diff --git a/buf.lock b/buf.lock
index 4bd6a04191..0941c76a5c 100644
--- a/buf.lock
+++ b/buf.lock
@@ -10,9 +10,9 @@ deps:
   - name: buf.build/grpc-ecosystem/grpc-gateway
     commit: a48fcebcf8f140dd9d09359b9bb185a4
     digest: b5:330af8a71b579ab96c4f3ee26929d1a68a5a9e986c7cfe0a898591fc514216bb6e723dc04c74d90fdee3f3f14f9100a54b4f079eb273e6e7213f0d5baca36ff8
-  - name: buf.build/opentelemetry/opentelemetry
-    commit: 648a3e2f02e14fe187656ea4ac3befa1
-    digest: b5:a0514be587ab2e8598f7102dfdaba5e985138b8c041c707e470a9c8b877410ada6e60cf2359352302f08c0504de685379f7f7a085d4699d69a2e6ed7035e78d9
+  - name: buf.build/redpandadata/ai-gateway
+    commit: 702ee5c67c994d9995e39e74bb6553f6
+    digest: b5:9717dd679ced8e42eab232efcc89c4ebcf9334b5aa6664b502268d5c7d25766e2c23b201822383a0a7c943d663859c7054c0656937fce7b612f7b578a59e3eb2
   - name: buf.build/redpandadata/common
     commit: 601698cfe71d43b1b36fd434a7f765f1
     digest: b5:d566ba6746a874a5709970e7f8569584008447d655c556676aabd3430111bbbc0a303dde11d99a1955ee27ac4748bcf7c972503a66db4ef850eb55f239f851ac
diff --git a/buf.yaml b/buf.yaml
index 68dda3d488..0586b5c1f0 100644
--- a/buf.yaml
+++ b/buf.yaml
@@ -11,6 +11,7 @@ deps:
   - buf.build/redpandadata/common
   - buf.build/redpandadata/core:05aa34b3829a4d5a801d9487623a7c76
   - buf.build/redpandadata/otel
+  - buf.build/redpandadata/ai-gateway
 lint:
   use:
     - STANDARD
diff --git a/frontend/bun.lock b/frontend/bun.lock
index 67faf6703e..21e5bf1449 100644
--- a/frontend/bun.lock
+++ b/frontend/bun.lock
@@ -1,5 +1,6 @@
 {
   "lockfileVersion": 1,
+  "configVersion": 0,
   "workspaces": {
     "": {
       "dependencies": {
diff --git a/frontend/rsbuild.config.ts b/frontend/rsbuild.config.ts
index 15c6393f7b..d6cee293d1 100644
--- a/frontend/rsbuild.config.ts
+++ b/frontend/rsbuild.config.ts
@@ -53,12 +53,31 @@ export default defineConfig({
       origin: ['http://localhost:3000', 'http://localhost:9090'],
       credentials: true,
     },
-    proxy: {
-      context: ['/api', '/redpanda.api', '/auth', '/logout'],
-      target: process.env.PROXY_TARGET || 'http://localhost:9090',
-      changeOrigin: !!process.env.PROXY_TARGET,
-      secure: process.env.PROXY_TARGET ? false : undefined,
-    },
+    proxy: [
+      // AI Gateway API - proxy to separate AI Gateway service
+      // Matches: /.redpanda/api/redpanda.api.aigateway.v1.*
+      // Proto package is: redpanda.api.aigateway.v1 (includes .api)
+      // AI Gateway now expects the full path with .api
+      ...(process.env.AI_GATEWAY_URL
+        ? [
+            {
+              context: ['/.redpanda/api/redpanda.api.aigateway.v1'],
+              target: process.env.AI_GATEWAY_URL,
+              changeOrigin: true,
+              secure: false,
+              logLevel: 'debug',
+              // No pathRewrite - AI Gateway expects full path with .api
+            },
+          ]
+        : []),
+      // All other APIs - proxy to Console backend
+      {
+        context: ['/api', '/redpanda.api', '/auth', '/logout'],
+        target: process.env.PROXY_TARGET || 'http://localhost:9090',
+        changeOrigin: !!process.env.PROXY_TARGET,
+        secure: process.env.PROXY_TARGET ? false : undefined,
+      },
+    ],
   },
   source: {
     define: {
diff --git a/frontend/src/components/constants.ts b/frontend/src/components/constants.ts
index 870a122cee..6b9577f368 100644
--- a/frontend/src/components/constants.ts
+++ b/frontend/src/components/constants.ts
@@ -18,6 +18,7 @@ export const FEATURE_FLAGS = {
   enableMcpServiceAccount: false,
   enablePipelineServiceAccount: false,
   enableTranscriptsInConsole: false,
+  enableApiKeyConfigurationAgent: false,
   shadowlinkCloudUi: false,
   enableNewTheme: false,
 };
diff --git a/frontend/src/components/pages/agents/create/ai-agent-create-page.tsx b/frontend/src/components/pages/agents/create/ai-agent-create-page.tsx
index bc6e04645c..19b225e160 100644
--- a/frontend/src/components/pages/agents/create/ai-agent-create-page.tsx
+++ b/frontend/src/components/pages/agents/create/ai-agent-create-page.tsx
@@ -32,6 +32,7 @@ import {
   type ServiceAccountSelectorRef,
 } from 'components/ui/service-account/service-account-selector';
 import { TagsFieldList } from 'components/ui/tag/tags-field-list';
+import { isFeatureFlagEnabled } from 'config';
 import { Loader2 } from 'lucide-react';
 import { Scope } from 'protogen/redpanda/api/dataplane/v1/secret_pb';
 import {
@@ -51,6 +52,7 @@ import {
 import { useEffect, useMemo, useRef, useState } from 'react';
 import { Controller, useFieldArray, useForm } from 'react-hook-form';
 import { useCreateAIAgentMutation } from 'react-query/api/ai-agent';
+import { useListGatewaysQuery } from 'react-query/api/ai-gateway';
 import { useListMCPServersQuery } from 'react-query/api/remote-mcp';
 import { useCreateSecretMutation, useListSecretsQuery } from 'react-query/api/secret';
 import { toast } from 'sonner';
@@ -72,6 +74,38 @@ export const AIAgentCreatePage = () => {
     skipInvalidation: true,
   });
 
