Initial commit

.api-linter.yaml

@@ -0,0 +1,8 @@
+- included_paths:
+    - "**/*"
+  disabled_rules:
+    - "core::0191::proto-package"
+    - "core::0123::resource-annotation"
+    - "core::0132::request-parent-required"
+    - "core::0133::request-parent-required"
+    - "core::0131::request-name-reference"

.bazelignore

@@ -0,0 +1,8 @@
+.ijwb
+.idea
+bazel-bin
+bazel-genfiles
+bazel-out
+bazel-testlogs
+bazel-peridot
+node_modules

.bazelrc

@@ -0,0 +1,205 @@
+# Java
+test --test_env='LC_ALL=en_US.UTF-8'
+test --test_env='LANG=en_US.UTF-8'
+test --jvmopt='-Dsun.jnu.encoding=UTF-8'
+test --jvmopt='-Dfile.encoding=UTF-8'
+build --test_env='LC_ALL=en_US.UTF-8'
+build --jvmopt='-Dsun.jnu.encoding=UTF-8'
+build --jvmopt='-Dfile.encoding=UTF-8'
+build --test_env='LANG=en_US.UTF-8'
+test --test_env=PATH
+
+build --java_language_version=17
+test --java_language_version=17
+
+# Do not upload locally executed action results to the remote cache.
+# This should be the default for local builds so local builds cannot poison the remote cache.
+# It should be flipped to `--remote_upload_local_results` on CI
+# by using `--bazelrc=.aspect/bazelrc/ci.bazelrc`.
+# Docs: https://bazel.build/reference/command-line-reference#flag--remote_upload_local_results
+build --noremote_upload_local_results
+
+# Don't allow network access for build actions in the sandbox.
+# Ensures that you don't accidentally make non-hermetic actions/tests which depend on remote
+# services.
+# Developers should tag targets with `tags=["requires-network"]` to opt-out of the enforcement.
+# Docs: https://bazel.build/reference/command-line-reference#flag--sandbox_default_allow_network
+build --sandbox_default_allow_network=false
+
+# Warn if a test's timeout is significantly longer than the test's actual execution time.
+# Bazel's default for test_timeout is medium (5 min), but most tests should instead be short (1 min).
+# While a test's timeout should be set such that it is not flaky, a test that has a highly
+# over-generous timeout can hide real problems that crop up unexpectedly.
+# For instance, a test that normally executes in a minute or two should not have a timeout of
+# ETERNAL or LONG as these are much, much too generous.
+# Docs: https://bazel.build/docs/user-manual#test-verbose-timeout-warnings
+test --test_verbose_timeout_warnings
+
+# Allow the Bazel server to check directory sources for changes. Ensures that the Bazel server
+# notices when a directory changes, if you have a directory listed in the srcs of some target.
+# Recommended when using
+# [copy_directory](https://github.com/aspect-build/bazel-lib/blob/main/docs/copy_directory.md) and
+# [rules_js](https://github.com/aspect-build/rules_js) since npm package are source directories
+# inputs to copy_directory actions.
+# Docs: https://bazel.build/reference/command-line-reference#flag--host_jvm_args
+startup --host_jvm_args=-DBAZEL_TRACK_SOURCE_DIRECTORIES=1
+
+# Allow exclusive tests to run in the sandbox. Fixes a bug where Bazel doesn't enable sandboxing for
+# tests with `tags=["exclusive"]`.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_exclusive_test_sandboxed
+test --incompatible_exclusive_test_sandboxed
+
+# Use a static value for `PATH` and does not inherit `LD_LIBRARY_PATH`. Doesn't let environment
+# variables like `PATH` sneak into the build, which can cause massive cache misses when they change.
+# Use `--action_env=ENV_VARIABLE` if you want to inherit specific environment variables from the
+# client, but note that doing so can prevent cross-user caching if a shared cache is used.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_strict_action_env
+build --incompatible_strict_action_env
+
+# Propagate tags from a target declaration to the actions' execution requirements.
+# Ensures that tags applied in your BUILD file, like `tags=["no-remote"]`
+# get propagated to actions created by the rule.
+# Without this option, you rely on rules authors to manually check the tags you passed
+# and apply relevant ones to the actions they create.
+# See https://github.com/bazelbuild/bazel/issues/8830 for details.
+# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_allow_tags_propagation
+build --experimental_allow_tags_propagation
+fetch --experimental_allow_tags_propagation
+query --experimental_allow_tags_propagation
+
+# Do not automatically create `__init__.py` files in the runfiles of Python targets. Fixes the wrong
+# default that comes from Google's internal monorepo by using `__init__.py` to delimit a Python
+# package. Precisely, when a `py_binary` or `py_test` target has `legacy_create_init` set to `auto (the
+# default), it is treated as false if and only if this flag is set. See
+# https://github.com/bazelbuild/bazel/issues/10076.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_default_to_explicit_init_py
+build --incompatible_default_to_explicit_init_py
+
+# Attempt to build & test every target whose prerequisites were successfully built.
+# Docs: https://bazel.build/docs/user-manual#keep-going
+build --keep_going
+
+# Output test errors to stderr so users don't have to `cat` or open test failure log files when test
+# fail. This makes the log noiser in exchange for reducing the time-to-feedback on test failures for
+# users.
+# Docs: https://bazel.build/docs/user-manual#test-output
+test --test_output=errors
+
+# Show the output files created by builds that requested more than one target. This helps users
+# locate the build outputs in more cases
+# Docs: https://bazel.build/docs/user-manual#show-result
+build --show_result=20
+
+# Bazel picks up host-OS-specific config lines from bazelrc files. For example, if the host OS is
+# Linux and you run bazel build, Bazel picks up lines starting with build:linux. Supported OS
+# identifiers are `linux`, `macos`, `windows`, `freebsd`, and `openbsd`. Enabling this flag is
+# equivalent to using `--config=linux` on Linux, `--config=windows` on Windows, etc.
+# Docs: https://bazel.build/reference/command-line-reference#flag--enable_platform_specific_config
+common --enable_platform_specific_config
+
+# Output a heap dump if an OOM is thrown during a Bazel invocation
+# (including OOMs due to `--experimental_oom_more_eagerly_threshold`).
+# The dump will be written to `<output_base>/<invocation_id>.heapdump.hprof`.
+# You may need to configure CI to capture this artifact and upload for later use.
+# Docs: https://bazel.build/reference/command-line-reference#flag--heap_dump_on_oom
+common --heap_dump_on_oom
+
+# Speed up all builds by not checking if output files have been modified. Lets you make changes to
+# the output tree without triggering a build for local debugging. For example, you can modify
+# [rules_js](https://github.com/aspect-build/rules_js) 3rd party npm packages in the output tree
+# when local debugging.
+# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/pkgcache/PackageOptions.java#L185
+build --noexperimental_check_output_files
+fetch --noexperimental_check_output_files
+query --noexperimental_check_output_files
+
+# Don't apply `--noremote_upload_local_results` and `--noremote_accept_cached` to the disk cache.
+# If you have both `--noremote_upload_local_results` and `--disk_cache`, then this fixes a bug where
+# Bazel doesn't write to the local disk cache as it treats as a remote cache.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_remote_results_ignore_disk
+build --incompatible_remote_results_ignore_disk
+
+# Do not build runfiles symlink forests for external repositories under
+# `.runfiles/wsname/external/repo` (in addition to `.runfiles/repo`). This reduces runfiles &
+# sandbox creation times & prevents accidentally depending on this feature which may flip to off by
+# default in the future. Note, some rules may fail under this flag, please file issues with the rule
+# author.
+# Docs: https://bazel.build/reference/command-line-reference#flag--legacy_external_runfiles
+build --nolegacy_external_runfiles
+
+# Some actions are always IO-intensive but require little compute. It's wasteful to put the output
+# in the remote cache, it just saturates the network and fills the cache storage causing earlier
+# evictions. It's also not worth sending them for remote execution.
+# For actions like PackageTar it's usually faster to just re-run the work locally every time.
+# You'll have to look at an execution log to figure out what other action mnemonics you care about.
+# In some cases you may need to patch rulesets to add a mnemonic to actions that don't have one.
+# https://bazel.build/reference/command-line-reference#flag--modify_execution_info
+build --modify_execution_info=PackageTar=+no-remote
+
+############################################################
+# Use `bazel test --config=debug` to enable these settings #
+############################################################
+
+# Stream stdout/stderr output from each test in real-time.
+# Docs: https://bazel.build/docs/user-manual#test-output
+test:debug --test_output=streamed
+
+# Run one test at a time.
+# Docs: https://bazel.build/reference/command-line-reference#flag--test_strategy
+test:debug --test_strategy=exclusive
+
+# Prevent long running tests from timing out.
+# Docs: https://bazel.build/docs/user-manual#test-timeout
+test:debug --test_timeout=9999
+
+# Always run tests even if they have cached results.
+# Docs: https://bazel.build/docs/user-manual#cache-test-results
+test:debug --nocache_test_results
+
+# Aspect recommended Bazel flags when using Aspect's JavaScript rules: https://github.com/aspect-build/rules_js
+# Docs for Node.js flags: https://nodejs.org/en/docs/guides/debugging-getting-started/#command-line-options
+
+# Support for debugging Node.js tests. Use bazel run with `--config=debug` to turn on the NodeJS
+# inspector agent. The node process will break before user code starts and wait for the debugger to
+# connect. Pass the --inspect-brk option to all tests which enables the node inspector agent. See
+# https://nodejs.org/de/docs/guides/debugging-getting-started/#command-line-options for more
+# details.
+# Docs: https://nodejs.org/en/docs/guides/debugging-getting-started/#command-line-options
+run:debug -- --node_options=--inspect-brk
+
+# Enable runfiles on all platforms. Runfiles are on by default on Linux and MacOS but off on
+# Windows.
+#
+# In general, rules_js and derivate rule sets assume that runfiles are enabled and do not support no
+# runfiles case because it does not scale to teach all Node.js tools to use the runfiles manifest.
+#
+# If you are developing on Windows, you must either run bazel with administrator privileges or
+# enable developer mode. If you do not you may hit this error on Windows:
+#
+#   Bazel needs to create symlinks to build the runfiles tree.
+#   Creating symlinks on Windows requires one of the following:
+#       1. Bazel is run with administrator privileges.
+#       2. The system version is Windows 10 Creators Update (1703) or later
+#          and developer mode is enabled.
+#
+# Docs: https://bazel.build/reference/command-line-reference#flag--enable_runfiles
+build --enable_runfiles
+
+# Speed up all builds by not checking if external repository files have been modified.
+# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java#L244
+build --noexperimental_check_external_repository_files
+fetch --noexperimental_check_external_repository_files
+query --noexperimental_check_external_repository_files
+
+# Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
+# Save time on Sandbox creation and deletion when many of the same kind of action run during the
+# build.
+# Docs: https://bazel.build/reference/command-line-reference#flag--reuse_sandbox_directories
+build --reuse_sandbox_directories
+
+# Avoid this flag being enabled by remote_download_minimal or remote_download_toplevel
+# See https://meroton.com/blog/bazel-6-errors-build-without-the-bytes/
+build --noexperimental_action_cache_store_output_metadata
+
+# Import Mac development flags
+import %workspace%/macdev.bazelrc

.bazelversion

@@ -0,0 +1 @@
+6.3.2

.editorconfig

@@ -0,0 +1,31 @@
+root = true
+
+[*]
+charset = utf-8
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+end_of_line = lf
+
+[*.md]
+max_line_length = off
+trim_trailing_whitespace = false
+
+[*.go]
+indent_size = 4
+
+[*.py]
+indent_size = 4
+
+[*.bzl]
+indent_size = 4
+
+[BUILD]
+indent_size = 4
+
+[BUILD.bazel]
+indent_size = 4
+
+[WORKSPACE]
+indent_size = 4

.gitignore

@@ -0,0 +1,4 @@
+.idea
+.ijwb
+bazel-*
+node_modules

.prettierrc

@@ -0,0 +1,5 @@
+{
+  "singleQuote": true,
+  "jsxSingleQuote": false,
+  "tabWidth": 2
+}

AUTHORS

@@ -0,0 +1 @@
+Mustafa Gezen <mustafa@gezen.no>

BUILD.bazel

@@ -0,0 +1,50 @@
+load("@aspect_bazel_lib//lib:copy_to_bin.bzl", "copy_to_bin")
+load("@io_bazel_rules_go//proto:compiler.bzl", "go_proto_compiler")
+load("@bazel_gazelle//:def.bzl", "gazelle")
+load("@npm//:defs.bzl", "npm_link_all_packages")
+
+npm_link_all_packages(name = "node_modules")
+
+exports_files(["tsconfig.json"])
+
+# gazelle:prefix go.resf.org/peridot
+# gazelle:exclude third_party/googleapis
+# gazelle:exclude vendor/go.resf.org/peridot
+# gazelle:exclude vendor/google.golang.org
+# gazelle:exclude vendor/github.com/golang/protobuf
+# gazelle:exclude vendor/golang.org/x/net
+# gazelle:exclude vendor.go
+# gazelle:go_grpc_compilers @io_bazel_rules_go//proto:go_grpc,//:go_gen_grpc_gateway
+# gazelle:resolve proto proto google/api/annotations.proto @googleapis//google/api:annotations_proto
+# gazelle:resolve proto go google/api/annotations.proto  @org_golang_google_genproto//googleapis/api/annotations
+gazelle(name = "gazelle")
+
+gazelle(
+    name = "gazelle-update-repos",
+    args = [
+        "-from_file=go.mod",
+        "-to_macro=deps.bzl%go_dependencies",
+        "-prune",
+    ],
+    command = "update-repos",
+)
+
+go_proto_compiler(
+    name = "go_gen_grpc_gateway",
+    options = ["logtostderr=true"],
+    plugin = "//vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway",
+    suffix = ".pb.gw.go",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime",
+        "//vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities",
+        "@org_golang_google_grpc//grpclog",
+        "@org_golang_google_grpc//metadata",
+    ],
+)
+
+copy_to_bin(
+    name = "tsconfig",
+    srcs = ["tsconfig.json"],
+    visibility = ["//visibility:public"],
+)

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2023 Peridot Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

WORKSPACE

@@ -0,0 +1,174 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+# ------------------------------------------------------------------------------
+# bazel_skylib
+# ------------------------------------------------------------------------------
+http_archive(
+    name = "bazel_skylib",
+    sha256 = "66ffd9315665bfaafc96b52278f57c7e2dd09f5ede279ea6d39b2be471e7e3aa",
+    strip_prefix = "",
+    # 1.4.2, latest as of 2023-06-08
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/1.4.2/bazel-skylib-1.4.2.tar.gz",
+        "https://github.com/bazelbuild/bazel-skylib/releases/download/1.4.2/bazel-skylib-1.4.2.tar.gz",
+    ],
+)
+
+# ------------------------------------------------------------------------------
+# protobuf
+# ------------------------------------------------------------------------------
+http_archive(
+    name = "com_google_protobuf",
+    sha256 = "d0f5f605d0d656007ce6c8b5a82df3037e1d8fe8b121ed42e536f569dec16113",
+    strip_prefix = "protobuf-3.14.0",
+    urls = [
+        "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v3.14.0.tar.gz",
+        "https://github.com/protocolbuffers/protobuf/archive/v3.14.0.tar.gz",
+    ],
+)
+
+load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
+
+protobuf_deps()
+
+# ------------------------------------------------------------------------------
+# googleapis
+# ------------------------------------------------------------------------------
+http_archive(
+    name = "googleapis",
+    sha256 = "9d1a930e767c93c825398b8f8692eca3fe353b9aaadedfbcf1fca2282c85df88",
+    strip_prefix = "googleapis-64926d52febbf298cb82a8f472ade4a3969ba922",
+    urls = [
+        "https://github.com/googleapis/googleapis/archive/64926d52febbf298cb82a8f472ade4a3969ba922.zip",
+    ],
+)
+
+load("@googleapis//:repository_rules.bzl", "switched_rules_by_language")
+
+switched_rules_by_language(
+    name = "com_google_googleapis_imports",
+)
+
+# ------------------------------------------------------------------------------
+# rules_go
+# ------------------------------------------------------------------------------
+http_archive(
+    name = "io_bazel_rules_go",
+    sha256 = "6dc2da7ab4cf5d7bfc7c949776b1b7c733f05e56edc4bcd9022bb249d2e2a996",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.39.1/rules_go-v0.39.1.zip",
+        "https://github.com/bazelbuild/rules_go/releases/download/v0.39.1/rules_go-v0.39.1.zip",
+    ],
+)
+
+http_archive(
+    name = "bazel_gazelle",
+    sha256 = "727f3e4edd96ea20c29e8c2ca9e8d2af724d8c7778e7923a854b2c80952bc405",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.30.0/bazel-gazelle-v0.30.0.tar.gz",
+        "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.30.0/bazel-gazelle-v0.30.0.tar.gz",
+    ],
+)
+
+load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
+
+go_rules_dependencies()
+
+go_register_toolchains(version = "1.20.5")
+
+load("//:deps.bzl", "go_dependencies")
+
+# gazelle:repository_macro deps.bzl%go_dependencies
+go_dependencies()
+
+gazelle_dependencies()
+
+# ------------------------------------------------------------------------------
+# rules_js
+# ------------------------------------------------------------------------------
+http_archive(
+    name = "aspect_rules_js",
+    sha256 = "7b2a4d1d264e105eae49a27e2e78065b23e2e45724df2251eacdd317e95bfdfd",
+    strip_prefix = "rules_js-1.31.0",
+    url = "https://github.com/aspect-build/rules_js/releases/download/v1.31.0/rules_js-v1.31.0.tar.gz",
+)
+
+load("@aspect_rules_js//js:repositories.bzl", "rules_js_dependencies")
+
+rules_js_dependencies()
+
+load("@rules_nodejs//nodejs:repositories.bzl", "nodejs_register_toolchains")
+
+nodejs_register_toolchains(
+    name = "nodejs",
+    node_version = "18.13.0",
+)
+
+load("@aspect_rules_js//npm:repositories.bzl", "npm_translate_lock")
+
+npm_translate_lock(
+    name = "npm",
+    pnpm_lock = "//:pnpm-lock.yaml",
+    verify_node_modules_ignored = "//:.bazelignore",
+)
+
+load("@npm//:repositories.bzl", "npm_repositories")
+
+npm_repositories()
+
+# ------------------------------------------------------------------------------
+# rules_swc
+# ------------------------------------------------------------------------------
+http_archive(
+    name = "aspect_rules_swc",
+    sha256 = "8eb9e42ed166f20cacedfdb22d8d5b31156352eac190fc3347db55603745a2d8",
+    strip_prefix = "rules_swc-1.1.0",
+    url = "https://github.com/aspect-build/rules_swc/releases/download/v1.1.0/rules_swc-v1.1.0.tar.gz",
+)
+
+# Fetches the rules_swc dependencies.
+# If you want to have a different version of some dependency,
+# you should fetch it *before* calling this.
+# Alternatively, you can skip calling this function, so long as you've
+# already fetched all the dependencies.
+load("@aspect_rules_swc//swc:dependencies.bzl", "rules_swc_dependencies")
+
+rules_swc_dependencies()
+
+# Fetches a SWC cli from
+# https://github.com/swc-project/swc/releases
+# If you'd rather compile it from source, you can use rules_rust, fetch the project,
+# then register the toolchain yourself. (Note, this is not yet documented)
+load("@aspect_rules_swc//swc:repositories.bzl", "swc_register_toolchains")
+
+swc_register_toolchains(
+    name = "swc",
+    swc_version_from = "//:package.json",
+)
+
+# ------------------------------------------------------------------------------
+# rules_esbuild
+# ------------------------------------------------------------------------------
+http_archive(
+    name = "aspect_rules_esbuild",
+    sha256 = "098e38e5ee868c14a6484ba263b79e57d48afacfc361ba30137c757a9c4716d6",
+    strip_prefix = "rules_esbuild-0.15.0",
+    url = "https://github.com/aspect-build/rules_esbuild/releases/download/v0.15.0/rules_esbuild-v0.15.0.tar.gz",
+)
+
+# Fetches the rules_esbuild dependencies.
+# If you want to have a different version of some dependency,
+# you should fetch it *before* calling this.
+# Alternatively, you can skip calling this function, so long as you've
+# already fetched all the dependencies.
+load("@aspect_rules_esbuild//esbuild:dependencies.bzl", "rules_esbuild_dependencies")
+
+rules_esbuild_dependencies()
+
+load("@aspect_rules_esbuild//esbuild:repositories.bzl", "esbuild_register_toolchains")
+
+esbuild_register_toolchains(
+    name = "esbuild",
+    esbuild_version = "0.17.18",
+)

base/BUILD.bazel

@@ -0,0 +1,11 @@
+load("@bazel_skylib//rules:common_settings.bzl", "bool_flag")
+
+bool_flag(
+    name = "minify_esbuild",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "minify_esbuild_enabled",
+    flag_values = {"minify_esbuild": "True"},
+)

base/ci/defaults.star

@@ -0,0 +1,9 @@
+default(
+    istio = True,
+)
+
+flags(
+    # replace later with a real registry
+    registry = "registry.resf.org",
+    version = "",
+)

base/go/BUILD.bazel

@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go",
+    srcs = [
+        "db.go",
+        "flags.go",
+        "frontend_server.go",
+        "grpc.go",
+        "log.go",
+        "pointer.go",
+        "slice.go",
+    ],
+    importpath = "go.resf.org/peridot/base/go",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/grpc-ecosystem/go-grpc-middleware",
+        "//vendor/github.com/grpc-ecosystem/go-grpc-prometheus",
+        "//vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime",
+        "//vendor/github.com/prometheus/client_golang/prometheus/promhttp",
+        "//vendor/github.com/urfave/cli/v2:cli",
+        "//vendor/github.com/wk8/go-ordered-map/v2:go-ordered-map",
+        "//vendor/go.ciq.dev/pika",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//credentials/insecure",
+    ],
+)

base/go/db.go

@@ -0,0 +1,110 @@
+package base
+
+import (
+	"context"
+	"fmt"
+	orderedmap "github.com/wk8/go-ordered-map/v2"
+	"go.ciq.dev/pika"
+)
+
+type Pika[T any] interface {
+	pika.QuerySet[T]
+
+	F(keyval ...any) Pika[T]
+	Transaction(ctx context.Context) (Pika[T], error)
+	U(x any) error
+}
+
+type DB struct {
+	*pika.PostgreSQL
+}
+
+type innerDB[T any] struct {
+	pika.QuerySet[T]
+	*DB
+}
+
+type idInterfaceForInt interface {
+	GetID() int64
+}
+
+type idInterfaceForString interface {
+	GetID() string
+}
+
+func NewDB(databaseURL string) (*DB, error) {
+	db, err := pika.NewPostgreSQL(databaseURL)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DB{db}, nil
+}
+
+func NewDBArgs(keyval ...any) *orderedmap.OrderedMap[string, any] {
+	args := pika.NewArgs()
+	for i := 0; i < len(keyval); i += 2 {
+		args.Set(keyval[i].(string), keyval[i+1])
+	}
+
+	return args
+}
+
+//goland:noinspection GoExportedFuncWithUnexportedType
+func Q[T any](db *DB) *innerDB[T] {
+	return &innerDB[T]{pika.Q[T](db.PostgreSQL), db}
+}
+
+func (inner *innerDB[T]) F(keyval ...any) Pika[T] {
+	var qs pika.QuerySet[T] = inner
+	args := pika.NewArgs()
+	for i := 0; i < len(keyval); i += 2 {
+		args.Set(keyval[i].(string), keyval[i+1])
+		qs = qs.Filter(fmt.Sprintf("%s=:%s", keyval[i].(string), keyval[i].(string)))
+	}
+
+	inner.QuerySet = qs.Args(args)
+	return inner
+}
+
+func (inner *innerDB[T]) Transaction(ctx context.Context) (Pika[T], error) {
+	ts := pika.NewPostgreSQLFromDB(inner.DB.DB())
+	err := ts.Begin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return &innerDB[T]{pika.Q[T](ts), inner.DB}, nil
+}
+
+func (inner *innerDB[T]) U(x any) error {
+	y := x.(*T)
+
+	// Check if x has GetID() method
+	var id any
+	idInterface, ok := x.(idInterfaceForInt)
+	if ok {
+		intID := idInterface.GetID()
+		if intID == 0 {
+			return fmt.Errorf("id is 0")
+		}
+		id = intID
+	}
+
+	idInterface2, ok := x.(idInterfaceForString)
+	if ok {
+		stringID := idInterface2.GetID()
+		if stringID == "" {
+			return fmt.Errorf("id is empty")
+		}
+		id = stringID
+	}
+
+	if id == nil {
+		// Fallback to normal Update
+		return inner.Update(y)
+	}
+
+	qs := inner.F("id", id)
+	return qs.Update(y)
+}

base/go/flags.go

@@ -0,0 +1,142 @@
+package base
+
+import (
+	"github.com/urfave/cli/v2"
+	"os"
+)
+
+type EnvVar string
+
+const (
+	EnvVarGRPCPort                  EnvVar = "GRPC_PORT"
+	EnvVarGatewayPort               EnvVar = "GATEWAY_PORT"
+	EnvVarDatabaseURL               EnvVar = "DATABASE_URL"
+	EnvVarFrontendPort              EnvVar = "FRONTEND_PORT"
+	EnvVarFrontendOIDCIssuer        EnvVar = "FRONTEND_OIDC_ISSUER"
+	EnvVarFrontendOIDCClientID      EnvVar = "FRONTEND_OIDC_CLIENT_ID"
+	EnvVarFrontendOIDCClientSecret  EnvVar = "FRONTEND_OIDC_CLIENT_SECRET"
+	EnvVarFrontendRequiredOIDCGroup EnvVar = "FRONTEND_REQUIRED_OIDC_GROUP"
+	EnvVarFrontendAdminOIDCGroup    EnvVar = "FRONTEND_ADMIN_OIDC_GROUP"
+)
+
+var defaultCliFlags = []cli.Flag{
+	&cli.IntFlag{
+		Name:    "grpc-port",
+		Aliases: []string{"p"},
+		Usage:   "gRPC port",
+		EnvVars: []string{string(EnvVarGRPCPort)},
+		Value:   8080,
+	},
+	&cli.IntFlag{
+		Name:    "gateway-port",
+		Aliases: []string{"g"},
+		Usage:   "gRPC gateway port",
+		EnvVars: []string{string(EnvVarGatewayPort)},
+		Value:   8081,
+	},
+	&cli.StringFlag{
+		Name:    "database-url",
+		Aliases: []string{"d"},
+		Usage:   "database url",
+		EnvVars: []string{string(EnvVarDatabaseURL)},
+		Value:   "postgres://postgres:postgres@localhost:5432/postgres?sslmode=disable",
+	},
+}
+
+var defaultFrontendNoAuthCliFlags = []cli.Flag{
+	&cli.IntFlag{
+		Name:    "port",
+		Aliases: []string{"p"},
+		Usage:   "frontend port",
+		EnvVars: []string{string(EnvVarFrontendPort)},
+		Value:   9111,
+	},
+}
+
+var defaultFrontendCliFlags = append(defaultFrontendNoAuthCliFlags, []cli.Flag{
+	&cli.StringFlag{
+		Name:    "oidc-issuer",
+		Usage:   "OIDC issuer",
+		EnvVars: []string{string(EnvVarFrontendOIDCIssuer)},
+		Value:   "https://accounts.rockylinux.org/auth/realms/rocky",
+	},
+	&cli.StringFlag{
+		Name:    "oidc-client-id",
+		Usage:   "OIDC client ID",
+		EnvVars: []string{string(EnvVarFrontendOIDCClientID)},
+	},
+	&cli.StringFlag{
+		Name:    "oidc-client-secret",
+		Usage:   "OIDC client secret",
+		EnvVars: []string{string(EnvVarFrontendOIDCClientSecret)},
+	},
+	&cli.StringFlag{
+		Name:    "required-oidc-group",
+		Usage:   "OIDC group that is required to access the frontend",
+		EnvVars: []string{string(EnvVarFrontendRequiredOIDCGroup)},
+	},
+}...)
+
+var defaultFrontendAdminCliFlags = append(defaultFrontendCliFlags, []cli.Flag{
+	&cli.StringFlag{
+		Name:    "admin-oidc-group",
+		Usage:   "OIDC group that is allowed to access the admin page",
+		EnvVars: []string{string(EnvVarFrontendAdminOIDCGroup)},
+	},
+}...)
+
+// WithDefaultCliFlags adds the default cli flags to the app.
+func WithDefaultCliFlags(flags ...cli.Flag) []cli.Flag {
+	return append(defaultCliFlags, flags...)
+}
+
+// WithDefaultFrontendNoAuthCliFlags adds the default frontend cli flags to the app.
+func WithDefaultFrontendNoAuthCliFlags(flags ...cli.Flag) []cli.Flag {
+	return append(defaultFrontendNoAuthCliFlags, flags...)
+}
+
+// WithDefaultFrontendCliFlags adds the default frontend cli flags to the app.
+func WithDefaultFrontendCliFlags(flags ...cli.Flag) []cli.Flag {
+	return append(defaultFrontendCliFlags, flags...)
+}
+
+// WithDefaultFrontendAdminCliFlags adds the default frontend cli flags to the app.
+func WithDefaultFrontendAdminCliFlags(flags ...cli.Flag) []cli.Flag {
+	return append(defaultFrontendAdminCliFlags, flags...)
+}
+
+// FlagsToGRPCServerOptions converts the cli flags to gRPC server options.
+func FlagsToGRPCServerOptions(ctx *cli.Context) []GRPCServerOption {
+	return []GRPCServerOption{
+		WithGRPCPort(ctx.Int("grpc-port")),
+		WithGatewayPort(ctx.Int("gateway-port")),
+	}
+}
+
+// GetDBFromFlags gets the database from the cli flags.
+func GetDBFromFlags(ctx *cli.Context) *DB {
+	db, err := NewDB(ctx.String("database-url"))
+	if err != nil {
+		LogFatalf("failed to create database: %v", err)
+	}
+
+	return db
+}
+
+// ChangeDefaultForEnvVar changes the default value of a flag based on an environment variable.
+func ChangeDefaultForEnvVar(envVar EnvVar, newDefault string) {
+	// Check if the environment variable is set.
+	if _, ok := os.LookupEnv(string(envVar)); ok {
+		return
+	}
+
+	// Change the default value.
+	if err := os.Setenv(string(envVar), newDefault); err != nil {
+		LogFatalf("failed to set environment variable %s: %v", envVar, err)
+	}
+}
+
+// ChangeDefaultDatabaseURL changes the default value of the database url based on an environment variable.
+func ChangeDefaultDatabaseURL(appName string) {
+	ChangeDefaultForEnvVar(EnvVarDatabaseURL, "postgres://postgres:postgres@localhost:5432/"+appName+"?sslmode=disable")
+}

base/go/frontend_server.go

@@ -0,0 +1,113 @@
+package base
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"mime"
+	"net/http"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+type FrontendInfo struct {
+	// Title to add to the HTML page
+	Title string
+}
+
+var frontendHtmlTemplate = `
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8" />
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1, viewport-fit=cover"
+    />
+    <title>{{.Title}}</title>
+
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link
+      rel="stylesheet"
+      href="https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;600;700&display=swap"
+    />
+</head>
+<body style="background-color:#f1f5f9;">
+    <div id="app"></div>
+
+    <script src="{{.BundleJS}}"></script>
+</body>
+</html>
+`
+
+func FrontendServer(info *FrontendInfo, kv ...string) {
+	port := 9111
+	if info == nil {
+		info = &FrontendInfo{}
+	}
+
+	newTemplate := frontendHtmlTemplate
+
+	// Set the title
+	if info.Title == "" {
+		info.Title = "Peridot"
+	}
+	newTemplate = strings.ReplaceAll(newTemplate, "{{.Title}}", info.Title)
+
+	pathToContent := map[string]string{}
+	// KV is a list of key-value pairs, where the key is the alias and the value
+	// is the actual file content.
+	for i := 0; i < len(kv); i += 2 {
+		content := kv[i+1]
+
+		// Sha256 hash of the content to add to name
+		hash := sha256.New()
+		hash.Write([]byte(content))
+		hashSum := hex.EncodeToString(hash.Sum(nil))
+
+		ext := filepath.Ext(kv[i])
+		noExtName := kv[i][:len(kv[i])-len(ext)]
+		path := fmt.Sprintf("/_ga/%s.%s%s", noExtName, hashSum[:8], ext)
+
+		pathToContent[path] = content
+
+		// If name is bundle.js, replace the template
+		if kv[i] == "bundle.js" {
+			newTemplate = strings.ReplaceAll(newTemplate, "{{.BundleJS}}", path)
+		}
+	}
+
+	// Log the paths
+	LogInfof("frontend server paths:")
+	for path := range pathToContent {
+		LogInfof("  %s", path)
+	}
+
+	// Serve the content
+	http.HandleFunc("/_ga/", func(w http.ResponseWriter, r *http.Request) {
+		mimeType := mime.TypeByExtension(filepath.Ext(r.URL.Path))
+		if mimeType == "" {
+			mimeType = "application/octet-stream"
+		}
+		w.Header().Set("Content-Type", mimeType)
+		_, _ = w.Write([]byte(pathToContent[r.URL.Path]))
+	})
+
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/html")
+		_, _ = w.Write([]byte(newTemplate))
+	})
+
+	// Handle other _ga meta routes
+	http.HandleFunc("/_ga/healthz", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain")
+		_, _ = w.Write([]byte("ok"))
+	})
+
+	LogInfof("starting frontend server on port %d", port)
+	if err := http.ListenAndServe(":"+strconv.Itoa(port), nil); err != nil {
+		LogFatalf("failed to start frontend server: %v", err)
+	}
+}

