// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networkservices.v1;

import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkServices.V1";
option go_package = "cloud.google.com/go/networkservices/apiv1/networkservicespb;networkservicespb";
option java_multiple_files = true;
option java_outer_classname = "AgentGatewayProto";
option java_package = "com.google.cloud.networkservices.v1";
option php_namespace = "Google\\Cloud\\NetworkServices\\V1";
option ruby_package = "Google::Cloud::NetworkServices::V1";

// AgentGateway represents the agent gateway resource.
message AgentGateway {
  option (google.api.resource) = {
    type: "networkservices.googleapis.com/AgentGateway"
    pattern: "projects/{project}/locations/{location}/agentGateways/{agent_gateway}"
    plural: "agentGateways"
    singular: "agentGateway"
  };

  // Configuration for Google Managed deployment mode.
  // Proxy is orchestrated and managed by GoogleCloud in a tenant project.
  message GoogleManaged {
    // GovernedAccessPath defines the type of access to protect.
    enum GovernedAccessPath {
      // Governed access path is not specified.
      GOVERNED_ACCESS_PATH_UNSPECIFIED = 0;

      // Govern agent conections to destinations.
      AGENT_TO_ANYWHERE = 1;

      // Protect connection to Agent or Tool.
      CLIENT_TO_AGENT = 2;
    }

    // Optional. Operating Mode of Agent Gateway.
    GovernedAccessPath governed_access_path = 1
        [(google.api.field_behavior) = OPTIONAL];
  }

  // Configuration for Self Managed deployment mode.
  // Attach to existing Application Load Balancers or Secure Web Proxies.
  message SelfManaged {
    // Optional. A supported Google Cloud networking proxy in the Project and
    // Location
    string resource_uri = 1 [
      (google.api.field_behavior) = OPTIONAL,
      (google.api.resource_reference) = { type: "*" }
    ];

    // Optional. List of supported Google Cloud networking proxies in the Project and
    // Location.
    // resource_uris is mutually exclusive with resource_uri.
    repeated string resource_uris = 2 [
      (google.api.field_behavior) = OPTIONAL,
      (google.api.resource_reference) = { type: "*" }
    ];
  }

  // NetworkConfig contains network configurations for the AgentGateway.
  message NetworkConfig {
    // Configuration for Egress
    message Egress {
      // TrustConfig defines the trust configuration for egress.
      message TrustConfig {
        // Required. PEM encoded root certificates used to validate the identity
        // of the upstream servers/destinations during egress connections.
        repeated string pem_certificates = 1
            [(google.api.field_behavior) = REQUIRED];
      }

      // Optional. The URI of the Network Attachment resource.
      string network_attachment = 1 [(google.api.field_behavior) = OPTIONAL];

      // Optional. TrustConfig defines the trust configuration for egress.
      TrustConfig trust_config = 2 [(google.api.field_behavior) = OPTIONAL];
    }

    // DNS peering config for the user VPC network.
    message DnsPeeringConfig {
      // Required. Domain names for which DNS queries should be forwarded to the
      // target network.
      repeated string domains = 1 [(google.api.field_behavior) = REQUIRED];

      // Required. Target project ID to which DNS queries should be forwarded
      // to. This can be the same project that contains the AgentGateway or a
      // different project.
      string target_project = 2 [(google.api.field_behavior) = REQUIRED];

      // Required. Target network in 'target project' to which DNS queries
      // should be forwarded to. Must be in format of
      // `projects/{project}/global/networks/{network}`.
      string target_network = 3 [
        (google.api.field_behavior) = REQUIRED,
        (google.api.resource_reference) = {
          type: "compute.googleapis.com/Network"
        }
      ];
    }

    // Optional. Optional PSC-Interface network attachment for connectivity to
    // your private VPCs network.
    Egress egress = 1 [(google.api.field_behavior) = OPTIONAL];

    // Optional. Optional DNS peering configuration for connectivity to your
    // private VPC network.
    DnsPeeringConfig dns_peering_config = 2
        [(google.api.field_behavior) = OPTIONAL];
  }

  // AgentGatewayOutputCard contains informational output-only fields
  message AgentGatewayOutputCard {
    // Output only. mTLS Endpoint associated with this AgentGateway
    string mtls_endpoint = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. Root Certificates for Agents to validate this AgentGateway
    repeated string root_certificates = 5
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. Service Account used by Service Extensions to operate.
    string service_extensions_service_account = 4
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Enums of all supported protocols
  enum Protocol {
    // Unspecified protocol.
    PROTOCOL_UNSPECIFIED = 0;