+  // Feature flag: when true, use legacy API key mode (hardcoded providers)
+  const isLegacyApiKeyMode = isFeatureFlagEnabled('enableApiKeyConfigurationAgent');
+
+  // Gateway detection and list query (using v1 API from ai-gateway module)
+  // Only fetch when NOT in legacy mode
+  const { data: gatewaysData, isLoading: isLoadingGateways } = useListGatewaysQuery(
+    {},
+    { enabled: !isLegacyApiKeyMode }
+  );
+
+  const hasGatewayDeployed = useMemo(() => {
+    if (isLegacyApiKeyMode || isLoadingGateways) {
+      return false;
+    }
+    return Boolean(gatewaysData?.gateways && gatewaysData.gateways.length > 0);
+  }, [isLegacyApiKeyMode, gatewaysData, isLoadingGateways]);
+
+  const availableGateways = useMemo(() => {
+    if (isLegacyApiKeyMode || !gatewaysData?.gateways) {
+      return [];
+    }
+    return gatewaysData.gateways.map((gw) => {
+      // Extract gateway ID from name (format: "gateways/{gateway_id}")
+      const gatewayId = gw.name.split('/').pop() || gw.name;
+      return {
+        id: gatewayId,
+        displayName: gw.displayName,
+        description: gw.description,
+      };
+    });
+  }, [isLegacyApiKeyMode, gatewaysData]);
+
   // Ref to ServiceAccountSelector to call createServiceAccount
   const serviceAccountSelectorRef = useRef<ServiceAccountSelectorRef>(null);
 
@@ -107,6 +141,13 @@ export const AIAgentCreatePage = () => {
     }
   }, [displayName, form]);
 
+  // Auto-select first gateway when gateways are available (only if not in legacy mode)
+  useEffect(() => {
+    if (!isLegacyApiKeyMode && availableGateways.length > 0 && !form.getValues('gatewayId')) {
+      form.setValue('gatewayId', availableGateways[0].id);
+    }
+  }, [isLegacyApiKeyMode, availableGateways, form]);
+
   const {
     fields: tagFields,
     append: appendTag,
@@ -294,7 +335,9 @@ export const AIAgentCreatePage = () => {
     });
 
     // Build provider configuration based on selected provider
-    const apiKeyRef = `\${secrets.${values.apiKeySecret}}`;
+    // When using gateway: api_key can be empty (proto has ignore = IGNORE_IF_ZERO_VALUE)
+    // When not using gateway: api_key must reference a secret
+    const apiKeyRef = values.apiKeySecret ? `\${secrets.${values.apiKeySecret}}` : '';
     let providerConfig: AIAgent_Provider;
 
     switch (values.provider) {
@@ -464,7 +507,7 @@ export const AIAgentCreatePage = () => {
                 </CardHeader>
                 <CardContent>
                   <LLMConfigSection
-                    availableGateways={[]}
+                    availableGateways={availableGateways}
                     availableSecrets={availableSecrets}
                     fieldNames={{
                       provider: 'provider',
@@ -475,7 +518,8 @@ export const AIAgentCreatePage = () => {
                       gatewayId: 'gatewayId',
                     }}
                     form={form}
-                    hasGatewayDeployed={false}
+                    hasGatewayDeployed={hasGatewayDeployed}
+                    isLoadingGateways={isLoadingGateways}
                     mode="create"
                     scopes={[Scope.MCP_SERVER, Scope.AI_AGENT]}
                     showBaseUrl={form.watch('provider') === 'openaiCompatible'}
diff --git a/frontend/src/components/pages/agents/create/schemas.ts b/frontend/src/components/pages/agents/create/schemas.ts
index a2dd0821cb..3ff54408e6 100644
--- a/frontend/src/components/pages/agents/create/schemas.ts
+++ b/frontend/src/components/pages/agents/create/schemas.ts
@@ -49,6 +49,14 @@ export const FormSchema = z
         { message: 'Tags must have unique keys' }
       ),
     triggerType: z.enum(['http', 'slack', 'kafka']).default('http'),
+    gatewayId: z
+      .string()
+      .refine(
+        (val) => !val || (val.length === 20 && /^[a-z0-9]+$/.test(val)),
+        'Gateway ID must be exactly 20 lowercase alphanumeric characters'
+      )
+      .optional()
+      .or(z.literal('')),
     provider: z.enum(['openai', 'anthropic', 'google', 'openaiCompatible']).default('openai'),
     apiKeySecret: z.string(),
     model: z.string().min(1, 'Model is required'),
@@ -77,15 +85,24 @@ export const FormSchema = z
         },
         { message: 'Subagent names must be unique' }
       ),
-    gatewayId: z
-      .string()
-      .length(20, 'Gateway ID must be exactly 20 characters')
-      .regex(/^[a-z0-9]+$/, 'Gateway ID must contain only lowercase letters and numbers')
-      .optional()
-      .or(z.literal('')),
   })
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: Complex validation logic with multiple conditional checks
   .superRefine((data, ctx) => {
+    // Note: Gateway validation happens in the UI layer based on availability
+    // If gateways are available, gateway is required (enforced by UI)
+    // If gateways are NOT available, API key is required
+
+    const hasGateway = data.gatewayId && data.gatewayId.trim() !== '';
+
+    if (!hasGateway && (!data.apiKeySecret || data.apiKeySecret.trim() === '')) {
+      // No gateway selected: API Key is required
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'API Token is required',
+        path: ['apiKeySecret'],
+      });
+    }
+
     if (data.provider === 'openaiCompatible') {
       if (!data.baseUrl || data.baseUrl.trim() === '') {
         ctx.addIssue({
@@ -131,6 +148,7 @@ export const initialValues: FormValues = {
   description: '',
   tags: [],
   triggerType: 'http',
+  gatewayId: '',
   provider: 'openai',
   apiKeySecret: '',
   model: '',
@@ -142,5 +160,4 @@ export const initialValues: FormValues = {
   systemPrompt: '',
   serviceAccountName: '',
   subagents: [],
-  gatewayId: '',
 };
diff --git a/frontend/src/components/pages/agents/details/ai-agent-configuration-tab.tsx b/frontend/src/components/pages/agents/details/ai-agent-configuration-tab.tsx
index 9a6e4f5a17..6a137d18fa 100644
--- a/frontend/src/components/pages/agents/details/ai-agent-configuration-tab.tsx
+++ b/frontend/src/components/pages/agents/details/ai-agent-configuration-tab.tsx
@@ -16,6 +16,7 @@ import { getRouteApi } from '@tanstack/react-router';
 const routeApi = getRouteApi('/agents/$id');
 