base/go/grpc.go

@@ -0,0 +1,258 @@
+package base
+
+import (
+	"context"
+	"errors"
+	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
+	grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"net"
+	"net/http"
+	"strconv"
+	"sync"
+	"time"
+)
+
+type GRPCServer struct {
+	server     *grpc.Server
+	gatewayMux *runtime.ServeMux
+
+	gatewayClientConn *grpc.ClientConn
+
+	serverOptions      []grpc.ServerOption
+	dialOptions        []grpc.DialOption
+	muxOptions         []runtime.ServeMuxOption
+	outgoingHeaders    []string
+	incomingHeaders    []string
+	unaryInterceptors  []grpc.UnaryServerInterceptor
+	streamInterceptors []grpc.StreamServerInterceptor
+	timeout            time.Duration
+	grpcPort           int
+	gatewayPort        int
+	noGrpcGateway      bool
+}
+
+type GrpcEndpointRegister func(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error
+type GRPCServerOption func(*GRPCServer)
+
+// WithServerOptions sets the gRPC server options. (Append)
+func WithServerOptions(opts ...grpc.ServerOption) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.serverOptions = append(g.serverOptions, opts...)
+	}
+}
+
+// WithDialOptions sets the gRPC dial options. (Append)
+func WithDialOptions(opts ...grpc.DialOption) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.dialOptions = append(g.dialOptions, opts...)
+	}
+}
+
+// WithMuxOptions sets the gRPC-gateway mux options. (Append)
+func WithMuxOptions(opts ...runtime.ServeMuxOption) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.muxOptions = append(g.muxOptions, opts...)
+	}
+}
+
+// WithOutgoingHeaders sets the outgoing headers for the gRPC-gateway. (Append)
+func WithOutgoingHeaders(headers ...string) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.outgoingHeaders = append(g.outgoingHeaders, headers...)
+	}
+}
+
+// WithIncomingHeaders sets the incoming headers for the gRPC-gateway. (Append)
+func WithIncomingHeaders(headers ...string) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.incomingHeaders = append(g.incomingHeaders, headers...)
+	}
+}
+
+// WithUnaryInterceptors sets the gRPC unary interceptors. (Append)
+func WithUnaryInterceptors(interceptors ...grpc.UnaryServerInterceptor) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.unaryInterceptors = append(g.unaryInterceptors, interceptors...)
+	}
+}
+
+// WithStreamInterceptors sets the gRPC stream interceptors. (Append)
+func WithStreamInterceptors(interceptors ...grpc.StreamServerInterceptor) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.streamInterceptors = append(g.streamInterceptors, interceptors...)
+	}
+}
+
+// WithTimeout sets the timeout for the gRPC server.
+func WithTimeout(timeout time.Duration) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.timeout = timeout
+	}
+}
+
+// WithGRPCPort sets the gRPC port for the gRPC server.
+func WithGRPCPort(port int) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.grpcPort = port
+	}
+}
+
+// WithGatewayPort sets the gRPC-gateway port for the gRPC server.
+func WithGatewayPort(port int) GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.gatewayPort = port
+	}
+}
+
+// WithNoGRPCGateway disables the gRPC-gateway for the gRPC server.
+func WithNoGRPCGateway() GRPCServerOption {
+	return func(g *GRPCServer) {
+		g.noGrpcGateway = true
+	}
+}
+
+// NewGRPCServer creates a new gRPC-server with gRPC-gateway, default interceptors
+// and exposed Prometheus metrics.
+func NewGRPCServer(opts ...GRPCServerOption) (*GRPCServer, error) {
+	g := &GRPCServer{
+		serverOptions:      []grpc.ServerOption{},
+		dialOptions:        []grpc.DialOption{},
+		muxOptions:         []runtime.ServeMuxOption{},
+		outgoingHeaders:    []string{},
+		incomingHeaders:    []string{},
+		unaryInterceptors:  []grpc.UnaryServerInterceptor{},
+		streamInterceptors: []grpc.StreamServerInterceptor{},
+	}
+
+	// Apply options first
+	for _, opt := range opts {
+		opt(g)
+	}
+
+	// Set defaults
+	if g.timeout == 0 {
+		g.timeout = 10 * time.Second
+	}
+	if g.grpcPort == 0 {
+		g.grpcPort = 8080
+	}
+	if g.gatewayPort == 0 {
+		g.gatewayPort = g.grpcPort + 1
+	}
+
+	// Always prepend the insecure dial option
+	// RESF deploys with Istio, which handles mTLS
+	g.dialOptions = append([]grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}, g.dialOptions...)
+
+	// Set default interceptors
+	if g.unaryInterceptors == nil {
+		g.unaryInterceptors = []grpc.UnaryServerInterceptor{}
+	}
+	if g.streamInterceptors == nil {
+		g.streamInterceptors = []grpc.StreamServerInterceptor{}
+	}
+
+	// Always prepend the prometheus interceptor
+	g.unaryInterceptors = append([]grpc.UnaryServerInterceptor{grpc_prometheus.UnaryServerInterceptor}, g.unaryInterceptors...)
+	g.streamInterceptors = append([]grpc.StreamServerInterceptor{grpc_prometheus.StreamServerInterceptor}, g.streamInterceptors...)
+
+	// Chain the interceptors
+	g.serverOptions = append(g.serverOptions, grpc.UnaryInterceptor(grpc_middleware.ChainUnaryServer(g.unaryInterceptors...)))
+	g.serverOptions = append(g.serverOptions, grpc.StreamInterceptor(grpc_middleware.ChainStreamServer(g.streamInterceptors...)))
+
+	g.server = grpc.NewServer(g.serverOptions...)
+
+	if !g.noGrpcGateway {
+		g.gatewayMux = runtime.NewServeMux(g.muxOptions...)
+
+		// Create gateway client connection
+		var err error
+		g.gatewayClientConn, err = grpc.Dial("localhost:"+strconv.Itoa(g.grpcPort), g.dialOptions...)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return g, nil
+}
+
+func (g *GRPCServer) RegisterService(register func(*grpc.Server)) {
+	register(g.server)
+}
+
+func (g *GRPCServer) GatewayEndpoints(registerEndpoints ...GrpcEndpointRegister) error {
+	if g.noGrpcGateway {
+		return errors.New("gRPC-gateway is disabled")
+	}
+
+	for _, register := range registerEndpoints {
+		if err := register(context.Background(), g.gatewayMux, g.gatewayClientConn); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (g *GRPCServer) Start() error {
+	// Create gRPC listener
+	grpcLis, err := net.Listen("tcp", ":"+strconv.Itoa(g.grpcPort))
+	if err != nil {
+		return err
+	}
+
+	var wg sync.WaitGroup
+
+	// First start the gRPC server
+	wg.Add(1)
+	go func(wg *sync.WaitGroup) {
+		defer wg.Done()
+
+		LogInfof("gRPC server listening on port " + strconv.Itoa(g.grpcPort))
+		grpc_prometheus.Register(g.server)
+
+		err := g.server.Serve(grpcLis)
+		if err != nil {
+			LogFatalf("gRPC server failed to serve: %v", err.Error())
+		}
+
+		LogInfof("gRPC server stopped")
+	}(&wg)
+
+	// Then start the gRPC-gateway
+	if !g.noGrpcGateway {
+		wg.Add(1)
+		go func(wg *sync.WaitGroup) {
+			defer wg.Done()
+
+			LogInfof("gRPC-gateway listening on port " + strconv.Itoa(g.gatewayPort))
+			err := http.ListenAndServe(":"+strconv.Itoa(g.gatewayPort), g.gatewayMux)
+			if err != nil {
+				LogFatalf("gRPC-gateway failed to serve: %v", err.Error())
+			}
+
+			LogInfof("gRPC-gateway stopped")
+		}(&wg)
+	}
+
+	// Serve proxmux
+	wg.Add(1)
+	go func(wg *sync.WaitGroup) {
+		defer wg.Done()
+
+		promMux := http.NewServeMux()
+		promMux.Handle("/metrics", promhttp.Handler())
+		err := http.ListenAndServe(":7332", promMux)
+		if err != nil {
+			LogFatalf("Prometheus mux failed to serve: %v", err.Error())
+		}
+	}(&wg)
+
+	wg.Wait()
+
+	return nil
+}

base/go/log.go

@@ -0,0 +1,49 @@
+package base
+
+import (
+	"fmt"
+	"log"
+	"strings"
+)
+
+type LogLevel string
+
+const (
+	LogLevelDebug LogLevel = "DEBUG"
+	LogLevelInfo  LogLevel = "INFO"
+	LogLevelWarn  LogLevel = "WARN"
+	LogLevelError LogLevel = "ERROR"
+	LogLevelFatal LogLevel = "FATAL"
+)
+
+func Logf(level LogLevel, format string, args ...interface{}) {
+	if !strings.HasPrefix(format, fmt.Sprintf("[%s] ", level)) {
+		format = fmt.Sprintf("[%s]: %s", level, format)
+	}
+
+	if level == LogLevelFatal {
+		log.Fatalf(format, args...)
+	} else {
+		log.Printf(format, args...)
+	}
+}
+
+func LogErrorf(format string, args ...interface{}) {
+	Logf(LogLevelError, format, args...)
+}
+
+func LogWarnf(format string, args ...interface{}) {
+	Logf(LogLevelWarn, format, args...)
+}
+
+func LogInfof(format string, args ...interface{}) {
+	Logf(LogLevelInfo, format, args...)
+}
+
+func LogDebugf(format string, args ...interface{}) {
+	Logf(LogLevelDebug, format, args...)
+}
+
+func LogFatalf(format string, args ...interface{}) {
+	Logf(LogLevelFatal, format, args...)
+}

base/go/pointer.go

@@ -0,0 +1,5 @@
+package base
+
+func Pointer[T any](v T) *T {
+	return &v
+}

base/go/slice.go

@@ -0,0 +1,11 @@
+package base
+
+func Contains[T comparable](s []T, e T) bool {
+	for _, a := range s {
+		if a == e {
+			return true
+		}
+	}
+
+	return false
+}

base/ts/BUILD.bazel

@@ -0,0 +1,9 @@
+load("@aspect_rules_swc//swc:defs.bzl", "swc")
+
+swc(
+    name = "ts",
+    srcs = glob([
+        "*.tsx",
+        "*.ts",
+    ]),
+)

base/ts/mui/BUILD.bazel

@@ -0,0 +1,23 @@
+load("@aspect_rules_swc//swc:defs.bzl", "swc")
+load("@aspect_rules_js//js:defs.bzl", "js_library")
+
+swc(
+    name = "lib",
+    srcs = glob([
+        "*.tsx",
+        "*.ts",
+    ]),
+    data = [
+        "//:node_modules/@mui/material",
+        "//:node_modules/react",
+        "//:node_modules/react-dom",
+        "//:node_modules/tslib",
+    ],
+    visibility = ["//visibility:private"],
+)
+
+js_library(
+    name = "mui",
+    srcs = [":lib"],
+    visibility = ["//visibility:public"],
+)

base/ts/mui/Drawer.tsx

@@ -0,0 +1,71 @@
+import React from 'react';
+
+import Box from '@mui/material/Box';
+import Toolbar from '@mui/material/Toolbar';
+import List from '@mui/material/List';
+import MuiDrawer from '@mui/material/Drawer';
+import ListItem from '@mui/material/ListItem';
+import ListItemButton from '@mui/material/ListItemButton';
+import ListItemIcon from '@mui/material/ListItemIcon';
+import ListItemText from '@mui/material/ListItemText';
+import ListSubheader from '@mui/material/ListSubheader';
+
+export interface DrawerLink {
+  text: string;
+  href: string;
+  external?: boolean;
+  icon?: React.ReactNode;
+}
+
+export interface DrawerSection {
+  links: DrawerLink[];
+  title?: string;
+}
+
+export interface DrawerProps {
+  sections: DrawerSection[];
+}
+
+const drawerWidth = 240;
+
+export const Drawer = (props: DrawerProps) => {
+  return (
+    <MuiDrawer
+      variant='permanent'
+      sx={{
+        width: drawerWidth,
+        flexShrink: 0,
+        [`& .MuiDrawer-paper`]: { width: drawerWidth, boxSizing: 'border-box' }
+      }}
+    >
+      <Toolbar variant='dense' />
+      <Box sx={{ overflow: 'auto' }}>
+        <List>
+          {props.sections.map((section: DrawerSection) => (
+            <>
+              {section.title && <ListSubheader>{section.title}</ListSubheader>}
+              {section.links.map((link: DrawerLink) => (
+                <ListItem key={link.href} disablePadding sx={{ display: 'block' }} dense>
+                  <ListItemButton
+                    href={link.href}
+                    sx={{
+                      justifyContent: 'center',
+                      px: 2.5
+                    }}
+                  >
+                    {link.icon && (
+                      <ListItemIcon>
+                        {link.icon}
+                      </ListItemIcon>
+                    )}
+                    <ListItemText primary={link.text} />
+                  </ListItemButton>
+                </ListItem>
+              ))}
+            </>
+          ))}
+        </List>
+      </Box>
+    </MuiDrawer>
+  );
+};

base/ts/mui/theme.tsx

@@ -0,0 +1,44 @@
+import React from 'react';
+import { createTheme, ThemeOptions } from '@mui/material/styles';
+import { Link as RouterLink, LinkProps as RouterLinkProps } from 'react-router-dom';
+import { LinkProps } from '@mui/material/Link';
+
+const LinkBehavior = React.forwardRef<
+  HTMLAnchorElement,
+  Omit<RouterLinkProps, 'to'> & { href: RouterLinkProps['to'] }
+>((props, ref) => {
+  const { href, ...other } = props;
+  // If the element indicates "real" link, use <a> tag
+  // Determine based on className
+  if (other.className?.includes('native-link')) {
+    return <a ref={ref} href={href} {...other} />;
+  }
+  // Map href (Material UI) -> to (react-router)
+  return <RouterLink ref={ref} to={href} {...other} />;
+});
+
+export const peridotThemeOptions: ThemeOptions = {
+  palette: {
+    mode: 'light',
+    primary: {
+      main: '#1c2834',
+    },
+    secondary: {
+      main: '#168afd',
+    },
+  },
+  components: {
+    MuiLink: {
+      defaultProps: {
+        component: LinkBehavior,
+      } as LinkProps,
+    },
+    MuiButtonBase: {
+      defaultProps: {
+        LinkComponent: LinkBehavior,
+      },
+    },
+  },
+};
+
+export const peridotTheme = createTheme(peridotThemeOptions);

ci.bazelrc

@@ -0,0 +1,76 @@
+# For CI builds, we want minified Esbuild output.
+build --//base:minify_esbuild=True
+
+# We recommend enforcing a policy that keeps your CI from being slowed down
+# by individual test targets that should be optimized
+# or split up into multiple test targets with sharding or manually.
+# Set this flag to exclude targets that have their timeout set to eternal (>15m) from running on CI.
+# Docs: https://bazel.build/docs/user-manual#test-timeout-filters
+test --test_timeout_filters=-eternal
+
+# Set this flag to enable re-tries of failed tests on CI.
+# When any test target fails, try one or more times. This applies regardless of whether the "flaky"
+# tag appears on the target definition.
+# This is a tradeoff: legitimately failing tests will take longer to report,
+# but we can paper over flaky tests that pass most of the time.
+# The alternative is to mark every flaky test with the `flaky = True` attribute, but this requires
+# the buildcop to make frequent code edits.
+# Not recommended for local builds so that the flakiness is observed during development and thus
+# is more likely to get fixed.
+# Note that when passing after the first attempt, Bazel will give a special "FLAKY" status.
+# Docs: https://bazel.build/docs/user-manual#flaky-test-attempts
+test --flaky_test_attempts=2
+
+# Announce all announces command options read from the bazelrc file(s) when starting up at the
+# beginning of each Bazel invocation. This is very useful on CI to be able to inspect what Bazel rc
+# settings are being applied on each run.
+# Docs: https://bazel.build/docs/user-manual#announce-rc
+build --announce_rc
+
+# Add a timestamp to each message generated by Bazel specifying the time at which the message was
+# displayed.
+# Docs: https://bazel.build/docs/user-manual#show-timestamps
+build --show_timestamps
+
+# Only show progress every 60 seconds on CI.
+# We want to find a compromise between printing often enough to show that the build isn't stuck,
+# but not so often that we produce a long log file that requires a lot of scrolling.
+# https://bazel.build/reference/command-line-reference#flag--show_progress_rate_limit
+build --show_progress_rate_limit=60
+
+# Use cursor controls in screen output.
+# Docs: https://bazel.build/docs/user-manual#curses
+build --curses=yes
+
+# Use colors to highlight output on the screen. Set to `no` if your CI does not display colors.
+# Docs: https://bazel.build/docs/user-manual#color
+build --color=yes
+
+# The terminal width in columns. Configure this to override the default value based on what your CI system renders.
+# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/runtime/UiOptions.java#L151
+build --terminal_columns=143
+
+######################################
+# Generic remote cache configuration #
+######################################
+
+# Only download remote outputs of top level targets to the local machine.
+# Docs: https://bazel.build/reference/command-line-reference#flag--remote_download_toplevel
+build --remote_download_toplevel
+
+# The maximum amount of time to wait for remote execution and cache calls.
+# https://bazel.build/reference/command-line-reference#flag--remote_timeout
+build --remote_timeout=3600
+
+# Upload locally executed action results to the remote cache.
+# Docs: https://bazel.build/reference/command-line-reference#flag--remote_upload_local_results
+build --remote_upload_local_results
+
+# Fall back to standalone local execution strategy if remote execution fails. If the grpc remote
+# cache connection fails, it will fail the build, add this so it falls back to the local cache.
+# Docs: https://bazel.build/reference/command-line-reference#flag--remote_local_fallback
+build --remote_local_fallback
+
+# Fixes builds hanging on CI that get the TCP connection closed without sending RST packets.
+# Docs: https://bazel.build/reference/command-line-reference#flag--grpc_keepalive_time
+build --grpc_keepalive_time=30s

devtools/garrison/.gitignore

@@ -0,0 +1 @@
+.idea

devtools/garrison/cmd/garrison/BUILD.bazel

@@ -0,0 +1,20 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "garrison_lib",
+    srcs = ["main.go"],
+    importpath = "go.resf.org/peridot/devtools/garrison/cmd/garrison",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//base/go",
+        "//devtools/garrison/internal/pkg/kubernetes",
+        "//devtools/garrison/internal/pkg/starlark",
+        "//vendor/github.com/urfave/cli/v2:cli",
+    ],
+)
+
+go_binary(
+    name = "garrison",
+    embed = [":garrison_lib"],
+    visibility = ["//visibility:public"],
+)

devtools/garrison/cmd/garrison/main.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"fmt"
+	"github.com/urfave/cli/v2"
+	base "go.resf.org/peridot/base/go"
+	"go.resf.org/peridot/devtools/garrison/internal/pkg/kubernetes"
+	"go.resf.org/peridot/devtools/garrison/internal/pkg/starlark"
+	"log"
+	"os"
+)
+
+func run(ctx *cli.Context) error {
+	stage := starlark.Stage(ctx.String("stage"))
+	if !base.Contains(starlark.GetValidStages(), stage) {
+		return cli.Exit("invalid stage", 1)
+	}
+
+	state, err := starlark.ExecFile(ctx.Args().First(), stage)
+	if err != nil {
+		return cli.Exit(err, 1)
+	}
+
+	k8sState := kubernetes.NewState(state)
+	err = k8sState.GenerateManifests()
+	if err != nil {
+		return cli.Exit(err, 1)
+	}
+
+	out, err := k8sState.YAML()
+	if err != nil {
+		return cli.Exit(err, 1)
+	}
+
+	fmt.Println(out)
+
+	return nil
+}
+
+func main() {
+	app := &cli.App{
+		Name:  "garrison",
+		Usage: "Deployment framework for the RESF",
+		Commands: []*cli.Command{
+			{
+				Name:   "build",
+				Usage:  "Build deployment manifests from a starlark file",
+				Action: run,
+			},
+		},
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "stage",
+				Aliases: []string{"s"},
+				Usage:   "stage to deploy to",
+				Value:   "development",
+			},
+			&cli.StringFlag{
+				Name:  "output-mode",
+				Usage: "output mode",
+				Value: "kubernetes",
+				Action: func(ctx *cli.Context, s string) error {
+					// todo(mustafa): add helm support
+					if s != "kubernetes" /*&& s != "helm"*/ {
+						return cli.Exit("invalid output mode", 1)
+					}
+
+					return nil
+				},
+			},
+			&cli.StringFlag{
+				Name:  "output-dir",
+				Usage: "output directory",
+				Value: "output",
+			},
+		},
+	}
+
+	if err := app.Run(os.Args); err != nil {
+		log.Fatal(err)
+	}
+}

devtools/garrison/examples/default_flags.star

@@ -0,0 +1,6 @@
+flags(
+    image = "ealen/echo-server:latest",
+    namespace = "echo",
+)
+
+ga_env = Environment(ga_id = "UA-XXXXXXXX-X")

devtools/garrison/examples/istio.star

@@ -0,0 +1,29 @@
+exec("./examples/default_flags.star")
+
+flags(
+    host = "example.com",
+)
+
+default(
+    istio = True,
+    namespace = args().namespace,
+)
+
+env = Environment(
+    PORT = "80",
+)
+env.update(var("ga_env"))
+
+service(
+    name = "simple",
+    image = args().image,
+    ports = [
+        Port(
+            port = 80,
+            expose = True,
+            external = True,
+            host = "test.resf.org",
+        ),
+    ],
+    env = env,
+)

devtools/garrison/internal/pkg/kubernetes/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "kubernetes",
+    srcs = [
+        "deployment.go",
+        "env.go",
+        "kubernetes.go",
+        "metadata.go",
+        "service.go",
+        "virtual_service.go",
+    ],
+    importpath = "go.resf.org/peridot/devtools/garrison/internal/pkg/kubernetes",
+    visibility = ["//devtools/garrison:__subpackages__"],
+    deps = [
+        "//base/go",
+        "//devtools/garrison/internal/pkg/starlark",
+        "//vendor/k8s.io/api/apps/v1:apps",
+        "//vendor/k8s.io/api/core/v1:core",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:meta",
+        "//vendor/k8s.io/apimachinery/pkg/util/intstr",
+        "//vendor/k8s.io/cli-runtime/pkg/printers",
+    ],
+)

devtools/garrison/internal/pkg/kubernetes/deployment.go

@@ -0,0 +1,184 @@
+package kubernetes
+
+import (
+	"bytes"
+	"fmt"
+	base "go.resf.org/peridot/base/go"
+	"go.resf.org/peridot/devtools/garrison/internal/pkg/starlark"
+	appsv1 "k8s.io/api/apps/v1"
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func (s *State) NewDeployment(service *starlark.Service) error {
+	md := s.getMetadata(service)
+
+	podLabels := map[string]string{
+		"app":   *service.Name,
+		"stage": string(s.Stage),
+	}
+
+	// Copy the metadata and add the labels.
+	podMd := *md
+	podMd.Labels = podLabels
+
+	imagePullPolicy := v1.PullIfNotPresent
+
+	affinity := &v1.Affinity{
+		PodAntiAffinity: &v1.PodAntiAffinity{
+			PreferredDuringSchedulingIgnoredDuringExecution: []v1.WeightedPodAffinityTerm{
+				{
+					Weight: int32(99),
+					PodAffinityTerm: v1.PodAffinityTerm{
+						LabelSelector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      "app",
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{*service.Name},
+								},
+							},
+						},
+						TopologyKey: "kubernetes.io/hostname",
+					},
+				},
+				{
+					Weight: int32(100),
+					PodAffinityTerm: v1.PodAffinityTerm{
+						LabelSelector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      "app",
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{*service.Name},
+								},
+							},
+						},
+						TopologyKey: "topology.kubernetes.io/zone",
+					},
+				},
+			},
+		},
+	}
+	if service.NoAntiAffinity != nil && *service.NoAntiAffinity {
+		affinity = nil
+	}
+
+	app := &appsv1.Deployment{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "apps/v1",
+			Kind:       "Deployment",
+		},
+		ObjectMeta: *md,
+		Spec: appsv1.DeploymentSpec{
+			RevisionHistoryLimit: base.Pointer(int32(15)),
+			Selector: &metav1.LabelSelector{
+				MatchLabels: podLabels,
+			},
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: podMd,
+				Spec: v1.PodSpec{
+					// For most use cases this is acceptable for RESF
+					AutomountServiceAccountToken: base.Pointer(true),
+					SecurityContext: &v1.PodSecurityContext{
+						// Volume ownership is set to 1000:1000 to match the default
+						FSGroup: base.Pointer(int64(1000)),
+					},
+					Affinity: affinity,
+					Containers: []v1.Container{
+						{
+							Name:            *service.Name,
+							ImagePullPolicy: imagePullPolicy,
+							Image:           *service.Image,
+							Command:         service.Command,
+							Args:            service.Args,
+						},
+					},
+				},
+			},
+			Strategy: appsv1.DeploymentStrategy{
+				Type: appsv1.RollingUpdateDeploymentStrategyType,
+				RollingUpdate: &appsv1.RollingUpdateDeployment{
+					// We don't want any unavailable pods during the update.
+					MaxUnavailable: base.Pointer(intstr.FromInt32(0)),
+					// Allow surging up to 300% of the desired replicas.
+					MaxSurge: base.Pointer(intstr.FromString("300%")),
+				},
+			},
+		},
+	}
+
+	// Add the ports
+	if service.Ports != nil {
+		for _, port := range service.Ports {
+			nPort := v1.ContainerPort{
+				Name:          *port.Name,
+				ContainerPort: int32(*port.ContainerPort),
+			}
+			app.Spec.Template.Spec.Containers[0].Ports = append(app.Spec.Template.Spec.Containers[0].Ports, nPort)
+		}
+	}
+
+	// Add the environment variables
+	if service.Env != nil {
+		for k, v := range service.Env {
+			nEnv := v1.EnvVar{
+				Name:  k,
+				Value: v,
+			}
+			app.Spec.Template.Spec.Containers[0].Env = append(app.Spec.Template.Spec.Containers[0].Env, nEnv)
+		}
+	}
+
+	// Add readiness/liveness probes
+	if service.Health != nil {
+		if service.Health.Http != nil {
+			probe := v1.Probe{
+				ProbeHandler: v1.ProbeHandler{
+					HTTPGet: &v1.HTTPGetAction{
+						Path: service.Health.Http.Path,
+						Port: intstr.FromInt32(int32(service.Health.Http.Port)),
+					},
+				},
+				InitialDelaySeconds: int32(*service.Health.InitialDelaySeconds),
+				PeriodSeconds:       int32(*service.Health.PeriodSeconds),
+				TimeoutSeconds:      int32(*service.Health.TimeoutSeconds),
+				SuccessThreshold:    int32(*service.Health.SuccessThreshold),
+				FailureThreshold:    int32(*service.Health.FailureThreshold),
+			}
+			app.Spec.Template.Spec.Containers[0].ReadinessProbe = &probe
+			app.Spec.Template.Spec.Containers[0].LivenessProbe = &probe
+		}
+
+		if service.Health.Grpc != nil {
+			probe := v1.Probe{
+				ProbeHandler: v1.ProbeHandler{
+					Exec: &v1.ExecAction{
+						Command: []string{
+							"grpc_health_probe",
+							"-connect-timeout=4s",
+							"-v",
+							fmt.Sprintf("-addr=:%d", service.Health.Grpc.Port),
+						},
+					},
+				},
+			}
+
+			app.Spec.Template.Spec.Containers[0].ReadinessProbe = &probe
+			app.Spec.Template.Spec.Containers[0].LivenessProbe = &probe
+		}
+	}
+
+	// Create yaml buffer
+	var yamlBuffer bytes.Buffer
+	err := s.printer.PrintObj(app, &yamlBuffer)
+	if err != nil {
+		return err
+	}
+
+	// Write yaml buffer to manifests
+	s.manifests = append(s.manifests, yamlBuffer.String())
+
+	return nil
+}

devtools/garrison/internal/pkg/kubernetes/env.go

@@ -0,0 +1,49 @@
+package kubernetes
+
+import (
+	"go.resf.org/peridot/devtools/garrison/internal/pkg/starlark"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type EnvironmentVariables struct {
+	// Stage is the environment the current deployment will run in
+	Stage starlark.Stage
+
+	// Kubernetes-specific
+
+	// Namespace is the Kubernetes namespace to deploy to
+	Namespace string
+
+	// ServiceAccountName is the Kubernetes service account to use
+	ServiceAccountName string
+
+	// Cloud-specific
+
+	// AwsRegion is the AWS region to use as default
+	AwsRegion string
+
+	// Dev-specific
+
+	// LocalstackEndpoint is the endpoint to use for localstack
+	LocalstackEndpoint string
+}
+
+func GetEnvironmentVariables(state *starlark.State, md *metav1.ObjectMeta) *EnvironmentVariables {
+	defaultAwsRegion := "us-east-2"
+	if state.Default.AwsRegion != nil {
+		defaultAwsRegion = *state.Default.AwsRegion
+	}
+
+	localstackEndpoint := "http://localstack.default.svc.cluster.local:4566"
+	if state.Stage != starlark.StageDevelopment {
+		localstackEndpoint = ""
+	}
+
+	return &EnvironmentVariables{
+		Stage:              state.Stage,
+		Namespace:          md.Namespace,
+		ServiceAccountName: md.Name,
+		AwsRegion:          defaultAwsRegion,
+		LocalstackEndpoint: localstackEndpoint,
+	}
+}

devtools/garrison/internal/pkg/kubernetes/kubernetes.go

@@ -0,0 +1,51 @@
+package kubernetes
+
+import (
+	"go.resf.org/peridot/devtools/garrison/internal/pkg/starlark"
+	"k8s.io/cli-runtime/pkg/printers"
+	"strings"
+)
+
+type State struct {
+	*starlark.State
+
+	printer   *printers.YAMLPrinter
+	manifests []string
+	helmMode  bool
+}
+
+func NewState(state *starlark.State) *State {
+	return &State{
+		State:     state,
+		printer:   &printers.YAMLPrinter{},
+		manifests: []string{},
+		helmMode:  false,
+	}
+}
+
+func (s *State) GenerateManifests() error {
+	for _, service := range s.Services.Services {
+		err := s.NewDeployment(service)
+		if err != nil {
+			return err
+		}
+
+		err = s.NewService(service)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (s *State) YAML() (string, error) {
+	var outBuffer strings.Builder
+	outBuffer.WriteString("---\n")
+
+	for _, manifest := range s.manifests {
+		outBuffer.WriteString(manifest)
+	}
+
+	return outBuffer.String(), nil
+}

devtools/garrison/internal/pkg/kubernetes/metadata.go

@@ -0,0 +1,30 @@
+package kubernetes
+
+import (
+	"go.resf.org/peridot/devtools/garrison/internal/pkg/starlark"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (s *State) getMetadata(service *starlark.Service) *metav1.ObjectMeta {
+	ns := ""
+	// If the defaults have a namespace, that is the first preference.
+	if s.Namespace != nil {
+		ns = *s.Namespace
+	}
+	// If the service has a namespace, that is the second preference.
+	if service.Namespace != nil {
+		ns = *service.Namespace
+	}
+	// If neither, use the service name.
+	if ns == "" {
+		ns = *service.Name
+	}
+
+	// Append stage to the namespace.
+	ns = ns + "-" + string(s.Stage)
+
+	return &metav1.ObjectMeta{
+		Name:      *service.Name,
+		Namespace: ns,
+	}
+}

devtools/garrison/internal/pkg/kubernetes/service.go

@@ -0,0 +1,59 @@
+package kubernetes
+
+import (
+	"bytes"
+	"go.resf.org/peridot/devtools/garrison/internal/pkg/starlark"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func (s *State) NewService(service *starlark.Service) error {
+	md := s.getMetadata(service)
+
+	podLabels := map[string]string{
+		"app":   *service.Name,
+		"stage": string(s.Stage),
+	}
+
+	// Copy the metadata and add the labels.
+	podMd := *md
+	podMd.Labels = podLabels
+
+	// Copy the metadata and add the labels.
+	svcMd := *md
+	svcMd.Labels = podLabels
+
+	// Create the service.
+	svc := &v1.Service{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Service",
+			APIVersion: "v1",
+		},
+		ObjectMeta: svcMd,
+		Spec: v1.ServiceSpec{
+			Selector: podLabels,
+			Ports:    []v1.ServicePort{},
+		},
+	}
+
+	// Create the ports.
+	for _, port := range service.Ports {
+		svc.Spec.Ports = append(svc.Spec.Ports, v1.ServicePort{
+			Name:       *port.Name,
+			Port:       int32(*port.Port),
+			TargetPort: intstr.FromInt32(int32(*port.Port)),
+		})
+	}
+
+	// Create yaml buffer
+	var outBuffer bytes.Buffer
+	err := s.printer.PrintObj(svc, &outBuffer)
+	if err != nil {
+		return err
+	}
+
+	s.manifests = append(s.manifests, outBuffer.String())
+
+	return nil
+}

devtools/garrison/internal/pkg/kubernetes/virtual_service.go

@@ -0,0 +1 @@
+package kubernetes

devtools/garrison/internal/pkg/starlark/BUILD.bazel

@@ -0,0 +1,30 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "starlark",
+    srcs = [
+        "builtin_args.go",
+        "builtin_default.go",
+        "builtin_environment.go",
+        "builtin_exec.go",
+        "builtin_flags.go",
+        "builtin_health.go",
+        "builtin_health_grpc.go",
+        "builtin_health_http.go",
+        "builtin_namespace.go",
+        "builtin_port.go",
+        "builtin_security.go",
+        "builtin_service.go",
+        "builtin_var.go",
+        "kv.go",
+        "stage.go",
+        "starlark.go",
+        "utils.go",
+    ],
+    importpath = "go.resf.org/peridot/devtools/garrison/internal/pkg/starlark",
+    visibility = ["//devtools/garrison:__subpackages__"],
+    deps = [
+        "//base/go",
+        "//vendor/go.starlark.net/starlark",
+    ],
+)

devtools/garrison/internal/pkg/starlark/builtin_args.go

@@ -0,0 +1,57 @@
+package starlark
+
+import (
+	"fmt"
+	"go.starlark.net/starlark"
+)
+
+type Args struct {
+	// key, value tuples
+	vals *KVs
+
+	frozen bool
+}
+
+func (a *Args) String() string {
+	return fmt.Sprintf("Args{vals=%v, frozen=%v}", a.vals, a.frozen)
+}
+
+func (a *Args) Type() string {
+	return "args"
+}
+
+func (a *Args) Freeze() {
+	a.frozen = true
+}
+
+func (a *Args) Truth() starlark.Bool {
+	return len(a.vals.KV) != 0
+}
+
+func (a *Args) Hash() (uint32, error) {
+	return 0, fmt.Errorf("unhashable type: %s", a.Type())
+}
+
+func (a *Args) Attr(name string) (starlark.Value, error) {
+	val, _ := a.vals.Get(name)
+	return val, nil
+}
+
+func (a *Args) AttrNames() []string {
+	names := make([]string, len(a.vals.KV))
+	for i, kv := range a.vals.KV {
+		names[i] = kv.Key
+	}
+
+	return names
+}
+
+// BuiltinArgs fetches values from flags and makes them available to the Starlark program.
+func builtinArgs(thread *starlark.Thread, _ *starlark.Builtin, _ starlark.Tuple, _ []starlark.Tuple) (starlark.Value, error) {
+	a, ok := thread.Local("args").(*Args)
+	if a == nil || !ok {
+		return nil, fmt.Errorf("args not declared, run flags() first")
+	}
+
+	return a, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_default.go