    // Message Control Plane protocol.
    MCP = 1;
  }

  // Deployment mode of the network proxy. Exactly one of the fields in this
  // `oneof` must be set.
  oneof deployment_mode {
    // Optional. Proxy is orchestrated and managed by GoogleCloud in a tenant
    // project.
    GoogleManaged google_managed = 8 [(google.api.field_behavior) = OPTIONAL];

    // Optional. Attach to existing Application Load Balancers or Secure Web
    // Proxies.
    SelfManaged self_managed = 9 [(google.api.field_behavior) = OPTIONAL];
  }

  // Identifier. Name of the AgentGateway resource. It matches pattern
  // `projects/*/locations/*/agentGateways/<agent_gateway>`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. The timestamp when the resource was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the resource was updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Set of label tags associated with the AgentGateway resource.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A free-text description of the resource. Max length 1024
  // characters.
  string description = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Etag of the resource.
  // If this is provided, it must match the server's etag. If the provided etag
  // does not match the server's etag, the request will fail with a 409 ABORTED
  // error.
  string etag = 6 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Deprecated.
  repeated Protocol protocols = 12
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. A list of Agent registries containing the agents, MCP servers and
  // tools governed by the Agent Gateway. Note: Currently limited to
  // project-scoped registries Must be of format
  // `//agentregistry.googleapis.com/projects/{project}/locations/{location}/`
  repeated string registries = 13 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Network configuration for the AgentGateway.
  NetworkConfig network_config = 10 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Field for populated AgentGateway card.
  AgentGatewayOutputCard agent_gateway_card = 11
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request used with the ListAgentGateways method.
message ListAgentGatewaysRequest {
  // Required. The project and location from which the AgentGateways should be
  // listed, specified in the format `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/AgentGateway"
    }
  ];

  // Optional. Maximum number of AgentGateways to return per call.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The value returned by the last `ListAgentGatewaysResponse`
  // Indicates that this is a continuation of a prior `ListAgentGateways`
  // call, and that the system should return the next page of data.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. If true, allow partial responses for multi-regional Aggregated
  // List requests. Otherwise if one of the locations is down or unreachable,
  // the Aggregated List request will fail.
  bool return_partial_success = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Response returned by the ListAgentGateways method.
message ListAgentGatewaysResponse {
  // List of AgentGateway resources.
  repeated AgentGateway agent_gateways = 1;

  // If there might be more results than those appearing in this response, then
  // `next_page_token` is included. To get the next set of results, call this
  // method again using the value of `next_page_token` as `page_token`.
  string next_page_token = 2;

  // Unreachable resources. Populated when the request attempts to list all
  // resources across all supported locations, while some locations are
  // temporarily unavailable.
  repeated string unreachable = 3;
}

// Request used by the GetAgentGateway method.
message GetAgentGatewayRequest {
  // Required. A name of the AgentGateway to get. Must be in the format
  // `projects/*/locations/*/agentGateways/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/AgentGateway"
    }
  ];
}

// Request used by the CreateAgentGateway method.
message CreateAgentGatewayRequest {
  // Required. The parent resource of the AgentGateway. Must be in the
  // format `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/AgentGateway"
    }
  ];

  // Required. Short name of the AgentGateway resource to be created.
  string agent_gateway_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. AgentGateway resource to be created.
  AgentGateway agent_gateway = 3 [(google.api.field_behavior) = REQUIRED];
}

// Request used by the UpdateAgentGateway method.
message UpdateAgentGatewayRequest {
  // Optional. Field mask is used to specify the fields to be overwritten in the
  // AgentGateway resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. Updated AgentGateway resource.
  AgentGateway agent_gateway = 2 [(google.api.field_behavior) = REQUIRED];
}

// Request used by the DeleteAgentGateway method.
message DeleteAgentGatewayRequest {
  // Required. A name of the AgentGateway to delete. Must be in the format
  // `projects/*/locations/*/agentGateways/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/AgentGateway"
    }
  ];

  // Optional. The etag of the AgentGateway to delete.
  string etag = 2 [(google.api.field_behavior) = OPTIONAL];
}