 import { CLOUD_MANAGED_TAG_KEYS, isCloudManagedTagKey } from 'components/constants';
+import { isFeatureFlagEnabled } from 'config';
 import {
   Accordion,
   AccordionContent,
@@ -65,6 +66,9 @@ import {
 } from 'protogen/redpanda/api/dataplane/v1alpha3/ai_agent_pb';
 import { useCallback, useMemo, useState } from 'react';
 import { useGetAIAgentQuery, useUpdateAIAgentMutation } from 'react-query/api/ai-agent';
+import { useListGatewaysQuery } from 'react-query/api/ai-gateway';
+import { useListModelProvidersQuery } from 'react-query/api/ai-gateway/model-providers';
+import { useListModelsQuery } from 'react-query/api/ai-gateway/models';
 import { type MCPServer, useListMCPServersQuery } from 'react-query/api/remote-mcp';
 import { useListSecretsQuery } from 'react-query/api/secret';
 import { toast } from 'sonner';
@@ -312,31 +316,17 @@ export const AIAgentConfigurationTab = () => {
   const { mutateAsync: updateAIAgent, isPending: isUpdateAIAgentPending } = useUpdateAIAgentMutation();
   const { data: mcpServersData } = useListMCPServersQuery();
   const { data: secretsData } = useListSecretsQuery();
+  const { data: gatewaysData } = useListGatewaysQuery();
 
   const [isEditing, setIsEditing] = useState(false);
   const [editedAgentData, setEditedAgentData] = useState<LocalAIAgent | null>(null);
   const [expandedSubagent, setExpandedSubagent] = useState<string | undefined>(undefined);
 
-  // Get available MCP servers
-  const availableMcpServers = useMemo(() => {
-    if (!mcpServersData?.mcpServers || mcpServersData.mcpServers.length === 0) {
-      return [];
-    }
-    return mcpServersData.mcpServers;
-  }, [mcpServersData]);
+  // Feature flag: when true, use legacy API key mode (hardcoded providers, no gateway API calls)
+  const isLegacyApiKeyMode = isFeatureFlagEnabled('enableApiKeyConfigurationAgent');
 
-  // Get available secrets for API key dropdown
-  const availableSecrets = useMemo(() => {
-    if (!secretsData?.secrets) {
-      return [];
-    }
-    return secretsData.secrets
-      .filter((secret): secret is NonNullable<typeof secret> & { id: string } => !!secret?.id)
-      .map((secret) => ({
-        id: secret.id,
-        name: secret.id,
-      }));
-  }, [secretsData]);
+  // Check if agent is using gateway AND feature flag allows it
+  const isUsingGateway = !isLegacyApiKeyMode && !!aiAgentData?.aiAgent?.gateway?.virtualGatewayId;
 
   const getResourceTierFromAgent = useCallback((resources?: { cpuShares?: string; memoryShares?: string }) => {
     if (!resources) {
@@ -352,12 +342,11 @@ export const AIAgentConfigurationTab = () => {
     return matchingTier?.id || 'Small';
   }, []);
 
-  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: not sure how this slipped through CI
-  const getCurrentData = useCallback((): LocalAIAgent | null => {
+  // Get current provider for filtering models
+  const displayData = useMemo(() => {
     if (editedAgentData) {
       return editedAgentData;
     }
-
     if (aiAgentData?.aiAgent?.provider) {
       const provider = aiAgentData.aiAgent.provider;
       const { apiKeyTemplate, baseUrl } = extractProviderInfo(provider);
@@ -405,84 +394,169 @@ export const AIAgentConfigurationTab = () => {
           : undefined,
       };
     }
-
     return null;
   }, [editedAgentData, aiAgentData, getResourceTierFromAgent]);
 