@@ -0,0 +1,70 @@
+package starlark
+
+import (
+	"fmt"
+	base "go.resf.org/peridot/base/go"
+	"go.starlark.net/starlark"
+)
+
+type Default struct {
+	Istio     *bool
+	AwsRegion *string
+}
+
+func (m *Default) String() string {
+	return fmt.Sprintf("Default{Istio=%v}", m.Istio)
+}
+
+func (m *Default) Type() string {
+	return "Default"
+}
+
+func (m *Default) Freeze() {}
+
+func (m *Default) Truth() starlark.Bool {
+	return true
+}
+
+func (m *Default) Hash() (uint32, error) {
+	return 0, fmt.Errorf("unhashable type: %s", m.Type())
+}
+
+// validDefaultKwargs maps to key and type of valid kwargs for the Default function.
+var validDefaultKwargs = map[string]starlark.Value{
+	"istio":      starlark.Bool(false),
+	"aws_region": starlark.String(""),
+}
+
+// BuiltinDefault is a Starlark function that declares defaults that affect the
+// Starlark program and output.
+func builtinDefault(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	if _, ok := thread.Local("default").(*Default); ok {
+		return nil, fmt.Errorf("default already declared")
+	}
+
+	defaults := &Default{}
+	kvs := kwargsToKV(kwargs)
+	for _, kv := range kvs.KV {
+		starlarkType, ok := validDefaultKwargs[kv.Key]
+		if !ok {
+			return nil, fmt.Errorf("invalid kwarg %s for Default", kv.Key)
+		}
+
+		if kv.Value.Type() != starlarkType.Type() {
+			return nil, fmt.Errorf("invalid type for kwarg %s, expected %s, got %s", kv.Key, starlarkType.Type(), kv.Value.Type())
+		}
+
+		switch kv.Key {
+		case "istio":
+			defaults.Istio = base.Pointer(valueToBool(kv.Value))
+		case "aws_region":
+			defaults.AwsRegion = base.Pointer(valueToString(kv.Value))
+		default:
+			return nil, fmt.Errorf("invalid kwarg %s for Default", kv.Key)
+		}
+	}
+
+	thread.SetLocal("default", defaults)
+
+	return starlark.None, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_environment.go

@@ -0,0 +1,31 @@
+package starlark
+
+import (
+	"go.starlark.net/starlark"
+)
+
+// builtinEnvironment is a Starlark function to declare environment variables for a deployment
+func builtinEnvironment(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	var newKwargs []starlark.Tuple
+	// Make sure all kwargs are strings
+	for _, kv := range kwargs {
+		if _, ok := kv[0].(starlark.String); !ok {
+			return nil, &starlark.EvalError{Msg: "environment variables must be strings"}
+		}
+		if _, ok := kv[1].(starlark.String); !ok {
+			return nil, &starlark.EvalError{Msg: "environment variables must be strings"}
+		}
+		newKwargs = append(newKwargs, kv)
+	}
+
+	// Set the dict values
+	dict := starlark.NewDict(len(newKwargs))
+	for _, kv := range newKwargs {
+		err := dict.SetKey(kv[0], kv[1])
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return dict, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_exec.go

@@ -0,0 +1,46 @@
+package starlark
+
+import (
+	"errors"
+	"go.starlark.net/starlark"
+	"os"
+)
+
+// builtinExec allows for the execution of another Starlark file.
+// Useful for embedding other Starlark files. (Declaring functions, etc.)
+func builtinExec(thread *starlark.Thread, _ *starlark.Builtin, args starlark.Tuple, _ []starlark.Tuple) (starlark.Value, error) {
+	fPath, ok := args.Index(0).(starlark.String)
+	if !ok {
+		return nil, errors.New("exec expects a string argument")
+	}
+	filePath := string(fPath)
+
+	if _, err := os.Stat(filePath); os.IsNotExist(err) {
+		return nil, err
+	}
+
+	globals, err := starlark.ExecFile(thread, filePath, nil, predeclared)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get the globals local
+	globalsLocal, ok := thread.Local("globals").(*starlark.Dict)
+	if !ok {
+		globalsLocal = starlark.NewDict(len(globals.Keys()))
+	}
+
+	// Add the globals to the local globals
+	for _, key := range globals.Keys() {
+		value := globals[key]
+		err := globalsLocal.SetKey(starlark.String(key), value)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Set the globals local
+	thread.SetLocal("globals", globalsLocal)
+
+	return starlark.None, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_flags.go

@@ -0,0 +1,82 @@
+package starlark
+
+import (
+	"flag"
+	"fmt"
+	"go.starlark.net/starlark"
+	"os"
+)
+
+// BuiltinFlags is a Starlark function that declares flags. The flags are then parsed
+// and made available to the Starlark program.
+func builtinFlags(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	localArgs, ok := thread.Local("args").(*Args)
+
+	var a *Args
+	if ok {
+		a = localArgs
+	} else {
+		a = &Args{
+			vals: NewKVs(),
+		}
+	}
+
+	flagMap := make(map[string]any)
+	kvs := kwargsToKV(kwargs)
+	// Parse flags
+	for _, kv := range kvs.KV {
+		switch v := kv.Value.(type) {
+		case starlark.String:
+			x := flag.String(kv.Key, v.GoString(), "")
+			flagMap[kv.Key] = x
+		case starlark.Bool:
+			x := flag.Bool(kv.Key, bool(v), "")
+			flagMap[kv.Key] = x
+		case starlark.Int:
+			x := flag.Int(kv.Key, v.Sign(), "")
+			flagMap[kv.Key] = x
+		case starlark.Float:
+			x := flag.Float64(kv.Key, float64(v), "")
+			flagMap[kv.Key] = x
+		default:
+			return nil, fmt.Errorf("unsupported type %T", v)
+		}
+	}
+
+	// Since this is called from cmd/garrison, we can assume that the index where
+	// the "build" word is located + 2 is the start of the flags.
+	buildIndex := 2
+	for i, arg := range os.Args {
+		if arg == "build" {
+			buildIndex = i + 2
+			break
+		}
+	}
+	flag.CommandLine.Parse(os.Args[buildIndex:])
+
+	// Set values from flagMap
+	for _, kv := range kvs.KV {
+		switch v := kv.Value.(type) {
+		case starlark.String:
+			a.vals.Set(kv.Key, starlark.String(*flagMap[kv.Key].(*string)))
+		case starlark.Bool:
+			a.vals.Set(kv.Key, starlark.Bool(*flagMap[kv.Key].(*bool)))
+		case starlark.Int:
+			a.vals.Set(kv.Key, starlark.MakeInt(*flagMap[kv.Key].(*int)))
+		case starlark.Float:
+			a.vals.Set(kv.Key, starlark.Float(*flagMap[kv.Key].(*float64)))
+		default:
+			return nil, fmt.Errorf("unsupported type %T", v)
+		}
+
+		// Check if value is truthy, otherwise error out because flags are "required"
+		// if no default
+		if x, ok := a.vals.Get(kv.Key); !ok || !bool(x.Truth()) {
+			return nil, fmt.Errorf("flag %s is required", kv.Key)
+		}
+	}
+
+	thread.SetLocal("args", a)
+
+	return starlark.None, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_health.go

@@ -0,0 +1,107 @@
+package starlark
+
+import (
+	"fmt"
+	base "go.resf.org/peridot/base/go"
+	"go.starlark.net/starlark"
+)
+
+type Health struct {
+	Http *HealthHTTP
+	Grpc *HealthGRPC
+
+	InitialDelaySeconds *int
+	PeriodSeconds       *int
+	TimeoutSeconds      *int
+	SuccessThreshold    *int
+	FailureThreshold    *int
+}
+
+func (h *Health) String() string {
+	return fmt.Sprintf("Health{Http=%v, Grpc=%v}", h.Http, h.Grpc)
+}
+
+func (h *Health) Type() string {
+	return "Health"
+}
+
+func (h *Health) Freeze() {}
+
+func (h *Health) Truth() starlark.Bool {
+	return true
+}
+
+func (h *Health) Hash() (uint32, error) {
+	return 0, fmt.Errorf("unhashable type: %s", h.Type())
+}
+
+func defaultHealth() *Health {
+	return &Health{
+		Http: &HealthHTTP{
+			Path: "/_ga/healthz",
+			Port: 6661,
+		},
+		InitialDelaySeconds: base.Pointer(1),
+		PeriodSeconds:       base.Pointer(3),
+		TimeoutSeconds:      base.Pointer(5),
+		SuccessThreshold:    base.Pointer(1),
+		FailureThreshold:    base.Pointer(10),
+	}
+}
+
+// validHealthKwargs maps to key and type of valid kwargs for the Health function.
+var validHealthKwargs = map[string]starlark.Value{
+	"http": &HealthHTTP{},
+	"grpc": &HealthGRPC{},
+
+	"initial_delay_seconds": starlark.MakeInt(0),
+	"period_seconds":        starlark.MakeInt(0),
+	"timeout_seconds":       starlark.MakeInt(0),
+	"success_threshold":     starlark.MakeInt(0),
+	"failure_threshold":     starlark.MakeInt(0),
+}
+
+// builtinHealth is a Starlark function that declares health settings for the target service.
+func builtinHealth(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	health := &Health{}
+
+	for _, kwarg := range kwargs {
+		key := string(kwarg[0].(starlark.String))
+		value := kwarg[1]
+
+		starlarkType, ok := validHealthKwargs[key]
+		if !ok {
+			return nil, fmt.Errorf("invalid kwarg %s for Health", key)
+		}
+
+		if value.Type() != starlarkType.Type() {
+			return nil, fmt.Errorf("invalid type for kwarg %s, expected %s, got %s", key, starlarkType.Type(), value.Type())
+		}
+
+		switch key {
+		case "http":
+			health.Http = value.(*HealthHTTP)
+			health.Grpc = nil
+		case "grpc":
+			health.Grpc = value.(*HealthGRPC)
+			health.Http = nil
+		case "initial_delay_seconds":
+			health.InitialDelaySeconds = base.Pointer(valueToInt(value))
+		case "period_seconds":
+			health.PeriodSeconds = base.Pointer(valueToInt(value))
+		case "timeout_seconds":
+			health.TimeoutSeconds = base.Pointer(valueToInt(value))
+		case "success_threshold":
+			health.SuccessThreshold = base.Pointer(valueToInt(value))
+		case "failure_threshold":
+			health.FailureThreshold = base.Pointer(valueToInt(value))
+		}
+	}
+
+	// Http or Grpc must be set
+	if health.Http == nil && health.Grpc == nil {
+		return nil, fmt.Errorf("invalid kwarg http or grpc for Health, expected http or grpc to be set")
+	}
+
+	return health, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_health_grpc.go

@@ -0,0 +1,64 @@
+package starlark
+
+import (
+	"fmt"
+	"go.starlark.net/starlark"
+)
+
+type HealthGRPC struct {
+	Port int
+}
+
+func (h *HealthGRPC) String() string {
+	return fmt.Sprintf("HealthGRPC{Port=%v}", h.Port)
+}
+
+func (h *HealthGRPC) Type() string {
+	return "HealthGRPC"
+}
+
+func (h *HealthGRPC) Freeze() {}
+
+func (h *HealthGRPC) Truth() starlark.Bool {
+	return true
+}
+
+func (h *HealthGRPC) Hash() (uint32, error) {
+	return 0, fmt.Errorf("unhashable type: %s", h.Type())
+}
+
+// validHealthGRPCKwargs maps to key and type of valid kwargs for the HealthGRPC function.
+var validHealthGRPCKwargs = map[string]starlark.Value{
+	"port": starlark.MakeInt(0),
+}
+
+// builtinHealthGRPC is a Starlark function that declares health settings for the target service.
+func builtinHealthGRPC(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	http := &HealthGRPC{}
+
+	for _, kwarg := range kwargs {
+		key := string(kwarg[0].(starlark.String))
+		value := kwarg[1]
+
+		starlarkType, ok := validHealthGRPCKwargs[key]
+		if !ok {
+			return nil, fmt.Errorf("invalid kwarg %s for HealthGRPC", key)
+		}
+
+		if value.Type() != starlarkType.Type() {
+			return nil, fmt.Errorf("invalid type for kwarg %s, expected %s, got %s", key, starlarkType.Type(), value.Type())
+		}
+
+		switch key {
+		case "port":
+			http.Port = valueToInt(value)
+		}
+	}
+
+	// Port must be set
+	if http.Port == 0 {
+		return nil, fmt.Errorf("invalid kwarg port for HealthGRPC, expected port to be set")
+	}
+
+	return http, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_health_http.go

@@ -0,0 +1,71 @@
+package starlark
+
+import (
+	"fmt"
+	"go.starlark.net/starlark"
+)
+
+type HealthHTTP struct {
+	Path string
+	Port int
+}
+
+func (h *HealthHTTP) String() string {
+	return fmt.Sprintf("HealthHTTP{Path=%v}", h.Path)
+}
+
+func (h *HealthHTTP) Type() string {
+	return "HealthHTTP"
+}
+
+func (h *HealthHTTP) Freeze() {}
+
+func (h *HealthHTTP) Truth() starlark.Bool {
+	return true
+}
+
+func (h *HealthHTTP) Hash() (uint32, error) {
+	return 0, fmt.Errorf("unhashable type: %s", h.Type())
+}
+
+// validHealthHTTPKwargs maps to key and type of valid kwargs for the HealthHTTP function.
+var validHealthHTTPKwargs = map[string]starlark.Value{
+	"path": starlark.String(""),
+	"port": starlark.MakeInt(0),
+}
+
+// builtinHealthHTTP is a Starlark function that declares health settings for the target service.
+func builtinHealthHTTP(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	http := &HealthHTTP{}
+
+	for _, kwarg := range kwargs {
+		key := string(kwarg[0].(starlark.String))
+		value := kwarg[1]
+
+		starlarkType, ok := validHealthHTTPKwargs[key]
+		if !ok {
+			return nil, fmt.Errorf("invalid kwarg %s for HealthHTTP", key)
+		}
+
+		if value.Type() != starlarkType.Type() {
+			return nil, fmt.Errorf("invalid type for kwarg %s, expected %s, got %s", key, starlarkType.Type(), value.Type())
+		}
+
+		switch key {
+		case "path":
+			http.Path = valueToString(value)
+		case "port":
+			http.Port = valueToInt(value)
+		}
+	}
+
+	if http.Path == "" {
+		http.Path = "/_ga/healthz"
+	}
+
+	if http.Port == 0 {
+		http.Port = 6661
+	}
+
+	return http, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_namespace.go

@@ -0,0 +1,26 @@
+package starlark
+
+import (
+	"errors"
+	"go.starlark.net/starlark"
+)
+
+// builtinNamespace is a Starlark function that declares a namespace for the
+// deployment. Use if it's desired to group all services in a namespace.
+func builtinNamespace(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	// Need exactly one argument.
+	if args.Len() != 1 {
+		return nil, errors.New("namespace expects exactly one argument")
+	}
+
+	// Extract namespace from args.
+	namespace, ok := args.Index(0).(starlark.String)
+	if !ok {
+		return nil, errors.New("namespace expects string argument")
+	}
+
+	// Set namespace in thread locals.
+	thread.SetLocal("namespace", namespace.GoString())
+
+	return starlark.None, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_port.go

@@ -0,0 +1,139 @@
+package starlark
+
+import (
+    "fmt"
+    base "go.resf.org/peridot/base/go"
+    "go.starlark.net/starlark"
+    "strings"
+)
+
+type Port struct {
+    Name          *string
+    ContainerPort *int
+    Port          *int
+    Expose        *bool
+    External      *bool
+    Host          *string
+    Path          *string
+}
+
+func (p *Port) String() string {
+    return fmt.Sprintf("Port{ContainerPort=%v, Port=%v}", p.ContainerPort, p.Port)
+}
+
+func (p *Port) Type() string {
+    return "Port"
+}
+
+func (p *Port) Freeze() {}
+
+func (p *Port) Truth() starlark.Bool {
+    return true
+}
+
+func (p *Port) Hash() (uint32, error) {
+    return 0, fmt.Errorf("unhashable type: %s", p.Type())
+}
+
+// validPortKwargs maps to key and type of valid kwargs for the Port function.
+var validPortKwargs = map[string]starlark.Value{
+    "name":           starlark.String(""),
+    "container_port": starlark.MakeInt(0),
+    "port":           starlark.MakeInt(0),
+    "expose":         starlark.Bool(false),
+    "external":       starlark.Bool(false),
+    "host":           starlark.String(""),
+    "path":           starlark.String(""),
+    "stage":          starlark.String(""),
+}
+
+// builtinPort is a Starlark function that returns a Port. Used to configure exposed ports for a container.
+func builtinPort(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+    port := &Port{}
+
+    for _, kwarg := range kwargs {
+        key := string(kwarg[0].(starlark.String))
+        value := kwarg[1]
+
+        starlarkType, ok := validPortKwargs[key]
+        if !ok {
+            return nil, fmt.Errorf("invalid kwarg %s for Port", key)
+        }
+
+        if value.Type() != starlarkType.Type() {
+            return nil, fmt.Errorf("invalid type for kwarg %s, expected %s, got %s", key, starlarkType.Type(), value.Type())
+        }
+
+        switch key {
+        case "name":
+            port.Name = base.Pointer(valueToString(value))
+        case "container_port":
+            port.ContainerPort = base.Pointer(valueToInt(value))
+        case "port":
+            port.Port = base.Pointer(valueToInt(value))
+        case "expose":
+            port.Expose = base.Pointer(valueToBool(value))
+        case "external":
+            port.External = base.Pointer(valueToBool(value))
+        case "host":
+            port.Host = base.Pointer(valueToString(value))
+        case "path":
+            port.Path = base.Pointer(valueToString(value))
+        default:
+            return nil, fmt.Errorf("invalid kwarg %s for Port", key)
+        }
+    }
+
+    // Check required kwargs and set defaults
+    if port.Name == nil {
+        return nil, fmt.Errorf("name kwarg is required for Port")
+    }
+    if port.Port == nil {
+        return nil, fmt.Errorf("port kwarg is required for Port")
+    }
+    if port.ContainerPort == nil {
+        port.ContainerPort = port.Port
+    }
+
+    if port.Expose == nil {
+        port.Expose = base.Pointer(false)
+    }
+    if *port.Expose {
+        if port.Host == nil {
+            return nil, fmt.Errorf("host kwarg is required when expose is true for Port")
+        }
+        if port.Path == nil {
+            port.Path = base.Pointer("/")
+        }
+
+        // If not external, then Host must contain ".corp."
+        if port.External == nil || !*port.External {
+            if !strings.Contains(*port.Host, ".corp.") {
+                return nil, fmt.Errorf("host kwarg must contain .corp. when expose is true and external is false for Port")
+            }
+        } else {
+            // If external, then Host must not contain ".corp."
+            if strings.Contains(*port.Host, ".corp.") {
+                return nil, fmt.Errorf("host kwarg must not contain .corp. when expose is true and external is true for Port")
+            }
+        }
+
+        // If stage is not prod, then Host must contain ".corp."
+        stage := thread.Local("stage").(Stage)
+        if stage != StageProduction {
+            // Add -{stage} to the first part of the host (as in the part before the first dot)
+            parts := strings.Split(*port.Host, ".")
+            parts[0] = fmt.Sprintf("%s-%s", parts[0], stage)
+
+            // Add .corp. to the second part of the host (as in the part after the first dot)
+            parts[1] = fmt.Sprintf("%s.corp.", parts[1])
+
+            *port.Host = strings.Join(parts, ".")
+        }
+
+        // External should also disable BeyondCorp auth checks
+        // todo(mustafa): implement this
+    }
+
+    return port, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_security.go

@@ -0,0 +1,64 @@
+package starlark
+
+import (
+	"fmt"
+	base "go.resf.org/peridot/base/go"
+	"go.starlark.net/starlark"
+)
+
+type Security struct {
+	RunAsUser  *int
+	RunAsGroup *int
+}
+
+func (s *Security) String() string {
+	return fmt.Sprintf("Security{RunAsUser=%v, RunAsGroup=%v}", s.RunAsUser, s.RunAsGroup)
+}
+
+func (s *Security) Type() string {
+	return "Security"
+}
+
+func (s *Security) Freeze() {}
+
+func (s *Security) Truth() starlark.Bool {
+	return true
+}
+
+func (s *Security) Hash() (uint32, error) {
+	return 0, fmt.Errorf("unhashable type: %s", s.Type())
+}
+
+// validSecurityKwargs maps to key and type of valid kwargs for the Security function.
+var validSecurityKwargs = map[string]starlark.Value{
+	"run_as_user":  starlark.MakeInt64(0),
+	"run_as_group": starlark.MakeInt64(0),
+}
+
+// builtinSecurity is a Starlark function that declares security settings for the target service.
+func builtinSecurity(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	security := &Security{}
+
+	for _, kwarg := range kwargs {
+		key := string(kwarg[0].(starlark.String))
+		value := kwarg[1]
+
+		starlarkType, ok := validSecurityKwargs[key]
+		if !ok {
+			return nil, fmt.Errorf("invalid kwarg %s for Security", key)
+		}
+
+		if value.Type() != starlarkType.Type() {
+			return nil, fmt.Errorf("invalid type for kwarg %s, expected %s, got %s", key, starlarkType.Type(), value.Type())
+		}
+
+		switch key {
+		case "run_as_user":
+			security.RunAsUser = base.Pointer(valueToInt(value))
+		case "run_as_group":
+			security.RunAsGroup = base.Pointer(valueToInt(value))
+		}
+	}
+
+	return security, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_service.go

@@ -0,0 +1,146 @@
+package starlark
+
+import (
+	"fmt"
+	base "go.resf.org/peridot/base/go"
+	"go.starlark.net/starlark"
+)
+
+type Service struct {
+	Name           *string
+	Image          *string
+	Ports          []*Port
+	Env            map[string]string
+	Command        []string
+	Args           []string
+	Security       *Security
+	Health         *Health
+	NoAntiAffinity *bool
+
+	Namespace *string
+}
+
+func (s *Service) String() string {
+	return fmt.Sprintf("Service{Name=%v, Image=%v, Ports=%v, Env=%v, Namespace=%v}", s.Name, s.Image, s.Ports, s.Env, s.Namespace)
+}
+
+type Services struct {
+	Services []*Service
+}
+
+// validServiceKwargs maps to key and type of valid kwargs for the Service function.
+var validServiceKwargs = map[string]starlark.Value{
+	"name":       starlark.String(""),
+	"image":      starlark.String(""),
+	"ports":      starlark.NewList([]starlark.Value{}),
+	"env":        starlark.NewDict(0),
+	"command":    starlark.NewList([]starlark.Value{}),
+	"args":       starlark.NewList([]starlark.Value{}),
+	"security":   &Security{},
+	"health":     &Health{},
+	"no_antiaff": starlark.Bool(false),
+}
+
+// BuiltinService is a Starlark function that declares metadata about the target service.
+func builtinService(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	localServices, ok := thread.Local("services").(*Services)
+
+	var services *Services
+	if ok {
+		services = localServices
+	} else {
+		services = &Services{}
+	}
+
+	m := &Service{
+		Ports: []*Port{},
+	}
+
+	kvs := kwargsToKV(kwargs)
+	for _, kv := range kvs.KV {
+		starlarkType, ok := validServiceKwargs[kv.Key]
+		if !ok {
+			return nil, fmt.Errorf("invalid kwarg %s for Service", kv.Key)
+		}
+
+		if kv.Value.Type() != starlarkType.Type() {
+			return nil, fmt.Errorf("invalid type for kwarg %s, expected %s, got %s", kv.Key, starlarkType.Type(), kv.Value.Type())
+		}
+
+		switch kv.Key {
+		case "name":
+			m.Name = base.Pointer(valueToString(kv.Value))
+		case "image":
+			m.Image = base.Pointer(valueToString(kv.Value))
+		case "ports":
+			ports, ok := kv.Value.(*starlark.List)
+			if !ok {
+				return nil, fmt.Errorf("invalid type for kwarg ports, expected List, got %s", kv.Value.Type())
+			}
+
+			// Ensure all elements in the list are of type Port.
+			var x starlark.Value
+			iterator := ports.Iterate()
+			for iterator.Next(&x) {
+				if _, ok := x.(*Port); !ok {
+					return nil, fmt.Errorf("invalid type for kwarg ports, expected Port, got %s", x.Type())
+				}
+			}
+
+			m.Ports = make([]*Port, ports.Len())
+			for i := 0; i < ports.Len(); i++ {
+				m.Ports[i] = ports.Index(i).(*Port)
+			}
+		case "env":
+			env, ok := kv.Value.(*starlark.Dict)
+			if !ok {
+				return nil, fmt.Errorf("invalid type for kwarg env, expected Dict, got %s", kv.Value.Type())
+			}
+
+			m.Env = make(map[string]string)
+			var x starlark.Value
+			for _, key := range env.Keys() {
+				x, _, _ = env.Get(key)
+				m.Env[key.(starlark.String).GoString()] = x.(starlark.String).GoString()
+			}
+		case "command":
+			command := kv.Value.(*starlark.List)
+			m.Command = make([]string, command.Len())
+			for i := 0; i < command.Len(); i++ {
+				m.Command[i] = command.Index(i).(starlark.String).GoString()
+			}
+		case "args":
+			sArgs := kv.Value.(*starlark.List)
+			m.Args = make([]string, sArgs.Len())
+			for i := 0; i < sArgs.Len(); i++ {
+				m.Args[i] = sArgs.Index(i).(starlark.String).GoString()
+			}
+		case "security":
+			m.Security = kv.Value.(*Security)
+		case "health":
+			m.Health = kv.Value.(*Health)
+		case "no_antiaff":
+			m.NoAntiAffinity = base.Pointer(valueToBool(kv.Value))
+		default:
+			return nil, fmt.Errorf("invalid kwarg %s for Service", kv.Key)
+		}
+	}
+
+	// Make sure name and image are set
+	if m.Name == nil {
+		return nil, fmt.Errorf("service name is required")
+	}
+	if m.Image == nil {
+		return nil, fmt.Errorf("service image is required")
+	}
+
+	// Set defaults
+	if m.Health == nil {
+		m.Health = defaultHealth()
+	}
+
+	services.Services = append(services.Services, m)
+	thread.SetLocal("services", services)
+
+	return starlark.None, nil
+}

devtools/garrison/internal/pkg/starlark/builtin_var.go

@@ -0,0 +1,31 @@
+package starlark
+
+import (
+	"errors"
+	"fmt"
+	"go.starlark.net/starlark"
+)
+
+// builtinVar is to fetch a global variable that was defined as a result
+// of an exec call
+func builtinVar(thread *starlark.Thread, _ *starlark.Builtin, args starlark.Tuple, _ []starlark.Tuple) (starlark.Value, error) {
+	key, ok := args.Index(0).(starlark.String)
+	if !ok {
+		return nil, errors.New("global expects a string argument")
+	}
+
+	globalsLocal, ok := thread.Local("globals").(*starlark.Dict)
+	if !ok {
+		return nil, fmt.Errorf("global %s not found", key)
+	}
+
+	value, ok, err := globalsLocal.Get(key)
+	if err != nil {
+		return nil, err
+	}
+	if !ok {
+		return nil, fmt.Errorf("global %s not found", key)
+	}
+
+	return value, nil
+}

devtools/garrison/internal/pkg/starlark/kv.go

@@ -0,0 +1,65 @@
+package starlark
+
+import "go.starlark.net/starlark"
+
+type KV struct {
+	Key   string
+	Value starlark.Value
+}
+
+type KVs struct {
+	KV       []KV
+	indexLoc map[string]int
+}
+
+func NewKVs() *KVs {
+	return &KVs{
+		KV:       make([]KV, 0),
+		indexLoc: make(map[string]int),
+	}
+}
+
+func (k *KVs) Add(kv KV) {
+	k.KV = append(k.KV, kv)
+	k.indexLoc[kv.Key] = len(k.KV) - 1
+}
+
+func (k *KVs) Get(key string) (starlark.Value, bool) {
+	loc, ok := k.indexLoc[key]
+	if !ok {
+		return nil, false
+	}
+	return k.KV[loc].Value, true
+}
+
+func (k *KVs) Set(key string, value starlark.Value) {
+	loc, ok := k.indexLoc[key]
+	if !ok {
+		k.Add(KV{
+			Key:   key,
+			Value: value,
+		})
+		return
+	}
+	k.KV[loc].Value = value
+}
+
+func (k *KVs) Del(key string) {
+	loc, ok := k.indexLoc[key]
+	if !ok {
+		return
+	}
+	k.KV = append(k.KV[:loc], k.KV[loc+1:]...)
+	delete(k.indexLoc, key)
+}
+
+func kwargsToKV(kwargs []starlark.Tuple) KVs {
+	kvs := NewKVs()
+	for _, kv := range kwargs {
+		kvs.Add(KV{
+			Key:   kv.Index(0).(starlark.String).GoString(),
+			Value: kv.Index(1),
+		})
+	}
+	return *kvs
+}

devtools/garrison/internal/pkg/starlark/stage.go

@@ -0,0 +1,19 @@
+package starlark
+
+type Stage string
+
+const (
+	StageDevelopment Stage = "development"
+	StageStaging     Stage = "staging"
+	StageProduction  Stage = "production"
+)
+
+var validStages = []Stage{
+	StageDevelopment,
+	StageStaging,
+	StageProduction,
+}
+
+func GetValidStages() []Stage {
+	return validStages
+}

devtools/garrison/internal/pkg/starlark/starlark.go

@@ -0,0 +1,74 @@
+package starlark
+
+import (
+	"fmt"
+	"go.starlark.net/starlark"
+)
+
+type State struct {
+	Services *Services
+	Default  *Default
+
+	Stage     Stage
+	Namespace *string
+}
+
+var predeclaredNoExec = starlark.StringDict{
+	"var":         starlark.NewBuiltin("var", builtinVar),
+	"flags":       starlark.NewBuiltin("flags", builtinFlags),
+	"default":     starlark.NewBuiltin("default", builtinDefault),
+	"namespace":   starlark.NewBuiltin("namespace", builtinNamespace),
+	"service":     starlark.NewBuiltin("service", builtinService),
+	"args":        starlark.NewBuiltin("args", builtinArgs),
+	"Port":        starlark.NewBuiltin("Port", builtinPort),
+	"Environment": starlark.NewBuiltin("Environment", builtinEnvironment),
+	"Security":    starlark.NewBuiltin("Security", builtinSecurity),
+	"Health":      starlark.NewBuiltin("Health", builtinHealth),
+	"HealthHTTP":  starlark.NewBuiltin("HealthHTTP", builtinHealthHTTP),
+	"HealthGRPC":  starlark.NewBuiltin("HealthGRPC", builtinHealthGRPC),
+}
+
+var predeclared = starlark.StringDict{}
+
+func init() {
+	predeclared = predeclaredNoExec
+	predeclared["exec"] = starlark.NewBuiltin("exec", builtinExec)
+}
+
+func ExecFile(file string, stage Stage) (*State, error) {
+	thread := &starlark.Thread{
+		Name: "garrison",
+	}
+
+	// Set stage in thread locals.
+	thread.SetLocal("stage", stage)
+
+	_, err := starlark.ExecFile(thread, file, nil, predeclared)
+	if err != nil {
+		return nil, err
+	}
+
+	// Extract Services and Default from thread locals.
+	services, ok := thread.Local("services").(*Services)
+	if !ok {
+		return nil, fmt.Errorf("services not declared")
+	}
+
+	defaults, ok := thread.Local("default").(*Default)
+	if !ok {
+		defaults = &Default{}
+	}
+
+	var ns *string
+	namespace, ok := thread.Local("namespace").(string)
+	if ok {
+		ns = &namespace
+	}
+
+	return &State{
+		Services:  services,
+		Default:   defaults,
+		Stage:     stage,
+		Namespace: ns,
+	}, nil
+}

devtools/garrison/internal/pkg/starlark/utils.go

@@ -0,0 +1,34 @@
+package starlark
+
+import "go.starlark.net/starlark"
+
+func valueToInt(v starlark.Value) int {
+	vInt, ok := v.(starlark.Int)
+	if !ok {
+		return 0
+	}
+	vInt64, ok := vInt.Int64()
+	if !ok {
+		return 0
+	}
+
+	return int(vInt64)
+}
+
+func valueToString(v starlark.Value) string {
+	vString, ok := v.(starlark.String)
+	if !ok {
+		return ""
+	}
+
+	return string(vString)
+}
+
+func valueToBool(v starlark.Value) bool {
+	vBool, ok := v.(starlark.Bool)
+	if !ok {
+		return false
+	}
+
+	return bool(vBool)
+}

devtools/garrison/readme.md

@@ -0,0 +1,12 @@
+# garrison
+
+Deployment framework to deploy RESF services. Starlark is used to define the deployment
+configuration.
+
+This tool is generally not very flexible and mostly designed to deploy RESF services. It is not
+recommended to use this tool for other purposes.
+
+Garrison can output:
+
+* Helm
+* Kubernetes YAML

devtools/yfs2/README.md

@@ -0,0 +1,2 @@
+# yumrepofs2
+An S3-backed Yum repository server

go.mod

@@ -0,0 +1,66 @@
+module go.resf.org/peridot
+
+go 1.20
+
+require (
+	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
+	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.2
+	github.com/prometheus/client_golang v1.16.0
+	github.com/urfave/cli/v2 v2.25.7
+	github.com/wk8/go-ordered-map/v2 v2.1.8
+	go.ciq.dev/pika v0.0.0-20230819201750-737c3e8f413d
+	go.starlark.net v0.0.0-20230814145427-12f4cb8177e4
+	google.golang.org/grpc v1.57.0
+	k8s.io/api v0.28.0
+	k8s.io/apimachinery v0.28.0
+	k8s.io/cli-runtime v0.28.0
+)
+
+require (
+	github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/buger/jsonparser v1.1.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	github.com/gertd/go-pluralize v0.2.1 // indirect
+	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/glog v1.1.0 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/iancoleman/strcase v0.3.0 // indirect
+	github.com/jmoiron/sqlx v1.3.5 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/lib/pq v1.10.9 // indirect
+	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/common v0.42.0 // indirect
+	github.com/prometheus/procfs v0.10.1 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
+	golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc // indirect
+	golang.org/x/net v0.13.0 // indirect
+	golang.org/x/sys v0.11.0 // indirect
+	golang.org/x/text v0.11.0 // indirect
+	google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230726155614-23370e0ffb3e // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/client-go v0.28.0 // indirect
+	k8s.io/klog/v2 v2.100.1 // indirect
+	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
+)

