisory can be acted on without recreating the entry.
    #[prost(enumeration="ObjectiveKind", optional, tag="7")]
    pub kind: ::core::option::Option<i32>,
    /// For an initiative, the standing objective it contributes to.
    /// Present and empty detaches it and leaves the initiative standing
    /// alone.
    #[prost(string, optional, tag="8")]
    pub parent_objective_id: ::core::option::Option<::prost::alloc::string::String>,
}
/// Response after updating an objective.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateObjectiveResponse {
    /// The updated objective.
    #[prost(message, optional, tag="1")]
    pub objective: ::core::option::Option<Objective>,
    /// Form problems found in the new wording. Advisory only — the update
    /// was applied regardless.
    #[prost(message, repeated, tag="2")]
    pub advisories: ::prost::alloc::vec::Vec<ObjectiveAdvisory>,
}
/// Request to retrieve one objective with its indicators.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetObjectiveRequest {
    /// ID of the objective to retrieve. Required.
    #[prost(string, tag="1")]
    pub objective_id: ::prost::alloc::string::String,
}
/// Response containing the requested objective.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetObjectiveResponse {
    /// The requested objective.
    #[prost(message, optional, tag="1")]
    pub objective: ::core::option::Option<Objective>,
    /// Indicators attached to it, ordered by creation time.
    #[prost(message, repeated, tag="2")]
    pub indicators: ::prost::alloc::vec::Vec<Indicator>,
}
/// Request to list the organization's objectives with pagination.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListObjectivesRequest {
    /// Pagination parameters.
    #[prost(message, optional, tag="1")]
    pub pagination: ::core::option::Option<Pagination>,
    /// Return only objectives in this state. Unspecified returns every
    /// state except OBJECTIVE_STATE_ARCHIVED.
    #[prost(enumeration="ObjectiveState", tag="2")]
    pub state: i32,
    /// Return only entries of this kind. Unspecified returns both kinds.
    #[prost(enumeration="ObjectiveKind", tag="3")]
    pub kind: i32,
}
/// Response containing a page of objectives.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListObjectivesResponse {
    /// Objectives in this page.
    #[prost(message, repeated, tag="1")]
    pub objectives: ::prost::alloc::vec::Vec<Objective>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to attach an indicator to an objective.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct AddIndicatorRequest {
    /// Objective the indicator hangs from. Required.
    #[prost(string, tag="1")]
    pub objective_id: ::prost::alloc::string::String,
    /// Short name. Required.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// Unit the readings are expressed in. Optional.
    /// Constraints: Max length 50 characters.
    #[prost(string, tag="3")]
    pub unit: ::prost::alloc::string::String,
    /// Desired direction of movement.
    #[prost(enumeration="IndicatorDirection", tag="4")]
    pub direction: i32,
    /// Expected reading cadence.
    #[prost(enumeration="IndicatorFrequency", tag="5")]
    pub frequency: i32,
    /// Accountable user. Optional.
    #[prost(string, tag="6")]
    pub owner_user_id: ::prost::alloc::string::String,
    /// Where readings come from. Required.
    #[prost(message, optional, tag="7")]
    pub evidence_source: ::core::option::Option<EvidenceSource>,
    /// Why this indicator was chosen. Optional.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="8")]
    pub rationale: ::prost::alloc::string::String,
    /// What it is meant to say about the objective. Optional.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="9")]
    pub strategic_meaning: ::prost::alloc::string::String,
    /// How a reading should be read. Optional.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="10")]
    pub interpretation_guidance: ::prost::alloc::string::String,
    /// Behaviour the indicator could encourage if optimized on its own.
    /// Optional; the server pre-fills it when left empty and the evidence
    /// source implies one.
    /// Constraints: Max length 2000 characters.
    #[prost(string, tag="11")]
    pub perverse_behavior_note: ::prost::alloc::string::String,
    /// The value being aimed for, expressed in `unit`. Optional.
    #[prost(double, optional, tag="12")]
    pub target: ::core::option::Option<f64>,
    /// Level of unit a verification question about this indicator is put
    /// at. Optional; unspecified follows the organization's default rather
    /// than selecting a level.
    #[prost(enumeration="VerificationUnitLevel", tag="13")]
    pub verification_unit_level: i32,
}
/// Response after attaching an indicator.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct AddIndicatorResponse {
    /// The newly created indicator.
    #[prost(message, optional, tag="1")]
    pub indicator: ::core::option::Option<Indicator>,
    /// What follows from declaring a verification campaign as the evidence
    /// source, given the shape of the organization. Empty for every other
    /// evidence kind, and empty when nothing follows. Advisory only — the
    /// indicator was stored regardless.
    #[prost(message, repeated, tag="2")]
    pub notices: ::prost::alloc::vec::Vec<VerificationSetupNotice>,
}
/// Request to update an indicator.
///
/// Every mutable field carries explicit presence and they all follow one
/// rule: a field left absent leaves the stored value untouched, and a
/// field that is present replaces it — including when the value sent is
/// empty. This is what lets an author delete server-pre-filled text such
/// as `perverse_behavior_note` instead of only overwriting it.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateIndicatorRequest {
    /// ID of the indicator to update. Required.
    #[prost(string, tag="1")]
    pub indicator_id: ::prost::alloc::string::String,
    /// New name.
    /// Constraints: Max length 200 characters.
    #[prost(string, optional, tag="2")]
    pub name: ::core::option::Option<::prost::alloc::string::String>,
    /// New unit.
    /// Constraints: Max length 50 characters.
    #[prost(string, optional, tag="3")]
    pub unit: ::core::option::Option<::prost::alloc::string::String>,
    /// New direction.
    #[prost(enumeration="IndicatorDirection", optional, tag="4")]
    pub direction: ::core::option::Option<i32>,
    /// New cadence.
    #[prost(enumeration="IndicatorFrequency", optional, tag="5")]
    pub frequency: ::core::option::Option<i32>,
    /// New accountable user. Present and empty detaches the owner.
    #[prost(string, optional, tag="6")]
    pub owner_user_id: ::core::option::Option<::prost::alloc::string::String>,
    /// New evidence source.
    #[prost(message, optional, tag="7")]
    pub evidence_source: ::core::option::Option<EvidenceSource>,
    /// New rationale.
    /// Constraints: Max length 2000 characters.
    #[prost(string, optional, tag="8")]
    pub rationale: ::core::option::Option<::prost::alloc::string::String>,
    /// New strategic meaning.
    /// Constraints: Max length 2000 characters.
    #[prost(string, optional, tag="9")]
    pub strategic_meaning: ::core::option::Option<::prost::alloc::string::String>,
    /// New interpretation guidance.
    /// Constraints: Max length 2000 characters.
    #[prost(string, optional, tag="10")]
    pub interpretation_guidance: ::core::option::Option<::prost::alloc::string::String>,
    /// New note on encouraged behaviour. Present and empty deletes the
    /// note, which is how an author rejects the server's pre-filled text.
    /// Constraints: Max length 2000 characters.
    #[prost(string, optional, tag="11")]
    pub perverse_behavior_note: ::core::option::Option<::prost::alloc::string::String>,
    /// New target.
    #[prost(double, optional, tag="12")]
    pub target: ::core::option::Option<f64>,
    /// New unit level. Absent leaves the current selection untouched;
    /// present with VERIFICATION_UNIT_LEVEL_UNSPECIFIED drops the override
    /// and returns this indicator to following the organization's default,
    /// which is how a per-indicator selection is undone rather than merely
    /// overwritten.
    #[prost(enumeration="VerificationUnitLevel", optional, tag="13")]
    pub verification_unit_level: ::core::option::Option<i32>,
}
/// Response after updating an indicator.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateIndicatorResponse {
    /// The updated indicator. Notices are recomputed on every update, so
    /// an evidence source switched onto or off a verification campaign
    /// gets the current answer rather than the one from creation time.
    #[prost(message, optional, tag="1")]
    pub indicator: ::core::option::Option<Indicator>,
    /// What follows from the evidence source as it now stands. Advisory
    /// only — the update was applied regardless.
    #[prost(message, repeated, tag="2")]
    pub notices: ::prost::alloc::vec::Vec<VerificationSetupNotice>,
}
/// Request to detach an indicator from its objective.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveIndicatorRequest {
    /// ID of the indicator to remove. Required.
    #[prost(string, tag="1")]
    pub indicator_id: ::prost::alloc::string::String,
}
/// Response after removing an indicator.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveIndicatorResponse {
}
/// Request to declare that a campaign serves an objective.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct LinkCampaignToObjectiveRequest {
    /// Campaign to link. Required.
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Objective the campaign serves. Required.
    #[prost(string, tag="2")]
    pub objective_id: ::prost::alloc::string::String,
    /// How the link came to be. Defaults to LINK_ORIGIN_DECLARED when
    /// unspecified.
    #[prost(enumeration="LinkOrigin", tag="3")]
    pub origin: i32,
}
/// Response after linking a campaign to an objective.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct LinkCampaignToObjectiveResponse {
    /// The recorded link. Linking an already-linked pair is idempotent and
    /// returns the existing link.
    #[prost(message, optional, tag="1")]
    pub link: ::core::option::Option<CampaignObjectiveLink>,
}
/// Request to remove the declaration that a campaign serves an objective.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UnlinkCampaignFromObjectiveRequest {
    /// Campaign to unlink. Required.
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Objective to unlink it from. Required.
    #[prost(string, tag="2")]
    pub objective_id: ::prost::alloc::string::String,
}
/// Response after unlinking a campaign from an objective.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UnlinkCampaignFromObjectiveResponse {
}
/// Request to list campaign-to-objective links, from either end of the
/// relationship. Exactly one of `objective_id` and `campaign_id` must be
/// set; sending both, or neither, returns INVALID_ARGUMENT.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListCampaignObjectiveLinksRequest {
    /// List the campaigns that serve this objective.
    #[prost(string, optional, tag="1")]
    pub objective_id: ::core::option::Option<::prost::alloc::string::String>,
    /// Pagination parameters.
    #[prost(message, optional, tag="2")]
    pub pagination: ::core::option::Option<Pagination>,
    /// List the objectives this campaign serves.
    #[prost(string, optional, tag="3")]
    pub campaign_id: ::core::option::Option<::prost::alloc::string::String>,
}
/// Response containing a page of campaign links.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListCampaignObjectiveLinksResponse {
    /// Links in this page, newest first.
    #[prost(message, repeated, tag="1")]
    pub links: ::prost::alloc::vec::Vec<CampaignObjectiveLink>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// A candidate way of observing an objective, offered for a person to
/// accept, edit or throw away.
///
/// A suggestion is not an indicator and carries no identifier, because
/// nothing has been created. Proposing how an objective might be
/// observed is a bounded generative task and the platform is useful at
/// it; deciding that the proposed measure actually moves with the
/// objective is not something any model can settle, and only accumulated
/// readings can. Keeping the two apart is the point of this message
/// existing separately from Indicator.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct IndicatorSuggestion {
    /// Proposed name for the indicator.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// Proposed unit the readings would be expressed in.
    #[prost(string, tag="2")]
    pub unit: ::prost::alloc::string::String,
    /// Proposed direction of desired movement.
    #[prost(enumeration="IndicatorDirection", tag="3")]
    pub direction: i32,
    /// Where readings would have to come from for this measure to exist.
    /// Part of the suggestion because a measure nobody can source is not a
    /// usable proposal.
    #[prost(enumeration="EvidenceSourceKind", tag="4")]
    pub evidence_source_kind: i32,
    /// Why this measure was proposed for this objective, in plain
    /// language, so the reader can reject it on the reasoning rather than
    /// on the wording.
    #[prost(string, tag="5")]
    pub rationale: ::prost::alloc::string::String,
}
/// Request for candidate indicators for a declared objective.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SuggestIndicatorsRequest {
    /// Objective to propose indicators for. Required.
    #[prost(string, tag="1")]
    pub objective_id: ::prost::alloc::string::String,
}
/// Response containing candidate indicators.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SuggestIndicatorsResponse {
    /// Candidates, most relevant first. Never applied by the server —
    /// acting on one means calling AddIndicator with its contents, and the
    /// indicator that results is unverified like any other.