+  const selectedProvider = displayData?.provider?.provider.case;
+
+  // Fetch providers and models from AI Gateway when using gateway
+  const { data: providersData, isLoading: isLoadingProviders } = useListModelProvidersQuery(
+    { filter: 'enabled = "true"' },
+    { enabled: isUsingGateway }
+  );
+
+  const { data: modelsData, isLoading: isLoadingModels } = useListModelsQuery(
+    {
+      filter: selectedProvider ? `provider = "${selectedProvider}" AND enabled = "true"` : 'enabled = "true"',
+    },
+    { enabled: isUsingGateway && !!selectedProvider }
+  );
+
+  // Get available providers - from gateway API or hardcoded
+  const availableProviders = useMemo(() => {
+    if (isUsingGateway && providersData?.modelProviders) {
+      // Map gateway providers to our format (already filtered for enabled at API level)
+      return providersData.modelProviders.map((provider) => {
+        // Strip "model_providers/" prefix from provider name
+        const providerName = provider.name.replace(/^model_providers\//, '');
+        const providerId = providerName.toLowerCase().replace(/\s+/g, '');
+
+        return {
+          id: providerId,
+          label: provider.displayName || providerName,
+          icon: MODEL_OPTIONS_BY_PROVIDER[providerId as keyof typeof MODEL_OPTIONS_BY_PROVIDER]?.icon || '',
+        };
+      });
+    }
+    // Fallback to hardcoded providers
+    return Object.entries(MODEL_OPTIONS_BY_PROVIDER).map(([id, provider]) => ({
+      id,
+      label: provider.label,
+      icon: provider.icon,
+    }));
+  }, [isUsingGateway, providersData]);
+
+  // Get available models - from gateway API or hardcoded
+  const filteredModels = useMemo(() => {
+    if (isUsingGateway && modelsData?.models) {
+      // Map gateway models to our format (already filtered for enabled at API level)
+      return modelsData.models.map((model) => {
+        // Strip "models/provider/" prefix from model name
+        const modelName = model.name.split('/').pop() || model.name;
+
+        return {
+          value: modelName,
+          name: model.displayName || modelName,
+          description: model.description || '',
+        };
+      });
+    }
+    // Fallback to hardcoded models
+    if (!selectedProvider) return [];
+    const providerData = MODEL_OPTIONS_BY_PROVIDER[selectedProvider as keyof typeof MODEL_OPTIONS_BY_PROVIDER];
+    return providerData?.models || [];
+  }, [isUsingGateway, modelsData, selectedProvider]);
+
+  // Get available MCP servers
+  const availableMcpServers = useMemo(() => {
+    if (!mcpServersData?.mcpServers || mcpServersData.mcpServers.length === 0) {
+      return [];
+    }
+    return mcpServersData.mcpServers;
+  }, [mcpServersData]);
+
+  // Get available secrets for API key dropdown
+  const availableSecrets = useMemo(() => {
+    if (!secretsData?.secrets) {
+      return [];
+    }
+    return secretsData.secrets
+      .filter((secret): secret is NonNullable<typeof secret> & { id: string } => !!secret?.id)
+      .map((secret) => ({
+        id: secret.id,
+        name: secret.id,
+      }));
+  }, [secretsData]);
+
+  // Get gateway display name
+  const gatewayDisplayName = useMemo(() => {
+    if (!aiAgentData?.aiAgent?.gateway?.virtualGatewayId || !gatewaysData?.gateways) {
+      return null;
+    }
+    const gateway = gatewaysData.gateways.find(
+      (gw) => gw.name.split('/').pop() === aiAgentData.aiAgent!.gateway?.virtualGatewayId
+    );
+    return gateway?.displayName || aiAgentData.aiAgent!.gateway!.virtualGatewayId;
+  }, [aiAgentData, gatewaysData]);
+
   const updateField = useCallback(
     (updates: Partial<LocalAIAgent>) => {
-      const currentData = getCurrentData();
-      if (!currentData) {
+      if (!displayData) {
         return;
       }
-      setEditedAgentData({ ...currentData, ...updates });
+      setEditedAgentData({ ...displayData, ...updates });
     },
-    [getCurrentData]
+    [displayData]
   );
 
   const handleAddTag = () => {
-    const currentData = getCurrentData();
-    if (!currentData) {
+    if (!displayData) {
       return;
     }
 
     setEditedAgentData({
-      ...currentData,
-      tags: [...currentData.tags, { key: '', value: '' }],
+      ...displayData,
+      tags: [...displayData.tags, { key: '', value: '' }],
     });
   };
 
   const handleRemoveTag = (index: number) => {
-    const currentData = getCurrentData();
-    if (!currentData) {
+    if (!displayData) {
       return;
     }
 
-    const updatedTags = currentData.tags.filter((_, i) => i !== index);
+    const updatedTags = displayData.tags.filter((_, i) => i !== index);
     setEditedAgentData({
-      ...currentData,
+      ...displayData,
       tags: updatedTags,
     });
   };
 
   const handleUpdateTag = (index: number, field: 'key' | 'value', value: string) => {
-    const currentData = getCurrentData();
-    if (!currentData) {
+    if (!displayData) {
       return;
     }
 
-    const updatedTags = [...currentData.tags];
+    const updatedTags = [...displayData.tags];
     updatedTags[index] = { ...updatedTags[index], [field]: value };
     setEditedAgentData({
-      ...currentData,
+      ...displayData,
       tags: updatedTags,
     });
   };
 
   const handleAddSubagent = () => {
-    const currentData = getCurrentData();
-    if (!currentData) {
+    if (!displayData) {
       return;
     }
 