go.sum

@@ -0,0 +1,273 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df h1:7RFfzj4SSt6nnvCPbCqijJi1nWCd+TqAT3bYCStRC18=
+github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df/go.mod h1:pSwJ0fSY5KhvocuWSx4fz3BA8OrA1bQn+K1Eli3BRwM=
+github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
+github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/fergusstrange/embedded-postgres v1.23.0 h1:ZYRD89nammxQDWDi6taJE2CYjDuAoVc1TpEqRIYQryc=
+github.com/gertd/go-pluralize v0.2.1 h1:M3uASbVjMnTsPb0PNqg+E/24Vwigyo/tvyMTtAlLgiA=
+github.com/gertd/go-pluralize v0.2.1/go.mod h1:rbYaKDbsXxmRfr8uygAEKhOWsjyrrqrkHVpZvoOp8zk=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
+github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.2 h1:dygLcbEBA+t/P7ck6a8AkXv6juQ4cK0RHBoh32jxhHM=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.2/go.mod h1:Ap9RLCIJVtgQg1/BBgVEfypOAySvvlcpcVQkSzJCH4Y=
+github.com/iancoleman/strcase v0.3.0 h1:nTXanmYxhfFAMjZL34Ov6gkzEsSJZ5DbhxWjvSASxEI=
+github.com/iancoleman/strcase v0.3.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
+github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
+github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRUbg=
+github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
+github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
+github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
+github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
+github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
+github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
+github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/urfave/cli/v2 v2.25.7 h1:VAzn5oq403l5pHjc4OhD54+XGO9cdKVL/7lDjF+iKUs=
+github.com/urfave/cli/v2 v2.25.7/go.mod h1:8qnjx1vcq5s2/wpsqoZFndg2CE5tNFyrTvS6SinrnYQ=
+github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
+github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
+github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
+github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
+github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.ciq.dev/pika v0.0.0-20230819201750-737c3e8f413d h1:bHcWrRI7hU9LQLAuQh9RtWQhRBi3S8f/JcCBOMtiLSU=
+go.ciq.dev/pika v0.0.0-20230819201750-737c3e8f413d/go.mod h1:FUnF19p1SuyHy77srykZo5s3dFikTj5A/f1stmcotCA=
+go.starlark.net v0.0.0-20230814145427-12f4cb8177e4 h1:Ydko8M6UfXgvSpGOnbAjRMQDIvBheUsjBjkm6Azcpf4=
+go.starlark.net v0.0.0-20230814145427-12f4cb8177e4/go.mod h1:jxU+3+j+71eXOW14274+SmmuW82qJzl6iZSeqEtTGds=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc h1:mCRnTeVUjcrhlRmO0VK8a6k6Rrf6TF9htwo2pJVSjIU=
+golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.13.0 h1:Nvo8UFsZ8X3BhAC9699Z1j7XQ3rsZnUUm7jfBEk1ueY=
+golang.org/x/net v0.13.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
+golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130 h1:Au6te5hbKUV8pIYWHqOUZ1pva5qK/rwbIhoXEUB9Lu8=
+google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:O9kGHb51iE/nOGvQaDUuadVYqovW56s5emA88lQnj6Y=
+google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e h1:z3vDksarJxsAKM5dmEGv0GHwE2hKJ096wZra71Vs4sw=
+google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e/go.mod h1:rsr7RhLuwsDKL7RmgDDCUc6yaGr1iqceVb5Wv6f6YvQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230726155614-23370e0ffb3e h1:S83+ibolgyZ0bqz7KEsUOPErxcv4VzlszxY+31OfB/E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230726155614-23370e0ffb3e/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
+google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+k8s.io/api v0.28.0 h1:3j3VPWmN9tTDI68NETBWlDiA9qOiGJ7sdKeufehBYsM=
+k8s.io/api v0.28.0/go.mod h1:0l8NZJzB0i/etuWnIXcwfIv+xnDOhL3lLW919AWYDuY=
+k8s.io/apimachinery v0.28.0 h1:ScHS2AG16UlYWk63r46oU3D5y54T53cVI5mMJwwqFNA=
+k8s.io/apimachinery v0.28.0/go.mod h1:X0xh/chESs2hP9koe+SdIAcXWcQ+RM5hy0ZynB+yEvw=
+k8s.io/cli-runtime v0.28.0 h1:Tcz1nnccXZDNIzoH6EwjCs+7ezkUGhorzCweEvlVOFg=
+k8s.io/cli-runtime v0.28.0/go.mod h1:U+ySmOKBm/JUCmebhmecXeTwNN1RzI7DW4+OM8Oryas=
+k8s.io/client-go v0.28.0 h1:ebcPRDZsCjpj62+cMk1eGNX1QkMdRmQ6lmz5BLoFWeM=
+k8s.io/client-go v0.28.0/go.mod h1:0Asy9Xt3U98RypWJmU1ZrRAGKhP6NqDPmptlAzK2kMc=
+k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
+k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk=
+k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
+sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
+sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
+sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=

macdev.bazelrc

@@ -0,0 +1,5 @@
+# Due to the overhead of symlinks and the amount of files to symlink with Node applications
+# It's better to disable sandboxing for macOS during development.
+# This reduces esbuild bundle times from 3.5s+ to approx. 0.5s.
+build:macdev --spawn_strategy=local
+run:macdev --spawn_strategy=local

package.json

@@ -0,0 +1,27 @@
+{
+  "name": "peridot",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "mustafa@rockylinux.org",
+  "license": "Apache-2.0",
+  "devDependencies": {
+    "@emotion/react": "^11.11.1",
+    "@emotion/styled": "^11.11.0",
+    "@mui/icons-material": "^5.14.3",
+    "@mui/material": "^5.14.5",
+    "@swc/core": "1.3.75",
+    "@types/react": "^18.2.20",
+    "@types/react-dom": "^18.2.7",
+    "prettier": "^3.0.2",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "react-router": "^6.15.0",
+    "react-router-dom": "^6.15.0",
+    "tslib": "^2.6.2"
+  }
+}

pnpm-lock.yaml

@@ -0,0 +1,849 @@
+lockfileVersion: 5.4
+
+specifiers:
+  '@emotion/react': ^11.11.1
+  '@emotion/styled': ^11.11.0
+  '@mui/icons-material': ^5.14.3
+  '@mui/material': ^5.14.5
+  '@swc/core': 1.3.75
+  '@types/react': ^18.2.20
+  '@types/react-dom': ^18.2.7
+  prettier: ^3.0.2
+  react: ^18.2.0
+  react-dom: ^18.2.0
+  react-router: ^6.15.0
+  react-router-dom: ^6.15.0
+  tslib: ^2.6.2
+
+devDependencies:
+  '@emotion/react': 11.11.1_j3ahe22lw6ac2w6qvqp4kjqnqy
+  '@emotion/styled': 11.11.0_yteb73ll6h6uyykb3t5anncyhm
+  '@mui/icons-material': 5.14.3_h5h5kh4s2gztkajbksiswsn4ia
+  '@mui/material': 5.14.5_ho7f4muyxo2kcc3eb2wgnvahca
+  '@swc/core': 1.3.75
+  '@types/react': 18.2.20
+  '@types/react-dom': 18.2.7
+  prettier: 3.0.2
+  react: 18.2.0
+  react-dom: 18.2.0_react@18.2.0
+  react-router: 6.15.0_react@18.2.0
+  react-router-dom: 6.15.0_biqbaboplfbrettd7655fr4n2y
+  tslib: 2.6.2
+
+packages:
+
+  /@babel/code-frame/7.22.10:
+    resolution: {integrity: sha512-/KKIMG4UEL35WmI9OlvMhurwtytjvXoFcGNrOvyG9zIzA8YmPjVtIZUf7b05+TPO7G7/GEmLHDaoCgACHl9hhA==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/highlight': 7.22.10
+      chalk: 2.4.2
+    dev: true
+
+  /@babel/helper-module-imports/7.22.5:
+    resolution: {integrity: sha512-8Dl6+HD/cKifutF5qGd/8ZJi84QeAKh+CEe1sBzz8UayBBGg1dAIJrdHOcOM5b2MpzWL2yuotJTtGjETq0qjXg==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/types': 7.22.10
+    dev: true
+
+  /@babel/helper-string-parser/7.22.5:
+    resolution: {integrity: sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==}
+    engines: {node: '>=6.9.0'}
+    dev: true
+
+  /@babel/helper-validator-identifier/7.22.5:
+    resolution: {integrity: sha512-aJXu+6lErq8ltp+JhkJUfk1MTGyuA4v7f3pA+BJ5HLfNC6nAQ0Cpi9uOquUj8Hehg0aUiHzWQbOVJGao6ztBAQ==}
+    engines: {node: '>=6.9.0'}
+    dev: true
+
+  /@babel/highlight/7.22.10:
+    resolution: {integrity: sha512-78aUtVcT7MUscr0K5mIEnkwxPE0MaxkR5RxRwuHaQ+JuU5AmTPhY+do2mdzVTnIJJpyBglql2pehuBIWHug+WQ==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/helper-validator-identifier': 7.22.5
+      chalk: 2.4.2
+      js-tokens: 4.0.0
+    dev: true
+
+  /@babel/runtime/7.22.10:
+    resolution: {integrity: sha512-21t/fkKLMZI4pqP2wlmsQAWnYW1PDyKyyUV4vCi+B25ydmdaYTKXPwCj0BzSUnZf4seIiYvSA3jcZ3gdsMFkLQ==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      regenerator-runtime: 0.14.0
+    dev: true
+
+  /@babel/types/7.22.10:
+    resolution: {integrity: sha512-obaoigiLrlDZ7TUQln/8m4mSqIW2QFeOrCQc9r+xsaHGNoplVNYlRVpsfE8Vj35GEm2ZH4ZhrNYogs/3fj85kg==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/helper-string-parser': 7.22.5
+      '@babel/helper-validator-identifier': 7.22.5
+      to-fast-properties: 2.0.0
+    dev: true
+
+  /@emotion/babel-plugin/11.11.0:
+    resolution: {integrity: sha512-m4HEDZleaaCH+XgDDsPF15Ht6wTLsgDTeR3WYj9Q/k76JtWhrJjcP4+/XlG8LGT/Rol9qUfOIztXeA84ATpqPQ==}
+    dependencies:
+      '@babel/helper-module-imports': 7.22.5
+      '@babel/runtime': 7.22.10
+      '@emotion/hash': 0.9.1
+      '@emotion/memoize': 0.8.1
+      '@emotion/serialize': 1.1.2
+      babel-plugin-macros: 3.1.0
+      convert-source-map: 1.9.0
+      escape-string-regexp: 4.0.0
+      find-root: 1.1.0
+      source-map: 0.5.7
+      stylis: 4.2.0
+    dev: true
+
+  /@emotion/cache/11.11.0:
+    resolution: {integrity: sha512-P34z9ssTCBi3e9EI1ZsWpNHcfY1r09ZO0rZbRO2ob3ZQMnFI35jB536qoXbkdesr5EUhYi22anuEJuyxifaqAQ==}
+    dependencies:
+      '@emotion/memoize': 0.8.1
+      '@emotion/sheet': 1.2.2
+      '@emotion/utils': 1.2.1
+      '@emotion/weak-memoize': 0.3.1
+      stylis: 4.2.0
+    dev: true
+
+  /@emotion/hash/0.9.1:
+    resolution: {integrity: sha512-gJB6HLm5rYwSLI6PQa+X1t5CFGrv1J1TWG+sOyMCeKz2ojaj6Fnl/rZEspogG+cvqbt4AE/2eIyD2QfLKTBNlQ==}
+    dev: true
+
+  /@emotion/is-prop-valid/1.2.1:
+    resolution: {integrity: sha512-61Mf7Ufx4aDxx1xlDeOm8aFFigGHE4z+0sKCa+IHCeZKiyP9RLD0Mmx7m8b9/Cf37f7NAvQOOJAbQQGVr5uERw==}
+    dependencies:
+      '@emotion/memoize': 0.8.1
+    dev: true
+
+  /@emotion/memoize/0.8.1:
+    resolution: {integrity: sha512-W2P2c/VRW1/1tLox0mVUalvnWXxavmv/Oum2aPsRcoDJuob75FC3Y8FbpfLwUegRcxINtGUMPq0tFCvYNTBXNA==}
+    dev: true
+
+  /@emotion/react/11.11.1_j3ahe22lw6ac2w6qvqp4kjqnqy:
+    resolution: {integrity: sha512-5mlW1DquU5HaxjLkfkGN1GA/fvVGdyHURRiX/0FHl2cfIfRxSOfmxEH5YS43edp0OldZrZ+dkBKbngxcNCdZvA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: '>=16.8.0'
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.22.10
+      '@emotion/babel-plugin': 11.11.0
+      '@emotion/cache': 11.11.0
+      '@emotion/serialize': 1.1.2
+      '@emotion/use-insertion-effect-with-fallbacks': 1.0.1_react@18.2.0
+      '@emotion/utils': 1.2.1
+      '@emotion/weak-memoize': 0.3.1
+      '@types/react': 18.2.20
+      hoist-non-react-statics: 3.3.2
+      react: 18.2.0
+    dev: true
+
+  /@emotion/serialize/1.1.2:
+    resolution: {integrity: sha512-zR6a/fkFP4EAcCMQtLOhIgpprZOwNmCldtpaISpvz348+DP4Mz8ZoKaGGCQpbzepNIUWbq4w6hNZkwDyKoS+HA==}
+    dependencies:
+      '@emotion/hash': 0.9.1
+      '@emotion/memoize': 0.8.1
+      '@emotion/unitless': 0.8.1
+      '@emotion/utils': 1.2.1
+      csstype: 3.1.2
+    dev: true
+
+  /@emotion/sheet/1.2.2:
+    resolution: {integrity: sha512-0QBtGvaqtWi+nx6doRwDdBIzhNdZrXUppvTM4dtZZWEGTXL/XE/yJxLMGlDT1Gt+UHH5IX1n+jkXyytE/av7OA==}
+    dev: true
+
+  /@emotion/styled/11.11.0_yteb73ll6h6uyykb3t5anncyhm:
+    resolution: {integrity: sha512-hM5Nnvu9P3midq5aaXj4I+lnSfNi7Pmd4EWk1fOZ3pxookaQTNew6bp4JaCBYM4HVFZF9g7UjJmsUmC2JlxOng==}
+    peerDependencies:
+      '@emotion/react': ^11.0.0-rc.0
+      '@types/react': '*'
+      react: '>=16.8.0'
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.22.10
+      '@emotion/babel-plugin': 11.11.0
+      '@emotion/is-prop-valid': 1.2.1
+      '@emotion/react': 11.11.1_j3ahe22lw6ac2w6qvqp4kjqnqy
+      '@emotion/serialize': 1.1.2
+      '@emotion/use-insertion-effect-with-fallbacks': 1.0.1_react@18.2.0
+      '@emotion/utils': 1.2.1
+      '@types/react': 18.2.20
+      react: 18.2.0
+    dev: true
+
+  /@emotion/unitless/0.8.1:
+    resolution: {integrity: sha512-KOEGMu6dmJZtpadb476IsZBclKvILjopjUii3V+7MnXIQCYh8W3NgNcgwo21n9LXZX6EDIKvqfjYxXebDwxKmQ==}
+    dev: true
+
+  /@emotion/use-insertion-effect-with-fallbacks/1.0.1_react@18.2.0:
+    resolution: {integrity: sha512-jT/qyKZ9rzLErtrjGgdkMBn2OP8wl0G3sQlBb3YPryvKHsjvINUhVaPFfP+fpBcOkmrVOVEEHQFJ7nbj2TH2gw==}
+    peerDependencies:
+      react: '>=16.8.0'
+    dependencies:
+      react: 18.2.0
+    dev: true
+
+  /@emotion/utils/1.2.1:
+    resolution: {integrity: sha512-Y2tGf3I+XVnajdItskUCn6LX+VUDmP6lTL4fcqsXAv43dnlbZiuW4MWQW38rW/BVWSE7Q/7+XQocmpnRYILUmg==}
+    dev: true
+
+  /@emotion/weak-memoize/0.3.1:
+    resolution: {integrity: sha512-EsBwpc7hBUJWAsNPBmJy4hxWx12v6bshQsldrVmjxJoc3isbxhOrF2IcCpaXxfvq03NwkI7sbsOLXbYuqF/8Ww==}
+    dev: true
+
+  /@mui/base/5.0.0-beta.11_qflmzdebv2ewfrqz6op6ohcc2q:
+    resolution: {integrity: sha512-FdKZGPd8qmC3ZNke7CNhzcEgToc02M6WYZc9hcBsNQ17bgAd3s9F//1bDDYgMVBYxDM71V0sv/hBHlOY4I1ZVA==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      '@types/react': ^17.0.0 || ^18.0.0
+      react: ^17.0.0 || ^18.0.0
+      react-dom: ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.22.10
+      '@emotion/is-prop-valid': 1.2.1
+      '@mui/types': 7.2.4_@types+react@18.2.20
+      '@mui/utils': 5.14.5_react@18.2.0
+      '@popperjs/core': 2.11.8
+      '@types/react': 18.2.20
+      clsx: 2.0.0
+      prop-types: 15.8.1
+      react: 18.2.0
+      react-dom: 18.2.0_react@18.2.0
+      react-is: 18.2.0
+    dev: true
+
+  /@mui/core-downloads-tracker/5.14.5:
+    resolution: {integrity: sha512-+wpGH1USwPcKMFPMvXqYPC6fEvhxM3FzxC8lyDiNK/imLyyJ6y2DPb1Oue7OGIKJWBmYBqrWWtfovrxd1aJHTA==}
+    dev: true
+
+  /@mui/icons-material/5.14.3_h5h5kh4s2gztkajbksiswsn4ia:
+    resolution: {integrity: sha512-XkxWPhageu1OPUm2LWjo5XqeQ0t2xfGe8EiLkRW9oz2LHMMZmijvCxulhgquUVTF1DnoSh+3KoDLSsoAFtVNVw==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      '@mui/material': ^5.0.0
+      '@types/react': ^17.0.0 || ^18.0.0
+      react: ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.22.10
+      '@mui/material': 5.14.5_ho7f4muyxo2kcc3eb2wgnvahca
+      '@types/react': 18.2.20
+      react: 18.2.0
+    dev: true
+
+  /@mui/material/5.14.5_ho7f4muyxo2kcc3eb2wgnvahca:
+    resolution: {integrity: sha512-4qa4GMfuZH0Ai3mttk5ccXP8a3sf7aPlAJwyMrUSz6h9hPri6BPou94zeu3rENhhmKLby9S/W1y+pmficy8JKA==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      '@emotion/react': ^11.5.0
+      '@emotion/styled': ^11.3.0
+      '@types/react': ^17.0.0 || ^18.0.0
+      react: ^17.0.0 || ^18.0.0
+      react-dom: ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@emotion/react':
+        optional: true
+      '@emotion/styled':
+        optional: true
+      '@types/react':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.22.10
+      '@emotion/react': 11.11.1_j3ahe22lw6ac2w6qvqp4kjqnqy
+      '@emotion/styled': 11.11.0_yteb73ll6h6uyykb3t5anncyhm
+      '@mui/base': 5.0.0-beta.11_qflmzdebv2ewfrqz6op6ohcc2q
+      '@mui/core-downloads-tracker': 5.14.5
+      '@mui/system': 5.14.5_zdbjtzkah63cptavg4ofw4cz7y
+      '@mui/types': 7.2.4_@types+react@18.2.20
+      '@mui/utils': 5.14.5_react@18.2.0
+      '@types/react': 18.2.20
+      '@types/react-transition-group': 4.4.6
+      clsx: 2.0.0
+      csstype: 3.1.2
+      prop-types: 15.8.1
+      react: 18.2.0
+      react-dom: 18.2.0_react@18.2.0
+      react-is: 18.2.0
+      react-transition-group: 4.4.5_biqbaboplfbrettd7655fr4n2y
+    dev: true
+
+  /@mui/private-theming/5.14.5_j3ahe22lw6ac2w6qvqp4kjqnqy:
+    resolution: {integrity: sha512-cC4C5RrpXpDaaZyH9QwmPhRLgz+f2SYbOty3cPkk4qPSOSfif2ZEcDD9HTENKDDd9deB+xkPKzzZhi8cxIx8Ig==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      '@types/react': ^17.0.0 || ^18.0.0
+      react: ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.22.10
+      '@mui/utils': 5.14.5_react@18.2.0
+      '@types/react': 18.2.20
+      prop-types: 15.8.1
+      react: 18.2.0
+    dev: true
+
+  /@mui/styled-engine/5.13.2_5uavjbr3lmuxf4a3t6dmknaeea:
+    resolution: {integrity: sha512-VCYCU6xVtXOrIN8lcbuPmoG+u7FYuOERG++fpY74hPpEWkyFQG97F+/XfTQVYzlR2m7nPjnwVUgATcTCMEaMvw==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      '@emotion/react': ^11.4.1
+      '@emotion/styled': ^11.3.0
+      react: ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@emotion/react':
+        optional: true
+      '@emotion/styled':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.22.10
+      '@emotion/cache': 11.11.0
+      '@emotion/react': 11.11.1_j3ahe22lw6ac2w6qvqp4kjqnqy
+      '@emotion/styled': 11.11.0_yteb73ll6h6uyykb3t5anncyhm
+      csstype: 3.1.2
+      prop-types: 15.8.1
+      react: 18.2.0
+    dev: true
+
+  /@mui/system/5.14.5_zdbjtzkah63cptavg4ofw4cz7y:
+    resolution: {integrity: sha512-mextXZHDeGcR7E1kx43TRARrVXy+gI4wzpUgNv7MqZs1dvTVXQGVeAT6ydj9d6FUqHBPMNLGV/21vJOrpqsL+w==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      '@emotion/react': ^11.5.0
+      '@emotion/styled': ^11.3.0
+      '@types/react': ^17.0.0 || ^18.0.0
+      react: ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@emotion/react':
+        optional: true
+      '@emotion/styled':
+        optional: true
+      '@types/react':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.22.10
+      '@emotion/react': 11.11.1_j3ahe22lw6ac2w6qvqp4kjqnqy
+      '@emotion/styled': 11.11.0_yteb73ll6h6uyykb3t5anncyhm
+      '@mui/private-theming': 5.14.5_j3ahe22lw6ac2w6qvqp4kjqnqy
+      '@mui/styled-engine': 5.13.2_5uavjbr3lmuxf4a3t6dmknaeea
+      '@mui/types': 7.2.4_@types+react@18.2.20
+      '@mui/utils': 5.14.5_react@18.2.0
+      '@types/react': 18.2.20
+      clsx: 2.0.0
+      csstype: 3.1.2
+      prop-types: 15.8.1
+      react: 18.2.0
+    dev: true
+
+  /@mui/types/7.2.4_@types+react@18.2.20:
+    resolution: {integrity: sha512-LBcwa8rN84bKF+f5sDyku42w1NTxaPgPyYKODsh01U1fVstTClbUoSA96oyRBnSNyEiAVjKm6Gwx9vjR+xyqHA==}
+    peerDependencies:
+      '@types/react': '*'
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+    dependencies:
+      '@types/react': 18.2.20
+    dev: true
+
+  /@mui/utils/5.14.5_react@18.2.0:
+    resolution: {integrity: sha512-6Hzw63VR9C5xYv+CbjndoRLU6Gntal8rJ5W+GUzkyHrGWIyYPWZPa6AevnyGioySNETATe1H9oXS8f/7qgIHJA==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      react: ^17.0.0 || ^18.0.0
+    dependencies:
+      '@babel/runtime': 7.22.10
+      '@types/prop-types': 15.7.5
+      '@types/react-is': 18.2.1
+      prop-types: 15.8.1
+      react: 18.2.0
+      react-is: 18.2.0
+    dev: true
+
+  /@popperjs/core/2.11.8:
+    resolution: {integrity: sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==}
+    dev: true
+
+  /@remix-run/router/1.8.0:
+    resolution: {integrity: sha512-mrfKqIHnSZRyIzBcanNJmVQELTnX+qagEDlcKO90RgRBVOZGSGvZKeDihTRfWcqoDn5N/NkUcwWTccnpN18Tfg==}
+    engines: {node: '>=14.0.0'}
+    dev: true
+
+  /@swc/core-darwin-arm64/1.3.75:
+    resolution: {integrity: sha512-anDnx9L465lGbjB2mvcV54NGHW6illr0IDvVV7JmkabYUVneaRdQvTr0tbHv3xjHnjrK1wuwVOHKV0LcQF2tnQ==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [darwin]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core-darwin-x64/1.3.75:
+    resolution: {integrity: sha512-dIHDfrLmeZfr2xwi1whO7AmzdI3HdamgvxthaL+S8L1x8TeczAZEvsmZTjy3s8p3Va4rbGXcb3+uBhmfkqCbfw==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [darwin]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core-linux-arm-gnueabihf/1.3.75:
+    resolution: {integrity: sha512-qeJmvMGrjC6xt+G0R4kVqqxvlhxJx7tTzhcEoWgLJnfvGZiF6SJdsef4OSM7HuReXrlBoEtJbfGPrLJtbV+C0w==}
+    engines: {node: '>=10'}
+    cpu: [arm]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core-linux-arm64-gnu/1.3.75:
+    resolution: {integrity: sha512-sqA9JqHEJBF4AdNuwo5zRqq0HC3l31SPsG9zpRa4nRzG5daBBJ80H7fi6PZQud1rfNNq+Q08gjYrdrxwHstvjw==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core-linux-arm64-musl/1.3.75:
+    resolution: {integrity: sha512-95rQT5xTAL3eKhMJbJbLsZHHP9EUlh1rcrFoLf0gUApoVF8g94QjZ9hYZiI72mMP5WPjgTEXQVnVB9O2GxeaLw==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core-linux-x64-gnu/1.3.75:
+    resolution: {integrity: sha512-If7UpAhnPduMmtC+TSgPpZ1UXZfp2hIpjUFxpeCmHHYLS6Fn/2GZC5hpEiu+wvFJF0hzPh93eNAHa9gUxGUG+w==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core-linux-x64-musl/1.3.75:
+    resolution: {integrity: sha512-HOhxX0YNHTElCZqIviquka3CGYTN8rSQ6BdFfSk/K0O+ZEHx3qGte0qr+gGLPF/237GxreUkp3OMaWKuURtuCg==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core-win32-arm64-msvc/1.3.75:
+    resolution: {integrity: sha512-7QPI+mvBXAerVfWahrgBNe+g7fK8PuetxFnZSEmXUcDXvWcdJXAndD7GjAJzbDyjQpLKHbsDKMiHYvfNxZoN/A==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [win32]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core-win32-ia32-msvc/1.3.75:
+    resolution: {integrity: sha512-EfABCy4Wlq7O5ShWsm32FgDkSjyeyj/SQ4wnUIvWpkXhgfT1iNXky7KRU1HtX+SmnVk/k/NnabVZpIklYbjtZA==}
+    engines: {node: '>=10'}
+    cpu: [ia32]
+    os: [win32]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core-win32-x64-msvc/1.3.75:
+    resolution: {integrity: sha512-cTvP0pOD9C3pSp1cwtt85ZsrUkQz8RZfSPhM+jCGxKxmoowDCnInoOQ4Ica/ehyuUnQ4/IstSdYtYpO5yzPDJg==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [win32]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@swc/core/1.3.75:
+    resolution: {integrity: sha512-YLqd5oZVnaOq/OzkjRSsJUQqAfKYiD0fzUyVUPVlNNCoQEfVfSMcXH80hLmYe9aDH0T/a7qEMjWyIr/0kWqy1A==}
+    engines: {node: '>=10'}
+    requiresBuild: true
+    peerDependencies:
+      '@swc/helpers': ^0.5.0
+    peerDependenciesMeta:
+      '@swc/helpers':
+        optional: true
+    optionalDependencies:
+      '@swc/core-darwin-arm64': 1.3.75
+      '@swc/core-darwin-x64': 1.3.75
+      '@swc/core-linux-arm-gnueabihf': 1.3.75
+      '@swc/core-linux-arm64-gnu': 1.3.75
+      '@swc/core-linux-arm64-musl': 1.3.75
+      '@swc/core-linux-x64-gnu': 1.3.75
+      '@swc/core-linux-x64-musl': 1.3.75
+      '@swc/core-win32-arm64-msvc': 1.3.75
+      '@swc/core-win32-ia32-msvc': 1.3.75
+      '@swc/core-win32-x64-msvc': 1.3.75
+    dev: true
+
+  /@types/parse-json/4.0.0:
+    resolution: {integrity: sha512-//oorEZjL6sbPcKUaCdIGlIUeH26mgzimjBB77G6XRgnDl/L5wOnpyBGRe/Mmf5CVW3PwEBE1NjiMZ/ssFh4wA==}
+    dev: true
+
+  /@types/prop-types/15.7.5:
+    resolution: {integrity: sha512-JCB8C6SnDoQf0cNycqd/35A7MjcnK+ZTqE7judS6o7utxUCg6imJg3QK2qzHKszlTjcj2cn+NwMB2i96ubpj7w==}
+    dev: true
+
+  /@types/react-dom/18.2.7:
+    resolution: {integrity: sha512-GRaAEriuT4zp9N4p1i8BDBYmEyfo+xQ3yHjJU4eiK5NDa1RmUZG+unZABUTK4/Ox/M+GaHwb6Ow8rUITrtjszA==}
+    dependencies:
+      '@types/react': 18.2.20
+    dev: true
+
+  /@types/react-is/18.2.1:
+    resolution: {integrity: sha512-wyUkmaaSZEzFZivD8F2ftSyAfk6L+DfFliVj/mYdOXbVjRcS87fQJLTnhk6dRZPuJjI+9g6RZJO4PNCngUrmyw==}
+    dependencies:
+      '@types/react': 18.2.20
+    dev: true
+
+  /@types/react-transition-group/4.4.6:
+    resolution: {integrity: sha512-VnCdSxfcm08KjsJVQcfBmhEQAPnLB8G08hAxn39azX1qYBQ/5RVQuoHuKIcfKOdncuaUvEpFKFzEvbtIMsfVew==}
+    dependencies:
+      '@types/react': 18.2.20
+    dev: true
+
+  /@types/react/18.2.20:
+    resolution: {integrity: sha512-WKNtmsLWJM/3D5mG4U84cysVY31ivmyw85dE84fOCk5Hx78wezB/XEjVPWl2JTZ5FkEeaTJf+VgUAUn3PE7Isw==}
+    dependencies:
+      '@types/prop-types': 15.7.5
+      '@types/scheduler': 0.16.3
+      csstype: 3.1.2
+    dev: true
+
+  /@types/scheduler/0.16.3:
+    resolution: {integrity: sha512-5cJ8CB4yAx7BH1oMvdU0Jh9lrEXyPkar6F9G/ERswkCuvP4KQZfZkSjcMbAICCpQTN4OuZn8tz0HiKv9TGZgrQ==}
+    dev: true
+
+  /ansi-styles/3.2.1:
+    resolution: {integrity: sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==}
+    engines: {node: '>=4'}
+    dependencies:
+      color-convert: 1.9.3
+    dev: true
+
+  /babel-plugin-macros/3.1.0:
+    resolution: {integrity: sha512-Cg7TFGpIr01vOQNODXOOaGz2NpCU5gl8x1qJFbb6hbZxR7XrcE2vtbAsTAbJ7/xwJtUuJEw8K8Zr/AE0LHlesg==}
+    engines: {node: '>=10', npm: '>=6'}
+    dependencies:
+      '@babel/runtime': 7.22.10
+      cosmiconfig: 7.1.0
+      resolve: 1.22.4
+    dev: true
+
+  /callsites/3.1.0:
+    resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
+    engines: {node: '>=6'}
+    dev: true
+
+  /chalk/2.4.2:
+    resolution: {integrity: sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==}
+    engines: {node: '>=4'}
+    dependencies:
+      ansi-styles: 3.2.1
+      escape-string-regexp: 1.0.5
+      supports-color: 5.5.0
+    dev: true
+
+  /clsx/2.0.0:
+    resolution: {integrity: sha512-rQ1+kcj+ttHG0MKVGBUXwayCCF1oh39BF5COIpRzuCEv8Mwjv0XucrI2ExNTOn9IlLifGClWQcU9BrZORvtw6Q==}
+    engines: {node: '>=6'}
+    dev: true
+
+  /color-convert/1.9.3:
+    resolution: {integrity: sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==}
+    dependencies:
+      color-name: 1.1.3
+    dev: true
+
+  /color-name/1.1.3:
+    resolution: {integrity: sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==}
+    dev: true
+
+  /convert-source-map/1.9.0:
+    resolution: {integrity: sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==}
+    dev: true
+
+  /cosmiconfig/7.1.0:
+    resolution: {integrity: sha512-AdmX6xUzdNASswsFtmwSt7Vj8po9IuqXm0UXz7QKPuEUmPB4XyjGfaAr2PSuELMwkRMVH1EpIkX5bTZGRB3eCA==}
+    engines: {node: '>=10'}
+    dependencies:
+      '@types/parse-json': 4.0.0
+      import-fresh: 3.3.0
+      parse-json: 5.2.0
+      path-type: 4.0.0
+      yaml: 1.10.2
+    dev: true
+
+  /csstype/3.1.2:
+    resolution: {integrity: sha512-I7K1Uu0MBPzaFKg4nI5Q7Vs2t+3gWWW648spaF+Rg7pI9ds18Ugn+lvg4SHczUdKlHI5LWBXyqfS8+DufyBsgQ==}
+    dev: true
+
+  /dom-helpers/5.2.1:
+    resolution: {integrity: sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==}
+    dependencies:
+      '@babel/runtime': 7.22.10
+      csstype: 3.1.2
+    dev: true
+
+  /error-ex/1.3.2:
+    resolution: {integrity: sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==}
+    dependencies:
+      is-arrayish: 0.2.1
+    dev: true
+
+  /escape-string-regexp/1.0.5:
+    resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
+    engines: {node: '>=0.8.0'}
+    dev: true
+
+  /escape-string-regexp/4.0.0:
+    resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
+    engines: {node: '>=10'}
+    dev: true
+
+  /find-root/1.1.0:
+    resolution: {integrity: sha512-NKfW6bec6GfKc0SGx1e07QZY9PE99u0Bft/0rzSD5k3sO/vwkVUpDUKVm5Gpp5Ue3YfShPFTX2070tDs5kB9Ng==}
+    dev: true
+
+  /function-bind/1.1.1:
+    resolution: {integrity: sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A==}
+    dev: true
+
+  /has-flag/3.0.0:
+    resolution: {integrity: sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==}
+    engines: {node: '>=4'}
+    dev: true
+
+  /has/1.0.3:
+    resolution: {integrity: sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==}
+    engines: {node: '>= 0.4.0'}
+    dependencies:
+      function-bind: 1.1.1
+    dev: true
+
+  /hoist-non-react-statics/3.3.2:
+    resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==}
+    dependencies:
+      react-is: 16.13.1
+    dev: true
+
+  /import-fresh/3.3.0:
+    resolution: {integrity: sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==}
+    engines: {node: '>=6'}
+    dependencies:
+      parent-module: 1.0.1
+      resolve-from: 4.0.0
+    dev: true
+
+  /is-arrayish/0.2.1:
+    resolution: {integrity: sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
+    dev: true
+
+  /is-core-module/2.13.0:
+    resolution: {integrity: sha512-Z7dk6Qo8pOCp3l4tsX2C5ZVas4V+UxwQodwZhLopL91TX8UyyHEXafPcyoeeWuLrwzHcr3igO78wNLwHJHsMCQ==}
+    dependencies:
+      has: 1.0.3
+    dev: true
+
+  /js-tokens/4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+    dev: true
+
+  /json-parse-even-better-errors/2.3.1:
+    resolution: {integrity: sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
+    dev: true
+
+  /lines-and-columns/1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+    dev: true
+
+  /loose-envify/1.4.0:
+    resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
+    hasBin: true
+    dependencies:
+      js-tokens: 4.0.0
+    dev: true
+
+  /object-assign/4.1.1:
+    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
+    engines: {node: '>=0.10.0'}
+    dev: true
+
+  /parent-module/1.0.1:
+    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
+    engines: {node: '>=6'}
+    dependencies:
+      callsites: 3.1.0
+    dev: true
+
+  /parse-json/5.2.0:
+    resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
+    engines: {node: '>=8'}
+    dependencies:
+      '@babel/code-frame': 7.22.10
+      error-ex: 1.3.2
+      json-parse-even-better-errors: 2.3.1
+      lines-and-columns: 1.2.4
+    dev: true
+
+  /path-parse/1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+    dev: true
+
+  /path-type/4.0.0:
+    resolution: {integrity: sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==}
+    engines: {node: '>=8'}
+    dev: true
+
+  /prettier/3.0.2:
+    resolution: {integrity: sha512-o2YR9qtniXvwEZlOKbveKfDQVyqxbEIWn48Z8m3ZJjBjcCmUy3xZGIv+7AkaeuaTr6yPXJjwv07ZWlsWbEy1rQ==}
+    engines: {node: '>=14'}
+    hasBin: true
+    dev: true
+
+  /prop-types/15.8.1:
+    resolution: {integrity: sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}
+    dependencies:
+      loose-envify: 1.4.0
+      object-assign: 4.1.1
+      react-is: 16.13.1
+    dev: true
+
+  /react-dom/18.2.0_react@18.2.0:
+    resolution: {integrity: sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==}
+    peerDependencies:
+      react: ^18.2.0
+    dependencies:
+      loose-envify: 1.4.0
+      react: 18.2.0
+      scheduler: 0.23.0
+    dev: true
+
+  /react-is/16.13.1:
+    resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
+    dev: true
+
+  /react-is/18.2.0:
+    resolution: {integrity: sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w==}
+    dev: true
+
+  /react-router-dom/6.15.0_biqbaboplfbrettd7655fr4n2y:
+    resolution: {integrity: sha512-aR42t0fs7brintwBGAv2+mGlCtgtFQeOzK0BM1/OiqEzRejOZtpMZepvgkscpMUnKb8YO84G7s3LsHnnDNonbQ==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      react: '>=16.8'
+      react-dom: '>=16.8'
+    dependencies:
+      '@remix-run/router': 1.8.0
+      react: 18.2.0
+      react-dom: 18.2.0_react@18.2.0
+      react-router: 6.15.0_react@18.2.0
+    dev: true
+
+  /react-router/6.15.0_react@18.2.0:
+    resolution: {integrity: sha512-NIytlzvzLwJkCQj2HLefmeakxxWHWAP+02EGqWEZy+DgfHHKQMUoBBjUQLOtFInBMhWtb3hiUy6MfFgwLjXhqg==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      react: '>=16.8'
+    dependencies:
+      '@remix-run/router': 1.8.0
+      react: 18.2.0
+    dev: true
+
+  /react-transition-group/4.4.5_biqbaboplfbrettd7655fr4n2y:
+    resolution: {integrity: sha512-pZcd1MCJoiKiBR2NRxeCRg13uCXbydPnmB4EOeRrY7480qNWO8IIgQG6zlDkm6uRMsURXPuKq0GWtiM59a5Q6g==}
+    peerDependencies:
+      react: '>=16.6.0'
+      react-dom: '>=16.6.0'
+    dependencies:
+      '@babel/runtime': 7.22.10
+      dom-helpers: 5.2.1
+      loose-envify: 1.4.0
+      prop-types: 15.8.1
+      react: 18.2.0
+      react-dom: 18.2.0_react@18.2.0
+    dev: true
+
+  /react/18.2.0:
+    resolution: {integrity: sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==}
+    engines: {node: '>=0.10.0'}
+    dependencies:
+      loose-envify: 1.4.0
+    dev: true
+
+  /regenerator-runtime/0.14.0:
+    resolution: {integrity: sha512-srw17NI0TUWHuGa5CFGGmhfNIeja30WMBfbslPNhf6JrqQlLN5gcrvig1oqPxiVaXb0oW0XRKtH6Nngs5lKCIA==}
+    dev: true
+
+  /resolve-from/4.0.0:
+    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
+    engines: {node: '>=4'}
+    dev: true
+
+  /resolve/1.22.4:
+    resolution: {integrity: sha512-PXNdCiPqDqeUou+w1C2eTQbNfxKSuMxqTCuvlmmMsk1NWHL5fRrhY6Pl0qEYYc6+QqGClco1Qj8XnjPego4wfg==}
+    hasBin: true
+    dependencies:
+      is-core-module: 2.13.0
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+    dev: true
+
+  /scheduler/0.23.0:
+    resolution: {integrity: sha512-CtuThmgHNg7zIZWAXi3AsyIzA3n4xx7aNyjwC2VJldO2LMVDhFK+63xGqq6CsJH4rTAt6/M+N4GhZiDYPx9eUw==}
+    dependencies:
+      loose-envify: 1.4.0
+    dev: true
+
+  /source-map/0.5.7:
+    resolution: {integrity: sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==}
+    engines: {node: '>=0.10.0'}
+    dev: true
+
+  /stylis/4.2.0:
+    resolution: {integrity: sha512-Orov6g6BB1sDfYgzWfTHDOxamtX1bE/zo104Dh9e6fqJ3PooipYyfJ0pUmrZO2wAvO8YbEyeFrkV91XTsGMSrw==}
+    dev: true
+
+  /supports-color/5.5.0:
+    resolution: {integrity: sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==}
+    engines: {node: '>=4'}
+    dependencies:
+      has-flag: 3.0.0
+    dev: true
+
+  /supports-preserve-symlinks-flag/1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+    dev: true
+
+  /to-fast-properties/2.0.0:
+    resolution: {integrity: sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==}
+    engines: {node: '>=4'}
+    dev: true
+
+  /tslib/2.6.2:
+    resolution: {integrity: sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q==}
+    dev: true
+
+  /yaml/1.10.2:
+    resolution: {integrity: sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==}
+    engines: {node: '>= 6'}
+    dev: true