    ///
    /// Empty when no candidate could be produced, including when the
    /// organization has model-assisted features turned off. Suggestions
    /// are a convenience and nothing in the contract depends on them, so
    /// their absence is not an error.
    #[prost(message, repeated, tag="1")]
    pub suggestions: ::prost::alloc::vec::Vec<IndicatorSuggestion>,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Lifecycle state of an objective.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ObjectiveState {
    Unspecified = 0,
    /// Being drafted. Not yet part of the organization's declared set and
    /// excluded from any analysis that reads the set as a whole.
    Draft = 1,
    /// Declared and in force.
    Active = 2,
    /// Withdrawn. Kept for history and for links already recorded against
    /// it, but no longer part of the declared set.
    Archived = 3,
}
impl ObjectiveState {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "OBJECTIVE_STATE_UNSPECIFIED",
            Self::Draft => "OBJECTIVE_STATE_DRAFT",
            Self::Active => "OBJECTIVE_STATE_ACTIVE",
            Self::Archived => "OBJECTIVE_STATE_ARCHIVED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "OBJECTIVE_STATE_UNSPECIFIED" => Some(Self::Unspecified),
            "OBJECTIVE_STATE_DRAFT" => Some(Self::Draft),
            "OBJECTIVE_STATE_ACTIVE" => Some(Self::Active),
            "OBJECTIVE_STATE_ARCHIVED" => Some(Self::Archived),
            _ => None,
        }
    }
}
/// Whether the entry is a standing desired state or a time-bounded
/// effort. The distinction is structural, not cosmetic: analyses that
/// read the declared set as a whole (coverage, overlap, gaps) apply only
/// to standing objectives, because a time-bounded effort is expected to
/// end and would distort them.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ObjectiveKind {
    Unspecified = 0,
    /// A desired state with no end date, written as a condition rather
    /// than as a change or a target.
    Objective = 1,
    /// A time-bounded effort with an explicit end. May stand alone or hang
    /// off a standing objective.
    Initiative = 2,
}
impl ObjectiveKind {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "OBJECTIVE_KIND_UNSPECIFIED",
            Self::Objective => "OBJECTIVE_KIND_OBJECTIVE",
            Self::Initiative => "OBJECTIVE_KIND_INITIATIVE",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "OBJECTIVE_KIND_UNSPECIFIED" => Some(Self::Unspecified),
            "OBJECTIVE_KIND_OBJECTIVE" => Some(Self::Objective),
            "OBJECTIVE_KIND_INITIATIVE" => Some(Self::Initiative),
            _ => None,
        }
    }
}
/// A form problem detected in an objective's wording. Advisory only —
/// servers never reject a write because of one, and clients present the
/// finding alongside the suggested rewrite while still allowing the save.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ObjectiveWritingIssue {
    Unspecified = 0,
    /// Phrased as a change ("improve", "reduce", "increase") rather than
    /// as the state that should hold once the change has happened.
    ChangeVerb = 1,
    /// Carries a number, percentage or date inside the statement, which
    /// makes it a target rather than a state. Targets belong on
    /// indicators.
    EmbeddedTarget = 2,
    /// Phrased as a project ("launch", "roll out", "migrate"), which has
    /// an end and therefore describes an initiative rather than a
    /// standing objective.
    ProjectForm = 3,
}
impl ObjectiveWritingIssue {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "OBJECTIVE_WRITING_ISSUE_UNSPECIFIED",
            Self::ChangeVerb => "OBJECTIVE_WRITING_ISSUE_CHANGE_VERB",
            Self::EmbeddedTarget => "OBJECTIVE_WRITING_ISSUE_EMBEDDED_TARGET",
            Self::ProjectForm => "OBJECTIVE_WRITING_ISSUE_PROJECT_FORM",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "OBJECTIVE_WRITING_ISSUE_UNSPECIFIED" => Some(Self::Unspecified),
            "OBJECTIVE_WRITING_ISSUE_CHANGE_VERB" => Some(Self::ChangeVerb),
            "OBJECTIVE_WRITING_ISSUE_EMBEDDED_TARGET" => Some(Self::EmbeddedTarget),
            "OBJECTIVE_WRITING_ISSUE_PROJECT_FORM" => Some(Self::ProjectForm),
            _ => None,
        }
    }
}
/// Whether a higher or a lower reading of an indicator is the desired
/// direction.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum IndicatorDirection {
    Unspecified = 0,
    HigherIsBetter = 1,
    LowerIsBetter = 2,
}
impl IndicatorDirection {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "INDICATOR_DIRECTION_UNSPECIFIED",
            Self::HigherIsBetter => "INDICATOR_DIRECTION_HIGHER_IS_BETTER",
            Self::LowerIsBetter => "INDICATOR_DIRECTION_LOWER_IS_BETTER",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "INDICATOR_DIRECTION_UNSPECIFIED" => Some(Self::Unspecified),
            "INDICATOR_DIRECTION_HIGHER_IS_BETTER" => Some(Self::HigherIsBetter),
            "INDICATOR_DIRECTION_LOWER_IS_BETTER" => Some(Self::LowerIsBetter),
            _ => None,
        }
    }
}
/// How often an indicator is expected to be read.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum IndicatorFrequency {
    Unspecified = 0,
    Daily = 1,
    Weekly = 2,
    Monthly = 3,
    Quarterly = 4,
    Annually = 5,
    /// Read on demand, with no fixed cadence.
    AdHoc = 6,
}
impl IndicatorFrequency {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "INDICATOR_FREQUENCY_UNSPECIFIED",
            Self::Daily => "INDICATOR_FREQUENCY_DAILY",
            Self::Weekly => "INDICATOR_FREQUENCY_WEEKLY",
            Self::Monthly => "INDICATOR_FREQUENCY_MONTHLY",
            Self::Quarterly => "INDICATOR_FREQUENCY_QUARTERLY",
            Self::Annually => "INDICATOR_FREQUENCY_ANNUALLY",
            Self::AdHoc => "INDICATOR_FREQUENCY_AD_HOC",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "INDICATOR_FREQUENCY_UNSPECIFIED" => Some(Self::Unspecified),
            "INDICATOR_FREQUENCY_DAILY" => Some(Self::Daily),
            "INDICATOR_FREQUENCY_WEEKLY" => Some(Self::Weekly),
            "INDICATOR_FREQUENCY_MONTHLY" => Some(Self::Monthly),
            "INDICATOR_FREQUENCY_QUARTERLY" => Some(Self::Quarterly),
            "INDICATOR_FREQUENCY_ANNUALLY" => Some(Self::Annually),
            "INDICATOR_FREQUENCY_AD_HOC" => Some(Self::AdHoc),
            _ => None,
        }
    }
}
/// Where an indicator's readings come from. Each kind is an adapter over
/// the same contract; kinds that are not yet implemented are rejected
/// with UNIMPLEMENTED rather than silently accepted.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum EvidenceSourceKind {
    Unspecified = 0,
    /// Signals produced inside the product by the audience of the message
    /// itself (acknowledgment, poll answer, and so on). Carries
    /// InAppEvidence.
    InApp = 1,
    /// A deferred follow-up message sent to someone other than the
    /// audience, whose answer is stored as a reading of this indicator.
    /// Carries VerificationCampaignEvidence.
    VerificationCampaign = 2,
    /// The organization pushes the operational fact from one of its own
    /// systems. Carries WebhookEvidence. Returns UNIMPLEMENTED until the
    /// adapter is built.
    Webhook = 3,
    /// Readings entered by hand or imported from a spreadsheet. Carries
    /// ManualEntryEvidence. Returns UNIMPLEMENTED until the adapter is
    /// built.
    ManualEntry = 4,
}
impl EvidenceSourceKind {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "EVIDENCE_SOURCE_KIND_UNSPECIFIED",
            Self::InApp => "EVIDENCE_SOURCE_KIND_IN_APP",
            Self::VerificationCampaign => "EVIDENCE_SOURCE_KIND_VERIFICATION_CAMPAIGN",
            Self::Webhook => "EVIDENCE_SOURCE_KIND_WEBHOOK",
            Self::ManualEntry => "EVIDENCE_SOURCE_KIND_MANUAL_ENTRY",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "EVIDENCE_SOURCE_KIND_UNSPECIFIED" => Some(Self::Unspecified),
            "EVIDENCE_SOURCE_KIND_IN_APP" => Some(Self::InApp),
            "EVIDENCE_SOURCE_KIND_VERIFICATION_CAMPAIGN" => Some(Self::VerificationCampaign),
            "EVIDENCE_SOURCE_KIND_WEBHOOK" => Some(Self::Webhook),
            "EVIDENCE_SOURCE_KIND_MANUAL_ENTRY" => Some(Self::ManualEntry),
            _ => None,
        }
    }
}
/// Whether an evidence source observes the whole population or a sample
/// of it.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum EvidenceCoverage {
    Unspecified = 0,
    Full = 1,
    Sampled = 2,
}
impl EvidenceCoverage {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "EVIDENCE_COVERAGE_UNSPECIFIED",
            Self::Full => "EVIDENCE_COVERAGE_FULL",
            Self::Sampled => "EVIDENCE_COVERAGE_SAMPLED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "EVIDENCE_COVERAGE_UNSPECIFIED" => Some(Self::Unspecified),
            "EVIDENCE_COVERAGE_FULL" => Some(Self::Full),
            "EVIDENCE_COVERAGE_SAMPLED" => Some(Self::Sampled),
            _ => None,
        }
    }
}
/// How the recipients of a verification message are derived from the
/// audience of the message being verified.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum VerifierDerivation {
    Unspecified = 0,
    /// Each audience member's manager, deduplicated. Self-targets are
    /// dropped.
    Manager = 1,
}
impl VerifierDerivation {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "VERIFIER_DERIVATION_UNSPECIFIED",
            Self::Manager => "VERIFIER_DERIVATION_MANAGER",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "VERIFIER_DERIVATION_UNSPECIFIED" => Some(Self::Unspecified),
            "VERIFIER_DERIVATION_MANAGER" => Some(Self::Manager),
            _ => None,
        }
    }
}
/// Whether an indicator has ever been corroborated by evidence outside
/// of the declaration that created it.
///
/// Recording readings is not part of this service. An indicator becomes
/// verified when an IndicatorReading is stored against it, which the
/// platform does from campaign outcomes; no RPC defined here can move
/// the state, so every indicator created or updated via
/// ObjectivesService stays UNVERIFIED.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum IndicatorVerificationState {
    Unspecified = 0,
    /// No corroborating reading has been recorded. This is the state of
    /// every newly created indicator, including one whose wording was
    /// suggested by a model: a suggestion is not evidence, and callers
    /// must not present an unverified indicator as one that is known to
    /// track its objective.
    Unverified = 1,
    /// At least one reading from the declared evidence source has been
    /// recorded against this indicator. The state says evidence exists,
    /// not that the evidence was favourable — an indicator corroborated by
    /// a negative reading is verified all the same.
    Verified = 2,
}
impl IndicatorVerificationState {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "INDICATOR_VERIFICATION_STATE_UNSPECIFIED",
            Self::Unverified => "INDICATOR_VERIFICATION_STATE_UNVERIFIED",
            Self::Verified => "INDICATOR_VERIFICATION_STATE_VERIFIED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "INDICATOR_VERIFICATION_STATE_UNSPECIFIED" => Some(Self::Unspecified),
            "INDICATOR_VERIFICATION_STATE_UNVERIFIED" => Some(Self::Unverified),
            "INDICATOR_VERIFICATION_STATE_VERIFIED" => Some(Self::Verified),
            _ => None,
        }
    }
}
/// How a campaign came to be linked to an objective.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum LinkOrigin {
    Unspecified = 0,
    /// Chosen explicitly by a person.
    Declared = 1,
    /// Proposed by the system from content similarity and confirmed by a
    /// person.
    Suggested = 2,
    /// Applied in bulk over historical campaigns when the objective set
    /// was first configured.
    Backfill = 3,
}
impl LinkOrigin {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "LINK_ORIGIN_UNSPECIFIED",
            Self::Declared => "LINK_ORIGIN_DECLARED",
            Self::Suggested => "LINK_ORIGIN_SUGGESTED",
            Self::Backfill => "LINK_ORIGIN_BACKFILL",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "LINK_ORIGIN_UNSPECIFIED" => Some(Self::Unspecified),
            "LINK_ORIGIN_DECLARED" => Some(Self::Declared),
            "LINK_ORIGIN_SUGGESTED" => Some(Self::Suggested),
            "LINK_ORIGIN_BACKFILL" => Some(Self::Backfill),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A single non-retired pepper version. Returned by GetPeppers.