-    const newIndex = currentData.subagents.length;
+    const newIndex = displayData.subagents.length;
     setEditedAgentData({
-      ...currentData,
-      subagents: [...currentData.subagents, { name: '', description: '', systemPrompt: '', selectedMcpServers: [] }],
+      ...displayData,
+      subagents: [...displayData.subagents, { name: '', description: '', systemPrompt: '', selectedMcpServers: [] }],
     });
     // Auto-expand the newly added subagent
     setExpandedSubagent(`subagent-${newIndex}`);
   };
 
   const handleRemoveSubagent = (index: number) => {
-    const currentData = getCurrentData();
-    if (!currentData) {
+    if (!displayData) {
       return;
     }
 
-    const updatedSubagents = currentData.subagents.filter((_, i) => i !== index);
+    const updatedSubagents = displayData.subagents.filter((_, i) => i !== index);
     setEditedAgentData({
-      ...currentData,
+      ...displayData,
       subagents: updatedSubagents,
     });
   };
@@ -492,15 +566,14 @@ export const AIAgentConfigurationTab = () => {
     field: 'name' | 'description' | 'systemPrompt' | 'selectedMcpServers',
     value: string | string[]
   ) => {
-    const currentData = getCurrentData();
-    if (!currentData) {
+    if (!displayData) {
       return;
     }
 
-    const updatedSubagents = [...currentData.subagents];
+    const updatedSubagents = [...displayData.subagents];
     updatedSubagents[index] = { ...updatedSubagents[index], [field]: value };
     setEditedAgentData({
-      ...currentData,
+      ...displayData,
       subagents: updatedSubagents,
     });
   };
@@ -572,17 +645,12 @@ export const AIAgentConfigurationTab = () => {
 
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: Complex form with many conditionals - already refactored with helper functions
   const handleSave = async () => {
-    if (!(aiAgentData?.aiAgent && id)) {
-      return;
-    }
-
-    const currentData = getCurrentData();
-    if (!currentData) {
+    if (!(aiAgentData?.aiAgent && id && displayData)) {
       return;
     }
 
     // Validate that user tags don't use reserved keys
-    for (const tag of currentData.tags) {
+    for (const tag of displayData.tags) {
       if (isCloudManagedTagKey(tag.key.trim())) {
         toast.error(`Tag key "${tag.key.trim()}" is reserved for system use`);
         return;
@@ -591,7 +659,7 @@ export const AIAgentConfigurationTab = () => {
 
     // Validate subagents
     const subagentNames = new Set<string>();
-    for (const [index, subagent] of currentData.subagents.entries()) {
+    for (const [index, subagent] of displayData.subagents.entries()) {
       const trimmedName = subagent.name.trim();
 
       // Validate name is not empty
@@ -633,17 +701,17 @@ export const AIAgentConfigurationTab = () => {
     }
 
     try {
-      const selectedTier = RESOURCE_TIERS.find((tier) => tier.id === currentData.resources.tier);
+      const selectedTier = RESOURCE_TIERS.find((tier) => tier.id === displayData.resources.tier);
 
       // Build MCP servers map
       const mcpServersMap: Record<string, { id: string }> = {};
-      for (const serverId of currentData.selectedMcpServers) {
+      for (const serverId of displayData.selectedMcpServers) {
         mcpServersMap[serverId] = create(AIAgent_MCPServerSchema, { id: serverId });
       }
 
       // Build subagents map
       const subagentsMap: Record<string, ReturnType<typeof create<typeof AIAgent_SubagentSchema>>> = {};
-      for (const subagent of currentData.subagents) {
+      for (const subagent of displayData.subagents) {
         const trimmedName = subagent.name.trim();
         if (trimmedName) {
           const subagentMcpMap: Record<string, { id: string }> = {};
@@ -659,14 +727,19 @@ export const AIAgentConfigurationTab = () => {
         }
       }
 
-      const tagsMap = buildTagsMap(aiAgentData.aiAgent.tags, currentData.tags);
-      const apiKeyRef = `\${secrets.${currentData.apiKeySecret}}`;
-      const updatedProvider = createUpdatedProvider(currentData.provider.provider.case, apiKeyRef, currentData.baseUrl);
+      const tagsMap = buildTagsMap(aiAgentData.aiAgent!.tags, displayData.tags);
+      // When using gateway, keep the existing API key reference; otherwise use the selected secret
+      const currentProvider = aiAgentData.aiAgent!.provider;
+      const apiKeyRef =
+        isUsingGateway && currentProvider
+          ? extractProviderInfo(currentProvider).apiKeyTemplate
+          : `\${secrets.${displayData.apiKeySecret}}`;
+      const updatedProvider = createUpdatedProvider(displayData.provider.provider.case, apiKeyRef, displayData.baseUrl);
 
       const gatewayConfig =
-        currentData.gatewayId && currentData.gatewayId.trim() !== ''
+        displayData.gatewayId && displayData.gatewayId.trim() !== ''
           ? create(AIAgent_GatewayConfigSchema, {
-              virtualGatewayId: currentData.gatewayId,
+              virtualGatewayId: displayData.gatewayId,
             })
           : undefined;
 
@@ -687,18 +760,18 @@ export const AIAgentConfigurationTab = () => {
         !!(provider?.organization || provider?.url);
 
       const agentCard =
-        currentData.agentCard && hasAgentCardData(currentData.agentCard)
+        displayData.agentCard && hasAgentCardData(displayData.agentCard)
           ? create(AIAgent_AgentCardSchema, {
-              iconUrl: currentData.agentCard.iconUrl || undefined,
-              documentationUrl: currentData.agentCard.documentationUrl || undefined,
+              iconUrl: displayData.agentCard.iconUrl || undefined,
+              documentationUrl: displayData.agentCard.documentationUrl || undefined,
               provider:
-                currentData.agentCard.provider && hasProviderData(currentData.agentCard.provider)
+                displayData.agentCard.provider && hasProviderData(displayData.agentCard.provider)
                   ? create(AIAgent_AgentCard_ProviderSchema, {
-                      organization: currentData.agentCard.provider.organization || undefined,
-                      url: currentData.agentCard.provider.url || undefined,
+                      organization: displayData.agentCard.provider.organization || undefined,
+                      url: displayData.agentCard.provider.url || undefined,
                     })
                   : undefined,
-              skills: currentData.agentCard.skills.map(sanitizeSkill),
+              skills: displayData.agentCard.skills.map(sanitizeSkill),
             })
           : undefined;
 