scripts/govendor

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+rm -rf vendor
+go mod tidy -e
+go mod vendor -e
+find vendor -name "BUILD.bazel" -delete
+find vendor -name "BUILD" -delete
+bazel run //:gazelle
+bazel run //:gazelle-update-repos

third_party/BUILD.bazel

@@ -0,0 +1,5 @@
+java_binary(
+    name = "copybara_uberjar",
+    main_class = "com.google.copybara.Main",
+    runtime_deps = [":copybara_deploy.jar"],
+)

third_party/copybara/BUILD

@@ -0,0 +1,3 @@
+load(":targets.bzl", "declare_targets")
+
+declare_targets()

third_party/copybara/googleapis/copy.bara.sky

@@ -0,0 +1,14 @@
+core.workflow(
+    name = "default",
+    origin = git.github_origin(
+        url = "https://github.com/googleapis/googleapis",
+        ref = "a85e6dfebd30932fbf8bfb1ce5600b2d6d645e9b",
+    ),
+    destination = folder.destination(),
+    origin_files = glob(["google/api/*.proto", "LICENSE"]),
+    destination_files = glob(["third_party/googleapis/**"], exclude = ["README_INTERNAL.txt"]),
+    authoring = authoring.pass_thru("peridot-copybara <peridot+copybara@lists.resf.org>"),
+    transformations = [
+        core.move("", "third_party/googleapis"),
+    ],
+)

third_party/copybara/targets.bzl

@@ -0,0 +1,11 @@
+load("//tools/build_rules/copybara:copybara.bzl", "copybara")
+
+copybara_list = [
+    "googleapis",
+    "pika",
+    "rules_dart",
+]
+
+def declare_targets():
+    for r in copybara_list:
+        copybara(name = r)

third_party/googleapis/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

third_party/googleapis/google/api/annotations.proto

@@ -0,0 +1,31 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/api/http.proto";
+import "google/protobuf/descriptor.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/api/annotations;annotations";
+option java_multiple_files = true;
+option java_outer_classname = "AnnotationsProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+extend google.protobuf.MethodOptions {
+  // See `HttpRule`.
+  HttpRule http = 72295728;
+}

third_party/googleapis/google/api/auth.proto

@@ -0,0 +1,236 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "AuthProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// `Authentication` defines the authentication configuration for API methods
+// provided by an API service.
+//
+// Example:
+//
+//     name: calendar.googleapis.com
+//     authentication:
+//       providers:
+//       - id: google_calendar_auth
+//         jwks_uri: https://www.googleapis.com/oauth2/v1/certs
+//         issuer: https://securetoken.google.com
+//       rules:
+//       - selector: "*"
+//         requirements:
+//           provider_id: google_calendar_auth
+//       - selector: google.calendar.Delegate
+//         oauth:
+//           canonical_scopes: https://www.googleapis.com/auth/calendar.read
+message Authentication {
+  // A list of authentication rules that apply to individual API methods.
+  //
+  // **NOTE:** All service configuration rules follow "last one wins" order.
+  repeated AuthenticationRule rules = 3;
+
+  // Defines a set of authentication providers that a service supports.
+  repeated AuthProvider providers = 4;
+}
+
+// Authentication rules for the service.
+//
+// By default, if a method has any authentication requirements, every request
+// must include a valid credential matching one of the requirements.
+// It's an error to include more than one kind of credential in a single
+// request.
+//
+// If a method doesn't have any auth requirements, request credentials will be
+// ignored.
+message AuthenticationRule {
+  // Selects the methods to which this rule applies.
+  //
+  // Refer to [selector][google.api.DocumentationRule.selector] for syntax details.
+  string selector = 1;
+
+  // The requirements for OAuth credentials.
+  OAuthRequirements oauth = 2;
+
+  // If true, the service accepts API keys without any other credential.
+  // This flag only applies to HTTP and gRPC requests.
+  bool allow_without_credential = 5;
+
+  // Requirements for additional authentication providers.
+  repeated AuthRequirement requirements = 7;
+}
+
+// Specifies a location to extract JWT from an API request.
+message JwtLocation {
+  oneof in {
+    // Specifies HTTP header name to extract JWT token.
+    string header = 1;
+
+    // Specifies URL query parameter name to extract JWT token.
+    string query = 2;
+
+    // Specifies cookie name to extract JWT token.
+    string cookie = 4;
+  }
+
+  // The value prefix. The value format is "value_prefix{token}"
+  // Only applies to "in" header type. Must be empty for "in" query type.
+  // If not empty, the header value has to match (case sensitive) this prefix.
+  // If not matched, JWT will not be extracted. If matched, JWT will be
+  // extracted after the prefix is removed.
+  //
+  // For example, for "Authorization: Bearer {JWT}",
+  // value_prefix="Bearer " with a space at the end.
+  string value_prefix = 3;
+}
+
+// Configuration for an authentication provider, including support for
+// [JSON Web Token
+// (JWT)](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32).
+message AuthProvider {
+  // The unique identifier of the auth provider. It will be referred to by
+  // `AuthRequirement.provider_id`.
+  //
+  // Example: "bookstore_auth".
+  string id = 1;
+
+  // Identifies the principal that issued the JWT. See
+  // https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.1
+  // Usually a URL or an email address.
+  //
+  // Example: https://securetoken.google.com
+  // Example: 1234567-compute@developer.gserviceaccount.com
+  string issuer = 2;
+
+  // URL of the provider's public key set to validate signature of the JWT. See
+  // [OpenID
+  // Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+  // Optional if the key set document:
+  //  - can be retrieved from
+  //    [OpenID
+  //    Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html)
+  //    of the issuer.
+  //  - can be inferred from the email domain of the issuer (e.g. a Google
+  //  service account).
+  //
+  // Example: https://www.googleapis.com/oauth2/v1/certs
+  string jwks_uri = 3;
+
+  // The list of JWT
+  // [audiences](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.3).
+  // that are allowed to access. A JWT containing any of these audiences will
+  // be accepted. When this setting is absent, JWTs with audiences:
+  //   - "https://[service.name]/[google.protobuf.Api.name]"
+  //   - "https://[service.name]/"
+  // will be accepted.
+  // For example, if no audiences are in the setting, LibraryService API will
+  // accept JWTs with the following audiences:
+  //   -
+  //   https://library-example.googleapis.com/google.example.library.v1.LibraryService
+  //   - https://library-example.googleapis.com/
+  //
+  // Example:
+  //
+  //     audiences: bookstore_android.apps.googleusercontent.com,
+  //                bookstore_web.apps.googleusercontent.com
+  string audiences = 4;
+
+  // Redirect URL if JWT token is required but not present or is expired.
+  // Implement authorizationUrl of securityDefinitions in OpenAPI spec.
+  string authorization_url = 5;
+
+  // Defines the locations to extract the JWT.  For now it is only used by the
+  // Cloud Endpoints to store the OpenAPI extension [x-google-jwt-locations]
+  // (https://cloud.google.com/endpoints/docs/openapi/openapi-extensions#x-google-jwt-locations)
+  //
+  // JWT locations can be one of HTTP headers, URL query parameters or
+  // cookies. The rule is that the first match wins.
+  //
+  // If not specified,  default to use following 3 locations:
+  //    1) Authorization: Bearer
+  //    2) x-goog-iap-jwt-assertion
+  //    3) access_token query parameter
+  //
+  // Default locations can be specified as followings:
+  //    jwt_locations:
+  //    - header: Authorization
+  //      value_prefix: "Bearer "
+  //    - header: x-goog-iap-jwt-assertion
+  //    - query: access_token
+  repeated JwtLocation jwt_locations = 6;
+}
+
+// OAuth scopes are a way to define data and permissions on data. For example,
+// there are scopes defined for "Read-only access to Google Calendar" and
+// "Access to Cloud Platform". Users can consent to a scope for an application,
+// giving it permission to access that data on their behalf.
+//
+// OAuth scope specifications should be fairly coarse grained; a user will need
+// to see and understand the text description of what your scope means.
+//
+// In most cases: use one or at most two OAuth scopes for an entire family of
+// products. If your product has multiple APIs, you should probably be sharing
+// the OAuth scope across all of those APIs.
+//
+// When you need finer grained OAuth consent screens: talk with your product
+// management about how developers will use them in practice.
+//
+// Please note that even though each of the canonical scopes is enough for a
+// request to be accepted and passed to the backend, a request can still fail
+// due to the backend requiring additional scopes or permissions.
+message OAuthRequirements {
+  // The list of publicly documented OAuth scopes that are allowed access. An
+  // OAuth token containing any of these scopes will be accepted.
+  //
+  // Example:
+  //
+  //      canonical_scopes: https://www.googleapis.com/auth/calendar,
+  //                        https://www.googleapis.com/auth/calendar.read
+  string canonical_scopes = 1;
+}
+
+// User-defined authentication requirements, including support for
+// [JSON Web Token
+// (JWT)](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32).
+message AuthRequirement {
+  // [id][google.api.AuthProvider.id] from authentication provider.
+  //
+  // Example:
+  //
+  //     provider_id: bookstore_auth
+  string provider_id = 1;
+
+  // NOTE: This will be deprecated soon, once AuthProvider.audiences is
+  // implemented and accepted in all the runtime components.
+  //
+  // The list of JWT
+  // [audiences](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.3).
+  // that are allowed to access. A JWT containing any of these audiences will
+  // be accepted. When this setting is absent, only JWTs with audience
+  // "https://[Service_name][google.api.Service.name]/[API_name][google.protobuf.Api.name]"
+  // will be accepted. For example, if no audiences are in the setting,
+  // LibraryService API will only accept JWTs with the following audience
+  // "https://library-example.googleapis.com/google.example.library.v1.LibraryService".
+  //
+  // Example:
+  //
+  //     audiences: bookstore_android.apps.googleusercontent.com,
+  //                bookstore_web.apps.googleusercontent.com
+  string audiences = 2;
+}

third_party/googleapis/google/api/backend.proto

@@ -0,0 +1,181 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "BackendProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// `Backend` defines the backend configuration for a service.
+message Backend {
+  // A list of API backend rules that apply to individual API methods.
+  //
+  // **NOTE:** All service configuration rules follow "last one wins" order.
+  repeated BackendRule rules = 1;
+}
+
+// A backend rule provides configuration for an individual API element.
+message BackendRule {
+  // Path Translation specifies how to combine the backend address with the
+  // request path in order to produce the appropriate forwarding URL for the
+  // request.
+  //
+  // Path Translation is applicable only to HTTP-based backends. Backends which
+  // do not accept requests over HTTP/HTTPS should leave `path_translation`
+  // unspecified.
+  enum PathTranslation {
+    PATH_TRANSLATION_UNSPECIFIED = 0;
+
+    // Use the backend address as-is, with no modification to the path. If the
+    // URL pattern contains variables, the variable names and values will be
+    // appended to the query string. If a query string parameter and a URL
+    // pattern variable have the same name, this may result in duplicate keys in
+    // the query string.
+    //
+    // # Examples
+    //
+    // Given the following operation config:
+    //
+    //     Method path:        /api/company/{cid}/user/{uid}
+    //     Backend address:    https://example.cloudfunctions.net/getUser
+    //
+    // Requests to the following request paths will call the backend at the
+    // translated path:
+    //
+    //     Request path: /api/company/widgetworks/user/johndoe
+    //     Translated:
+    //     https://example.cloudfunctions.net/getUser?cid=widgetworks&uid=johndoe
+    //
+    //     Request path: /api/company/widgetworks/user/johndoe?timezone=EST
+    //     Translated:
+    //     https://example.cloudfunctions.net/getUser?timezone=EST&cid=widgetworks&uid=johndoe
+    CONSTANT_ADDRESS = 1;
+
+    // The request path will be appended to the backend address.
+    //
+    // # Examples
+    //
+    // Given the following operation config:
+    //
+    //     Method path:        /api/company/{cid}/user/{uid}
+    //     Backend address:    https://example.appspot.com
+    //
+    // Requests to the following request paths will call the backend at the
+    // translated path:
+    //
+    //     Request path: /api/company/widgetworks/user/johndoe
+    //     Translated:
+    //     https://example.appspot.com/api/company/widgetworks/user/johndoe
+    //
+    //     Request path: /api/company/widgetworks/user/johndoe?timezone=EST
+    //     Translated:
+    //     https://example.appspot.com/api/company/widgetworks/user/johndoe?timezone=EST
+    APPEND_PATH_TO_ADDRESS = 2;
+  }
+
+  // Selects the methods to which this rule applies.
+  //
+  // Refer to [selector][google.api.DocumentationRule.selector] for syntax details.
+  string selector = 1;
+
+  // The address of the API backend.
+  //
+  // The scheme is used to determine the backend protocol and security.
+  // The following schemes are accepted:
+  //
+  //    SCHEME        PROTOCOL    SECURITY
+  //    http://       HTTP        None
+  //    https://      HTTP        TLS
+  //    grpc://       gRPC        None
+  //    grpcs://      gRPC        TLS
+  //
+  // It is recommended to explicitly include a scheme. Leaving out the scheme
+  // may cause constrasting behaviors across platforms.
+  //
+  // If the port is unspecified, the default is:
+  // - 80 for schemes without TLS
+  // - 443 for schemes with TLS
+  //
+  // For HTTP backends, use [protocol][google.api.BackendRule.protocol]
+  // to specify the protocol version.
+  string address = 2;
+
+  // The number of seconds to wait for a response from a request. The default
+  // varies based on the request protocol and deployment environment.
+  double deadline = 3;
+
+  // Deprecated, do not use.
+  double min_deadline = 4 [deprecated = true];
+
+  // The number of seconds to wait for the completion of a long running
+  // operation. The default is no deadline.
+  double operation_deadline = 5;
+
+  PathTranslation path_translation = 6;
+
+  // Authentication settings used by the backend.
+  //
+  // These are typically used to provide service management functionality to
+  // a backend served on a publicly-routable URL. The `authentication`
+  // details should match the authentication behavior used by the backend.
+  //
+  // For example, specifying `jwt_audience` implies that the backend expects
+  // authentication via a JWT.
+  //
+  // When authentication is unspecified, the resulting behavior is the same
+  // as `disable_auth` set to `true`.
+  //
+  // Refer to https://developers.google.com/identity/protocols/OpenIDConnect for
+  // JWT ID token.
+  oneof authentication {
+    // The JWT audience is used when generating a JWT ID token for the backend.
+    // This ID token will be added in the HTTP "authorization" header, and sent
+    // to the backend.
+    string jwt_audience = 7;
+
+    // When disable_auth is true, a JWT ID token won't be generated and the
+    // original "Authorization" HTTP header will be preserved. If the header is
+    // used to carry the original token and is expected by the backend, this
+    // field must be set to true to preserve the header.
+    bool disable_auth = 8;
+  }
+
+  // The protocol used for sending a request to the backend.
+  // The supported values are "http/1.1" and "h2".
+  //
+  // The default value is inferred from the scheme in the
+  // [address][google.api.BackendRule.address] field:
+  //
+  //    SCHEME        PROTOCOL
+  //    http://       http/1.1
+  //    https://      http/1.1
+  //    grpc://       h2
+  //    grpcs://      h2
+  //
+  // For secure HTTP backends (https://) that support HTTP/2, set this field
+  // to "h2" for improved performance.
+  //
+  // Configuring this field to non-default values is only supported for secure
+  // HTTP backends. This field will be ignored for all other backends.
+  //
+  // See
+  // https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
+  // for more details on the supported values.
+  string protocol = 9;
+}

third_party/googleapis/google/api/billing.proto

@@ -0,0 +1,75 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "BillingProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Billing related configuration of the service.
+//
+// The following example shows how to configure monitored resources and metrics
+// for billing, `consumer_destinations` is the only supported destination and
+// the monitored resources need at least one label key
+// `cloud.googleapis.com/location` to indicate the location of the billing
+// usage, using different monitored resources between monitoring and billing is
+// recommended so they can be evolved independently:
+//
+//
+//     monitored_resources:
+//     - type: library.googleapis.com/billing_branch
+//       labels:
+//       - key: cloud.googleapis.com/location
+//         description: |
+//           Predefined label to support billing location restriction.
+//       - key: city
+//         description: |
+//           Custom label to define the city where the library branch is located
+//           in.
+//       - key: name
+//         description: Custom label to define the name of the library branch.
+//     metrics:
+//     - name: library.googleapis.com/book/borrowed_count
+//       metric_kind: DELTA
+//       value_type: INT64
+//       unit: "1"
+//     billing:
+//       consumer_destinations:
+//       - monitored_resource: library.googleapis.com/billing_branch
+//         metrics:
+//         - library.googleapis.com/book/borrowed_count
+message Billing {
+  // Configuration of a specific billing destination (Currently only support
+  // bill against consumer project).
+  message BillingDestination {
+    // The monitored resource type. The type must be defined in
+    // [Service.monitored_resources][google.api.Service.monitored_resources] section.
+    string monitored_resource = 1;
+
+    // Names of the metrics to report to this billing destination.
+    // Each name must be defined in [Service.metrics][google.api.Service.metrics] section.
+    repeated string metrics = 2;
+  }
+
+  // Billing configurations for sending metrics to the consumer project.
+  // There can be multiple consumer destinations per service, each one must have
+  // a different monitored resource type. A metric can be used in at most
+  // one consumer destination.
+  repeated BillingDestination consumer_destinations = 8;
+}

third_party/googleapis/google/api/client.proto

@@ -0,0 +1,349 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/api/launch_stage.proto";
+import "google/protobuf/descriptor.proto";
+import "google/protobuf/duration.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/api/annotations;annotations";
+option java_multiple_files = true;
+option java_outer_classname = "ClientProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+extend google.protobuf.MethodOptions {
+  // A definition of a client library method signature.
+  //
+  // In client libraries, each proto RPC corresponds to one or more methods
+  // which the end user is able to call, and calls the underlying RPC.
+  // Normally, this method receives a single argument (a struct or instance
+  // corresponding to the RPC request object). Defining this field will
+  // add one or more overloads providing flattened or simpler method signatures
+  // in some languages.
+  //
+  // The fields on the method signature are provided as a comma-separated
+  // string.
+  //
+  // For example, the proto RPC and annotation:
+  //
+  //   rpc CreateSubscription(CreateSubscriptionRequest)
+  //       returns (Subscription) {
+  //     option (google.api.method_signature) = "name,topic";
+  //   }
+  //
+  // Would add the following Java overload (in addition to the method accepting
+  // the request object):
+  //
+  //   public final Subscription createSubscription(String name, String topic)
+  //
+  // The following backwards-compatibility guidelines apply:
+  //
+  //   * Adding this annotation to an unannotated method is backwards
+  //     compatible.
+  //   * Adding this annotation to a method which already has existing
+  //     method signature annotations is backwards compatible if and only if
+  //     the new method signature annotation is last in the sequence.
+  //   * Modifying or removing an existing method signature annotation is
+  //     a breaking change.
+  //   * Re-ordering existing method signature annotations is a breaking
+  //     change.
+  repeated string method_signature = 1051;
+}
+
+extend google.protobuf.ServiceOptions {
+  // The hostname for this service.
+  // This should be specified with no prefix or protocol.
+  //
+  // Example:
+  //
+  //   service Foo {
+  //     option (google.api.default_host) = "foo.googleapi.com";
+  //     ...
+  //   }
+  string default_host = 1049;
+
+  // OAuth scopes needed for the client.
+  //
+  // Example:
+  //
+  //   service Foo {
+  //     option (google.api.oauth_scopes) = \
+  //       "https://www.googleapis.com/auth/cloud-platform";
+  //     ...
+  //   }
+  //
+  // If there is more than one scope, use a comma-separated string:
+  //
+  // Example:
+  //
+  //   service Foo {
+  //     option (google.api.oauth_scopes) = \
+  //       "https://www.googleapis.com/auth/cloud-platform,"
+  //       "https://www.googleapis.com/auth/monitoring";
+  //     ...
+  //   }
+  string oauth_scopes = 1050;
+}
+
+// Required information for every language.
+message CommonLanguageSettings {
+  // Link to automatically generated reference documentation.  Example:
+  // https://cloud.google.com/nodejs/docs/reference/asset/latest
+  string reference_docs_uri = 1 [deprecated = true];
+
+  // The destination where API teams want this client library to be published.
+  repeated ClientLibraryDestination destinations = 2;
+}
+
+// Details about how and where to publish client libraries.
+message ClientLibrarySettings {
+  // Version of the API to apply these settings to.
+  string version = 1;
+
+  // Launch stage of this version of the API.
+  LaunchStage launch_stage = 2;
+
+  // When using transport=rest, the client request will encode enums as
+  // numbers rather than strings.
+  bool rest_numeric_enums = 3;
+
+  // Settings for legacy Java features, supported in the Service YAML.
+  JavaSettings java_settings = 21;
+
+  // Settings for C++ client libraries.
+  CppSettings cpp_settings = 22;
+
+  // Settings for PHP client libraries.
+  PhpSettings php_settings = 23;
+
+  // Settings for Python client libraries.
+  PythonSettings python_settings = 24;
+
+  // Settings for Node client libraries.
+  NodeSettings node_settings = 25;
+
+  // Settings for .NET client libraries.
+  DotnetSettings dotnet_settings = 26;
+
+  // Settings for Ruby client libraries.
+  RubySettings ruby_settings = 27;
+
+  // Settings for Go client libraries.
+  GoSettings go_settings = 28;
+}
+
+// This message configures the settings for publishing [Google Cloud Client
+// libraries](https://cloud.google.com/apis/docs/cloud-client-libraries)
+// generated from the service config.
+message Publishing {
+  // A list of API method settings, e.g. the behavior for methods that use the
+  // long-running operation pattern.
+  repeated MethodSettings method_settings = 2;
+
+  // Link to a place that API users can report issues.  Example:
+  // https://issuetracker.google.com/issues/new?component=190865&template=1161103
+  string new_issue_uri = 101;
+
+  // Link to product home page.  Example:
+  // https://cloud.google.com/asset-inventory/docs/overview
+  string documentation_uri = 102;
+
+  // Used as a tracking tag when collecting data about the APIs developer
+  // relations artifacts like docs, packages delivered to package managers,
+  // etc.  Example: "speech".
+  string api_short_name = 103;
+
+  // GitHub label to apply to issues and pull requests opened for this API.
+  string github_label = 104;
+
+  // GitHub teams to be added to CODEOWNERS in the directory in GitHub
+  // containing source code for the client libraries for this API.
+  repeated string codeowner_github_teams = 105;
+
+  // A prefix used in sample code when demarking regions to be included in
+  // documentation.
+  string doc_tag_prefix = 106;
+
+  // For whom the client library is being published.
+  ClientLibraryOrganization organization = 107;
+
+  // Client library settings.  If the same version string appears multiple
+  // times in this list, then the last one wins.  Settings from earlier
+  // settings with the same version string are discarded.
+  repeated ClientLibrarySettings library_settings = 109;
+}
+
+// Settings for Java client libraries.
+message JavaSettings {
+  // The package name to use in Java. Clobbers the java_package option
+  // set in the protobuf. This should be used **only** by APIs
+  // who have already set the language_settings.java.package_name" field
+  // in gapic.yaml. API teams should use the protobuf java_package option
+  // where possible.
+  //
+  // Example of a YAML configuration::
+  //
+  //  publishing:
+  //    java_settings:
+  //      library_package: com.google.cloud.pubsub.v1
+  string library_package = 1;
+
+  // Configure the Java class name to use instead of the service's for its
+  // corresponding generated GAPIC client. Keys are fully-qualified
+  // service names as they appear in the protobuf (including the full
+  // the language_settings.java.interface_names" field in gapic.yaml. API
+  // teams should otherwise use the service name as it appears in the
+  // protobuf.
+  //
+  // Example of a YAML configuration::
+  //
+  //  publishing:
+  //    java_settings:
+  //      service_class_names:
+  //        - google.pubsub.v1.Publisher: TopicAdmin
+  //        - google.pubsub.v1.Subscriber: SubscriptionAdmin
+  map<string, string> service_class_names = 2;
+
+  // Some settings.
+  CommonLanguageSettings common = 3;
+}
+
+// Settings for C++ client libraries.
+message CppSettings {
+  // Some settings.
+  CommonLanguageSettings common = 1;
+}
+
+// Settings for Php client libraries.
+message PhpSettings {
+  // Some settings.
+  CommonLanguageSettings common = 1;
+}
+
+// Settings for Python client libraries.
+message PythonSettings {
+  // Some settings.
+  CommonLanguageSettings common = 1;
+}
+
+// Settings for Node client libraries.
+message NodeSettings {
+  // Some settings.
+  CommonLanguageSettings common = 1;
+}
+
+// Settings for Dotnet client libraries.
+message DotnetSettings {
+  // Some settings.
+  CommonLanguageSettings common = 1;
+}
+
+// Settings for Ruby client libraries.
+message RubySettings {
+  // Some settings.
+  CommonLanguageSettings common = 1;
+}
+
+// Settings for Go client libraries.
+message GoSettings {
+  // Some settings.
+  CommonLanguageSettings common = 1;
+}
+
+// Describes the generator configuration for a method.
+message MethodSettings {
+  // Describes settings to use when generating API methods that use the
+  // long-running operation pattern.
+  // All default values below are from those used in the client library
+  // generators (e.g.
+  // [Java](https://github.com/googleapis/gapic-generator-java/blob/04c2faa191a9b5a10b92392fe8482279c4404803/src/main/java/com/google/api/generator/gapic/composer/common/RetrySettingsComposer.java)).
+  message LongRunning {
+    // Initial delay after which the first poll request will be made.
+    // Default value: 5 seconds.
+    google.protobuf.Duration initial_poll_delay = 1;
+
+    // Multiplier to gradually increase delay between subsequent polls until it
+    // reaches max_poll_delay.
+    // Default value: 1.5.
+    float poll_delay_multiplier = 2;
+
+    // Maximum time between two subsequent poll requests.
+    // Default value: 45 seconds.
+    google.protobuf.Duration max_poll_delay = 3;
+
+    // Total polling timeout.
+    // Default value: 5 minutes.
+    google.protobuf.Duration total_poll_timeout = 4;
+  }
+
+  // The fully qualified name of the method, for which the options below apply.
+  // This is used to find the method to apply the options.
+  string selector = 1;
+
+  // Describes settings to use for long-running operations when generating
+  // API methods for RPCs. Complements RPCs that use the annotations in
+  // google/longrunning/operations.proto.
+  //
+  // Example of a YAML configuration::
+  //
+  //  publishing:
+  //    method_behavior:
+  //      - selector: CreateAdDomain
+  //        long_running:
+  //          initial_poll_delay:
+  //            seconds: 60 # 1 minute
+  //          poll_delay_multiplier: 1.5
+  //          max_poll_delay:
+  //            seconds: 360 # 6 minutes
+  //          total_poll_timeout:
+  //             seconds: 54000 # 90 minutes
+  LongRunning long_running = 2;
+}
+
+// The organization for which the client libraries are being published.
+// Affects the url where generated docs are published, etc.
+enum ClientLibraryOrganization {
+  // Not useful.
+  CLIENT_LIBRARY_ORGANIZATION_UNSPECIFIED = 0;
+
+  // Google Cloud Platform Org.
+  CLOUD = 1;
+
+  // Ads (Advertising) Org.
+  ADS = 2;
+
+  // Photos Org.
+  PHOTOS = 3;
+
+  // Street View Org.
+  STREET_VIEW = 4;
+}
+
+// To where should client libraries be published?
+enum ClientLibraryDestination {
+  // Client libraries will neither be generated nor published to package
+  // managers.
+  CLIENT_LIBRARY_DESTINATION_UNSPECIFIED = 0;
+
+  // Generate the client library in a repo under github.com/googleapis,
+  // but don't publish it to package managers.
+  GITHUB = 10;
+
+  // Publish the library to package managers like nuget.org and npmjs.com.
+  PACKAGE_MANAGER = 20;
+}