///
/// During a rotation overlap, multiple versions are returned — callers
/// (e.g. pidgr-integrations) compute lookup hashes under EVERY returned
/// version to write or match against `identifier_lookup_hash_v1` and
/// `identifier_lookup_hash_v2` on the reachability registry.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Pepper {
    /// Monotonically-increasing version number. Lower versions retire first.
    #[prost(int32, tag="1")]
    pub version: i32,
    /// Raw HMAC key material. Sensitive — callers MUST NOT log or persist
    /// this value to disk. In-memory caching keyed on (org_id, version) with
    /// a short TTL is permitted and expected.
    #[prost(bytes="vec", tag="2")]
    pub key_material: ::prost::alloc::vec::Vec<u8>,
}
/// Request to fetch the active (non-retired) peppers for one org/purpose.
///
/// Auth: internal-mTLS only. This RPC exposes raw cryptographic key material
/// and MUST NOT be reachable from the public ingress or from JWT-authenticated
/// clients. The server SHALL reject any caller whose mTLS identity is not on
/// the configured allowlist.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetPeppersRequest {
    /// Organization whose peppers are requested.
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
    /// Purpose identifier scoping which key family to return. Use
    /// `"reachability_lookup"` for the pidgr-integrations registry lookup hash.
    #[prost(string, tag="2")]
    pub purpose: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetPeppersResponse {
    /// All non-retired pepper versions for the (org_id, purpose) pair, in
    /// ascending version order. Typically exactly one entry; two during a
    /// rotation overlap window; zero only when no pepper has ever been
    /// generated for this (org, purpose).
    #[prost(message, repeated, tag="1")]
    pub peppers: ::prost::alloc::vec::Vec<Pepper>,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// Maps an identity provider claim to a user profile field.
/// Used for automatic profile population when users authenticate via SSO/SAML.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SsoAttributeMapping {
    /// Claim name from the identity provider (e.g. "urn:oid:2.5.4.11", "given_name").
    /// Constraints: Max length 500 characters.
    #[prost(string, tag="1")]
    pub idp_claim: ::prost::alloc::string::String,
    /// Target UserProfile field name (e.g. "department", "first_name").
    /// For custom attributes, use "custom:" prefix (e.g. "custom:cost_center").
    /// Constraints: Max length 100 characters.
    #[prost(string, tag="2")]
    pub profile_field: ::prost::alloc::string::String,
}
/// An organization (tenant) in the Pidgr platform.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Organization {
    /// Unique identifier for the organization.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Organization display name.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// Default workflow used when campaigns don't specify one.
    #[prost(message, optional, tag="3")]
    pub default_workflow: ::core::option::Option<WorkflowDefinition>,
    /// Timestamp when the organization was created.
    #[prost(message, optional, tag="4")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Industry vertical.
    #[prost(enumeration="Industry", tag="5")]
    pub industry: i32,
    /// Employee headcount range.
    #[prost(enumeration="CompanySize", tag="6")]
    pub company_size: i32,
    /// SSO identity provider claim-to-profile mappings.
    /// Empty when the organization does not use SSO.
    #[prost(message, repeated, tag="7")]
    pub sso_attribute_mappings: ::prost::alloc::vec::Vec<SsoAttributeMapping>,
    /// Default language for new users in this organization.
    /// Empty means no org default (users auto-detect from device/browser).
    /// Valid values: en, es, pt-BR, zh, ja.
    #[prost(string, tag="8")]
    pub default_locale: ::prost::alloc::string::String,
    /// Organization lifecycle type.
    #[prost(enumeration="OrgType", tag="9")]
    pub org_type: i32,
    /// Expiration time for sandbox organizations. Empty for standard orgs.
    #[prost(message, optional, tag="10")]
    pub expires_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Data governance framework (EU, LATAM, BR, APAC, US).
    /// Determines legal framework, DPA template, and Bedrock endpoint routing.
    #[prost(string, tag="11")]
    pub data_governance_region: ::prost::alloc::string::String,
    /// AWS region for content storage (resolved from data_governance_region).
    /// e.g., "eu-west-1", "us-east-1".
    #[prost(string, tag="12")]
    pub data_content_region: ::prost::alloc::string::String,
    /// ─── ML pipeline settings ──────────────────────────────────────────────────
    /// Cold-start threshold: completed campaigns below this count trigger immediate
    /// retraining. At or above, the org is flagged for the weekly cron.
    /// Default 10, range 1-100.
    #[prost(int32, tag="13")]
    pub ml_retrain_cold_threshold: i32,
    /// Whether cancelled campaigns count toward the training counter. Default true.
    #[prost(bool, tag="14")]
    pub ml_cancelled_counts: bool,
    /// Monthly limit on manual retrain triggers. Default 3, range 0-10.
    #[prost(int32, tag="15")]
    pub ml_manual_limit_monthly: i32,
    /// Number of manual retrains used in the current month (resets monthly).
    #[prost(int32, tag="16")]
    pub ml_manual_retrains_used: i32,
    /// Whether the org is flagged for the next weekly cron run.
    #[prost(bool, tag="17")]
    pub ml_needs_retrain: bool,
    /// Campaigns completed since the last ML training run.
    #[prost(int32, tag="18")]
    pub campaigns_since_last_training: i32,
    /// Total campaigns completed across the organization lifetime.
    #[prost(int32, tag="19")]
    pub total_completed_campaigns: i32,
    /// Timestamp of the most recent successful ML training. Empty if never trained.
    #[prost(message, optional, tag="20")]
    pub last_ml_training_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Controls whether aggregate stats (campaign recipient/ack/missed counts)
    /// include synthetic data. Unset = default by org type: sandbox orgs include,
    /// standard orgs exclude. Derived intelligence (ML, analytics, attestation
    /// evidence) always excludes synthetic regardless of this setting.
    #[prost(bool, optional, tag="21")]
    pub include_synthetic_in_aggregates: ::core::option::Option<bool>,
    /// Whether the organization has opted into provisional (rule-based,
    /// low-confidence) archetypes for groups that don't yet have trained
    /// ML archetypes. Only meaningful for ORG_TYPE_STANDARD — sandbox
    /// organizations are always eligible regardless of this setting.
    /// Default false: production analytics stay conservative.
    #[prost(bool, tag="22")]
    pub provisional_archetypes_enabled: bool,
    /// The level of organizational unit verification questions are put at
    /// across the organization, applied to every indicator that does not
    /// override it.
    ///
    /// The default lives here because the shape of the organization is the
    /// organization's own fact and does not change from one indicator to
    /// the next; the override lives on the indicator because how close the
    /// respondent must be to the work is a property of what is being
    /// measured. Unset means no default has been declared and the platform
    /// applies VERIFICATION_UNIT_LEVEL_DERIVED_UNIT, which is the most
    /// sensitive level and is already bounded by the size floor.
    #[prost(enumeration="VerificationUnitLevel", tag="23")]
    pub default_verification_unit_level: i32,
}
/// Request to create a new organization.
/// JWT auth only — the authenticated caller becomes the initial admin. Additional
/// admins are added via CreateInviteLink after the org exists.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateOrganizationRequest {
    /// Name for the new organization.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// Industry vertical for the organization.
    #[prost(enumeration="Industry", tag="2")]
    pub industry: i32,
    /// Employee headcount range.
    #[prost(enumeration="CompanySize", tag="3")]
    pub company_size: i32,
    /// Access code required during early access.
    /// Format: PIDGR-XXXXXXXX (8 alphanumeric characters).
    #[prost(string, tag="4")]
    pub access_code: ::prost::alloc::string::String,
    /// Data governance framework. Defaults to "US" if omitted.
    /// Valid values: EU, LATAM, BR, APAC, US.
    #[prost(string, tag="5")]
    pub data_governance_region: ::prost::alloc::string::String,
    /// Optional bootstrap fixture to seed the organization with starter data.
    /// Empty string means the default fixture.
    #[prost(string, tag="6")]
    pub fixture_id: ::prost::alloc::string::String,
}
/// Response after creating an organization.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateOrganizationResponse {
    /// The newly created organization.
    #[prost(message, optional, tag="1")]
    pub organization: ::core::option::Option<Organization>,
    /// The admin user created for the organization.
    #[prost(message, optional, tag="2")]
    pub admin_user: ::core::option::Option<User>,
}
/// Request to retrieve the organization for the authenticated user.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetOrganizationRequest {
}
/// Response containing the organization.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetOrganizationResponse {
    /// The organization the authenticated user belongs to.
    #[prost(message, optional, tag="1")]
    pub organization: ::core::option::Option<Organization>,
}
/// Request to update organization settings.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateOrganizationRequest {
    /// New organization name. Empty string leaves unchanged.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// New default workflow definition. Null leaves unchanged.
    #[prost(message, optional, tag="2")]
    pub default_workflow: ::core::option::Option<WorkflowDefinition>,
    /// New industry vertical. UNSPECIFIED leaves unchanged.
    #[prost(enumeration="Industry", tag="3")]
    pub industry: i32,
    /// New employee headcount range. UNSPECIFIED leaves unchanged.
    #[prost(enumeration="CompanySize", tag="4")]
    pub company_size: i32,
    /// New default language for new users. Empty string leaves unchanged.
    /// Valid values: en, es, pt-BR, zh, ja.
    #[prost(string, tag="5")]
    pub default_locale: ::prost::alloc::string::String,
    /// New ML cold-start threshold. 0 leaves unchanged, otherwise must be in \[1, 100\].
    #[prost(int32, tag="6")]
    pub ml_retrain_cold_threshold: i32,
    /// New ML cancelled-counts flag. Uses google.protobuf.BoolValue-style semantics
    /// via optional to distinguish "not provided" from "set to false".
    #[prost(bool, optional, tag="7")]
    pub ml_cancelled_counts: ::core::option::Option<bool>,
    /// New ML monthly manual limit. Negative leaves unchanged, otherwise must be in \[0, 10\].
    /// Encoded as int32 with -1 meaning "leave unchanged".
    #[prost(int32, tag="8")]
    pub ml_manual_limit_monthly: i32,
    /// Set the synthetic-aggregates override; unset leaves it unchanged.
    #[prost(bool, optional, tag="9")]
    pub include_synthetic_in_aggregates: ::core::option::Option<bool>,
    /// New provisional-archetypes opt-in for standard organizations.
    /// Unset leaves unchanged. Rejected for sandbox organizations, which
    /// are always eligible automatically.
    #[prost(bool, optional, tag="10")]
    pub provisional_archetypes_enabled: ::core::option::Option<bool>,
    /// New organization-wide default for the level of unit verification
    /// questions are put at. UNSPECIFIED leaves unchanged. Changing it moves
    /// every indicator that has not overridden the default, and applies to
    /// questions asked from then on — readings already stored were taken at
    /// the level in force when they were collected and are not restated.
    #[prost(enumeration="VerificationUnitLevel", tag="11")]
    pub default_verification_unit_level: i32,
}
/// Response after updating the organization.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateOrganizationResponse {
    /// The updated organization.
    #[prost(message, optional, tag="1")]
    pub organization: ::core::option::Option<Organization>,
}
/// Request to replace all SSO attribute mappings for the organization.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateSsoAttributeMappingsRequest {
    /// Complete list of SSO mappings (replaces all existing mappings).
    #[prost(message, repeated, tag="1")]
    pub sso_attribute_mappings: ::prost::alloc::vec::Vec<SsoAttributeMapping>,
}
/// Response after updating SSO attribute mappings.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateSsoAttributeMappingsResponse {
    /// The updated organization with the new SSO mappings.
    #[prost(message, optional, tag="1")]
    pub organization: ::core::option::Option<Organization>,
}
/// Request to rotate the analytics salt and optionally increase the bucket count.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RotateAnalyticsSaltRequest {
    /// New bucket count. Must be >= current bucket count. 0 means keep current.