@@ -706,12 +779,12 @@ export const AIAgentConfigurationTab = () => {
         create(UpdateAIAgentRequestSchema, {
           id,
           aiAgent: create(AIAgentUpdateSchema, {
-            displayName: currentData.displayName,
-            description: currentData.description,
-            model: currentData.model,
-            maxIterations: currentData.maxIterations,
+            displayName: displayData.displayName,
+            description: displayData.description,
+            model: displayData.model,
+            maxIterations: displayData.maxIterations,
             provider: updatedProvider,
-            systemPrompt: currentData.systemPrompt,
+            systemPrompt: displayData.systemPrompt,
             serviceAccount: aiAgentData.aiAgent.serviceAccount,
             resources: {
               cpuShares: selectedTier?.cpu || '100m',
@@ -770,16 +843,11 @@ export const AIAgentConfigurationTab = () => {
     return mcpServersData.mcpServers.filter((server) => connectedServerIds.includes(server.id));
   }, [aiAgentData, mcpServersData]);
 
-  if (!aiAgentData?.aiAgent) {
+  if (!aiAgentData?.aiAgent || !displayData) {
     return null;
   }
 
   const agent = aiAgentData.aiAgent;
-  const displayData = getCurrentData();
-
-  if (!displayData) {
-    return null;
-  }
 
   return (
     <div className="space-y-6">
@@ -1108,16 +1176,28 @@ export const AIAgentConfigurationTab = () => {
             <CardContent className="px-4 pb-4">
               {isEditing ? (
                 <div className="space-y-4">
+                  {/* AI Gateway - show if configured (read-only in edit mode) */}
+                  {gatewayDisplayName && (
+                    <div className="space-y-2">
+                      <Label>AI Gateway</Label>
+                      <div className="flex h-10 items-center rounded-md border border-gray-200 bg-gray-50 px-3 py-2">
+                        <Text variant="muted">{gatewayDisplayName}</Text>
+                      </div>
+                      <Text className="text-xs" variant="muted">
+                        Gateway configuration cannot be changed after creation
+                      </Text>
+                    </div>
+                  )}
                   {/* Provider - now editable */}
                   <div className="space-y-2">
                     <Label htmlFor="provider">Provider</Label>
                     <Select
+                      disabled={isLoadingProviders}
                       onValueChange={(value: 'openai' | 'anthropic' | 'google' | 'openaiCompatible') => {
-                        const newProviderData = MODEL_OPTIONS_BY_PROVIDER[value];
+                        // Get models for the new provider
+                        const providerModels = isUsingGateway ? [] : MODEL_OPTIONS_BY_PROVIDER[value]?.models || [];
                         const firstModel =
-                          newProviderData.models.length > 0 && newProviderData.models[0]
-                            ? newProviderData.models[0].value
-                            : displayData.model;
+                          providerModels.length > 0 && providerModels[0] ? providerModels[0].value : displayData.model;
 