third_party/googleapis/google/api/config_change.proto

@@ -0,0 +1,84 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/configchange;configchange";
+option java_multiple_files = true;
+option java_outer_classname = "ConfigChangeProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Output generated from semantically comparing two versions of a service
+// configuration.
+//
+// Includes detailed information about a field that have changed with
+// applicable advice about potential consequences for the change, such as
+// backwards-incompatibility.
+message ConfigChange {
+  // Object hierarchy path to the change, with levels separated by a '.'
+  // character. For repeated fields, an applicable unique identifier field is
+  // used for the index (usually selector, name, or id). For maps, the term
+  // 'key' is used. If the field has no unique identifier, the numeric index
+  // is used.
+  // Examples:
+  // - visibility.rules[selector=="google.LibraryService.ListBooks"].restriction
+  // - quota.metric_rules[selector=="google"].metric_costs[key=="reads"].value
+  // - logging.producer_destinations[0]
+  string element = 1;
+
+  // Value of the changed object in the old Service configuration,
+  // in JSON format. This field will not be populated if ChangeType == ADDED.
+  string old_value = 2;
+
+  // Value of the changed object in the new Service configuration,
+  // in JSON format. This field will not be populated if ChangeType == REMOVED.
+  string new_value = 3;
+
+  // The type for this change, either ADDED, REMOVED, or MODIFIED.
+  ChangeType change_type = 4;
+
+  // Collection of advice provided for this change, useful for determining the
+  // possible impact of this change.
+  repeated Advice advices = 5;
+}
+
+// Generated advice about this change, used for providing more
+// information about how a change will affect the existing service.
+message Advice {
+  // Useful description for why this advice was applied and what actions should
+  // be taken to mitigate any implied risks.
+  string description = 2;
+}
+
+// Classifies set of possible modifications to an object in the service
+// configuration.
+enum ChangeType {
+  // No value was provided.
+  CHANGE_TYPE_UNSPECIFIED = 0;
+
+  // The changed object exists in the 'new' service configuration, but not
+  // in the 'old' service configuration.
+  ADDED = 1;
+
+  // The changed object exists in the 'old' service configuration, but not
+  // in the 'new' service configuration.
+  REMOVED = 2;
+
+  // The changed object exists in both service configurations, but its value
+  // is different.
+  MODIFIED = 3;
+}

third_party/googleapis/google/api/consumer.proto

@@ -0,0 +1,82 @@
+// Copyright 2016 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "ConsumerProto";
+option java_package = "com.google.api";
+
+// A descriptor for defining project properties for a service. One service may
+// have many consumer projects, and the service may want to behave differently
+// depending on some properties on the project. For example, a project may be
+// associated with a school, or a business, or a government agency, a business
+// type property on the project may affect how a service responds to the client.
+// This descriptor defines which properties are allowed to be set on a project.
+//
+// Example:
+//
+//    project_properties:
+//      properties:
+//      - name: NO_WATERMARK
+//        type: BOOL
+//        description: Allows usage of the API without watermarks.
+//      - name: EXTENDED_TILE_CACHE_PERIOD
+//        type: INT64
+message ProjectProperties {
+  // List of per consumer project-specific properties.
+  repeated Property properties = 1;
+}
+
+// Defines project properties.
+//
+// API services can define properties that can be assigned to consumer projects
+// so that backends can perform response customization without having to make
+// additional calls or maintain additional storage. For example, Maps API
+// defines properties that controls map tile cache period, or whether to embed a
+// watermark in a result.
+//
+// These values can be set via API producer console. Only API providers can
+// define and set these properties.
+message Property {
+  // Supported data type of the property values
+  enum PropertyType {
+    // The type is unspecified, and will result in an error.
+    UNSPECIFIED = 0;
+
+    // The type is `int64`.
+    INT64 = 1;
+
+    // The type is `bool`.
+    BOOL = 2;
+
+    // The type is `string`.
+    STRING = 3;
+
+    // The type is 'double'.
+    DOUBLE = 4;
+  }
+
+  // The name of the property (a.k.a key).
+  string name = 1;
+
+  // The type of this property.
+  PropertyType type = 2;
+
+  // The description of the property
+  string description = 3;
+}

third_party/googleapis/google/api/context.proto

@@ -0,0 +1,89 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "ContextProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// `Context` defines which contexts an API requests.
+//
+// Example:
+//
+//     context:
+//       rules:
+//       - selector: "*"
+//         requested:
+//         - google.rpc.context.ProjectContext
+//         - google.rpc.context.OriginContext
+//
+// The above specifies that all methods in the API request
+// `google.rpc.context.ProjectContext` and
+// `google.rpc.context.OriginContext`.
+//
+// Available context types are defined in package
+// `google.rpc.context`.
+//
+// This also provides mechanism to allowlist any protobuf message extension that
+// can be sent in grpc metadata using “x-goog-ext-<extension_id>-bin” and
+// “x-goog-ext-<extension_id>-jspb” format. For example, list any service
+// specific protobuf types that can appear in grpc metadata as follows in your
+// yaml file:
+//
+// Example:
+//
+//     context:
+//       rules:
+//        - selector: "google.example.library.v1.LibraryService.CreateBook"
+//          allowed_request_extensions:
+//          - google.foo.v1.NewExtension
+//          allowed_response_extensions:
+//          - google.foo.v1.NewExtension
+//
+// You can also specify extension ID instead of fully qualified extension name
+// here.
+message Context {
+  // A list of RPC context rules that apply to individual API methods.
+  //
+  // **NOTE:** All service configuration rules follow "last one wins" order.
+  repeated ContextRule rules = 1;
+}
+
+// A context rule provides information about the context for an individual API
+// element.
+message ContextRule {
+  // Selects the methods to which this rule applies.
+  //
+  // Refer to [selector][google.api.DocumentationRule.selector] for syntax details.
+  string selector = 1;
+
+  // A list of full type names of requested contexts.
+  repeated string requested = 2;
+
+  // A list of full type names of provided contexts.
+  repeated string provided = 3;
+
+  // A list of full type names or extension IDs of extensions allowed in grpc
+  // side channel from client to backend.
+  repeated string allowed_request_extensions = 4;
+
+  // A list of full type names or extension IDs of extensions allowed in grpc
+  // side channel from backend to client.
+  repeated string allowed_response_extensions = 5;
+}

third_party/googleapis/google/api/control.proto

@@ -0,0 +1,36 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "ControlProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Selects and configures the service controller used by the service.
+//
+// Example:
+//
+//     control:
+//       environment: servicecontrol.googleapis.com
+message Control {
+  // The service controller environment to use. If empty, no control plane
+  // feature (like quota and billing) will be enabled. The recommended value for
+  // most services is servicecontrol.googleapis.com
+  string environment = 1;
+}

third_party/googleapis/google/api/distribution.proto

@@ -0,0 +1,211 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/api/distribution;distribution";
+option java_multiple_files = true;
+option java_outer_classname = "DistributionProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// `Distribution` contains summary statistics for a population of values. It
+// optionally contains a histogram representing the distribution of those values
+// across a set of buckets.
+//
+// The summary statistics are the count, mean, sum of the squared deviation from
+// the mean, the minimum, and the maximum of the set of population of values.
+// The histogram is based on a sequence of buckets and gives a count of values
+// that fall into each bucket. The boundaries of the buckets are given either
+// explicitly or by formulas for buckets of fixed or exponentially increasing
+// widths.
+//
+// Although it is not forbidden, it is generally a bad idea to include
+// non-finite values (infinities or NaNs) in the population of values, as this
+// will render the `mean` and `sum_of_squared_deviation` fields meaningless.
+message Distribution {
+  // The range of the population values.
+  message Range {
+    // The minimum of the population values.
+    double min = 1;
+
+    // The maximum of the population values.
+    double max = 2;
+  }
+
+  // `BucketOptions` describes the bucket boundaries used to create a histogram
+  // for the distribution. The buckets can be in a linear sequence, an
+  // exponential sequence, or each bucket can be specified explicitly.
+  // `BucketOptions` does not include the number of values in each bucket.
+  //
+  // A bucket has an inclusive lower bound and exclusive upper bound for the
+  // values that are counted for that bucket. The upper bound of a bucket must
+  // be strictly greater than the lower bound. The sequence of N buckets for a
+  // distribution consists of an underflow bucket (number 0), zero or more
+  // finite buckets (number 1 through N - 2) and an overflow bucket (number N -
+  // 1). The buckets are contiguous: the lower bound of bucket i (i > 0) is the
+  // same as the upper bound of bucket i - 1. The buckets span the whole range
+  // of finite values: lower bound of the underflow bucket is -infinity and the
+  // upper bound of the overflow bucket is +infinity. The finite buckets are
+  // so-called because both bounds are finite.
+  message BucketOptions {
+    // Specifies a linear sequence of buckets that all have the same width
+    // (except overflow and underflow). Each bucket represents a constant
+    // absolute uncertainty on the specific value in the bucket.
+    //
+    // There are `num_finite_buckets + 2` (= N) buckets. Bucket `i` has the
+    // following boundaries:
+    //
+    //    Upper bound (0 <= i < N-1):     offset + (width * i).
+    //    Lower bound (1 <= i < N):       offset + (width * (i - 1)).
+    message Linear {
+      // Must be greater than 0.
+      int32 num_finite_buckets = 1;
+
+      // Must be greater than 0.
+      double width = 2;
+
+      // Lower bound of the first bucket.
+      double offset = 3;
+    }
+
+    // Specifies an exponential sequence of buckets that have a width that is
+    // proportional to the value of the lower bound. Each bucket represents a
+    // constant relative uncertainty on a specific value in the bucket.
+    //
+    // There are `num_finite_buckets + 2` (= N) buckets. Bucket `i` has the
+    // following boundaries:
+    //
+    //    Upper bound (0 <= i < N-1):     scale * (growth_factor ^ i).
+    //    Lower bound (1 <= i < N):       scale * (growth_factor ^ (i - 1)).
+    message Exponential {
+      // Must be greater than 0.
+      int32 num_finite_buckets = 1;
+
+      // Must be greater than 1.
+      double growth_factor = 2;
+
+      // Must be greater than 0.
+      double scale = 3;
+    }
+
+    // Specifies a set of buckets with arbitrary widths.
+    //
+    // There are `size(bounds) + 1` (= N) buckets. Bucket `i` has the following
+    // boundaries:
+    //
+    //    Upper bound (0 <= i < N-1):     bounds[i]
+    //    Lower bound (1 <= i < N);       bounds[i - 1]
+    //
+    // The `bounds` field must contain at least one element. If `bounds` has
+    // only one element, then there are no finite buckets, and that single
+    // element is the common boundary of the overflow and underflow buckets.
+    message Explicit {
+      // The values must be monotonically increasing.
+      repeated double bounds = 1;
+    }
+
+    // Exactly one of these three fields must be set.
+    oneof options {
+      // The linear bucket.
+      Linear linear_buckets = 1;
+
+      // The exponential buckets.
+      Exponential exponential_buckets = 2;
+
+      // The explicit buckets.
+      Explicit explicit_buckets = 3;
+    }
+  }
+
+  // Exemplars are example points that may be used to annotate aggregated
+  // distribution values. They are metadata that gives information about a
+  // particular value added to a Distribution bucket, such as a trace ID that
+  // was active when a value was added. They may contain further information,
+  // such as a example values and timestamps, origin, etc.
+  message Exemplar {
+    // Value of the exemplar point. This value determines to which bucket the
+    // exemplar belongs.
+    double value = 1;
+
+    // The observation (sampling) time of the above value.
+    google.protobuf.Timestamp timestamp = 2;
+
+    // Contextual information about the example value. Examples are:
+    //
+    //   Trace: type.googleapis.com/google.monitoring.v3.SpanContext
+    //
+    //   Literal string: type.googleapis.com/google.protobuf.StringValue
+    //
+    //   Labels dropped during aggregation:
+    //     type.googleapis.com/google.monitoring.v3.DroppedLabels
+    //
+    // There may be only a single attachment of any given message type in a
+    // single exemplar, and this is enforced by the system.
+    repeated google.protobuf.Any attachments = 3;
+  }
+
+  // The number of values in the population. Must be non-negative. This value
+  // must equal the sum of the values in `bucket_counts` if a histogram is
+  // provided.
+  int64 count = 1;
+
+  // The arithmetic mean of the values in the population. If `count` is zero
+  // then this field must be zero.
+  double mean = 2;
+
+  // The sum of squared deviations from the mean of the values in the
+  // population. For values x_i this is:
+  //
+  //     Sum[i=1..n]((x_i - mean)^2)
+  //
+  // Knuth, "The Art of Computer Programming", Vol. 2, page 232, 3rd edition
+  // describes Welford's method for accumulating this sum in one pass.
+  //
+  // If `count` is zero then this field must be zero.
+  double sum_of_squared_deviation = 3;
+
+  // If specified, contains the range of the population values. The field
+  // must not be present if the `count` is zero.
+  Range range = 4;
+
+  // Defines the histogram bucket boundaries. If the distribution does not
+  // contain a histogram, then omit this field.
+  BucketOptions bucket_options = 6;
+
+  // The number of values in each bucket of the histogram, as described in
+  // `bucket_options`. If the distribution does not have a histogram, then omit
+  // this field. If there is a histogram, then the sum of the values in
+  // `bucket_counts` must equal the value in the `count` field of the
+  // distribution.
+  //
+  // If present, `bucket_counts` should contain N values, where N is the number
+  // of buckets specified in `bucket_options`. If you supply fewer than N
+  // values, the remaining values are assumed to be 0.
+  //
+  // The order of the values in `bucket_counts` follows the bucket numbering
+  // schemes described for the three bucket types. The first value must be the
+  // count for the underflow bucket (number 0). The next N-2 values are the
+  // counts for the finite buckets (number 1 through N-2). The N'th value in
+  // `bucket_counts` is the count for the overflow bucket (number N-1).
+  repeated int64 bucket_counts = 7;
+
+  // Must be in increasing order of `value` field.
+  repeated Exemplar exemplars = 10;
+}

third_party/googleapis/google/api/documentation.proto

@@ -0,0 +1,168 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "DocumentationProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// `Documentation` provides the information for describing a service.
+//
+// Example:
+// <pre><code>documentation:
+//   summary: >
+//     The Google Calendar API gives access
+//     to most calendar features.
+//   pages:
+//   - name: Overview
+//     content: &#40;== include google/foo/overview.md ==&#41;
+//   - name: Tutorial
+//     content: &#40;== include google/foo/tutorial.md ==&#41;
+//     subpages;
+//     - name: Java
+//       content: &#40;== include google/foo/tutorial_java.md ==&#41;
+//   rules:
+//   - selector: google.calendar.Calendar.Get
+//     description: >
+//       ...
+//   - selector: google.calendar.Calendar.Put
+//     description: >
+//       ...
+// </code></pre>
+// Documentation is provided in markdown syntax. In addition to
+// standard markdown features, definition lists, tables and fenced
+// code blocks are supported. Section headers can be provided and are
+// interpreted relative to the section nesting of the context where
+// a documentation fragment is embedded.
+//
+// Documentation from the IDL is merged with documentation defined
+// via the config at normalization time, where documentation provided
+// by config rules overrides IDL provided.
+//
+// A number of constructs specific to the API platform are supported
+// in documentation text.
+//
+// In order to reference a proto element, the following
+// notation can be used:
+// <pre><code>&#91;fully.qualified.proto.name]&#91;]</code></pre>
+// To override the display text used for the link, this can be used:
+// <pre><code>&#91;display text]&#91;fully.qualified.proto.name]</code></pre>
+// Text can be excluded from doc using the following notation:
+// <pre><code>&#40;-- internal comment --&#41;</code></pre>
+//
+// A few directives are available in documentation. Note that
+// directives must appear on a single line to be properly
+// identified. The `include` directive includes a markdown file from
+// an external source:
+// <pre><code>&#40;== include path/to/file ==&#41;</code></pre>
+// The `resource_for` directive marks a message to be the resource of
+// a collection in REST view. If it is not specified, tools attempt
+// to infer the resource from the operations in a collection:
+// <pre><code>&#40;== resource_for v1.shelves.books ==&#41;</code></pre>
+// The directive `suppress_warning` does not directly affect documentation
+// and is documented together with service config validation.
+message Documentation {
+  // A short description of what the service does. The summary must be plain
+  // text. It becomes the overview of the service displayed in Google Cloud
+  // Console.
+  // NOTE: This field is equivalent to the standard field `description`.
+  string summary = 1;
+
+  // The top level pages for the documentation set.
+  repeated Page pages = 5;
+
+  // A list of documentation rules that apply to individual API elements.
+  //
+  // **NOTE:** All service configuration rules follow "last one wins" order.
+  repeated DocumentationRule rules = 3;
+
+  // The URL to the root of documentation.
+  string documentation_root_url = 4;
+
+  // Specifies the service root url if the default one (the service name
+  // from the yaml file) is not suitable. This can be seen in any fully
+  // specified service urls as well as sections that show a base that other
+  // urls are relative to.
+  string service_root_url = 6;
+
+  // Declares a single overview page. For example:
+  // <pre><code>documentation:
+  //   summary: ...
+  //   overview: &#40;== include overview.md ==&#41;
+  // </code></pre>
+  // This is a shortcut for the following declaration (using pages style):
+  // <pre><code>documentation:
+  //   summary: ...
+  //   pages:
+  //   - name: Overview
+  //     content: &#40;== include overview.md ==&#41;
+  // </code></pre>
+  // Note: you cannot specify both `overview` field and `pages` field.
+  string overview = 2;
+}
+
+// A documentation rule provides information about individual API elements.
+message DocumentationRule {
+  // The selector is a comma-separated list of patterns for any element such as
+  // a method, a field, an enum value. Each pattern is a qualified name of the
+  // element which may end in "*", indicating a wildcard. Wildcards are only
+  // allowed at the end and for a whole component of the qualified name,
+  // i.e. "foo.*" is ok, but not "foo.b*" or "foo.*.bar". A wildcard will match
+  // one or more components. To specify a default for all applicable elements,
+  // the whole pattern "*" is used.
+  string selector = 1;
+
+  // Description of the selected proto element (e.g. a message, a method, a
+  // 'service' definition, or a field). Defaults to leading & trailing comments
+  // taken from the proto source definition of the proto element.
+  string description = 2;
+
+  // Deprecation description of the selected element(s). It can be provided if
+  // an element is marked as `deprecated`.
+  string deprecation_description = 3;
+}
+
+// Represents a documentation page. A page can contain subpages to represent
+// nested documentation set structure.
+message Page {
+  // The name of the page. It will be used as an identity of the page to
+  // generate URI of the page, text of the link to this page in navigation,
+  // etc. The full page name (start from the root page name to this page
+  // concatenated with `.`) can be used as reference to the page in your
+  // documentation. For example:
+  // <pre><code>pages:
+  // - name: Tutorial
+  //   content: &#40;== include tutorial.md ==&#41;
+  //   subpages:
+  //   - name: Java
+  //     content: &#40;== include tutorial_java.md ==&#41;
+  // </code></pre>
+  // You can reference `Java` page using Markdown reference link syntax:
+  // `[Java][Tutorial.Java]`.
+  string name = 1;
+
+  // The Markdown content of the page. You can use <code>&#40;== include {path}
+  // ==&#41;</code> to include content from a Markdown file. The content can be
+  // used to produce the documentation page such as HTML format page.
+  string content = 2;
+
+  // Subpages of this page. The order of subpages specified here will be
+  // honored in the generated docset.
+  repeated Page subpages = 3;
+}

third_party/googleapis/google/api/endpoint.proto

@@ -0,0 +1,73 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "EndpointProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// `Endpoint` describes a network address of a service that serves a set of
+// APIs. It is commonly known as a service endpoint. A service may expose
+// any number of service endpoints, and all service endpoints share the same
+// service definition, such as quota limits and monitoring metrics.
+//
+// Example:
+//
+//     type: google.api.Service
+//     name: library-example.googleapis.com
+//     endpoints:
+//       # Declares network address `https://library-example.googleapis.com`
+//       # for service `library-example.googleapis.com`. The `https` scheme
+//       # is implicit for all service endpoints. Other schemes may be
+//       # supported in the future.
+//     - name: library-example.googleapis.com
+//       allow_cors: false
+//     - name: content-staging-library-example.googleapis.com
+//       # Allows HTTP OPTIONS calls to be passed to the API frontend, for it
+//       # to decide whether the subsequent cross-origin request is allowed
+//       # to proceed.
+//       allow_cors: true
+message Endpoint {
+  // The canonical name of this endpoint.
+  string name = 1;
+
+  // Unimplemented. Dot not use.
+  //
+  // DEPRECATED: This field is no longer supported. Instead of using aliases,
+  // please specify multiple [google.api.Endpoint][google.api.Endpoint] for each
+  // of the intended aliases.
+  //
+  // Additional names that this endpoint will be hosted on.
+  repeated string aliases = 2 [deprecated = true];
+
+  // The specification of an Internet routable address of API frontend that will
+  // handle requests to this [API
+  // Endpoint](https://cloud.google.com/apis/design/glossary). It should be
+  // either a valid IPv4 address or a fully-qualified domain name. For example,
+  // "8.8.8.8" or "myservice.appspot.com".
+  string target = 101;
+
+  // Allowing
+  // [CORS](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing), aka
+  // cross-domain traffic, would allow the backends served from this endpoint to
+  // receive and respond to HTTP OPTIONS requests. The response will be used by
+  // the browser to determine whether the subsequent cross-origin request is
+  // allowed to proceed.
+  bool allow_cors = 5;
+}

third_party/googleapis/google/api/error_reason.proto

@@ -0,0 +1,535 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/error_reason;error_reason";
+option java_multiple_files = true;
+option java_outer_classname = "ErrorReasonProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Defines the supported values for `google.rpc.ErrorInfo.reason` for the
+// `googleapis.com` error domain. This error domain is reserved for [Service
+// Infrastructure](https://cloud.google.com/service-infrastructure/docs/overview).
+// For each error info of this domain, the metadata key "service" refers to the
+// logical identifier of an API service, such as "pubsub.googleapis.com". The
+// "consumer" refers to the entity that consumes an API Service. It typically is
+// a Google project that owns the client application or the server resource,
+// such as "projects/123". Other metadata keys are specific to each error
+// reason. For more information, see the definition of the specific error
+// reason.
+enum ErrorReason {
+  // Do not use this default value.
+  ERROR_REASON_UNSPECIFIED = 0;
+
+  // The request is calling a disabled service for a consumer.
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" contacting
+  // "pubsub.googleapis.com" service which is disabled:
+  //
+  //     { "reason": "SERVICE_DISABLED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "pubsub.googleapis.com"
+  //       }
+  //     }
+  //
+  // This response indicates the "pubsub.googleapis.com" has been disabled in
+  // "projects/123".
+  SERVICE_DISABLED = 1;
+
+  // The request whose associated billing account is disabled.
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" fails to contact
+  // "pubsub.googleapis.com" service because the associated billing account is
+  // disabled:
+  //
+  //     { "reason": "BILLING_DISABLED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "pubsub.googleapis.com"
+  //       }
+  //     }
+  //
+  // This response indicates the billing account associated has been disabled.
+  BILLING_DISABLED = 2;
+
+  // The request is denied because the provided [API
+  // key](https://cloud.google.com/docs/authentication/api-keys) is invalid. It
+  // may be in a bad format, cannot be found, or has been expired).
+  //
+  // Example of an ErrorInfo when the request is contacting
+  // "storage.googleapis.com" service with an invalid API key:
+  //
+  //     { "reason": "API_KEY_INVALID",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "storage.googleapis.com",
+  //       }
+  //     }
+  API_KEY_INVALID = 3;
+
+  // The request is denied because it violates [API key API
+  // restrictions](https://cloud.google.com/docs/authentication/api-keys#adding_api_restrictions).
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" fails to call the
+  // "storage.googleapis.com" service because this service is restricted in the
+  // API key:
+  //
+  //     { "reason": "API_KEY_SERVICE_BLOCKED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com"
+  //       }
+  //     }
+  API_KEY_SERVICE_BLOCKED = 4;
+
+  // The request is denied because it violates [API key HTTP
+  // restrictions](https://cloud.google.com/docs/authentication/api-keys#adding_http_restrictions).
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" fails to call
+  // "storage.googleapis.com" service because the http referrer of the request
+  // violates API key HTTP restrictions:
+  //
+  //     { "reason": "API_KEY_HTTP_REFERRER_BLOCKED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com",
+  //       }
+  //     }
+  API_KEY_HTTP_REFERRER_BLOCKED = 7;
+
+  // The request is denied because it violates [API key IP address
+  // restrictions](https://cloud.google.com/docs/authentication/api-keys#adding_application_restrictions).
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" fails to call
+  // "storage.googleapis.com" service because the caller IP of the request
+  // violates API key IP address restrictions:
+  //
+  //     { "reason": "API_KEY_IP_ADDRESS_BLOCKED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com",
+  //       }
+  //     }
+  API_KEY_IP_ADDRESS_BLOCKED = 8;
+
+  // The request is denied because it violates [API key Android application
+  // restrictions](https://cloud.google.com/docs/authentication/api-keys#adding_application_restrictions).
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" fails to call
+  // "storage.googleapis.com" service because the request from the Android apps
+  // violates the API key Android application restrictions:
+  //
+  //     { "reason": "API_KEY_ANDROID_APP_BLOCKED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com"
+  //       }
+  //     }
+  API_KEY_ANDROID_APP_BLOCKED = 9;
+
+  // The request is denied because it violates [API key iOS application
+  // restrictions](https://cloud.google.com/docs/authentication/api-keys#adding_application_restrictions).
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" fails to call
+  // "storage.googleapis.com" service because the request from the iOS apps
+  // violates the API key iOS application restrictions:
+  //
+  //     { "reason": "API_KEY_IOS_APP_BLOCKED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com"
+  //       }
+  //     }
+  API_KEY_IOS_APP_BLOCKED = 13;
+
+  // The request is denied because there is not enough rate quota for the
+  // consumer.
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" fails to contact
+  // "pubsub.googleapis.com" service because consumer's rate quota usage has
+  // reached the maximum value set for the quota limit
+  // "ReadsPerMinutePerProject" on the quota metric
+  // "pubsub.googleapis.com/read_requests":
+  //
+  //     { "reason": "RATE_LIMIT_EXCEEDED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "pubsub.googleapis.com",
+  //         "quota_metric": "pubsub.googleapis.com/read_requests",
+  //         "quota_limit": "ReadsPerMinutePerProject"
+  //       }
+  //     }
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" checks quota on
+  // the service "dataflow.googleapis.com" and hits the organization quota
+  // limit "DefaultRequestsPerMinutePerOrganization" on the metric
+  // "dataflow.googleapis.com/default_requests".
+  //
+  //     { "reason": "RATE_LIMIT_EXCEEDED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "dataflow.googleapis.com",
+  //         "quota_metric": "dataflow.googleapis.com/default_requests",
+  //         "quota_limit": "DefaultRequestsPerMinutePerOrganization"
+  //       }
+  //     }
+  RATE_LIMIT_EXCEEDED = 5;
+
+  // The request is denied because there is not enough resource quota for the
+  // consumer.
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" fails to contact
+  // "compute.googleapis.com" service because consumer's resource quota usage
+  // has reached the maximum value set for the quota limit "VMsPerProject"
+  // on the quota metric "compute.googleapis.com/vms":
+  //
+  //     { "reason": "RESOURCE_QUOTA_EXCEEDED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "compute.googleapis.com",
+  //         "quota_metric": "compute.googleapis.com/vms",
+  //         "quota_limit": "VMsPerProject"
+  //       }
+  //     }
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" checks resource
+  // quota on the service "dataflow.googleapis.com" and hits the organization
+  // quota limit "jobs-per-organization" on the metric
+  // "dataflow.googleapis.com/job_count".
+  //
+  //     { "reason": "RESOURCE_QUOTA_EXCEEDED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "dataflow.googleapis.com",
+  //         "quota_metric": "dataflow.googleapis.com/job_count",
+  //         "quota_limit": "jobs-per-organization"
+  //       }
+  //     }
+  RESOURCE_QUOTA_EXCEEDED = 6;
+
+  // The request whose associated billing account address is in a tax restricted
+  // location, violates the local tax restrictions when creating resources in
+  // the restricted region.
+  //
+  // Example of an ErrorInfo when creating the Cloud Storage Bucket in the
+  // container "projects/123" under a tax restricted region
+  // "locations/asia-northeast3":
+  //
+  //     { "reason": "LOCATION_TAX_POLICY_VIOLATED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com",
+  //         "location": "locations/asia-northeast3"
+  //       }
+  //     }
+  //
+  // This response indicates creating the Cloud Storage Bucket in
+  // "locations/asia-northeast3" violates the location tax restriction.
+  LOCATION_TAX_POLICY_VIOLATED = 10;
+
+  // The request is denied because the caller does not have required permission
+  // on the user project "projects/123" or the user project is invalid. For more
+  // information, check the [userProject System
+  // Parameters](https://cloud.google.com/apis/docs/system-parameters).
+  //
+  // Example of an ErrorInfo when the caller is calling Cloud Storage service
+  // with insufficient permissions on the user project:
+  //
+  //     { "reason": "USER_PROJECT_DENIED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com"
+  //       }
+  //     }
+  USER_PROJECT_DENIED = 11;
+
+  // The request is denied because the consumer "projects/123" is suspended due
+  // to Terms of Service(Tos) violations. Check [Project suspension
+  // guidelines](https://cloud.google.com/resource-manager/docs/project-suspension-guidelines)
+  // for more information.
+  //
+  // Example of an ErrorInfo when calling Cloud Storage service with the
+  // suspended consumer "projects/123":
+  //
+  //     { "reason": "CONSUMER_SUSPENDED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com"
+  //       }
+  //     }
+  CONSUMER_SUSPENDED = 12;
+
+  // The request is denied because the associated consumer is invalid. It may be
+  // in a bad format, cannot be found, or have been deleted.
+  //
+  // Example of an ErrorInfo when calling Cloud Storage service with the
+  // invalid consumer "projects/123":
+  //
+  //     { "reason": "CONSUMER_INVALID",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com"
+  //       }
+  //     }
+  CONSUMER_INVALID = 14;
+
+  // The request is denied because it violates [VPC Service
+  // Controls](https://cloud.google.com/vpc-service-controls/docs/overview).
+  // The 'uid' field is a random generated identifier that customer can use it
+  // to search the audit log for a request rejected by VPC Service Controls. For
+  // more information, please refer [VPC Service Controls
+  // Troubleshooting](https://cloud.google.com/vpc-service-controls/docs/troubleshooting#unique-id)
+  //
+  // Example of an ErrorInfo when the consumer "projects/123" fails to call
+  // Cloud Storage service because the request is prohibited by the VPC Service
+  // Controls.
+  //
+  //     { "reason": "SECURITY_POLICY_VIOLATED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "uid": "123456789abcde",
+  //         "consumer": "projects/123",
+  //         "service": "storage.googleapis.com"
+  //       }
+  //     }
+  SECURITY_POLICY_VIOLATED = 15;
+
+  // The request is denied because the provided access token has expired.
+  //
+  // Example of an ErrorInfo when the request is calling Cloud Storage service
+  // with an expired access token:
+  //
+  //     { "reason": "ACCESS_TOKEN_EXPIRED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "storage.googleapis.com",
+  //         "method": "google.storage.v1.Storage.GetObject"
+  //       }
+  //     }
+  ACCESS_TOKEN_EXPIRED = 16;
+
+  // The request is denied because the provided access token doesn't have at
+  // least one of the acceptable scopes required for the API. Please check
+  // [OAuth 2.0 Scopes for Google
+  // APIs](https://developers.google.com/identity/protocols/oauth2/scopes) for
+  // the list of the OAuth 2.0 scopes that you might need to request to access
+  // the API.
+  //
+  // Example of an ErrorInfo when the request is calling Cloud Storage service
+  // with an access token that is missing required scopes:
+  //
+  //     { "reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "storage.googleapis.com",
+  //         "method": "google.storage.v1.Storage.GetObject"
+  //       }
+  //     }
+  ACCESS_TOKEN_SCOPE_INSUFFICIENT = 17;
+
+  // The request is denied because the account associated with the provided
+  // access token is in an invalid state, such as disabled or deleted.
+  // For more information, see https://cloud.google.com/docs/authentication.
+  //
+  // Warning: For privacy reasons, the server may not be able to disclose the
+  // email address for some accounts. The client MUST NOT depend on the
+  // availability of the `email` attribute.
+  //
+  // Example of an ErrorInfo when the request is to the Cloud Storage API with
+  // an access token that is associated with a disabled or deleted [service
+  // account](http://cloud/iam/docs/service-accounts):
+  //
+  //     { "reason": "ACCOUNT_STATE_INVALID",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "storage.googleapis.com",
+  //         "method": "google.storage.v1.Storage.GetObject",
+  //         "email": "user@123.iam.gserviceaccount.com"
+  //       }
+  //     }
+  ACCOUNT_STATE_INVALID = 18;
+
+  // The request is denied because the type of the provided access token is not
+  // supported by the API being called.
+  //
+  // Example of an ErrorInfo when the request is to the Cloud Storage API with
+  // an unsupported token type.
+  //
+  //     { "reason": "ACCESS_TOKEN_TYPE_UNSUPPORTED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "storage.googleapis.com",
+  //         "method": "google.storage.v1.Storage.GetObject"
+  //       }
+  //     }
+  ACCESS_TOKEN_TYPE_UNSUPPORTED = 19;
+
+  // The request is denied because the request doesn't have any authentication
+  // credentials. For more information regarding the supported authentication
+  // strategies for Google Cloud APIs, see
+  // https://cloud.google.com/docs/authentication.
+  //
+  // Example of an ErrorInfo when the request is to the Cloud Storage API
+  // without any authentication credentials.
+  //
+  //     { "reason": "CREDENTIALS_MISSING",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "storage.googleapis.com",
+  //         "method": "google.storage.v1.Storage.GetObject"
+  //       }
+  //     }
+  CREDENTIALS_MISSING = 20;
+
+  // The request is denied because the provided project owning the resource
+  // which acts as the [API
+  // consumer](https://cloud.google.com/apis/design/glossary#api_consumer) is
+  // invalid. It may be in a bad format or empty.
+  //
+  // Example of an ErrorInfo when the request is to the Cloud Functions API,
+  // but the offered resource project in the request in a bad format which can't
+  // perform the ListFunctions method.
+  //
+  //     { "reason": "RESOURCE_PROJECT_INVALID",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "cloudfunctions.googleapis.com",
+  //         "method":
+  //         "google.cloud.functions.v1.CloudFunctionsService.ListFunctions"
+  //       }
+  //     }
+  RESOURCE_PROJECT_INVALID = 21;
+
+  // The request is denied because the provided session cookie is missing,
+  // invalid or failed to decode.
+  //
+  // Example of an ErrorInfo when the request is calling Cloud Storage service
+  // with a SID cookie which can't be decoded.
+  //
+  //     { "reason": "SESSION_COOKIE_INVALID",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "storage.googleapis.com",
+  //         "method": "google.storage.v1.Storage.GetObject",
+  //         "cookie": "SID"
+  //       }
+  //     }
+  SESSION_COOKIE_INVALID = 23;
+
+  // The request is denied because the user is from a Google Workspace customer
+  // that blocks their users from accessing a particular service.
+  //
+  // Example scenario: https://support.google.com/a/answer/9197205?hl=en
+  //
+  // Example of an ErrorInfo when access to Google Cloud Storage service is
+  // blocked by the Google Workspace administrator:
+  //
+  //     { "reason": "USER_BLOCKED_BY_ADMIN",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "storage.googleapis.com",
+  //         "method": "google.storage.v1.Storage.GetObject",
+  //       }
+  //     }
+  USER_BLOCKED_BY_ADMIN = 24;
+
+  // The request is denied because the resource service usage is restricted
+  // by administrators according to the organization policy constraint.
+  // For more information see
+  // https://cloud.google.com/resource-manager/docs/organization-policy/restricting-services.
+  //
+  // Example of an ErrorInfo when access to Google Cloud Storage service is
+  // restricted by Resource Usage Restriction policy:
+  //
+  //     { "reason": "RESOURCE_USAGE_RESTRICTION_VIOLATED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "consumer": "projects/project-123",
+  //         "service": "storage.googleapis.com"
+  //       }
+  //     }
+  RESOURCE_USAGE_RESTRICTION_VIOLATED = 25;
+
+  // Unimplemented. Do not use.
+  //
+  // The request is denied because it contains unsupported system parameters in
+  // URL query parameters or HTTP headers. For more information,
+  // see https://cloud.google.com/apis/docs/system-parameters
+  //
+  // Example of an ErrorInfo when access "pubsub.googleapis.com" service with
+  // a request header of "x-goog-user-ip":
+  //
+  //     { "reason": "SYSTEM_PARAMETER_UNSUPPORTED",
+  //       "domain": "googleapis.com",
+  //       "metadata": {
+  //         "service": "pubsub.googleapis.com"
+  //         "parameter": "x-goog-user-ip"
+  //       }
+  //     }
+  SYSTEM_PARAMETER_UNSUPPORTED = 26;
+
+  // The request is denied because it violates Org Restriction: the requested
+  // resource does not belong to allowed organizations specified in
+  // "X-Goog-Allowed-Resources" header.
+  //
+  // Example of an ErrorInfo when accessing a GCP resource that is restricted by
+  // Org Restriction for "pubsub.googleapis.com" service.
+  //
+  // {
+  //   reason: "ORG_RESTRICTION_VIOLATION"
+  //   domain: "googleapis.com"
+  //   metadata {
+  //     "consumer":"projects/123456"
+  //     "service": "pubsub.googleapis.com"
+  //   }
+  // }
+  ORG_RESTRICTION_VIOLATION = 27;
+
+  // The request is denied because "X-Goog-Allowed-Resources" header is in a bad
+  // format.
+  //
+  // Example of an ErrorInfo when
+  // accessing "pubsub.googleapis.com" service with an invalid
+  // "X-Goog-Allowed-Resources" request header.
+  //
+  // {
+  //   reason: "ORG_RESTRICTION_HEADER_INVALID"
+  //   domain: "googleapis.com"
+  //   metadata {
+  //     "consumer":"projects/123456"
+  //     "service": "pubsub.googleapis.com"
+  //   }
+  // }
+  ORG_RESTRICTION_HEADER_INVALID = 28;
+}