    #[prost(int32, tag="1")]
    pub new_bucket_count: i32,
}
/// Response after rotating the analytics salt.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RotateAnalyticsSaltResponse {
    /// The new bucket count after rotation.
    #[prost(int32, tag="1")]
    pub bucket_count: i32,
}
/// Request to update the analytics epsilon (differential privacy parameter).
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct UpdateAnalyticsEpsilonRequest {
    /// New epsilon value. Must be in range \[0.5, 5.0\].
    #[prost(float, tag="1")]
    pub epsilon: f32,
}
/// Response after updating the analytics epsilon.
#[derive(Clone, Copy, PartialEq, ::prost::Message)]
pub struct UpdateAnalyticsEpsilonResponse {
    /// The new epsilon value.
    #[prost(float, tag="1")]
    pub epsilon: f32,
}
/// Request to create a sandbox organization for testing.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateSandboxOrganizationRequest {
    /// Name for the sandbox organization.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// Required expiration time. Max 30 days from now for interactive callers;
    /// API-key callers may set shorter TTLs for ephemeral test sandboxes.
    #[prost(message, optional, tag="2")]
    pub expires_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Data governance framework. Defaults to "US" if omitted.
    /// Valid values: EU, LATAM, BR, APAC, US.
    #[prost(string, tag="3")]
    pub data_governance_region: ::prost::alloc::string::String,
    /// Optional bootstrap fixture to seed the sandbox with starter data.
    /// Empty string means the default fixture.
    /// Must match an id returned by ListSandboxFixtures.
    #[prost(string, tag="4")]
    pub fixture_id: ::prost::alloc::string::String,
}
/// Response after creating a sandbox organization.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateSandboxOrganizationResponse {
    /// The newly created sandbox organization (org_type: SANDBOX).
    #[prost(message, optional, tag="1")]
    pub organization: ::core::option::Option<Organization>,
    /// The admin user created for the sandbox.
    #[prost(message, optional, tag="2")]
    pub admin_user: ::core::option::Option<User>,
}
/// Request to delete a sandbox organization. Only callable for orgs with
/// org_type=SANDBOX. Allowed for super admins of the sandbox or the creator.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteSandboxOrganizationRequest {
    /// ID of the sandbox organization to delete.
    #[prost(string, tag="1")]
    pub org_id: ::prost::alloc::string::String,
}
/// Response after requesting deletion. Deletion runs asynchronously via
/// the DeleteOrgWorkflow; a success response means the workflow started.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteSandboxOrganizationResponse {
    /// ID of the Temporal workflow handling the deletion.
    #[prost(string, tag="1")]
    pub workflow_id: ::prost::alloc::string::String,
}
/// A bootstrap fixture that can be applied when creating a new organization.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SandboxFixture {
    /// Stable slug for referencing this fixture (e.g. "starter", "empty",
    /// "fintech", "sales"). Pass it back as the fixture_id on create.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Display name for admin UI (e.g. "Starter").
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// Description shown alongside the fixture option in the UI.
    #[prost(string, tag="3")]
    pub description: ::prost::alloc::string::String,
    /// Exactly one fixture has is_default=true. Clients that show a simple
    /// "seed initial data" control select this fixture's id by default.
    #[prost(bool, tag="4")]
    pub is_default: bool,
}
/// Request to list all bootstrap fixtures available for seeding.
/// No parameters — catalog is the same for all callers.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListSandboxFixturesRequest {
}
/// Response containing the bootstrap fixture catalog.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListSandboxFixturesResponse {
    /// All registered fixtures, ordered by name.
    #[prost(message, repeated, tag="1")]
    pub fixtures: ::prost::alloc::vec::Vec<SandboxFixture>,
}
/// Request to list all organizations the authenticated user belongs to.
/// No parameters — user identity is extracted from the JWT sub claim.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListUserOrganizationsRequest {
}
/// Response containing all organizations the authenticated user belongs to.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListUserOrganizationsResponse {
    /// Organizations the user belongs to, ordered by created_at ascending.
    /// Excludes expired sandbox organizations.
    #[prost(message, repeated, tag="1")]
    pub organizations: ::prost::alloc::vec::Vec<Organization>,
}
/// Request to list only the sandbox organizations the authenticated user
/// belongs to (i.e. orgs where org_type = SANDBOX, filtered from the full
/// membership set). No parameters — user identity is extracted from the JWT
/// sub claim.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListUserSandboxesRequest {
}
/// Response containing the user's sandbox organizations.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListUserSandboxesResponse {
    /// Sandbox organizations the user belongs to, ordered by expires_at
    /// ascending (soonest-expiring first — matches the admin UI
    /// /organization/sandboxes ordering). Excludes already-expired sandboxes
    /// (those are pending cleanup by SandboxCleanupWorkflow).
    #[prost(message, repeated, tag="1")]
    pub sandboxes: ::prost::alloc::vec::Vec<Organization>,
}
/// A single org-level data-processing toggle with consent-trace metadata.
/// The metadata records who flipped the toggle last and when, so the admin
/// consent-trace UI can show a verifiable change trail.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct OrgPrivacyToggle {
    /// Whether this category of processing is enabled for the organization.
    #[prost(bool, tag="1")]
    pub enabled: bool,
    /// Email of the admin who last changed this toggle.
    /// Empty if the toggle has never been changed from its default.
    #[prost(string, tag="2")]
    pub last_changed_by_email: ::prost::alloc::string::String,
    /// When this toggle was last changed.
    /// Empty if the toggle has never been changed from its default.
    #[prost(message, optional, tag="3")]
    pub last_changed_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Org-level data-processing settings (compliance consent surface).
/// Each toggle gates an entire category of processing for every user in
/// the organization.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct OrgPrivacySettings {
    /// Gates ML archetype clustering and ACK predictions.
    #[prost(message, optional, tag="1")]
    pub ai_clustering: ::core::option::Option<OrgPrivacyToggle>,
    /// Gates behavioral analytics (session replay, heatmaps, dwell metrics).
    #[prost(message, optional, tag="2")]
    pub behavioral_analytics: ::core::option::Option<OrgPrivacyToggle>,
    /// Gates third-party notification channel dispatch (email, Slack, SMS, …).
    #[prost(message, optional, tag="3")]
    pub third_party_channels: ::core::option::Option<OrgPrivacyToggle>,
}
/// Request to retrieve the org-level privacy settings.
/// The organization is extracted from the JWT.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetOrgPrivacySettingsRequest {
}
/// Response containing the org-level privacy settings with consent-trace
/// metadata for each toggle.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetOrgPrivacySettingsResponse {
    /// The organization's current privacy settings.
    #[prost(message, optional, tag="1")]
    pub settings: ::core::option::Option<OrgPrivacySettings>,
}
/// Request to update org-level privacy settings. Only the provided fields
/// are changed; unset fields leave the corresponding toggle unchanged.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateOrgPrivacySettingsRequest {
    /// Enable or disable ML archetype clustering and ACK predictions.
    /// Unset leaves unchanged.
    #[prost(bool, optional, tag="1")]
    pub ai_clustering_enabled: ::core::option::Option<bool>,
    /// Enable or disable behavioral analytics. Unset leaves unchanged.
    #[prost(bool, optional, tag="2")]
    pub behavioral_analytics_enabled: ::core::option::Option<bool>,
    /// Enable or disable third-party notification channels.
    /// Unset leaves unchanged.
    #[prost(bool, optional, tag="3")]
    pub third_party_channels_enabled: ::core::option::Option<bool>,
}
/// Response after updating org-level privacy settings.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateOrgPrivacySettingsResponse {
    /// The organization's privacy settings after the update, with refreshed
    /// consent-trace metadata.
    #[prost(message, optional, tag="1")]
    pub settings: ::core::option::Option<OrgPrivacySettings>,
}
// ─── Enums ───────────────────────────────────────────────────────────────────

/// Industry vertical for an organization.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum Industry {
    Unspecified = 0,
    Technology = 1,
    Finance = 2,
    Healthcare = 3,
    Education = 4,
    Retail = 5,
    Manufacturing = 6,
    Media = 7,
    Other = 8,
}
impl Industry {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "INDUSTRY_UNSPECIFIED",
            Self::Technology => "INDUSTRY_TECHNOLOGY",
            Self::Finance => "INDUSTRY_FINANCE",
            Self::Healthcare => "INDUSTRY_HEALTHCARE",
            Self::Education => "INDUSTRY_EDUCATION",
            Self::Retail => "INDUSTRY_RETAIL",
            Self::Manufacturing => "INDUSTRY_MANUFACTURING",
            Self::Media => "INDUSTRY_MEDIA",
            Self::Other => "INDUSTRY_OTHER",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "INDUSTRY_UNSPECIFIED" => Some(Self::Unspecified),
            "INDUSTRY_TECHNOLOGY" => Some(Self::Technology),
            "INDUSTRY_FINANCE" => Some(Self::Finance),
            "INDUSTRY_HEALTHCARE" => Some(Self::Healthcare),
            "INDUSTRY_EDUCATION" => Some(Self::Education),
            "INDUSTRY_RETAIL" => Some(Self::Retail),
            "INDUSTRY_MANUFACTURING" => Some(Self::Manufacturing),
            "INDUSTRY_MEDIA" => Some(Self::Media),
            "INDUSTRY_OTHER" => Some(Self::Other),
            _ => None,
        }
    }
}
/// Employee headcount range for an organization.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum CompanySize {
    Unspecified = 0,
    CompanySize1200 = 1,
    CompanySize200500 = 2,
    CompanySize5001000 = 3,
    CompanySize10005000 = 4,
    CompanySize5000Plus = 5,
}
impl CompanySize {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "COMPANY_SIZE_UNSPECIFIED",
            Self::CompanySize1200 => "COMPANY_SIZE_1_200",
            Self::CompanySize200500 => "COMPANY_SIZE_200_500",
            Self::CompanySize5001000 => "COMPANY_SIZE_500_1000",
            Self::CompanySize10005000 => "COMPANY_SIZE_1000_5000",
            Self::CompanySize5000Plus => "COMPANY_SIZE_5000_PLUS",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "COMPANY_SIZE_UNSPECIFIED" => Some(Self::Unspecified),
            "COMPANY_SIZE_1_200" => Some(Self::CompanySize1200),
            "COMPANY_SIZE_200_500" => Some(Self::CompanySize200500),
            "COMPANY_SIZE_500_1000" => Some(Self::CompanySize5001000),
            "COMPANY_SIZE_1000_5000" => Some(Self::CompanySize10005000),
            "COMPANY_SIZE_5000_PLUS" => Some(Self::CompanySize5000Plus),
            _ => None,
        }
    }
}
/// Classification of an organization's lifecycle type.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum OrgType {
    Unspecified = 0,
    Standard = 1,
    Sandbox = 2,
    /// Reserved for platform operations. At most one per deployment, seeded
    /// by migration. Cannot be created via CreateOrganization.
    Staff = 3,
}
impl OrgType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "ORG_TYPE_UNSPECIFIED",
            Self::Standard => "ORG_TYPE_STANDARD",
            Self::Sandbox => "ORG_TYPE_SANDBOX",
            Self::Staff => "ORG_TYPE_STAFF",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "ORG_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "ORG_TYPE_STANDARD" => Some(Self::Standard),
            "ORG_TYPE_SANDBOX" => Some(Self::Sandbox),
            "ORG_TYPE_STAFF" => Some(Self::Staff),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// Per-user rendering context containing variable substitutions.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UserRenderContext {
    /// ID of the user being rendered for.
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// Variable name-value pairs to substitute into the template.
    /// Constraints: Max 100 entries. Key max length 100 characters, value max length 10000 characters.
    #[prost(map="string, string", tag="2")]
    pub variables: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>,
}
/// Request to render a template for a batch of users.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct RenderBatchRequest {
    /// ID of the template to render.
    #[prost(string, tag="1")]
    pub template_id: ::prost::alloc::string::String,
    /// Version of the template to render.
    #[prost(int32, tag="2")]
    pub version: i32,
    /// Per-user rendering contexts with variable substitutions.
    /// Constraints: Max 10000 users per batch.
    #[prost(message, repeated, tag="3")]
    pub users: ::prost::alloc::vec::Vec<UserRenderContext>,
}
/// Streamed response for each user's rendered message.