                         updateField({
                           provider: createUpdatedProvider(value, '', displayData.baseUrl || ''),
@@ -1128,7 +1208,7 @@ export const AIAgentConfigurationTab = () => {
                       value={displayData.provider?.provider.case}
                     >
                       <SelectTrigger>
-                        <SelectValue placeholder="Select provider">
+                        <SelectValue placeholder={isLoadingProviders ? 'Loading providers...' : 'Select provider'}>
                           {Boolean(displayData.provider?.provider.case) && (
                             <div className="flex items-center gap-2">
                               <img
@@ -1155,10 +1235,10 @@ export const AIAgentConfigurationTab = () => {
                         </SelectValue>
                       </SelectTrigger>
                       <SelectContent>
-                        {Object.entries(MODEL_OPTIONS_BY_PROVIDER).map(([providerId, provider]) => (
-                          <SelectItem key={providerId} value={providerId}>
+                        {availableProviders.map((provider) => (
+                          <SelectItem key={provider.id} value={provider.id}>
                             <div className="flex items-center gap-2">
-                              <img alt={provider.label} className="h-4 w-4" src={provider.icon} />
+                              {provider.icon && <img alt={provider.label} className="h-4 w-4" src={provider.icon} />}
                               <span>{provider.label}</span>
                             </div>
                           </SelectItem>
@@ -1170,16 +1250,21 @@ export const AIAgentConfigurationTab = () => {
                   {/* Model - filtered by provider */}
                   <div className="space-y-2">
                     <Label htmlFor="model">Model</Label>
-                    {displayData.provider?.provider.case === 'openaiCompatible' ? (
+                    {displayData.provider?.provider.case === 'openaiCompatible' ||
+                    (isUsingGateway && filteredModels.length === 0 && !isLoadingModels) ? (
                       <Input
                         onChange={(e) => updateField({ model: e.target.value })}
                         placeholder="Enter model name (e.g., llama-3.1-70b)"
                         value={displayData.model}
                       />
                     ) : (
-                      <Select onValueChange={(value) => updateField({ model: value })} value={displayData.model}>
+                      <Select
+                        disabled={isLoadingModels}
+                        onValueChange={(value) => updateField({ model: value })}
+                        value={displayData.model}
+                      >
                         <SelectTrigger>
-                          <SelectValue>
+                          <SelectValue placeholder={isLoadingModels ? 'Loading models...' : 'Select model'}>
                             {Boolean(displayData.model) && detectProvider(displayData.model) ? (
                               <div className="flex items-center gap-2">
                                 <img
@@ -1195,63 +1280,70 @@ export const AIAgentConfigurationTab = () => {
                           </SelectValue>
                         </SelectTrigger>
                         <SelectContent>
-                          {(() => {
-                            const providerCase = displayData.provider?.provider.case;
-
-                            const providerData = providerCase
-                              ? MODEL_OPTIONS_BY_PROVIDER[providerCase as keyof typeof MODEL_OPTIONS_BY_PROVIDER]
-                              : null;
-
-                            if (!providerData) {
-                              return (
-                                <div className="p-2">
-                                  <Text variant="muted">No models available for this provider</Text>
-                                </div>
-                              );
-                            }
-
-                            return (
-                              <SelectGroup>
+                          {isLoadingModels ? (
+                            <div className="p-2">
+                              <Text variant="muted">Loading models...</Text>
+                            </div>
+                          ) : filteredModels.length > 0 ? (
+                            <SelectGroup>
+                              {!isUsingGateway && displayData.provider?.provider.case && (
                                 <SelectLabel>
                                   <div className="flex items-center gap-2">
-                                    <img alt={providerData.label} className="h-4 w-4" src={providerData.icon} />
-                                    <span>{providerData.label}</span>
+                                    <img
+                                      alt={
+                                        MODEL_OPTIONS_BY_PROVIDER[
+                                          displayData.provider.provider.case as keyof typeof MODEL_OPTIONS_BY_PROVIDER
+                                        ]?.label
+                                      }
+                                      className="h-4 w-4"
+                                      src={
+                                        MODEL_OPTIONS_BY_PROVIDER[
+                                          displayData.provider.provider.case as keyof typeof MODEL_OPTIONS_BY_PROVIDER
+                                        ]?.icon
+                                      }
+                                    />
+                                    <span>
+                                      {
+                                        MODEL_OPTIONS_BY_PROVIDER[
+                                          displayData.provider.provider.case as keyof typeof MODEL_OPTIONS_BY_PROVIDER
+                                        ]?.label
+                                      }
+                                    </span>
                                   </div>
                                 </SelectLabel>
-                                {providerData.models.map(
-                                  (model: { value: string; name: string; description: string }) => (
-                                    <SelectItem key={model.value} value={model.value}>
-                                      <div className="flex flex-col gap-0.5">
-                                        <Text className="font-medium">{model.name}</Text>
-                                        <Text className="text-xs" variant="muted">
-                                          {model.description}
-                                        </Text>
-                                      </div>
-                                    </SelectItem>
-                                  )
-                                )}
-                              </SelectGroup>
-                            );
-                          })()}
+                              )}
+                              {filteredModels.map((model: { value: string; name: string; description: string }) => (
+                                <SelectItem key={model.value} value={model.value}>
+                                  {model.name}
+                                </SelectItem>
+                              ))}
+                            </SelectGroup>
+                          ) : (
+                            <div className="p-2">
+                              <Text variant="muted">No models available</Text>
+                            </div>
+                          )}
                         </SelectContent>
                       </Select>
                     )}
                   </div>
 
-                  {/* API Token */}
-                  <div className="space-y-2">
-                    <Label htmlFor="apiKeySecret">API Token</Label>
-                    <div className="[&>div]:flex-col [&>div]:items-stretch [&>div]:gap-2">
-                      <SecretSelector
-                        availableSecrets={availableSecrets}
-                        customText={AI_AGENT_SECRET_TEXT}
-                        onChange={(value) => updateField({ apiKeySecret: value })}
-                        placeholder="Select from secrets store or create new"
-                        scopes={[Scope.MCP_SERVER, Scope.AI_AGENT]}
-                        value={displayData.apiKeySecret}
-                      />
+                  {/* API Token - hide when using gateway */}
+                  {!isUsingGateway && (
+                    <div className="space-y-2">
+                      <Label htmlFor="apiKeySecret">API Token</Label>
+                      <div className="[&>div]:flex-col [&>div]:items-stretch [&>div]:gap-2">
+                        <SecretSelector
+                          availableSecrets={availableSecrets}
+                          customText={AI_AGENT_SECRET_TEXT}
+                          onChange={(value) => updateField({ apiKeySecret: value })}
+                          placeholder="Select from secrets store or create new"
+                          scopes={[Scope.MCP_SERVER, Scope.AI_AGENT]}
+                          value={displayData.apiKeySecret}
+                        />
+                      </div>
                     </div>
-                  </div>
+                  )}
 