third_party/googleapis/google/api/field_behavior.proto

@@ -0,0 +1,90 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/protobuf/descriptor.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/api/annotations;annotations";
+option java_multiple_files = true;
+option java_outer_classname = "FieldBehaviorProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+extend google.protobuf.FieldOptions {
+  // A designation of a specific field behavior (required, output only, etc.)
+  // in protobuf messages.
+  //
+  // Examples:
+  //
+  //   string name = 1 [(google.api.field_behavior) = REQUIRED];
+  //   State state = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
+  //   google.protobuf.Duration ttl = 1
+  //     [(google.api.field_behavior) = INPUT_ONLY];
+  //   google.protobuf.Timestamp expire_time = 1
+  //     [(google.api.field_behavior) = OUTPUT_ONLY,
+  //      (google.api.field_behavior) = IMMUTABLE];
+  repeated google.api.FieldBehavior field_behavior = 1052;
+}
+
+// An indicator of the behavior of a given field (for example, that a field
+// is required in requests, or given as output but ignored as input).
+// This **does not** change the behavior in protocol buffers itself; it only
+// denotes the behavior and may affect how API tooling handles the field.
+//
+// Note: This enum **may** receive new values in the future.
+enum FieldBehavior {
+  // Conventional default for enums. Do not use this.
+  FIELD_BEHAVIOR_UNSPECIFIED = 0;
+
+  // Specifically denotes a field as optional.
+  // While all fields in protocol buffers are optional, this may be specified
+  // for emphasis if appropriate.
+  OPTIONAL = 1;
+
+  // Denotes a field as required.
+  // This indicates that the field **must** be provided as part of the request,
+  // and failure to do so will cause an error (usually `INVALID_ARGUMENT`).
+  REQUIRED = 2;
+
+  // Denotes a field as output only.
+  // This indicates that the field is provided in responses, but including the
+  // field in a request does nothing (the server *must* ignore it and
+  // *must not* throw an error as a result of the field's presence).
+  OUTPUT_ONLY = 3;
+
+  // Denotes a field as input only.
+  // This indicates that the field is provided in requests, and the
+  // corresponding field is not included in output.
+  INPUT_ONLY = 4;
+
+  // Denotes a field as immutable.
+  // This indicates that the field may be set once in a request to create a
+  // resource, but may not be changed thereafter.
+  IMMUTABLE = 5;
+
+  // Denotes that a (repeated) field is an unordered list.
+  // This indicates that the service may provide the elements of the list
+  // in any arbitrary  order, rather than the order the user originally
+  // provided. Additionally, the list's order may or may not be stable.
+  UNORDERED_LIST = 6;
+
+  // Denotes that this field returns a non-empty default value if not set.
+  // This indicates that if the user provides the empty value in a request,
+  // a non-empty value will be returned. The user will not be aware of what
+  // non-empty value to expect.
+  NON_EMPTY_DEFAULT = 7;
+}

third_party/googleapis/google/api/http.proto

@@ -0,0 +1,375 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/genproto/googleapis/api/annotations;annotations";
+option java_multiple_files = true;
+option java_outer_classname = "HttpProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Defines the HTTP configuration for an API service. It contains a list of
+// [HttpRule][google.api.HttpRule], each specifying the mapping of an RPC method
+// to one or more HTTP REST API methods.
+message Http {
+  // A list of HTTP configuration rules that apply to individual API methods.
+  //
+  // **NOTE:** All service configuration rules follow "last one wins" order.
+  repeated HttpRule rules = 1;
+
+  // When set to true, URL path parameters will be fully URI-decoded except in
+  // cases of single segment matches in reserved expansion, where "%2F" will be
+  // left encoded.
+  //
+  // The default behavior is to not decode RFC 6570 reserved characters in multi
+  // segment matches.
+  bool fully_decode_reserved_expansion = 2;
+}
+
+// # gRPC Transcoding
+//
+// gRPC Transcoding is a feature for mapping between a gRPC method and one or
+// more HTTP REST endpoints. It allows developers to build a single API service
+// that supports both gRPC APIs and REST APIs. Many systems, including [Google
+// APIs](https://github.com/googleapis/googleapis),
+// [Cloud Endpoints](https://cloud.google.com/endpoints), [gRPC
+// Gateway](https://github.com/grpc-ecosystem/grpc-gateway),
+// and [Envoy](https://github.com/envoyproxy/envoy) proxy support this feature
+// and use it for large scale production services.
+//
+// `HttpRule` defines the schema of the gRPC/REST mapping. The mapping specifies
+// how different portions of the gRPC request message are mapped to the URL
+// path, URL query parameters, and HTTP request body. It also controls how the
+// gRPC response message is mapped to the HTTP response body. `HttpRule` is
+// typically specified as an `google.api.http` annotation on the gRPC method.
+//
+// Each mapping specifies a URL path template and an HTTP method. The path
+// template may refer to one or more fields in the gRPC request message, as long
+// as each field is a non-repeated field with a primitive (non-message) type.
+// The path template controls how fields of the request message are mapped to
+// the URL path.
+//
+// Example:
+//
+//     service Messaging {
+//       rpc GetMessage(GetMessageRequest) returns (Message) {
+//         option (google.api.http) = {
+//             get: "/v1/{name=messages/*}"
+//         };
+//       }
+//     }
+//     message GetMessageRequest {
+//       string name = 1; // Mapped to URL path.
+//     }
+//     message Message {
+//       string text = 1; // The resource content.
+//     }
+//
+// This enables an HTTP REST to gRPC mapping as below:
+//
+// HTTP | gRPC
+// -----|-----
+// `GET /v1/messages/123456`  | `GetMessage(name: "messages/123456")`
+//
+// Any fields in the request message which are not bound by the path template
+// automatically become HTTP query parameters if there is no HTTP request body.
+// For example:
+//
+//     service Messaging {
+//       rpc GetMessage(GetMessageRequest) returns (Message) {
+//         option (google.api.http) = {
+//             get:"/v1/messages/{message_id}"
+//         };
+//       }
+//     }
+//     message GetMessageRequest {
+//       message SubMessage {
+//         string subfield = 1;
+//       }
+//       string message_id = 1; // Mapped to URL path.
+//       int64 revision = 2;    // Mapped to URL query parameter `revision`.
+//       SubMessage sub = 3;    // Mapped to URL query parameter `sub.subfield`.
+//     }
+//
+// This enables a HTTP JSON to RPC mapping as below:
+//
+// HTTP | gRPC
+// -----|-----
+// `GET /v1/messages/123456?revision=2&sub.subfield=foo` |
+// `GetMessage(message_id: "123456" revision: 2 sub: SubMessage(subfield:
+// "foo"))`
+//
+// Note that fields which are mapped to URL query parameters must have a
+// primitive type or a repeated primitive type or a non-repeated message type.
+// In the case of a repeated type, the parameter can be repeated in the URL
+// as `...?param=A&param=B`. In the case of a message type, each field of the
+// message is mapped to a separate parameter, such as
+// `...?foo.a=A&foo.b=B&foo.c=C`.
+//
+// For HTTP methods that allow a request body, the `body` field
+// specifies the mapping. Consider a REST update method on the
+// message resource collection:
+//
+//     service Messaging {
+//       rpc UpdateMessage(UpdateMessageRequest) returns (Message) {
+//         option (google.api.http) = {
+//           patch: "/v1/messages/{message_id}"
+//           body: "message"
+//         };
+//       }
+//     }
+//     message UpdateMessageRequest {
+//       string message_id = 1; // mapped to the URL
+//       Message message = 2;   // mapped to the body
+//     }
+//
+// The following HTTP JSON to RPC mapping is enabled, where the
+// representation of the JSON in the request body is determined by
+// protos JSON encoding:
+//
+// HTTP | gRPC
+// -----|-----
+// `PATCH /v1/messages/123456 { "text": "Hi!" }` | `UpdateMessage(message_id:
+// "123456" message { text: "Hi!" })`
+//
+// The special name `*` can be used in the body mapping to define that
+// every field not bound by the path template should be mapped to the
+// request body.  This enables the following alternative definition of
+// the update method:
+//
+//     service Messaging {
+//       rpc UpdateMessage(Message) returns (Message) {
+//         option (google.api.http) = {
+//           patch: "/v1/messages/{message_id}"
+//           body: "*"
+//         };
+//       }
+//     }
+//     message Message {
+//       string message_id = 1;
+//       string text = 2;
+//     }
+//
+//
+// The following HTTP JSON to RPC mapping is enabled:
+//
+// HTTP | gRPC
+// -----|-----
+// `PATCH /v1/messages/123456 { "text": "Hi!" }` | `UpdateMessage(message_id:
+// "123456" text: "Hi!")`
+//
+// Note that when using `*` in the body mapping, it is not possible to
+// have HTTP parameters, as all fields not bound by the path end in
+// the body. This makes this option more rarely used in practice when
+// defining REST APIs. The common usage of `*` is in custom methods
+// which don't use the URL at all for transferring data.
+//
+// It is possible to define multiple HTTP methods for one RPC by using
+// the `additional_bindings` option. Example:
+//
+//     service Messaging {
+//       rpc GetMessage(GetMessageRequest) returns (Message) {
+//         option (google.api.http) = {
+//           get: "/v1/messages/{message_id}"
+//           additional_bindings {
+//             get: "/v1/users/{user_id}/messages/{message_id}"
+//           }
+//         };
+//       }
+//     }
+//     message GetMessageRequest {
+//       string message_id = 1;
+//       string user_id = 2;
+//     }
+//
+// This enables the following two alternative HTTP JSON to RPC mappings:
+//
+// HTTP | gRPC
+// -----|-----
+// `GET /v1/messages/123456` | `GetMessage(message_id: "123456")`
+// `GET /v1/users/me/messages/123456` | `GetMessage(user_id: "me" message_id:
+// "123456")`
+//
+// ## Rules for HTTP mapping
+//
+// 1. Leaf request fields (recursive expansion nested messages in the request
+//    message) are classified into three categories:
+//    - Fields referred by the path template. They are passed via the URL path.
+//    - Fields referred by the [HttpRule.body][google.api.HttpRule.body]. They are passed via the HTTP
+//      request body.
+//    - All other fields are passed via the URL query parameters, and the
+//      parameter name is the field path in the request message. A repeated
+//      field can be represented as multiple query parameters under the same
+//      name.
+//  2. If [HttpRule.body][google.api.HttpRule.body] is "*", there is no URL query parameter, all fields
+//     are passed via URL path and HTTP request body.
+//  3. If [HttpRule.body][google.api.HttpRule.body] is omitted, there is no HTTP request body, all
+//     fields are passed via URL path and URL query parameters.
+//
+// ### Path template syntax
+//
+//     Template = "/" Segments [ Verb ] ;
+//     Segments = Segment { "/" Segment } ;
+//     Segment  = "*" | "**" | LITERAL | Variable ;
+//     Variable = "{" FieldPath [ "=" Segments ] "}" ;
+//     FieldPath = IDENT { "." IDENT } ;
+//     Verb     = ":" LITERAL ;
+//
+// The syntax `*` matches a single URL path segment. The syntax `**` matches
+// zero or more URL path segments, which must be the last part of the URL path
+// except the `Verb`.
+//
+// The syntax `Variable` matches part of the URL path as specified by its
+// template. A variable template must not contain other variables. If a variable
+// matches a single path segment, its template may be omitted, e.g. `{var}`
+// is equivalent to `{var=*}`.
+//
+// The syntax `LITERAL` matches literal text in the URL path. If the `LITERAL`
+// contains any reserved character, such characters should be percent-encoded
+// before the matching.
+//
+// If a variable contains exactly one path segment, such as `"{var}"` or
+// `"{var=*}"`, when such a variable is expanded into a URL path on the client
+// side, all characters except `[-_.~0-9a-zA-Z]` are percent-encoded. The
+// server side does the reverse decoding. Such variables show up in the
+// [Discovery
+// Document](https://developers.google.com/discovery/v1/reference/apis) as
+// `{var}`.
+//
+// If a variable contains multiple path segments, such as `"{var=foo/*}"`
+// or `"{var=**}"`, when such a variable is expanded into a URL path on the
+// client side, all characters except `[-_.~/0-9a-zA-Z]` are percent-encoded.
+// The server side does the reverse decoding, except "%2F" and "%2f" are left
+// unchanged. Such variables show up in the
+// [Discovery
+// Document](https://developers.google.com/discovery/v1/reference/apis) as
+// `{+var}`.
+//
+// ## Using gRPC API Service Configuration
+//
+// gRPC API Service Configuration (service config) is a configuration language
+// for configuring a gRPC service to become a user-facing product. The
+// service config is simply the YAML representation of the `google.api.Service`
+// proto message.
+//
+// As an alternative to annotating your proto file, you can configure gRPC
+// transcoding in your service config YAML files. You do this by specifying a
+// `HttpRule` that maps the gRPC method to a REST endpoint, achieving the same
+// effect as the proto annotation. This can be particularly useful if you
+// have a proto that is reused in multiple services. Note that any transcoding
+// specified in the service config will override any matching transcoding
+// configuration in the proto.
+//
+// Example:
+//
+//     http:
+//       rules:
+//         # Selects a gRPC method and applies HttpRule to it.
+//         - selector: example.v1.Messaging.GetMessage
+//           get: /v1/messages/{message_id}/{sub.subfield}
+//
+// ## Special notes
+//
+// When gRPC Transcoding is used to map a gRPC to JSON REST endpoints, the
+// proto to JSON conversion must follow the [proto3
+// specification](https://developers.google.com/protocol-buffers/docs/proto3#json).
+//
+// While the single segment variable follows the semantics of
+// [RFC 6570](https://tools.ietf.org/html/rfc6570) Section 3.2.2 Simple String
+// Expansion, the multi segment variable **does not** follow RFC 6570 Section
+// 3.2.3 Reserved Expansion. The reason is that the Reserved Expansion
+// does not expand special characters like `?` and `#`, which would lead
+// to invalid URLs. As the result, gRPC Transcoding uses a custom encoding
+// for multi segment variables.
+//
+// The path variables **must not** refer to any repeated or mapped field,
+// because client libraries are not capable of handling such variable expansion.
+//
+// The path variables **must not** capture the leading "/" character. The reason
+// is that the most common use case "{var}" does not capture the leading "/"
+// character. For consistency, all path variables must share the same behavior.
+//
+// Repeated message fields must not be mapped to URL query parameters, because
+// no client library can support such complicated mapping.
+//
+// If an API needs to use a JSON array for request or response body, it can map
+// the request or response body to a repeated field. However, some gRPC
+// Transcoding implementations may not support this feature.
+message HttpRule {
+  // Selects a method to which this rule applies.
+  //
+  // Refer to [selector][google.api.DocumentationRule.selector] for syntax details.
+  string selector = 1;
+
+  // Determines the URL pattern is matched by this rules. This pattern can be
+  // used with any of the {get|put|post|delete|patch} methods. A custom method
+  // can be defined using the 'custom' field.
+  oneof pattern {
+    // Maps to HTTP GET. Used for listing and getting information about
+    // resources.
+    string get = 2;
+
+    // Maps to HTTP PUT. Used for replacing a resource.
+    string put = 3;
+
+    // Maps to HTTP POST. Used for creating a resource or performing an action.
+    string post = 4;
+
+    // Maps to HTTP DELETE. Used for deleting a resource.
+    string delete = 5;
+
+    // Maps to HTTP PATCH. Used for updating a resource.
+    string patch = 6;
+
+    // The custom pattern is used for specifying an HTTP method that is not
+    // included in the `pattern` field, such as HEAD, or "*" to leave the
+    // HTTP method unspecified for this rule. The wild-card rule is useful
+    // for services that provide content to Web (HTML) clients.
+    CustomHttpPattern custom = 8;
+  }
+
+  // The name of the request field whose value is mapped to the HTTP request
+  // body, or `*` for mapping all request fields not captured by the path
+  // pattern to the HTTP body, or omitted for not having any HTTP request body.
+  //
+  // NOTE: the referred field must be present at the top-level of the request
+  // message type.
+  string body = 7;
+
+  // Optional. The name of the response field whose value is mapped to the HTTP
+  // response body. When omitted, the entire response message will be used
+  // as the HTTP response body.
+  //
+  // NOTE: The referred field must be present at the top-level of the response
+  // message type.
+  string response_body = 12;
+
+  // Additional HTTP bindings for the selector. Nested bindings must
+  // not contain an `additional_bindings` field themselves (that is,
+  // the nesting may only be one level deep).
+  repeated HttpRule additional_bindings = 11;
+}
+
+// A custom pattern is used for defining custom HTTP verb.
+message CustomHttpPattern {
+  // The name of this custom HTTP verb.
+  string kind = 1;
+
+  // The path matched by this custom verb.
+  string path = 2;
+}

third_party/googleapis/google/api/httpbody.proto

@@ -0,0 +1,81 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/protobuf/any.proto";
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/genproto/googleapis/api/httpbody;httpbody";
+option java_multiple_files = true;
+option java_outer_classname = "HttpBodyProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Message that represents an arbitrary HTTP body. It should only be used for
+// payload formats that can't be represented as JSON, such as raw binary or
+// an HTML page.
+//
+//
+// This message can be used both in streaming and non-streaming API methods in
+// the request as well as the response.
+//
+// It can be used as a top-level request field, which is convenient if one
+// wants to extract parameters from either the URL or HTTP template into the
+// request fields and also want access to the raw HTTP body.
+//
+// Example:
+//
+//     message GetResourceRequest {
+//       // A unique request id.
+//       string request_id = 1;
+//
+//       // The raw HTTP body is bound to this field.
+//       google.api.HttpBody http_body = 2;
+//
+//     }
+//
+//     service ResourceService {
+//       rpc GetResource(GetResourceRequest)
+//         returns (google.api.HttpBody);
+//       rpc UpdateResource(google.api.HttpBody)
+//         returns (google.protobuf.Empty);
+//
+//     }
+//
+// Example with streaming methods:
+//
+//     service CaldavService {
+//       rpc GetCalendar(stream google.api.HttpBody)
+//         returns (stream google.api.HttpBody);
+//       rpc UpdateCalendar(stream google.api.HttpBody)
+//         returns (stream google.api.HttpBody);
+//
+//     }
+//
+// Use of this type only changes how the request and response bodies are
+// handled, all other features will continue to work unchanged.
+message HttpBody {
+  // The HTTP Content-Type header value specifying the content type of the body.
+  string content_type = 1;
+
+  // The HTTP request/response body as raw binary.
+  bytes data = 2;
+
+  // Application specific response metadata. Must be set in the first response
+  // for streaming APIs.
+  repeated google.protobuf.Any extensions = 3;
+}

third_party/googleapis/google/api/label.proto

@@ -0,0 +1,48 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/genproto/googleapis/api/label;label";
+option java_multiple_files = true;
+option java_outer_classname = "LabelProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// A description of a label.
+message LabelDescriptor {
+  // Value types that can be used as label values.
+  enum ValueType {
+    // A variable-length string. This is the default.
+    STRING = 0;
+
+    // Boolean; true or false.
+    BOOL = 1;
+
+    // A 64-bit signed integer.
+    INT64 = 2;
+  }
+
+  // The label key.
+  string key = 1;
+
+  // The type of data that can be assigned to the label.
+  ValueType value_type = 2;
+
+  // A human-readable description for the label.
+  string description = 3;
+}

third_party/googleapis/google/api/launch_stage.proto

@@ -0,0 +1,72 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api;api";
+option java_multiple_files = true;
+option java_outer_classname = "LaunchStageProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// The launch stage as defined by [Google Cloud Platform
+// Launch Stages](https://cloud.google.com/terms/launch-stages).
+enum LaunchStage {
+  // Do not use this default value.
+  LAUNCH_STAGE_UNSPECIFIED = 0;
+
+  // The feature is not yet implemented. Users can not use it.
+  UNIMPLEMENTED = 6;
+
+  // Prelaunch features are hidden from users and are only visible internally.
+  PRELAUNCH = 7;
+
+  // Early Access features are limited to a closed group of testers. To use
+  // these features, you must sign up in advance and sign a Trusted Tester
+  // agreement (which includes confidentiality provisions). These features may
+  // be unstable, changed in backward-incompatible ways, and are not
+  // guaranteed to be released.
+  EARLY_ACCESS = 1;
+
+  // Alpha is a limited availability test for releases before they are cleared
+  // for widespread use. By Alpha, all significant design issues are resolved
+  // and we are in the process of verifying functionality. Alpha customers
+  // need to apply for access, agree to applicable terms, and have their
+  // projects allowlisted. Alpha releases don't have to be feature complete,
+  // no SLAs are provided, and there are no technical support obligations, but
+  // they will be far enough along that customers can actually use them in
+  // test environments or for limited-use tests -- just like they would in
+  // normal production cases.
+  ALPHA = 2;
+
+  // Beta is the point at which we are ready to open a release for any
+  // customer to use. There are no SLA or technical support obligations in a
+  // Beta release. Products will be complete from a feature perspective, but
+  // may have some open outstanding issues. Beta releases are suitable for
+  // limited production use cases.
+  BETA = 3;
+
+  // GA features are open to all developers and are considered stable and
+  // fully qualified for production use.
+  GA = 4;
+
+  // Deprecated features are scheduled to be shut down and removed. For more
+  // information, see the "Deprecation Policy" section of our [Terms of
+  // Service](https://cloud.google.com/terms/)
+  // and the [Google Cloud Platform Subject to the Deprecation
+  // Policy](https://cloud.google.com/terms/deprecation) documentation.
+  DEPRECATED = 5;
+}

third_party/googleapis/google/api/log.proto

@@ -0,0 +1,54 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/api/label.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "LogProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// A description of a log type. Example in YAML format:
+//
+//     - name: library.googleapis.com/activity_history
+//       description: The history of borrowing and returning library items.
+//       display_name: Activity
+//       labels:
+//       - key: /customer_id
+//         description: Identifier of a library customer
+message LogDescriptor {
+  // The name of the log. It must be less than 512 characters long and can
+  // include the following characters: upper- and lower-case alphanumeric
+  // characters [A-Za-z0-9], and punctuation characters including
+  // slash, underscore, hyphen, period [/_-.].
+  string name = 1;
+
+  // The set of labels that are available to describe a specific log entry.
+  // Runtime requests that contain labels not specified here are
+  // considered invalid.
+  repeated LabelDescriptor labels = 2;
+
+  // A human-readable description of this log. This information appears in
+  // the documentation and can contain details.
+  string description = 3;
+
+  // The human-readable name for this log. This information appears on
+  // the user interface and should be concise.
+  string display_name = 4;
+}

third_party/googleapis/google/api/logging.proto

@@ -0,0 +1,80 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "LoggingProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Logging configuration of the service.
+//
+// The following example shows how to configure logs to be sent to the
+// producer and consumer projects. In the example, the `activity_history`
+// log is sent to both the producer and consumer projects, whereas the
+// `purchase_history` log is only sent to the producer project.
+//
+//     monitored_resources:
+//     - type: library.googleapis.com/branch
+//       labels:
+//       - key: /city
+//         description: The city where the library branch is located in.
+//       - key: /name
+//         description: The name of the branch.
+//     logs:
+//     - name: activity_history
+//       labels:
+//       - key: /customer_id
+//     - name: purchase_history
+//     logging:
+//       producer_destinations:
+//       - monitored_resource: library.googleapis.com/branch
+//         logs:
+//         - activity_history
+//         - purchase_history
+//       consumer_destinations:
+//       - monitored_resource: library.googleapis.com/branch
+//         logs:
+//         - activity_history
+message Logging {
+  // Configuration of a specific logging destination (the producer project
+  // or the consumer project).
+  message LoggingDestination {
+    // The monitored resource type. The type must be defined in the
+    // [Service.monitored_resources][google.api.Service.monitored_resources] section.
+    string monitored_resource = 3;
+
+    // Names of the logs to be sent to this destination. Each name must
+    // be defined in the [Service.logs][google.api.Service.logs] section. If the log name is
+    // not a domain scoped name, it will be automatically prefixed with
+    // the service name followed by "/".
+    repeated string logs = 1;
+  }
+
+  // Logging configurations for sending logs to the producer project.
+  // There can be multiple producer destinations, each one must have a
+  // different monitored resource type. A log can be used in at most
+  // one producer destination.
+  repeated LoggingDestination producer_destinations = 1;
+
+  // Logging configurations for sending logs to the consumer project.
+  // There can be multiple consumer destinations, each one must have a
+  // different monitored resource type. A log can be used in at most
+  // one consumer destination.
+  repeated LoggingDestination consumer_destinations = 2;
+}

third_party/googleapis/google/api/metric.proto

@@ -0,0 +1,264 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/api/label.proto";
+import "google/api/launch_stage.proto";
+import "google/protobuf/duration.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/api/metric;metric";
+option java_multiple_files = true;
+option java_outer_classname = "MetricProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Defines a metric type and its schema. Once a metric descriptor is created,
+// deleting or altering it stops data collection and makes the metric type's
+// existing data unusable.
+//
+message MetricDescriptor {
+  // The kind of measurement. It describes how the data is reported.
+  // For information on setting the start time and end time based on
+  // the MetricKind, see [TimeInterval][google.monitoring.v3.TimeInterval].
+  enum MetricKind {
+    // Do not use this default value.
+    METRIC_KIND_UNSPECIFIED = 0;
+
+    // An instantaneous measurement of a value.
+    GAUGE = 1;
+
+    // The change in a value during a time interval.
+    DELTA = 2;
+
+    // A value accumulated over a time interval.  Cumulative
+    // measurements in a time series should have the same start time
+    // and increasing end times, until an event resets the cumulative
+    // value to zero and sets a new start time for the following
+    // points.
+    CUMULATIVE = 3;
+  }
+
+  // The value type of a metric.
+  enum ValueType {
+    // Do not use this default value.
+    VALUE_TYPE_UNSPECIFIED = 0;
+
+    // The value is a boolean.
+    // This value type can be used only if the metric kind is `GAUGE`.
+    BOOL = 1;
+
+    // The value is a signed 64-bit integer.
+    INT64 = 2;
+
+    // The value is a double precision floating point number.
+    DOUBLE = 3;
+
+    // The value is a text string.
+    // This value type can be used only if the metric kind is `GAUGE`.
+    STRING = 4;
+
+    // The value is a [`Distribution`][google.api.Distribution].
+    DISTRIBUTION = 5;
+
+    // The value is money.
+    MONEY = 6;
+  }
+
+  // Additional annotations that can be used to guide the usage of a metric.
+  message MetricDescriptorMetadata {
+    // Deprecated. Must use the [MetricDescriptor.launch_stage][google.api.MetricDescriptor.launch_stage] instead.
+    LaunchStage launch_stage = 1 [deprecated = true];
+
+    // The sampling period of metric data points. For metrics which are written
+    // periodically, consecutive data points are stored at this time interval,
+    // excluding data loss due to errors. Metrics with a higher granularity have
+    // a smaller sampling period.
+    google.protobuf.Duration sample_period = 2;
+
+    // The delay of data points caused by ingestion. Data points older than this
+    // age are guaranteed to be ingested and available to be read, excluding
+    // data loss due to errors.
+    google.protobuf.Duration ingest_delay = 3;
+  }
+
+  // The resource name of the metric descriptor.
+  string name = 1;
+
+  // The metric type, including its DNS name prefix. The type is not
+  // URL-encoded. All user-defined metric types have the DNS name
+  // `custom.googleapis.com` or `external.googleapis.com`. Metric types should
+  // use a natural hierarchical grouping. For example:
+  //
+  //     "custom.googleapis.com/invoice/paid/amount"
+  //     "external.googleapis.com/prometheus/up"
+  //     "appengine.googleapis.com/http/server/response_latencies"
+  string type = 8;
+
+  // The set of labels that can be used to describe a specific
+  // instance of this metric type. For example, the
+  // `appengine.googleapis.com/http/server/response_latencies` metric
+  // type has a label for the HTTP response code, `response_code`, so
+  // you can look at latencies for successful responses or just
+  // for responses that failed.
+  repeated LabelDescriptor labels = 2;
+
+  // Whether the metric records instantaneous values, changes to a value, etc.
+  // Some combinations of `metric_kind` and `value_type` might not be supported.
+  MetricKind metric_kind = 3;
+
+  // Whether the measurement is an integer, a floating-point number, etc.
+  // Some combinations of `metric_kind` and `value_type` might not be supported.
+  ValueType value_type = 4;
+
+  // The units in which the metric value is reported. It is only applicable
+  // if the `value_type` is `INT64`, `DOUBLE`, or `DISTRIBUTION`. The `unit`
+  // defines the representation of the stored metric values.
+  //
+  // Different systems might scale the values to be more easily displayed (so a
+  // value of `0.02kBy` _might_ be displayed as `20By`, and a value of
+  // `3523kBy` _might_ be displayed as `3.5MBy`). However, if the `unit` is
+  // `kBy`, then the value of the metric is always in thousands of bytes, no
+  // matter how it might be displayed.
+  //
+  // If you want a custom metric to record the exact number of CPU-seconds used
+  // by a job, you can create an `INT64 CUMULATIVE` metric whose `unit` is
+  // `s{CPU}` (or equivalently `1s{CPU}` or just `s`). If the job uses 12,005
+  // CPU-seconds, then the value is written as `12005`.
+  //
+  // Alternatively, if you want a custom metric to record data in a more
+  // granular way, you can create a `DOUBLE CUMULATIVE` metric whose `unit` is
+  // `ks{CPU}`, and then write the value `12.005` (which is `12005/1000`),
+  // or use `Kis{CPU}` and write `11.723` (which is `12005/1024`).
+  //
+  // The supported units are a subset of [The Unified Code for Units of
+  // Measure](https://unitsofmeasure.org/ucum.html) standard:
+  //
+  // **Basic units (UNIT)**
+  //
+  // * `bit`   bit
+  // * `By`    byte
+  // * `s`     second
+  // * `min`   minute
+  // * `h`     hour
+  // * `d`     day
+  // * `1`     dimensionless
+  //
+  // **Prefixes (PREFIX)**
+  //
+  // * `k`     kilo    (10^3)
+  // * `M`     mega    (10^6)
+  // * `G`     giga    (10^9)
+  // * `T`     tera    (10^12)
+  // * `P`     peta    (10^15)
+  // * `E`     exa     (10^18)
+  // * `Z`     zetta   (10^21)
+  // * `Y`     yotta   (10^24)
+  //
+  // * `m`     milli   (10^-3)
+  // * `u`     micro   (10^-6)
+  // * `n`     nano    (10^-9)
+  // * `p`     pico    (10^-12)
+  // * `f`     femto   (10^-15)
+  // * `a`     atto    (10^-18)
+  // * `z`     zepto   (10^-21)
+  // * `y`     yocto   (10^-24)
+  //
+  // * `Ki`    kibi    (2^10)
+  // * `Mi`    mebi    (2^20)
+  // * `Gi`    gibi    (2^30)
+  // * `Ti`    tebi    (2^40)
+  // * `Pi`    pebi    (2^50)
+  //
+  // **Grammar**
+  //
+  // The grammar also includes these connectors:
+  //
+  // * `/`    division or ratio (as an infix operator). For examples,
+  //          `kBy/{email}` or `MiBy/10ms` (although you should almost never
+  //          have `/s` in a metric `unit`; rates should always be computed at
+  //          query time from the underlying cumulative or delta value).
+  // * `.`    multiplication or composition (as an infix operator). For
+  //          examples, `GBy.d` or `k{watt}.h`.
+  //
+  // The grammar for a unit is as follows:
+  //
+  //     Expression = Component { "." Component } { "/" Component } ;
+  //
+  //     Component = ( [ PREFIX ] UNIT | "%" ) [ Annotation ]
+  //               | Annotation
+  //               | "1"
+  //               ;
+  //
+  //     Annotation = "{" NAME "}" ;
+  //
+  // Notes:
+  //
+  // * `Annotation` is just a comment if it follows a `UNIT`. If the annotation
+  //    is used alone, then the unit is equivalent to `1`. For examples,
+  //    `{request}/s == 1/s`, `By{transmitted}/s == By/s`.
+  // * `NAME` is a sequence of non-blank printable ASCII characters not
+  //    containing `{` or `}`.
+  // * `1` represents a unitary [dimensionless
+  //    unit](https://en.wikipedia.org/wiki/Dimensionless_quantity) of 1, such
+  //    as in `1/s`. It is typically used when none of the basic units are
+  //    appropriate. For example, "new users per day" can be represented as
+  //    `1/d` or `{new-users}/d` (and a metric value `5` would mean "5 new
+  //    users). Alternatively, "thousands of page views per day" would be
+  //    represented as `1000/d` or `k1/d` or `k{page_views}/d` (and a metric
+  //    value of `5.3` would mean "5300 page views per day").
+  // * `%` represents dimensionless value of 1/100, and annotates values giving
+  //    a percentage (so the metric values are typically in the range of 0..100,
+  //    and a metric value `3` means "3 percent").
+  // * `10^2.%` indicates a metric contains a ratio, typically in the range
+  //    0..1, that will be multiplied by 100 and displayed as a percentage
+  //    (so a metric value `0.03` means "3 percent").
+  string unit = 5;
+
+  // A detailed description of the metric, which can be used in documentation.
+  string description = 6;
+
+  // A concise name for the metric, which can be displayed in user interfaces.
+  // Use sentence case without an ending period, for example "Request count".
+  // This field is optional but it is recommended to be set for any metrics
+  // associated with user-visible concepts, such as Quota.
+  string display_name = 7;
+
+  // Optional. Metadata which can be used to guide usage of the metric.
+  MetricDescriptorMetadata metadata = 10;
+
+  // Optional. The launch stage of the metric definition.
+  LaunchStage launch_stage = 12;
+
+  // Read-only. If present, then a [time
+  // series][google.monitoring.v3.TimeSeries], which is identified partially by
+  // a metric type and a [MonitoredResourceDescriptor][google.api.MonitoredResourceDescriptor], that is associated
+  // with this metric type can only be associated with one of the monitored
+  // resource types listed here.
+  repeated string monitored_resource_types = 13;
+}
+
+// A specific metric, identified by specifying values for all of the
+// labels of a [`MetricDescriptor`][google.api.MetricDescriptor].
+message Metric {
+  // An existing metric type, see [google.api.MetricDescriptor][google.api.MetricDescriptor].
+  // For example, `custom.googleapis.com/invoice/paid/amount`.
+  string type = 3;
+
+  // The set of label values that uniquely identify this metric. All
+  // labels listed in the `MetricDescriptor` must be assigned values.
+  map<string, string> labels = 2;
+}