/// One response is emitted per user in the batch.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct RenderBatchResponse {
    /// ID of the user this result is for.
    #[prost(string, tag="1")]
    pub user_id: ::prost::alloc::string::String,
    /// The rendered message (set on success).
    #[prost(message, optional, tag="2")]
    pub message: ::core::option::Option<Message>,
    /// Error message if rendering failed for this user (empty on success).
    #[prost(string, tag="3")]
    pub error: ::prost::alloc::string::String,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A session recording summary from the analytics provider.
/// Anonymous: no user identifiers are included.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SessionRecording {
    /// Recording ID from the analytics provider.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Timestamp when the recording started.
    #[prost(message, optional, tag="2")]
    pub start_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the recording ended.
    #[prost(message, optional, tag="3")]
    pub end_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Duration of the recording in seconds.
    #[prost(int32, tag="4")]
    pub duration_seconds: i32,
    /// Activity score (0.0–1.0).
    #[prost(float, tag="5")]
    pub activity_score: f32,
}
/// Request to list session recordings.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListSessionRecordingsRequest {
    /// Optional: filter recordings by campaign ID (mapped to analytics property filter).
    /// Constraints: UUID format (36 characters).
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Optional: start of the time range filter (inclusive).
    #[prost(message, optional, tag="2")]
    pub date_from: ::core::option::Option<::prost_types::Timestamp>,
    /// Optional: end of the time range filter (inclusive).
    #[prost(message, optional, tag="3")]
    pub date_to: ::core::option::Option<::prost_types::Timestamp>,
    /// Pagination parameters.
    #[prost(message, optional, tag="4")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of session recordings.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListSessionRecordingsResponse {
    /// List of session recordings in this page.
    #[prost(message, repeated, tag="1")]
    pub recordings: ::prost::alloc::vec::Vec<SessionRecording>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to fetch rrweb snapshot events for a recording.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetSessionSnapshotsRequest {
    /// Recording ID from the analytics provider.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub recording_id: ::prost::alloc::string::String,
}
/// Response containing rrweb snapshot events.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetSessionSnapshotsResponse {
    /// JSON-encoded array of rrweb eventWithTime objects.
    /// Clients parse this JSON to feed into rrweb-player.
    #[prost(string, tag="1")]
    pub snapshot_data: ::prost::alloc::string::String,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// Request to list all roles in the caller's organization.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListRolesRequest {
}
/// Response containing the organization's roles.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListRolesResponse {
    /// All roles in the organization, including their permission sets.
    #[prost(message, repeated, tag="1")]
    pub roles: ::prost::alloc::vec::Vec<Role>,
}
/// Request to create a new role in the caller's organization.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateRoleRequest {
    /// Display name for the role (e.g. "Team Lead"). Required.
    /// A slug is auto-generated from the name.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// Initial permission set for the role.
    /// PERMISSION_UNSPECIFIED values are rejected.
    #[prost(enumeration="Permission", repeated, tag="2")]
    pub permissions: ::prost::alloc::vec::Vec<i32>,
}
/// Response after creating a role.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateRoleResponse {
    /// The newly created role with its generated slug and permission set.
    #[prost(message, optional, tag="1")]
    pub role: ::core::option::Option<Role>,
}
/// Request to update a role's name and/or permissions.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateRoleRequest {
    /// ID of the role to update. Required.
    #[prost(string, tag="1")]
    pub role_id: ::prost::alloc::string::String,
    /// New display name. If empty, the name is not changed.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// New permission set (replaces existing permissions entirely).
    /// If empty, permissions are not changed.
    /// PERMISSION_UNSPECIFIED values are rejected.
    #[prost(enumeration="Permission", repeated, tag="3")]
    pub permissions: ::prost::alloc::vec::Vec<i32>,
}
/// Response after updating a role.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateRoleResponse {
    /// The updated role.
    #[prost(message, optional, tag="1")]
    pub role: ::core::option::Option<Role>,
}
/// Request to delete a role.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteRoleRequest {
    /// ID of the role to delete. Required.
    #[prost(string, tag="1")]
    pub role_id: ::prost::alloc::string::String,
}
/// Response after deleting a role.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteRoleResponse {
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// Custom SAML attribute name overrides for identity providers that use
/// non-standard attribute names. When provided, these override the
/// auto-detected values from the metadata URL host.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SamlAttributeNames {
    /// SAML attribute name for the user's email address.
    #[prost(string, tag="1")]
    pub email: ::prost::alloc::string::String,
    /// SAML attribute name for the user's first name.
    #[prost(string, tag="2")]
    pub given_name: ::prost::alloc::string::String,
    /// SAML attribute name for the user's last name.
    #[prost(string, tag="3")]
    pub family_name: ::prost::alloc::string::String,
}
/// An SSO identity provider configured for an organization.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SsoProvider {
    /// Unique identifier for the provider.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Email domain that triggers this SSO provider (e.g. "acme.com").
    /// Constraints: Max length 253 characters (RFC 1035).
    #[prost(string, tag="2")]
    pub domain: ::prost::alloc::string::String,
    /// Type of identity provider.
    #[prost(enumeration="SsoProviderType", tag="3")]
    pub r#type: i32,
    /// SAML metadata URL or OIDC discovery URL.
    /// Constraints: Max length 2048 characters. HTTPS required.
    #[prost(string, tag="4")]
    pub metadata_url: ::prost::alloc::string::String,
    /// Name of the identity provider (used for signInWithRedirect).
    /// Set by the API when the IdP is created.
    #[prost(string, tag="5")]
    pub idp_provider_name: ::prost::alloc::string::String,
    /// Timestamp when the provider was created.
    #[prost(message, optional, tag="6")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the provider was last updated.
    #[prost(message, optional, tag="7")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Optional custom SAML attribute name overrides.
    #[prost(message, optional, tag="8")]
    pub attribute_mapping: ::core::option::Option<SamlAttributeNames>,
}
/// Request to check if an email domain has SSO configured.
/// This RPC is pre-authentication — no JWT required.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CheckSsoByDomainRequest {
    /// Email address to check. The domain part is extracted.
    /// Constraints: Max length 254 characters (RFC 5321).
    #[prost(string, tag="1")]
    pub email: ::prost::alloc::string::String,
}
/// Response for SSO domain check.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CheckSsoByDomainResponse {
    /// Whether SSO is enabled for the email's domain.
    #[prost(bool, tag="1")]
    pub sso_enabled: bool,
    /// Identity provider name for signInWithRedirect.
    /// Empty if sso_enabled is false.
    #[prost(string, tag="2")]
    pub provider_name: ::prost::alloc::string::String,
}
/// Request to create an SSO provider for the organization.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateSsoProviderRequest {
    /// Email domain to associate (e.g. "acme.com").
    /// Constraints: Max length 253 characters (RFC 1035).
    #[prost(string, tag="1")]
    pub domain: ::prost::alloc::string::String,
    /// Type of identity provider.
    #[prost(enumeration="SsoProviderType", tag="2")]
    pub r#type: i32,
    /// SAML metadata URL or OIDC discovery URL.
    /// Constraints: Max length 2048 characters. HTTPS required.
    #[prost(string, tag="3")]
    pub metadata_url: ::prost::alloc::string::String,
    /// Optional custom SAML attribute name overrides.
    /// When omitted, attribute names are auto-detected from the metadata URL.
    #[prost(message, optional, tag="4")]
    pub attribute_mapping: ::core::option::Option<SamlAttributeNames>,
}
/// Response after creating an SSO provider.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateSsoProviderResponse {
    /// The newly created SSO provider.
    #[prost(message, optional, tag="1")]
    pub provider: ::core::option::Option<SsoProvider>,
}
/// Request to get the SSO provider for the organization.
/// Returns the provider if one is configured, or empty if not.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetSsoProviderRequest {
}
/// Response containing the organization's SSO provider.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetSsoProviderResponse {
    /// The organization's SSO provider, or null if not configured.
    #[prost(message, optional, tag="1")]
    pub provider: ::core::option::Option<SsoProvider>,
}
/// Request to delete the organization's SSO provider.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteSsoProviderRequest {
    /// ID of the provider to delete.
    #[prost(string, tag="1")]
    pub provider_id: ::prost::alloc::string::String,
}
/// Response after deleting an SSO provider.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteSsoProviderResponse {
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Type of SSO identity provider.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum SsoProviderType {
    /// Default value; not a valid type.
    Unspecified = 0,
    /// SAML 2.0 identity provider (e.g. Okta, Azure AD).
    Saml = 1,
    /// OpenID Connect identity provider (e.g. Google Workspace, Auth0).
    Oidc = 2,
}
impl SsoProviderType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "SSO_PROVIDER_TYPE_UNSPECIFIED",
            Self::Saml => "SSO_PROVIDER_TYPE_SAML",
            Self::Oidc => "SSO_PROVIDER_TYPE_OIDC",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "SSO_PROVIDER_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "SSO_PROVIDER_TYPE_SAML" => Some(Self::Saml),
            "SSO_PROVIDER_TYPE_OIDC" => Some(Self::Oidc),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// An organizational unit within an organization (e.g. department, division).
/// Teams represent the organizational structure and can serve as sender identity
/// in campaigns.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Team {
    /// Unique identifier for the team.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Human-readable display name (unique within the organization).
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// Optional description of the team's purpose.
    /// Constraints: Max length 1000 characters.
    #[prost(string, tag="3")]
    pub description: ::prost::alloc::string::String,
    /// Number of users currently in the team.
    #[prost(int32, tag="4")]
    pub member_count: i32,
    /// Timestamp when the team was created.
    #[prost(message, optional, tag="5")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the team was last updated.
    #[prost(message, optional, tag="6")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Whether this is the organization's default team (cannot be deleted or renamed).
    #[prost(bool, tag="7")]
    pub is_default: bool,
    /// ID of the user who created this team. Empty for system-seeded defaults.
    #[prost(string, tag="8")]
    pub created_by: ::prost::alloc::string::String,
}
/// Request to create a new team.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateTeamRequest {
    /// Display name for the team. Required.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// Optional description.
    /// Constraints: Max length 1000 characters.
    #[prost(string, tag="2")]
    pub description: ::prost::alloc::string::String,
}
/// Response after creating a team.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateTeamResponse {
    /// The newly created team.
    #[prost(message, optional, tag="1")]
    pub team: ::core::option::Option<Team>,
}
/// Request to retrieve a team by ID.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetTeamRequest {
    /// ID of the team to retrieve. Required.
    #[prost(string, tag="1")]
    pub team_id: ::prost::alloc::string::String,
}
/// Response containing the requested team.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetTeamResponse {
    /// The requested team.
    #[prost(message, optional, tag="1")]
    pub team: ::core::option::Option<Team>,
}
/// Request to list teams in the organization with pagination.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListTeamsRequest {
    /// Pagination parameters.
    #[prost(message, optional, tag="1")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of teams.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListTeamsResponse {
    /// Teams in this page.
    #[prost(message, repeated, tag="1")]
    pub teams: ::prost::alloc::vec::Vec<Team>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to update a team's name and/or description.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateTeamRequest {
    /// ID of the team to update. Required.
    #[prost(string, tag="1")]
    pub team_id: ::prost::alloc::string::String,
    /// New display name. If empty, the name is not changed.
    /// Default teams cannot be renamed.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// New description. If empty, the description is not changed.
    /// Constraints: Max length 1000 characters.
    #[prost(string, tag="3")]
    pub description: ::prost::alloc::string::String,
}
/// Response after updating a team.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateTeamResponse {
    /// The updated team.
    #[prost(message, optional, tag="1")]
    pub team: ::core::option::Option<Team>,
}
/// Request to delete a team.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteTeamRequest {
    /// ID of the team to delete. Required.
    /// Default teams cannot be deleted.
    #[prost(string, tag="1")]
    pub team_id: ::prost::alloc::string::String,
}
/// Response after deleting a team.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeleteTeamResponse {
}
/// Request to add users to a team.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AddTeamMembersRequest {
    /// ID of the team to add members to. Required.
    #[prost(string, tag="1")]
    pub team_id: ::prost::alloc::string::String,
    /// IDs of users to add. Must belong to the same organization.
    /// Adding an existing member is a no-op (idempotent).
    /// Constraints: Max 100 user IDs per request.
    #[prost(string, repeated, tag="2")]
    pub user_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Response after adding team members.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AddTeamMembersResponse {
    /// The team with updated member_count.
    #[prost(message, optional, tag="1")]
    pub team: ::core::option::Option<Team>,
}
/// Request to remove users from a team.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveTeamMembersRequest {
    /// ID of the team to remove members from. Required.
    #[prost(string, tag="1")]
    pub team_id: ::prost::alloc::string::String,
    /// IDs of users to remove. Removing a non-member is a no-op (idempotent).
    /// Constraints: Max 100 user IDs per request.
    #[prost(string, repeated, tag="2")]
    pub user_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Response after removing team members.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveTeamMembersResponse {
    /// The team with updated member_count.
    #[prost(message, optional, tag="1")]
    pub team: ::core::option::Option<Team>,
}
/// Request to list members of a team with pagination.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListTeamMembersRequest {
    /// ID of the team whose members to list. Required.
    #[prost(string, tag="1")]
    pub team_id: ::prost::alloc::string::String,
    /// Pagination parameters.
    #[prost(message, optional, tag="2")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of team members.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListTeamMembersResponse {
    /// Users in this page.
    #[prost(message, repeated, tag="1")]
    pub users: ::prost::alloc::vec::Vec<User>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// A variable placeholder within a template that gets substituted during rendering.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TemplateVariable {
    /// Variable name used in the template body (e.g. "employee_name").
    /// Constraints: Max length 100 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// Human-readable description of what this variable represents.
    /// Constraints: Max length 500 characters.
    #[prost(string, tag="2")]
    pub description: ::prost::alloc::string::String,
    /// Whether this variable must be provided during rendering.
    #[prost(bool, tag="3")]
    pub required: bool,
    /// Where this variable's value comes from (profile attribute or campaign config).
    #[prost(enumeration="TemplateVariableSource", tag="4")]
    pub source: i32,
    /// Fallback value used when the source does not provide a value.
    /// Constraints: Max length 1000 characters.
    #[prost(string, tag="5")]
    pub default_value: ::prost::alloc::string::String,
    /// When true, this variable's rendered value is masked in session replay
    /// and heatmap screenshots. Org admin controls per variable.
    #[prost(bool, tag="6")]
    pub pii: bool,
}
/// A versioned message template with variable placeholders.
/// Templates are append-only — updates create new versions.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Template {
    /// Unique identifier for the template.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Human-readable template name (admin-facing label).
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    /// Template body with {{variable}} placeholders for substitution.
    /// Constraints: Max length 50000 characters.
    #[prost(string, tag="3")]
    pub body: ::prost::alloc::string::String,
    /// Variables that can be substituted into the template body.
    #[prost(message, repeated, tag="4")]
    pub variables: ::prost::alloc::vec::Vec<TemplateVariable>,
    /// Version number (auto-incremented on each update).
    #[prost(int32, tag="5")]
    pub version: i32,
    /// Timestamp when this version was created.
    #[prost(message, optional, tag="6")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp of the most recent update (same as created_at for the latest version).
    #[prost(message, optional, tag="7")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
    /// User-facing title shown as the message subject to recipients.
    /// Serves as the default title; campaigns can override it.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="8")]
    pub title: ::prost::alloc::string::String,
    /// Content format of this template (markdown, rich, HTML).
    /// UNSPECIFIED is treated as MARKDOWN for backward compatibility.
    #[prost(enumeration="TemplateType", tag="9")]
    pub r#type: i32,
    /// Language of the template body content (e.g., "en", "es", "ja").
    /// Defaults to the org's default_locale, falling back to "en".
    /// Translations are created as locale variants of this source.
    #[prost(string, tag="10")]
    pub source_locale: ::prost::alloc::string::String,
}
/// A locale-specific translation of a template's title and body.
/// Translations are created per template version and go through a review workflow.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TemplateTranslation {
    /// Unique identifier for this translation.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// ID of the source template.
    #[prost(string, tag="2")]
    pub template_id: ::prost::alloc::string::String,
    /// Version of the source template this translation is for.
    #[prost(int32, tag="3")]
    pub version: i32,
    /// Target locale (e.g., "es", "pt-BR", "zh", "ja").
    #[prost(string, tag="4")]
    pub locale: ::prost::alloc::string::String,
    /// Translated title.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="5")]
    pub title: ::prost::alloc::string::String,
    /// Translated body content with {{variable}} placeholders preserved.
    /// Constraints: Max length 50000 characters.
    #[prost(string, tag="6")]
    pub body: ::prost::alloc::string::String,
    /// Current review status.
    #[prost(enumeration="TranslationStatus", tag="7")]
    pub status: i32,
    /// Who created this translation ("ai:bedrock", "ai:deepl", or user UUID).
    #[prost(string, tag="8")]
    pub translated_by: ::prost::alloc::string::String,
    /// User who approved the translation. Empty until approved.
    #[prost(string, tag="9")]
    pub reviewed_by: ::prost::alloc::string::String,
    /// When the translation was approved.
    #[prost(message, optional, tag="10")]
    pub reviewed_at: ::core::option::Option<::prost_types::Timestamp>,
    /// When the translation was created.
    #[prost(message, optional, tag="11")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to create a new template.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateTemplateRequest {
    /// Human-readable template name (admin-facing label).
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// Template body with {{variable}} placeholders.
    /// Constraints: Max length 50000 characters.
    #[prost(string, tag="2")]
    pub body: ::prost::alloc::string::String,
    /// Variables available for substitution in the body.
    #[prost(message, repeated, tag="3")]
    pub variables: ::prost::alloc::vec::Vec<TemplateVariable>,
    /// User-facing title shown as the message subject to recipients.
    /// Constraints: Max length 200 characters.
    #[prost(string, tag="4")]
    pub title: ::prost::alloc::string::String,
    /// Content format of the template. Defaults to MARKDOWN if unspecified.
    #[prost(enumeration="TemplateType", tag="5")]
    pub r#type: i32,
    /// Language of the template body content. Defaults to org's default_locale.
    /// Valid values: en, es, pt-BR, zh, ja.
    #[prost(string, tag="6")]
    pub source_locale: ::prost::alloc::string::String,
}
/// Response after creating a template.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateTemplateResponse {
    /// The newly created template (version 1).
    #[prost(message, optional, tag="1")]
    pub template: ::core::option::Option<Template>,
}
/// Request to update a template, creating a new version.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateTemplateRequest {
    /// ID of the template to update.
    #[prost(string, tag="1")]
    pub template_id: ::prost::alloc::string::String,
    /// New template body with {{variable}} placeholders.
    /// Constraints: Max length 50000 characters.
    #[prost(string, tag="2")]
    pub body: ::prost::alloc::string::String,
    /// Updated variables for substitution.
    #[prost(message, repeated, tag="3")]
    pub variables: ::prost::alloc::vec::Vec<TemplateVariable>,
}
/// Response after updating a template.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateTemplateResponse {
    /// The updated template with incremented version number.
    #[prost(message, optional, tag="1")]
    pub template: ::core::option::Option<Template>,
}
/// Request to retrieve a specific template version.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetTemplateRequest {
    /// ID of the template to retrieve.
    #[prost(string, tag="1")]
    pub template_id: ::prost::alloc::string::String,
    /// Version to retrieve. 0 returns the latest version.
    #[prost(int32, tag="2")]
    pub version: i32,
}
/// Response containing the requested template.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetTemplateResponse {
    /// The requested template.
    #[prost(message, optional, tag="1")]
    pub template: ::core::option::Option<Template>,
}
/// Request to list templates with pagination.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListTemplatesRequest {
    /// Pagination parameters.
    #[prost(message, optional, tag="1")]
    pub pagination: ::core::option::Option<Pagination>,
    /// Filter by template type. UNSPECIFIED returns all templates.
    #[prost(enumeration="TemplateType", tag="2")]
    pub r#type: i32,
}
/// Response containing a page of templates.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListTemplatesResponse {
    /// List of templates in this page (latest version of each).
    #[prost(message, repeated, tag="1")]
    pub templates: ::prost::alloc::vec::Vec<Template>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to create a translation for a template.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateTemplateTranslationRequest {
    /// ID of the template to translate.
    #[prost(string, tag="1")]
    pub template_id: ::prost::alloc::string::String,
    /// Version of the template to translate.
    #[prost(int32, tag="2")]
    pub version: i32,
    /// Target locale.
    #[prost(string, tag="3")]
    pub locale: ::prost::alloc::string::String,
    /// Translated title.
    #[prost(string, tag="4")]
    pub title: ::prost::alloc::string::String,
    /// Translated body content.
    #[prost(string, tag="5")]
    pub body: ::prost::alloc::string::String,
    /// Who created this translation ("ai:bedrock" or user UUID).
    #[prost(string, tag="6")]
    pub translated_by: ::prost::alloc::string::String,
    /// Initial status (typically DRAFT or AI_TRANSLATED).
    #[prost(enumeration="TranslationStatus", tag="7")]
    pub status: i32,
}
/// Response after creating a template translation.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateTemplateTranslationResponse {
    /// The created translation.
    #[prost(message, optional, tag="1")]
    pub translation: ::core::option::Option<TemplateTranslation>,
}
/// Request to update an existing template translation.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateTemplateTranslationRequest {
    /// ID of the translation to update.
    #[prost(string, tag="1")]
    pub translation_id: ::prost::alloc::string::String,
    /// Updated title. Empty leaves unchanged.
    #[prost(string, tag="2")]
    pub title: ::prost::alloc::string::String,
    /// Updated body. Empty leaves unchanged.
    #[prost(string, tag="3")]
    pub body: ::prost::alloc::string::String,
    /// Updated status.
    #[prost(enumeration="TranslationStatus", tag="4")]
    pub status: i32,
}
/// Response after updating a template translation.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateTemplateTranslationResponse {
    /// The updated translation.
    #[prost(message, optional, tag="1")]
    pub translation: ::core::option::Option<TemplateTranslation>,
}
/// Request to list translations for a template version.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListTemplateTranslationsRequest {
    /// ID of the template.
    #[prost(string, tag="1")]
    pub template_id: ::prost::alloc::string::String,
    /// Version of the template. 0 returns translations for the latest version.
    #[prost(int32, tag="2")]
    pub version: i32,
}
/// Response containing all translations for a template version.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListTemplateTranslationsResponse {
    /// Translations for the requested template version.
    #[prost(message, repeated, tag="1")]
    pub translations: ::prost::alloc::vec::Vec<TemplateTranslation>,
}
/// Request to approve a template translation.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ApproveTemplateTranslationRequest {
    /// ID of the translation to approve.
    #[prost(string, tag="1")]
    pub translation_id: ::prost::alloc::string::String,
}
/// Response after approving a template translation.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ApproveTemplateTranslationResponse {
    /// The approved translation (status: APPROVED, reviewed_by and reviewed_at set).
    #[prost(message, optional, tag="1")]
    pub translation: ::core::option::Option<TemplateTranslation>,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Content format of a template, determining which editor and renderer to use.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum TemplateType {
    /// Default value; treated as MARKDOWN for backward compatibility.
    Unspecified = 0,
    /// Markdown with {{variable}} placeholders.
    Markdown = 1,
    /// Rich text format (reserved for future use).
    Rich = 2,
    /// Raw HTML format (reserved for future use).
    Html = 3,
}
impl TemplateType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "TEMPLATE_TYPE_UNSPECIFIED",
            Self::Markdown => "TEMPLATE_TYPE_MARKDOWN",
            Self::Rich => "TEMPLATE_TYPE_RICH",
            Self::Html => "TEMPLATE_TYPE_HTML",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "TEMPLATE_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "TEMPLATE_TYPE_MARKDOWN" => Some(Self::Markdown),
            "TEMPLATE_TYPE_RICH" => Some(Self::Rich),
            "TEMPLATE_TYPE_HTML" => Some(Self::Html),
            _ => None,
        }
    }
}
/// Source from which a template variable's value is resolved at render time.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum TemplateVariableSource {
    /// Default value; treated as CUSTOM for backward compatibility.
    Unspecified = 0,
    /// Auto-resolved from the target user's profile attributes.
    Profile = 1,
    /// Provided manually in the campaign or workflow step configuration.