third_party/googleapis/google/api/monitored_resource.proto

@@ -0,0 +1,125 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/api/label.proto";
+import "google/api/launch_stage.proto";
+import "google/protobuf/struct.proto";
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/genproto/googleapis/api/monitoredres;monitoredres";
+option java_multiple_files = true;
+option java_outer_classname = "MonitoredResourceProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// An object that describes the schema of a [MonitoredResource][google.api.MonitoredResource] object using a
+// type name and a set of labels.  For example, the monitored resource
+// descriptor for Google Compute Engine VM instances has a type of
+// `"gce_instance"` and specifies the use of the labels `"instance_id"` and
+// `"zone"` to identify particular VM instances.
+//
+// Different APIs can support different monitored resource types. APIs generally
+// provide a `list` method that returns the monitored resource descriptors used
+// by the API.
+//
+message MonitoredResourceDescriptor {
+  // Optional. The resource name of the monitored resource descriptor:
+  // `"projects/{project_id}/monitoredResourceDescriptors/{type}"` where
+  // {type} is the value of the `type` field in this object and
+  // {project_id} is a project ID that provides API-specific context for
+  // accessing the type.  APIs that do not use project information can use the
+  // resource name format `"monitoredResourceDescriptors/{type}"`.
+  string name = 5;
+
+  // Required. The monitored resource type. For example, the type
+  // `"cloudsql_database"` represents databases in Google Cloud SQL.
+  //  For a list of types, see [Monitoring resource
+  //  types](https://cloud.google.com/monitoring/api/resources)
+  // and [Logging resource
+  // types](https://cloud.google.com/logging/docs/api/v2/resource-list).
+  string type = 1;
+
+  // Optional. A concise name for the monitored resource type that might be
+  // displayed in user interfaces. It should be a Title Cased Noun Phrase,
+  // without any article or other determiners. For example,
+  // `"Google Cloud SQL Database"`.
+  string display_name = 2;
+
+  // Optional. A detailed description of the monitored resource type that might
+  // be used in documentation.
+  string description = 3;
+
+  // Required. A set of labels used to describe instances of this monitored
+  // resource type. For example, an individual Google Cloud SQL database is
+  // identified by values for the labels `"database_id"` and `"zone"`.
+  repeated LabelDescriptor labels = 4;
+
+  // Optional. The launch stage of the monitored resource definition.
+  LaunchStage launch_stage = 7;
+}
+
+// An object representing a resource that can be used for monitoring, logging,
+// billing, or other purposes. Examples include virtual machine instances,
+// databases, and storage devices such as disks. The `type` field identifies a
+// [MonitoredResourceDescriptor][google.api.MonitoredResourceDescriptor] object that describes the resource's
+// schema. Information in the `labels` field identifies the actual resource and
+// its attributes according to the schema. For example, a particular Compute
+// Engine VM instance could be represented by the following object, because the
+// [MonitoredResourceDescriptor][google.api.MonitoredResourceDescriptor] for `"gce_instance"` has labels
+// `"project_id"`, `"instance_id"` and `"zone"`:
+//
+//     { "type": "gce_instance",
+//       "labels": { "project_id": "my-project",
+//                   "instance_id": "12345678901234",
+//                   "zone": "us-central1-a" }}
+message MonitoredResource {
+  // Required. The monitored resource type. This field must match
+  // the `type` field of a [MonitoredResourceDescriptor][google.api.MonitoredResourceDescriptor] object. For
+  // example, the type of a Compute Engine VM instance is `gce_instance`.
+  // Some descriptors include the service name in the type; for example,
+  // the type of a Datastream stream is `datastream.googleapis.com/Stream`.
+  string type = 1;
+
+  // Required. Values for all of the labels listed in the associated monitored
+  // resource descriptor. For example, Compute Engine VM instances use the
+  // labels `"project_id"`, `"instance_id"`, and `"zone"`.
+  map<string, string> labels = 2;
+}
+
+// Auxiliary metadata for a [MonitoredResource][google.api.MonitoredResource] object.
+// [MonitoredResource][google.api.MonitoredResource] objects contain the minimum set of information to
+// uniquely identify a monitored resource instance. There is some other useful
+// auxiliary metadata. Monitoring and Logging use an ingestion
+// pipeline to extract metadata for cloud resources of all types, and store
+// the metadata in this message.
+message MonitoredResourceMetadata {
+  // Output only. Values for predefined system metadata labels.
+  // System labels are a kind of metadata extracted by Google, including
+  // "machine_image", "vpc", "subnet_id",
+  // "security_group", "name", etc.
+  // System label values can be only strings, Boolean values, or a list of
+  // strings. For example:
+  //
+  //     { "name": "my-test-instance",
+  //       "security_group": ["a", "b", "c"],
+  //       "spot_instance": false }
+  google.protobuf.Struct system_labels = 1;
+
+  // Output only. A map of user-defined metadata labels.
+  map<string, string> user_labels = 2;
+}

third_party/googleapis/google/api/monitoring.proto

@@ -0,0 +1,105 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "MonitoringProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Monitoring configuration of the service.
+//
+// The example below shows how to configure monitored resources and metrics
+// for monitoring. In the example, a monitored resource and two metrics are
+// defined. The `library.googleapis.com/book/returned_count` metric is sent
+// to both producer and consumer projects, whereas the
+// `library.googleapis.com/book/num_overdue` metric is only sent to the
+// consumer project.
+//
+//     monitored_resources:
+//     - type: library.googleapis.com/Branch
+//       display_name: "Library Branch"
+//       description: "A branch of a library."
+//       launch_stage: GA
+//       labels:
+//       - key: resource_container
+//         description: "The Cloud container (ie. project id) for the Branch."
+//       - key: location
+//         description: "The location of the library branch."
+//       - key: branch_id
+//         description: "The id of the branch."
+//     metrics:
+//     - name: library.googleapis.com/book/returned_count
+//       display_name: "Books Returned"
+//       description: "The count of books that have been returned."
+//       launch_stage: GA
+//       metric_kind: DELTA
+//       value_type: INT64
+//       unit: "1"
+//       labels:
+//       - key: customer_id
+//         description: "The id of the customer."
+//     - name: library.googleapis.com/book/num_overdue
+//       display_name: "Books Overdue"
+//       description: "The current number of overdue books."
+//       launch_stage: GA
+//       metric_kind: GAUGE
+//       value_type: INT64
+//       unit: "1"
+//       labels:
+//       - key: customer_id
+//         description: "The id of the customer."
+//     monitoring:
+//       producer_destinations:
+//       - monitored_resource: library.googleapis.com/Branch
+//         metrics:
+//         - library.googleapis.com/book/returned_count
+//       consumer_destinations:
+//       - monitored_resource: library.googleapis.com/Branch
+//         metrics:
+//         - library.googleapis.com/book/returned_count
+//         - library.googleapis.com/book/num_overdue
+message Monitoring {
+  // Configuration of a specific monitoring destination (the producer project
+  // or the consumer project).
+  message MonitoringDestination {
+    // The monitored resource type. The type must be defined in
+    // [Service.monitored_resources][google.api.Service.monitored_resources] section.
+    string monitored_resource = 1;
+
+    // Types of the metrics to report to this monitoring destination.
+    // Each type must be defined in [Service.metrics][google.api.Service.metrics] section.
+    repeated string metrics = 2;
+  }
+
+  // Monitoring configurations for sending metrics to the producer project.
+  // There can be multiple producer destinations. A monitored resource type may
+  // appear in multiple monitoring destinations if different aggregations are
+  // needed for different sets of metrics associated with that monitored
+  // resource type. A monitored resource and metric pair may only be used once
+  // in the Monitoring configuration.
+  repeated MonitoringDestination producer_destinations = 1;
+
+  // Monitoring configurations for sending metrics to the consumer project.
+  // There can be multiple consumer destinations. A monitored resource type may
+  // appear in multiple monitoring destinations if different aggregations are
+  // needed for different sets of metrics associated with that monitored
+  // resource type. A monitored resource and metric pair may only be used once
+  // in the Monitoring configuration.
+  repeated MonitoringDestination consumer_destinations = 2;
+}

third_party/googleapis/google/api/quota.proto

@@ -0,0 +1,183 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig";
+option java_multiple_files = true;
+option java_outer_classname = "QuotaProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+// Quota configuration helps to achieve fairness and budgeting in service
+// usage.
+//
+// The metric based quota configuration works this way:
+// - The service configuration defines a set of metrics.
+// - For API calls, the quota.metric_rules maps methods to metrics with
+//   corresponding costs.
+// - The quota.limits defines limits on the metrics, which will be used for
+//   quota checks at runtime.
+//
+// An example quota configuration in yaml format:
+//
+//    quota:
+//      limits:
+//
+//      - name: apiWriteQpsPerProject
+//        metric: library.googleapis.com/write_calls
+//        unit: "1/min/{project}"  # rate limit for consumer projects
+//        values:
+//          STANDARD: 10000
+//
+//
+//      (The metric rules bind all methods to the read_calls metric,
+//       except for the UpdateBook and DeleteBook methods. These two methods
+//       are mapped to the write_calls metric, with the UpdateBook method
+//       consuming at twice rate as the DeleteBook method.)
+//      metric_rules:
+//      - selector: "*"
+//        metric_costs:
+//          library.googleapis.com/read_calls: 1
+//      - selector: google.example.library.v1.LibraryService.UpdateBook
+//        metric_costs:
+//          library.googleapis.com/write_calls: 2
+//      - selector: google.example.library.v1.LibraryService.DeleteBook
+//        metric_costs:
+//          library.googleapis.com/write_calls: 1
+//
+//  Corresponding Metric definition:
+//
+//      metrics:
+//      - name: library.googleapis.com/read_calls
+//        display_name: Read requests
+//        metric_kind: DELTA
+//        value_type: INT64
+//
+//      - name: library.googleapis.com/write_calls
+//        display_name: Write requests
+//        metric_kind: DELTA
+//        value_type: INT64
+//
+//
+message Quota {
+  // List of QuotaLimit definitions for the service.
+  repeated QuotaLimit limits = 3;
+
+  // List of MetricRule definitions, each one mapping a selected method to one
+  // or more metrics.
+  repeated MetricRule metric_rules = 4;
+}
+
+// Bind API methods to metrics. Binding a method to a metric causes that
+// metric's configured quota behaviors to apply to the method call.
+message MetricRule {
+  // Selects the methods to which this rule applies.
+  //
+  // Refer to [selector][google.api.DocumentationRule.selector] for syntax details.
+  string selector = 1;
+
+  // Metrics to update when the selected methods are called, and the associated
+  // cost applied to each metric.
+  //
+  // The key of the map is the metric name, and the values are the amount
+  // increased for the metric against which the quota limits are defined.
+  // The value must not be negative.
+  map<string, int64> metric_costs = 2;
+}
+
+// `QuotaLimit` defines a specific limit that applies over a specified duration
+// for a limit type. There can be at most one limit for a duration and limit
+// type combination defined within a `QuotaGroup`.
+message QuotaLimit {
+  // Name of the quota limit.
+  //
+  // The name must be provided, and it must be unique within the service. The
+  // name can only include alphanumeric characters as well as '-'.
+  //
+  // The maximum length of the limit name is 64 characters.
+  string name = 6;
+
+  // Optional. User-visible, extended description for this quota limit.
+  // Should be used only when more context is needed to understand this limit
+  // than provided by the limit's display name (see: `display_name`).
+  string description = 2;
+
+  // Default number of tokens that can be consumed during the specified
+  // duration. This is the number of tokens assigned when a client
+  // application developer activates the service for his/her project.
+  //
+  // Specifying a value of 0 will block all requests. This can be used if you
+  // are provisioning quota to selected consumers and blocking others.
+  // Similarly, a value of -1 will indicate an unlimited quota. No other
+  // negative values are allowed.
+  //
+  // Used by group-based quotas only.
+  int64 default_limit = 3;
+
+  // Maximum number of tokens that can be consumed during the specified
+  // duration. Client application developers can override the default limit up
+  // to this maximum. If specified, this value cannot be set to a value less
+  // than the default limit. If not specified, it is set to the default limit.
+  //
+  // To allow clients to apply overrides with no upper bound, set this to -1,
+  // indicating unlimited maximum quota.
+  //
+  // Used by group-based quotas only.
+  int64 max_limit = 4;
+
+  // Free tier value displayed in the Developers Console for this limit.
+  // The free tier is the number of tokens that will be subtracted from the
+  // billed amount when billing is enabled.
+  // This field can only be set on a limit with duration "1d", in a billable
+  // group; it is invalid on any other limit. If this field is not set, it
+  // defaults to 0, indicating that there is no free tier for this service.
+  //
+  // Used by group-based quotas only.
+  int64 free_tier = 7;
+
+  // Duration of this limit in textual notation. Must be "100s" or "1d".
+  //
+  // Used by group-based quotas only.
+  string duration = 5;
+
+  // The name of the metric this quota limit applies to. The quota limits with
+  // the same metric will be checked together during runtime. The metric must be
+  // defined within the service config.
+  string metric = 8;
+
+  // Specify the unit of the quota limit. It uses the same syntax as
+  // [Metric.unit][]. The supported unit kinds are determined by the quota
+  // backend system.
+  //
+  // Here are some examples:
+  // * "1/min/{project}" for quota per minute per project.
+  //
+  // Note: the order of unit components is insignificant.
+  // The "1" at the beginning is required to follow the metric unit syntax.
+  string unit = 9;
+
+  // Tiered limit values. You must specify this as a key:value pair, with an
+  // integer value that is the maximum number of requests allowed for the
+  // specified unit. Currently only STANDARD is supported.
+  map<string, int64> values = 10;
+
+  // User-visible display name for this limit.
+  // Optional. If not set, the UI will provide a default display name based on
+  // the quota configuration. This field can be used to override the default
+  // display name generated from the configuration.
+  string display_name = 12;
+}

third_party/googleapis/google/api/resource.proto

@@ -0,0 +1,238 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/protobuf/descriptor.proto";
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/genproto/googleapis/api/annotations;annotations";
+option java_multiple_files = true;
+option java_outer_classname = "ResourceProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+extend google.protobuf.FieldOptions {
+  // An annotation that describes a resource reference, see
+  // [ResourceReference][].
+  google.api.ResourceReference resource_reference = 1055;
+}
+
+extend google.protobuf.FileOptions {
+  // An annotation that describes a resource definition without a corresponding
+  // message; see [ResourceDescriptor][].
+  repeated google.api.ResourceDescriptor resource_definition = 1053;
+}
+
+extend google.protobuf.MessageOptions {
+  // An annotation that describes a resource definition, see
+  // [ResourceDescriptor][].
+  google.api.ResourceDescriptor resource = 1053;
+}
+
+// A simple descriptor of a resource type.
+//
+// ResourceDescriptor annotates a resource message (either by means of a
+// protobuf annotation or use in the service config), and associates the
+// resource's schema, the resource type, and the pattern of the resource name.
+//
+// Example:
+//
+//     message Topic {
+//       // Indicates this message defines a resource schema.
+//       // Declares the resource type in the format of {service}/{kind}.
+//       // For Kubernetes resources, the format is {api group}/{kind}.
+//       option (google.api.resource) = {
+//         type: "pubsub.googleapis.com/Topic"
+//         pattern: "projects/{project}/topics/{topic}"
+//       };
+//     }
+//
+// The ResourceDescriptor Yaml config will look like:
+//
+//     resources:
+//     - type: "pubsub.googleapis.com/Topic"
+//       pattern: "projects/{project}/topics/{topic}"
+//
+// Sometimes, resources have multiple patterns, typically because they can
+// live under multiple parents.
+//
+// Example:
+//
+//     message LogEntry {
+//       option (google.api.resource) = {
+//         type: "logging.googleapis.com/LogEntry"
+//         pattern: "projects/{project}/logs/{log}"
+//         pattern: "folders/{folder}/logs/{log}"
+//         pattern: "organizations/{organization}/logs/{log}"
+//         pattern: "billingAccounts/{billing_account}/logs/{log}"
+//       };
+//     }
+//
+// The ResourceDescriptor Yaml config will look like:
+//
+//     resources:
+//     - type: 'logging.googleapis.com/LogEntry'
+//       pattern: "projects/{project}/logs/{log}"
+//       pattern: "folders/{folder}/logs/{log}"
+//       pattern: "organizations/{organization}/logs/{log}"
+//       pattern: "billingAccounts/{billing_account}/logs/{log}"
+message ResourceDescriptor {
+  // A description of the historical or future-looking state of the
+  // resource pattern.
+  enum History {
+    // The "unset" value.
+    HISTORY_UNSPECIFIED = 0;
+
+    // The resource originally had one pattern and launched as such, and
+    // additional patterns were added later.
+    ORIGINALLY_SINGLE_PATTERN = 1;
+
+    // The resource has one pattern, but the API owner expects to add more
+    // later. (This is the inverse of ORIGINALLY_SINGLE_PATTERN, and prevents
+    // that from being necessary once there are multiple patterns.)
+    FUTURE_MULTI_PATTERN = 2;
+  }
+
+  // A flag representing a specific style that a resource claims to conform to.
+  enum Style {
+    // The unspecified value. Do not use.
+    STYLE_UNSPECIFIED = 0;
+
+    // This resource is intended to be "declarative-friendly".
+    //
+    // Declarative-friendly resources must be more strictly consistent, and
+    // setting this to true communicates to tools that this resource should
+    // adhere to declarative-friendly expectations.
+    //
+    // Note: This is used by the API linter (linter.aip.dev) to enable
+    // additional checks.
+    DECLARATIVE_FRIENDLY = 1;
+  }
+
+  // The resource type. It must be in the format of
+  // {service_name}/{resource_type_kind}. The `resource_type_kind` must be
+  // singular and must not include version numbers.
+  //
+  // Example: `storage.googleapis.com/Bucket`
+  //
+  // The value of the resource_type_kind must follow the regular expression
+  // /[A-Za-z][a-zA-Z0-9]+/. It should start with an upper case character and
+  // should use PascalCase (UpperCamelCase). The maximum number of
+  // characters allowed for the `resource_type_kind` is 100.
+  string type = 1;
+
+  // Optional. The relative resource name pattern associated with this resource
+  // type. The DNS prefix of the full resource name shouldn't be specified here.
+  //
+  // The path pattern must follow the syntax, which aligns with HTTP binding
+  // syntax:
+  //
+  //     Template = Segment { "/" Segment } ;
+  //     Segment = LITERAL | Variable ;
+  //     Variable = "{" LITERAL "}" ;
+  //
+  // Examples:
+  //
+  //     - "projects/{project}/topics/{topic}"
+  //     - "projects/{project}/knowledgeBases/{knowledge_base}"
+  //
+  // The components in braces correspond to the IDs for each resource in the
+  // hierarchy. It is expected that, if multiple patterns are provided,
+  // the same component name (e.g. "project") refers to IDs of the same
+  // type of resource.
+  repeated string pattern = 2;
+
+  // Optional. The field on the resource that designates the resource name
+  // field. If omitted, this is assumed to be "name".
+  string name_field = 3;
+
+  // Optional. The historical or future-looking state of the resource pattern.
+  //
+  // Example:
+  //
+  //     // The InspectTemplate message originally only supported resource
+  //     // names with organization, and project was added later.
+  //     message InspectTemplate {
+  //       option (google.api.resource) = {
+  //         type: "dlp.googleapis.com/InspectTemplate"
+  //         pattern:
+  //         "organizations/{organization}/inspectTemplates/{inspect_template}"
+  //         pattern: "projects/{project}/inspectTemplates/{inspect_template}"
+  //         history: ORIGINALLY_SINGLE_PATTERN
+  //       };
+  //     }
+  History history = 4;
+
+  // The plural name used in the resource name and permission names, such as
+  // 'projects' for the resource name of 'projects/{project}' and the permission
+  // name of 'cloudresourcemanager.googleapis.com/projects.get'. It is the same
+  // concept of the `plural` field in k8s CRD spec
+  // https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/
+  //
+  // Note: The plural form is required even for singleton resources. See
+  // https://aip.dev/156
+  string plural = 5;
+
+  // The same concept of the `singular` field in k8s CRD spec
+  // https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/
+  // Such as "project" for the `resourcemanager.googleapis.com/Project` type.
+  string singular = 6;
+
+  // Style flag(s) for this resource.
+  // These indicate that a resource is expected to conform to a given
+  // style. See the specific style flags for additional information.
+  repeated Style style = 10;
+}
+
+// Defines a proto annotation that describes a string field that refers to
+// an API resource.
+message ResourceReference {
+  // The resource type that the annotated field references.
+  //
+  // Example:
+  //
+  //     message Subscription {
+  //       string topic = 2 [(google.api.resource_reference) = {
+  //         type: "pubsub.googleapis.com/Topic"
+  //       }];
+  //     }
+  //
+  // Occasionally, a field may reference an arbitrary resource. In this case,
+  // APIs use the special value * in their resource reference.
+  //
+  // Example:
+  //
+  //     message GetIamPolicyRequest {
+  //       string resource = 2 [(google.api.resource_reference) = {
+  //         type: "*"
+  //       }];
+  //     }
+  string type = 1;
+
+  // The resource type of a child collection that the annotated field
+  // references. This is useful for annotating the `parent` field that
+  // doesn't have a fixed resource type.
+  //
+  // Example:
+  //
+  //     message ListLogEntriesRequest {
+  //       string parent = 1 [(google.api.resource_reference) = {
+  //         child_type: "logging.googleapis.com/LogEntry"
+  //       };
+  //     }
+  string child_type = 2;
+}

third_party/googleapis/google/api/routing.proto

@@ -0,0 +1,461 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.api;
+
+import "google/protobuf/descriptor.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/api/annotations;annotations";
+option java_multiple_files = true;
+option java_outer_classname = "RoutingProto";
+option java_package = "com.google.api";
+option objc_class_prefix = "GAPI";
+
+extend google.protobuf.MethodOptions {
+  // See RoutingRule.
+  google.api.RoutingRule routing = 72295729;
+}
+
+// Specifies the routing information that should be sent along with the request
+// in the form of routing header.
+// **NOTE:** All service configuration rules follow the "last one wins" order.
+//
+// The examples below will apply to an RPC which has the following request type:
+//
+// Message Definition:
+//
+//     message Request {
+//       // The name of the Table
+//       // Values can be of the following formats:
+//       // - `projects/<project>/tables/<table>`
+//       // - `projects/<project>/instances/<instance>/tables/<table>`
+//       // - `region/<region>/zones/<zone>/tables/<table>`
+//       string table_name = 1;
+//
+//       // This value specifies routing for replication.
+//       // It can be in the following formats:
+//       // - `profiles/<profile_id>`
+//       // - a legacy `profile_id` that can be any string
+//       string app_profile_id = 2;
+//     }
+//
+// Example message:
+//
+//     {
+//       table_name: projects/proj_foo/instances/instance_bar/table/table_baz,
+//       app_profile_id: profiles/prof_qux
+//     }
+//
+// The routing header consists of one or multiple key-value pairs. Every key
+// and value must be percent-encoded, and joined together in the format of
+// `key1=value1&key2=value2`.
+// In the examples below I am skipping the percent-encoding for readablity.
+//
+// Example 1
+//
+// Extracting a field from the request to put into the routing header
+// unchanged, with the key equal to the field name.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // Take the `app_profile_id`.
+//       routing_parameters {
+//         field: "app_profile_id"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params: app_profile_id=profiles/prof_qux
+//
+// Example 2
+//
+// Extracting a field from the request to put into the routing header
+// unchanged, with the key different from the field name.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // Take the `app_profile_id`, but name it `routing_id` in the header.
+//       routing_parameters {
+//         field: "app_profile_id"
+//         path_template: "{routing_id=**}"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params: routing_id=profiles/prof_qux
+//
+// Example 3
+//
+// Extracting a field from the request to put into the routing
+// header, while matching a path template syntax on the field's value.
+//
+// NB: it is more useful to send nothing than to send garbage for the purpose
+// of dynamic routing, since garbage pollutes cache. Thus the matching.
+//
+// Sub-example 3a
+//
+// The field matches the template.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // Take the `table_name`, if it's well-formed (with project-based
+//       // syntax).
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{table_name=projects/*/instances/*/**}"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params:
+//     table_name=projects/proj_foo/instances/instance_bar/table/table_baz
+//
+// Sub-example 3b
+//
+// The field does not match the template.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // Take the `table_name`, if it's well-formed (with region-based
+//       // syntax).
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{table_name=regions/*/zones/*/**}"
+//       }
+//     };
+//
+// result:
+//
+//     <no routing header will be sent>
+//
+// Sub-example 3c
+//
+// Multiple alternative conflictingly named path templates are
+// specified. The one that matches is used to construct the header.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // Take the `table_name`, if it's well-formed, whether
+//       // using the region- or projects-based syntax.
+//
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{table_name=regions/*/zones/*/**}"
+//       }
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{table_name=projects/*/instances/*/**}"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params:
+//     table_name=projects/proj_foo/instances/instance_bar/table/table_baz
+//
+// Example 4
+//
+// Extracting a single routing header key-value pair by matching a
+// template syntax on (a part of) a single request field.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // Take just the project id from the `table_name` field.
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{routing_id=projects/*}/**"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params: routing_id=projects/proj_foo
+//
+// Example 5
+//
+// Extracting a single routing header key-value pair by matching
+// several conflictingly named path templates on (parts of) a single request
+// field. The last template to match "wins" the conflict.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // If the `table_name` does not have instances information,
+//       // take just the project id for routing.
+//       // Otherwise take project + instance.
+//
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{routing_id=projects/*}/**"
+//       }
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{routing_id=projects/*/instances/*}/**"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params:
+//     routing_id=projects/proj_foo/instances/instance_bar
+//
+// Example 6
+//
+// Extracting multiple routing header key-value pairs by matching
+// several non-conflicting path templates on (parts of) a single request field.
+//
+// Sub-example 6a
+//
+// Make the templates strict, so that if the `table_name` does not
+// have an instance information, nothing is sent.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // The routing code needs two keys instead of one composite
+//       // but works only for the tables with the "project-instance" name
+//       // syntax.
+//
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{project_id=projects/*}/instances/*/**"
+//       }
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "projects/*/{instance_id=instances/*}/**"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params:
+//     project_id=projects/proj_foo&instance_id=instances/instance_bar
+//
+// Sub-example 6b
+//
+// Make the templates loose, so that if the `table_name` does not
+// have an instance information, just the project id part is sent.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // The routing code wants two keys instead of one composite
+//       // but will work with just the `project_id` for tables without
+//       // an instance in the `table_name`.
+//
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{project_id=projects/*}/**"
+//       }
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "projects/*/{instance_id=instances/*}/**"
+//       }
+//     };
+//
+// result (is the same as 6a for our example message because it has the instance
+// information):
+//
+//     x-goog-request-params:
+//     project_id=projects/proj_foo&instance_id=instances/instance_bar
+//
+// Example 7
+//
+// Extracting multiple routing header key-value pairs by matching
+// several path templates on multiple request fields.
+//
+// NB: note that here there is no way to specify sending nothing if one of the
+// fields does not match its template. E.g. if the `table_name` is in the wrong
+// format, the `project_id` will not be sent, but the `routing_id` will be.
+// The backend routing code has to be aware of that and be prepared to not
+// receive a full complement of keys if it expects multiple.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // The routing needs both `project_id` and `routing_id`
+//       // (from the `app_profile_id` field) for routing.
+//
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{project_id=projects/*}/**"
+//       }
+//       routing_parameters {
+//         field: "app_profile_id"
+//         path_template: "{routing_id=**}"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params:
+//     project_id=projects/proj_foo&routing_id=profiles/prof_qux
+//
+// Example 8
+//
+// Extracting a single routing header key-value pair by matching
+// several conflictingly named path templates on several request fields. The
+// last template to match "wins" the conflict.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // The `routing_id` can be a project id or a region id depending on
+//       // the table name format, but only if the `app_profile_id` is not set.
+//       // If `app_profile_id` is set it should be used instead.
+//
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{routing_id=projects/*}/**"
+//       }
+//       routing_parameters {
+//          field: "table_name"
+//          path_template: "{routing_id=regions/*}/**"
+//       }
+//       routing_parameters {
+//         field: "app_profile_id"
+//         path_template: "{routing_id=**}"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params: routing_id=profiles/prof_qux
+//
+// Example 9
+//
+// Bringing it all together.
+//
+// annotation:
+//
+//     option (google.api.routing) = {
+//       // For routing both `table_location` and a `routing_id` are needed.
+//       //
+//       // table_location can be either an instance id or a region+zone id.
+//       //
+//       // For `routing_id`, take the value of `app_profile_id`
+//       // - If it's in the format `profiles/<profile_id>`, send
+//       // just the `<profile_id>` part.
+//       // - If it's any other literal, send it as is.
+//       // If the `app_profile_id` is empty, and the `table_name` starts with
+//       // the project_id, send that instead.
+//
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "projects/*/{table_location=instances/*}/tables/*"
+//       }
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{table_location=regions/*/zones/*}/tables/*"
+//       }
+//       routing_parameters {
+//         field: "table_name"
+//         path_template: "{routing_id=projects/*}/**"
+//       }
+//       routing_parameters {
+//         field: "app_profile_id"
+//         path_template: "{routing_id=**}"
+//       }
+//       routing_parameters {
+//         field: "app_profile_id"
+//         path_template: "profiles/{routing_id=*}"
+//       }
+//     };
+//
+// result:
+//
+//     x-goog-request-params:
+//     table_location=instances/instance_bar&routing_id=prof_qux
+message RoutingRule {
+  // A collection of Routing Parameter specifications.
+  // **NOTE:** If multiple Routing Parameters describe the same key
+  // (via the `path_template` field or via the `field` field when
+  // `path_template` is not provided), "last one wins" rule
+  // determines which Parameter gets used.
+  // See the examples for more details.
+  repeated RoutingParameter routing_parameters = 2;
+}
+
+// A projection from an input message to the GRPC or REST header.
+message RoutingParameter {
+  // A request field to extract the header key-value pair from.
+  string field = 1;
+
+  // A pattern matching the key-value field. Optional.
+  // If not specified, the whole field specified in the `field` field will be
+  // taken as value, and its name used as key. If specified, it MUST contain
+  // exactly one named segment (along with any number of unnamed segments) The
+  // pattern will be matched over the field specified in the `field` field, then
+  // if the match is successful:
+  // - the name of the single named segment will be used as a header name,
+  // - the match value of the segment will be used as a header value;
+  // if the match is NOT successful, nothing will be sent.
+  //
+  // Example:
+  //
+  //               -- This is a field in the request message
+  //              |   that the header value will be extracted from.
+  //              |
+  //              |                     -- This is the key name in the
+  //              |                    |   routing header.
+  //              V                    |
+  //     field: "table_name"           v
+  //     path_template: "projects/*/{table_location=instances/*}/tables/*"
+  //                                                ^            ^
+  //                                                |            |
+  //       In the {} brackets is the pattern that --             |
+  //       specifies what to extract from the                    |
+  //       field as a value to be sent.                          |
+  //                                                             |
+  //      The string in the field must match the whole pattern --
+  //      before brackets, inside brackets, after brackets.
+  //
+  // When looking at this specific example, we can see that:
+  // - A key-value pair with the key `table_location`
+  //   and the value matching `instances/*` should be added
+  //   to the x-goog-request-params routing header.
+  // - The value is extracted from the request message's `table_name` field
+  //   if it matches the full pattern specified:
+  //   `projects/*/instances/*/tables/*`.
+  //
+  // **NB:** If the `path_template` field is not provided, the key name is
+  // equal to the field name, and the whole field should be sent as a value.
+  // This makes the pattern for the field and the value functionally equivalent
+  // to `**`, and the configuration
+  //
+  //     {
+  //       field: "table_name"
+  //     }
+  //
+  // is a functionally equivalent shorthand to:
+  //
+  //     {
+  //       field: "table_name"
+  //       path_template: "{table_name=**}"
+  //     }
+  //
+  // See Example 1 for more details.
+  string path_template = 2;
+}