    Custom = 2,
}
impl TemplateVariableSource {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "TEMPLATE_VARIABLE_SOURCE_UNSPECIFIED",
            Self::Profile => "TEMPLATE_VARIABLE_SOURCE_PROFILE",
            Self::Custom => "TEMPLATE_VARIABLE_SOURCE_CUSTOM",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "TEMPLATE_VARIABLE_SOURCE_UNSPECIFIED" => Some(Self::Unspecified),
            "TEMPLATE_VARIABLE_SOURCE_PROFILE" => Some(Self::Profile),
            "TEMPLATE_VARIABLE_SOURCE_CUSTOM" => Some(Self::Custom),
            _ => None,
        }
    }
}
/// Review status of a template translation.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum TranslationStatus {
    Unspecified = 0,
    /// Translation draft, not yet reviewed.
    Draft = 1,
    /// Translation generated by AI, pending human review.
    AiTranslated = 2,
    /// Translation is being reviewed by a human.
    InReview = 3,
    /// Translation has been approved for use.
    Approved = 4,
}
impl TranslationStatus {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "TRANSLATION_STATUS_UNSPECIFIED",
            Self::Draft => "TRANSLATION_STATUS_DRAFT",
            Self::AiTranslated => "TRANSLATION_STATUS_AI_TRANSLATED",
            Self::InReview => "TRANSLATION_STATUS_IN_REVIEW",
            Self::Approved => "TRANSLATION_STATUS_APPROVED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "TRANSLATION_STATUS_UNSPECIFIED" => Some(Self::Unspecified),
            "TRANSLATION_STATUS_DRAFT" => Some(Self::Draft),
            "TRANSLATION_STATUS_AI_TRANSLATED" => Some(Self::AiTranslated),
            "TRANSLATION_STATUS_IN_REVIEW" => Some(Self::InReview),
            "TRANSLATION_STATUS_APPROVED" => Some(Self::Approved),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// Decoded deeplink-token payload. Populated by ValidateDeeplinkToken
/// only when validation succeeds.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeeplinkTokenPayload {
    /// Campaign UUID the deeplink targets. The native app uses this for the
    /// authenticated GetCampaign follow-up post-recipient-auth.
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Recipient UUID the token authorizes. The token does not authenticate
    /// the recipient (that's the auth flow's job); it authorizes "this
    /// deeplink path is for this recipient" so the native app can refuse
    /// to render a token whose embedded recipient mismatches the signed-in
    /// user.
    #[prost(string, tag="2")]
    pub recipient_user_id: ::prost::alloc::string::String,
    /// Step kind the deeplink targets — REMINDER vs ESCALATION. Lets the
    /// native app pick the right campaign-card variant before the auth
    /// gate.
    #[prost(enumeration="ChannelStepKind", tag="3")]
    pub step_kind: i32,
    /// Expiry the token carries. Validation rejects tokens past this time
    /// even if the signature checks out.
    #[prost(message, optional, tag="4")]
    pub expires_at: ::core::option::Option<::prost_types::Timestamp>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SignDeeplinkTokenRequest {
    /// Campaign whose deeplink this token authorizes. Constraints: required,
    /// must be a UUID and exist within the caller's organization.
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Recipient the token authorizes. Constraints: required, must be a UUID
    /// and a member of the campaign's audience.
    #[prost(string, tag="2")]
    pub recipient_user_id: ::prost::alloc::string::String,
    /// Step kind the deeplink targets. Required.
    #[prost(enumeration="ChannelStepKind", tag="3")]
    pub step_kind: i32,
    /// Token lifetime in seconds from now. Constraints: required, must be
    /// in (0, 30 * 24 * 3600] (1 second to 30 days). 30 days matches the
    /// platform's outer bound on actionable campaign lifetimes; longer
    /// tokens are not signed.
    #[prost(int64, tag="4")]
    pub ttl_seconds: i64,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SignDeeplinkTokenResponse {
    /// The signed token, ready to URL-embed in
    /// links.pidgr.com/c/{short_code}?t={token}. Format: base64url-encoded
    /// payload (JSON) + base64url-encoded HMAC-SHA256 trailer, joined by
    /// a single dot. Implementation detail — clients SHOULD NOT parse or
    /// mutate the token; they pass it back to ValidateDeeplinkToken.
    #[prost(string, tag="1")]
    pub token: ::prost::alloc::string::String,
    /// The expiry the token carries. Echoed back so clients don't need to
    /// redo the time-math the caller passed in via ttl_seconds.
    #[prost(message, optional, tag="2")]
    pub expires_at: ::core::option::Option<::prost_types::Timestamp>,
    /// The platform key version used to sign. Clients MAY record for
    /// telemetry but SHOULD NOT branch logic on it — the platform manages
    /// overlap windows during rotation transparently.
    #[prost(int32, tag="3")]
    pub key_version: i32,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ValidateDeeplinkTokenRequest {
    /// The token bytes from the deeplink URL's `t` query parameter.
    /// Constraints: required, non-empty.
    #[prost(string, tag="1")]
    pub token: ::prost::alloc::string::String,
    /// Campaign UUID embedded in the URL path (translated from the
    /// short-code by the native app via CampaignService.GetCampaignByShortCode).
    /// Validation rejects when the token's embedded campaign_id does not
    /// match — defense against replay attacks that swap the short-code
    /// path component while reusing a signed token from a different
    /// campaign.
    #[prost(string, tag="2")]
    pub campaign_id: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ValidateDeeplinkTokenResponse {
    /// True when signature + expiry both check out under any active or
    /// overlap-window key version.
    #[prost(bool, tag="1")]
    pub valid: bool,
    /// Reason validation failed. Set only when valid=false; UNSPECIFIED
    /// when valid=true. The native app uses this to drive UX (silent retry
    /// vs. "this link expired" message vs. "this link looks tampered").
    #[prost(enumeration="ValidationFailureReason", tag="2")]
    pub failure_reason: i32,
    /// Decoded payload. Populated only when valid=true. The native app
    /// SHOULD compare payload.recipient_user_id against the signed-in user
    /// and refuse to render the campaign card on mismatch.
    #[prost(message, optional, tag="3")]
    pub payload: ::core::option::Option<DeeplinkTokenPayload>,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Reason a deeplink-token validation failed. Empty when valid=true.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ValidationFailureReason {
    Unspecified = 0,
    /// Token bytes parsed but the HMAC signature did not verify under any
    /// active or overlap-window key version.
    InvalidSignature = 1,
    /// Token signature verified but its embedded expiry has passed.
    Expired = 2,
    /// Signature would have verified, but the key version that signed the
    /// token is past the rotation overlap window and has been hard-deleted.
    /// This means the token is older than the platform's retention bound
    /// (rotation cadence + overlap window) — operationally equivalent to
    /// EXPIRED but distinguishable for telemetry.
    KeyRetired = 3,
    /// Token bytes could not be parsed at all (not base64url, wrong length,
    /// missing payload separator, etc.). Indicates a tampered or
    /// truncated URL.
    Malformed = 4,
}
impl ValidationFailureReason {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "VALIDATION_FAILURE_REASON_UNSPECIFIED",
            Self::InvalidSignature => "VALIDATION_FAILURE_REASON_INVALID_SIGNATURE",
            Self::Expired => "VALIDATION_FAILURE_REASON_EXPIRED",
            Self::KeyRetired => "VALIDATION_FAILURE_REASON_KEY_RETIRED",
            Self::Malformed => "VALIDATION_FAILURE_REASON_MALFORMED",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "VALIDATION_FAILURE_REASON_UNSPECIFIED" => Some(Self::Unspecified),
            "VALIDATION_FAILURE_REASON_INVALID_SIGNATURE" => Some(Self::InvalidSignature),
            "VALIDATION_FAILURE_REASON_EXPIRED" => Some(Self::Expired),
            "VALIDATION_FAILURE_REASON_KEY_RETIRED" => Some(Self::KeyRetired),
            "VALIDATION_FAILURE_REASON_MALFORMED" => Some(Self::Malformed),
            _ => None,
        }
    }
}
// ─── Messages ───────────────────────────────────────────────────────────────

/// One recorded observation of an indicator over a period.
///
/// A reading records what was reported and nothing else. Reading it
/// together with the response rate of the campaign it followed produces
/// an interpretation — for instance that a well-acknowledged message
/// nonetheless changed nothing, which says the gap was never one of
/// direction. That crossing is analysis and belongs to the diagnosis
/// layer; storing it here would make the record and its interpretation
/// impossible to tell apart, and would freeze one interpretation into
/// data that later analysis cannot revisit.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct IndicatorReading {
    /// Unique identifier for the reading.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Indicator this reading was recorded against.
    #[prost(string, tag="2")]
    pub indicator_id: ::prost::alloc::string::String,
    /// Kind of source that produced it.
    #[prost(enumeration="ReadingSource", tag="3")]
    pub source: i32,
    /// What the reading says.
    #[prost(enumeration="ReadingOutcome", tag="4")]
    pub outcome: i32,
    /// Start of the period the reading covers.
    #[prost(message, optional, tag="5")]
    pub period_start: ::core::option::Option<::prost_types::Timestamp>,
    /// End of the period the reading covers.
    #[prost(message, optional, tag="6")]
    pub period_end: ::core::option::Option<::prost_types::Timestamp>,
    /// Verification run that produced it. Set only when `source` is
    /// READING_SOURCE_VERIFICATION_CAMPAIGN, and the way to check the
    /// reading: the run carries how many verifiers were asked and over
    /// what window, never who they were. The identities are deliberately
    /// not recorded, because the reading is about a unit and not about its
    /// members, and keeping the two apart is what stops a stored answer
    /// from becoming one person's judgement of another.
    #[prost(string, tag="7")]
    pub verification_run_id: ::prost::alloc::string::String,
    /// Campaign whose responses produced it. For an in-app reading this is
    /// the campaign the audience answered; for a verification reading it
    /// is the follow-up that was sent to the verifiers.
    #[prost(string, tag="8")]
    pub campaign_id: ::prost::alloc::string::String,
    /// How many responses fed this reading. For a verification reading the
    /// unit of count is the organizational unit that answered, not the
    /// person: the question is asked once per unit.
    ///
    /// Absent for a source that does not count responses at all, such as a
    /// figure pushed from another system. Absence and a count of none are
    /// different facts and the field carries presence so they stay
    /// different.
    #[prost(int32, optional, tag="9")]
    pub response_count: ::core::option::Option<i32>,
    /// How many responses were expected over the same period. Travels with
    /// `response_count` so that the reading carries its own denominator
    /// and can be judged without a second lookup, and carries presence for
    /// the same reason.
    #[prost(int32, optional, tag="10")]
    pub expected_response_count: ::core::option::Option<i32>,
    /// Timestamp when the reading was stored.
    #[prost(message, optional, tag="11")]
    pub recorded_at: ::core::option::Option<::prost_types::Timestamp>,
    /// The measured figure, expressed in the indicator's unit and read
    /// together with its direction and target.
    ///
    /// Present only for a source that produces a number: a figure pushed
    /// from one of the organization's own systems, or one entered by hand.
    /// A verification-campaign reading never carries one, because the
    /// question put to a verifier is whether the behaviour changed and an
    /// answer to that has no magnitude — deriving a figure from it would
    /// manufacture precision the answer does not contain. Absent for every
    /// source that has no number to report, which is not the same as a
    /// measurement of zero.
    #[prost(double, optional, tag="12")]
    pub value: ::core::option::Option<f64>,
    /// The number of people in the smallest organizational unit any answer
    /// in this reading was about.
    ///
    /// A reading aggregates several verifiers answering about several
    /// units, so it has no single unit size and does not claim one. The
    /// smallest is what it carries, because that is the only figure that
    /// answers the question a stored reading has to survive: if the size
    /// below which a unit may not be asked about is raised to some larger
    /// number, which readings already taken fall below it? Without this the
    /// question is unanswerable in retrospect and a raised floor can only
    /// apply forward.
    ///
    /// Carries presence. Absent means the size was not knowable — a reading
    /// recorded before sizes were kept, or a source with no units behind it
    /// at all — and absent MUST NOT be read as a small unit, nor as a large
    /// one; it is the absence of the fact.
    ///
    /// This is a size and deliberately nothing else. The reading records no
    /// unit identity, so the figure cannot be attached to any unit, and
    /// consumers MUST NOT use it to rank, compare or otherwise set units
    /// against one another: comparing organizational units is not something
    /// this contract carries, and size without identity is what keeps a
    /// later re-reading of the floor possible without reopening it.
    /// Consumers MUST NOT present a reading whose smallest unit is below
    /// the floor in force as a judgement about that unit.
    #[prost(int32, optional, tag="13")]
    pub min_unit_size: ::core::option::Option<i32>,
}
/// A scheduled follow-up that asks whether the behaviour a campaign was
/// trying to change actually changed, and lands the answer on an
/// indicator.
///
/// The question is asked about an organizational unit, never about a
/// named person. A run therefore never produces a third party's judgement
/// of an individual, which is a category of data this contract does not
/// carry.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct VerificationRun {
    /// Unique identifier for the run.
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// Campaign whose effect is being verified.
    #[prost(string, tag="2")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Indicator the answers are recorded against.
    #[prost(string, tag="3")]
    pub indicator_id: ::prost::alloc::string::String,
    /// Objective the indicator hangs from, carried here so a run can be
    /// listed and read at the objective level without resolving the
    /// indicator first.
    #[prost(string, tag="4")]
    pub objective_id: ::prost::alloc::string::String,
    /// Lifecycle state.
    #[prost(enumeration="VerificationRunState", tag="5")]
    pub state: i32,
    /// The follow-up campaign sent to the verifiers. Empty while the run
    /// is VERIFICATION_RUN_STATE_PENDING, because it does not exist yet.
    #[prost(string, tag="6")]
    pub verification_campaign_id: ::prost::alloc::string::String,
    /// When the follow-up is due, derived from the wait declared on the
    /// indicator's evidence source. Known from the moment the run is
    /// created.
    #[prost(message, optional, tag="7")]
    pub scheduled_for: ::core::option::Option<::prost_types::Timestamp>,
    /// When the follow-up actually went out and collection opened. Unset
    /// while the run is pending.
    #[prost(message, optional, tag="8")]
    pub window_start: ::core::option::Option<::prost_types::Timestamp>,
    /// When collection closed. Unset until the run is complete.
    #[prost(message, optional, tag="9")]
    pub window_end: ::core::option::Option<::prost_types::Timestamp>,
    /// How many people the follow-up asks. Verifiers are derived from the
    /// audience being measured — each audience member's manager,
    /// deduplicated, dropping anyone who is inside that audience — and
    /// each verifier's affirmation is recorded as an ordinary per-delivery
    /// acknowledgement of the follow-up campaign. No folding of units too
    /// small to be asked about on their own into the level above them
    /// takes place.
    #[prost(int32, tag="10")]
    pub verifier_count: i32,
    /// Reading this run produced. Empty until the run completes, and
    /// empty on a completed run that produced none — a run nobody answered
    /// leaves the indicator without evidence rather than with a zero.
    #[prost(string, tag="11")]
    pub reading_id: ::prost::alloc::string::String,
    /// Timestamp when the run was created.
    #[prost(message, optional, tag="12")]
    pub created_at: ::core::option::Option<::prost_types::Timestamp>,
    /// Timestamp when the run was last updated.
    #[prost(message, optional, tag="13")]
    pub updated_at: ::core::option::Option<::prost_types::Timestamp>,
}
/// Request to schedule a verification run for a campaign and one of the
/// indicators it should move.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct StartVerificationRunRequest {
    /// Campaign whose effect is to be verified. Required.
    #[prost(string, tag="1")]
    pub campaign_id: ::prost::alloc::string::String,
    /// Indicator the answers will be recorded against. Required. Its
    /// evidence source must be the verification-campaign kind; any other
    /// kind returns FAILED_PRECONDITION, because the wait, the verifier
    /// derivation and the follow-up template all come from that
    /// configuration and have nowhere else to come from.
    #[prost(string, tag="2")]
    pub indicator_id: ::prost::alloc::string::String,
}
/// Response after scheduling a verification run.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct StartVerificationRunResponse {
    /// The scheduled run. Scheduling a run for a pair that already has one
    /// that has not completed is idempotent and returns the existing run.
    #[prost(message, optional, tag="1")]
    pub run: ::core::option::Option<VerificationRun>,
}
/// Request to retrieve one verification run.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetVerificationRunRequest {
    /// ID of the run to retrieve. Required.
    #[prost(string, tag="1")]
    pub verification_run_id: ::prost::alloc::string::String,
}
/// Response containing the requested verification run.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetVerificationRunResponse {
    /// The requested run.
    #[prost(message, optional, tag="1")]
    pub run: ::core::option::Option<VerificationRun>,
    /// The reading it produced, when it produced one. Absent while the run
    /// is still open and absent on a completed run that collected nothing.
    #[prost(message, optional, tag="2")]
    pub reading: ::core::option::Option<IndicatorReading>,
}
/// Request to list verification runs. Exactly one of `objective_id`,
/// `indicator_id` and `campaign_id` must be set; sending more than one,
/// or none, returns INVALID_ARGUMENT.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListVerificationRunsRequest {
    /// List the runs recorded against the indicators of this objective.
    #[prost(string, optional, tag="1")]
    pub objective_id: ::core::option::Option<::prost::alloc::string::String>,
    /// List the runs recorded against this indicator.
    #[prost(string, optional, tag="2")]
    pub indicator_id: ::core::option::Option<::prost::alloc::string::String>,
    /// List the runs verifying this campaign.
    #[prost(string, optional, tag="3")]
    pub campaign_id: ::core::option::Option<::prost::alloc::string::String>,
    /// Return only runs in this state. Unspecified returns every state.
    #[prost(enumeration="VerificationRunState", tag="4")]
    pub state: i32,
    /// Pagination parameters.
    #[prost(message, optional, tag="5")]
    pub pagination: ::core::option::Option<Pagination>,
}
/// Response containing a page of verification runs.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListVerificationRunsResponse {
    /// Runs in this page, newest first.
    #[prost(message, repeated, tag="1")]
    pub runs: ::prost::alloc::vec::Vec<VerificationRun>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
/// Request to list the readings recorded against one indicator.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListIndicatorReadingsRequest {
    /// Indicator whose readings to list. Required.
    #[prost(string, tag="1")]
    pub indicator_id: ::prost::alloc::string::String,
    /// Return only readings from this kind of source. Unspecified returns
    /// every kind.
    #[prost(enumeration="ReadingSource", tag="2")]
    pub source: i32,
    /// Pagination parameters.
    #[prost(message, optional, tag="3")]
    pub pagination: ::core::option::Option<Pagination>,
    /// Return only readings whose period ends at or after this instant.
    /// Unset leaves the range open at that end.
    #[prost(message, optional, tag="4")]
    pub period_start_after: ::core::option::Option<::prost_types::Timestamp>,
    /// Return only readings whose period starts at or before this instant.
    /// Unset leaves the range open at that end.
    #[prost(message, optional, tag="5")]
    pub period_end_before: ::core::option::Option<::prost_types::Timestamp>,
}
/// Response containing a page of readings.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListIndicatorReadingsResponse {
    /// Readings in this page, newest period first. An empty page means no
    /// reading exists for the filter, which is a statement about evidence
    /// and not about the indicator's value.
    #[prost(message, repeated, tag="1")]
    pub readings: ::prost::alloc::vec::Vec<IndicatorReading>,
    /// Pagination metadata for fetching subsequent pages.
    #[prost(message, optional, tag="2")]
    pub pagination_meta: ::core::option::Option<PaginationMeta>,
}
// ─── Enums ──────────────────────────────────────────────────────────────────

/// Where a reading came from. One value per evidence adapter, so that a
/// reading can always be traced back to the kind of source that produced
/// it without consulting the indicator's current configuration — an
/// indicator's evidence source can be changed after readings exist, and
/// past readings keep saying how they were actually obtained.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ReadingSource {
    Unspecified = 0,
    /// Produced by responses from the audience of the message itself.
    InApp = 1,
    /// Produced by a deferred follow-up message asking someone other than
    /// the audience whether the behaviour changed.
    VerificationCampaign = 2,
    /// Pushed by the organization from one of its own systems.
    Webhook = 3,
    /// Entered by hand or imported from a spreadsheet.
    ManualEntry = 4,
}
impl ReadingSource {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "READING_SOURCE_UNSPECIFIED",
            Self::InApp => "READING_SOURCE_IN_APP",
            Self::VerificationCampaign => "READING_SOURCE_VERIFICATION_CAMPAIGN",
            Self::Webhook => "READING_SOURCE_WEBHOOK",
            Self::ManualEntry => "READING_SOURCE_MANUAL_ENTRY",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "READING_SOURCE_UNSPECIFIED" => Some(Self::Unspecified),
            "READING_SOURCE_IN_APP" => Some(Self::InApp),
            "READING_SOURCE_VERIFICATION_CAMPAIGN" => Some(Self::VerificationCampaign),
            "READING_SOURCE_WEBHOOK" => Some(Self::Webhook),
            "READING_SOURCE_MANUAL_ENTRY" => Some(Self::ManualEntry),
            _ => None,
        }
    }
}
/// What a reading says about the indicator it was recorded against.
/// Every reading carries one, whatever produced it, so that sources of
/// different shapes remain comparable on the only question the indicator
/// is there to answer.
///
/// For a verification-campaign reading this is the whole of it. A
/// verifier is asked whether the behaviour changed for a unit, not to
/// grade it, so a three-way judgement is all the answer contains and
/// anything finer would be invented; those readings therefore carry no
/// figure. A source that genuinely measures something — a system of the
/// organization's own, or a figure entered by hand — reports the number
/// in `value` in addition, and the outcome then says how that number
/// reads against the indicator's direction and target.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ReadingOutcome {
    Unspecified = 0,
    /// The behaviour the indicator describes was reported as happening.
    Positive = 1,
    /// The behaviour the indicator describes was reported as not
    /// happening. A negative reading is a finding, not a failure to
    /// collect.
    Negative = 2,
    /// Answers were collected but they do not support either reading —
    /// too few came back, or they disagreed.
    ///
    /// Distinct from no reading at all. When nobody answers, no reading is
    /// recorded and the indicator simply has no evidence for that period;
    /// silence is never stored as an outcome, and never as a zero.
    Insufficient = 3,
}
impl ReadingOutcome {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "READING_OUTCOME_UNSPECIFIED",
            Self::Positive => "READING_OUTCOME_POSITIVE",
            Self::Negative => "READING_OUTCOME_NEGATIVE",
            Self::Insufficient => "READING_OUTCOME_INSUFFICIENT",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "READING_OUTCOME_UNSPECIFIED" => Some(Self::Unspecified),
            "READING_OUTCOME_POSITIVE" => Some(Self::Positive),
            "READING_OUTCOME_NEGATIVE" => Some(Self::Negative),
            "READING_OUTCOME_INSUFFICIENT" => Some(Self::Insufficient),
            _ => None,
        }
    }
}
/// Lifecycle of a verification run.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum VerificationRunState {
    Unspecified = 0,
    /// Scheduled. The wait after the original message has not elapsed and
    /// the follow-up has not been sent.
    Pending = 1,
    /// The follow-up has been sent and answers are being collected.
    Collecting = 2,
    /// Collection is closed. The run either produced a reading or produced
    /// none; both are terminal, and the second is not an error.
    Complete = 3,
}
impl VerificationRunState {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "VERIFICATION_RUN_STATE_UNSPECIFIED",
            Self::Pending => "VERIFICATION_RUN_STATE_PENDING",
            Self::Collecting => "VERIFICATION_RUN_STATE_COLLECTING",
            Self::Complete => "VERIFICATION_RUN_STATE_COMPLETE",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "VERIFICATION_RUN_STATE_UNSPECIFIED" => Some(Self::Unspecified),
            "VERIFICATION_RUN_STATE_PENDING" => Some(Self::Pending),
            "VERIFICATION_RUN_STATE_COLLECTING" => Some(Self::Collecting),
            "VERIFICATION_RUN_STATE_COMPLETE" => Some(Self::Complete),
            _ => None,
        }
    }
}
include!("pidgr.v1.tonic.rs");
// @@protoc_insertion_point(module)