                   {/* Base URL - only show for openaiCompatible */}
                   {displayData.provider?.provider.case === 'openaiCompatible' && (
@@ -1282,6 +1374,15 @@ export const AIAgentConfigurationTab = () => {
                 </div>
               ) : (
                 <div className="space-y-4">
+                  {/* AI Gateway - show if configured */}
+                  {gatewayDisplayName && (
+                    <div className="space-y-2">
+                      <Label>AI Gateway</Label>
+                      <div className="flex h-10 items-center rounded-md border border-gray-200 bg-gray-50 px-3 py-2">
+                        <Text>{gatewayDisplayName}</Text>
+                      </div>
+                    </div>
+                  )}
                   <div className="space-y-2">
                     <Label>Provider</Label>
                     <div className="flex h-10 items-center rounded-md border border-gray-200 bg-gray-50 px-3 py-2">
@@ -1299,13 +1400,15 @@ export const AIAgentConfigurationTab = () => {
                       <AIAgentModel model={displayData.model} />
                     </div>
                   </div>
-                  {/* API Token */}
-                  <div className="space-y-2">
-                    <Label>API Token</Label>
-                    <div className="flex h-10 items-center rounded-md border border-gray-200 bg-gray-50 px-3 py-2">
-                      <Text>{displayData.apiKeySecret || 'No secret configured'}</Text>
+                  {/* API Token - hide when using gateway */}
+                  {!isUsingGateway && (
+                    <div className="space-y-2">
+                      <Label>API Token</Label>
+                      <div className="flex h-10 items-center rounded-md border border-gray-200 bg-gray-50 px-3 py-2">
+                        <Text>{displayData.apiKeySecret || 'No secret configured'}</Text>
+                      </div>
                     </div>
-                  </div>
+                  )}
                   {agent.provider?.provider.case === 'openaiCompatible' && displayData.baseUrl && (
                     <div className="space-y-2">
                       <Label>Base URL</Label>
diff --git a/frontend/src/components/ui/ai-agent/llm-config-section.tsx b/frontend/src/components/ui/ai-agent/llm-config-section.tsx
index c7e79813e0..b19dc3b3f8 100644
--- a/frontend/src/components/ui/ai-agent/llm-config-section.tsx
+++ b/frontend/src/components/ui/ai-agent/llm-config-section.tsx
@@ -33,11 +33,10 @@ import {
 import type { Scope } from "protogen/redpanda/api/dataplane/v1/secret_pb";
 import { useEffect, useMemo } from "react";
 import { Controller, type UseFormReturn } from "react-hook-form";
+import { useListModelProvidersQuery } from "react-query/api/ai-gateway/model-providers";
+import { useListModelsQuery } from "react-query/api/ai-gateway/models";
 
-import {
-	detectProvider,
-	MODEL_OPTIONS_BY_PROVIDER,
-} from "../../pages/agents/ai-agent-model";
+import { MODEL_OPTIONS_BY_PROVIDER } from "../../pages/agents/ai-agent-model";
 
 export interface LLMConfigSectionProps {
   mode: 'create' | 'edit';
@@ -55,6 +54,7 @@ export interface LLMConfigSectionProps {
   showBaseUrl?: boolean;
   showMaxIterations?: boolean;
   hasGatewayDeployed?: boolean;
+  isLoadingGateways?: boolean;
   availableGateways?: Array<{ id: string; displayName: string; description?: string }>;
 }
 
@@ -67,56 +67,146 @@ export const LLMConfigSection: React.FC<LLMConfigSectionProps> = ({
   showBaseUrl = false,
   showMaxIterations = true,
   hasGatewayDeployed = false,
+  isLoadingGateways = false,
   availableGateways = [],
 }) => {
-  const GATEWAY_HARDCODED_PROVIDER = 'openai';
-  const GATEWAY_HARDCODED_MODEL = 'gpt-4o';
-
   const selectedProvider = form.watch(fieldNames.provider) as keyof typeof MODEL_OPTIONS_BY_PROVIDER;
   const selectedGatewayId = fieldNames.gatewayId ? form.watch(fieldNames.gatewayId) : undefined;
   const isUsingGateway = hasGatewayDeployed && !!selectedGatewayId;
 
+  // Fetch providers and models from AI Gateway when using gateway
+  // Filter for enabled providers at the API level
+  const { data: providersData, isLoading: isLoadingProviders } = useListModelProvidersQuery(
+    { filter: 'enabled = "true"' },
+    { enabled: isUsingGateway }
+  );
+
+  // Filter models by provider and enabled status
+  const { data: modelsData, isLoading: isLoadingModels } = useListModelsQuery(
+    {
+      filter: selectedProvider
+        ? `provider = "${selectedProvider}" AND enabled = "true"`
+        : 'enabled = "true"',
+    },
+    { enabled: isUsingGateway && !!selectedProvider }
+  );
+
+	// Get available providers - from gateway API or hardcoded
+	const availableProviders = useMemo(() => {
+		if (isUsingGateway && providersData?.modelProviders) {
+			// Map gateway providers to our format (already filtered for enabled at API level)
+			// Provider names are already transformed by the query hook (prefix stripped)
+			return providersData.modelProviders.map((provider) => {
+				const providerId = provider.name.toLowerCase().replace(/\s+/g, '');
+
+				return {
+					id: providerId,
+					label: provider.displayName || provider.name,
+					icon: MODEL_OPTIONS_BY_PROVIDER[providerId as keyof typeof MODEL_OPTIONS_BY_PROVIDER]?.icon || '',
+				};
+			});
+		}
+		// Fallback to hardcoded providers
+		return Object.entries(MODEL_OPTIONS_BY_PROVIDER).map(([id, provider]) => ({
+			id,
+			label: provider.label,
+			icon: provider.icon,
+		}));
+	}, [isUsingGateway, providersData]);
+
+	// Get available models - from gateway API or hardcoded
 	const filteredModels = useMemo(() => {
+		if (isUsingGateway && modelsData?.models) {
+			// Map gateway models to our format (already filtered for enabled at API level)
+			// Model names are already transformed by the query hook (prefix stripped)
+			return modelsData.models.map((model) => ({
+				value: model.name,
+				name: model.displayName || model.name,
+				description: model.description || '',
+			}));
+		}
+		// Fallback to hardcoded models
 		if (!selectedProvider) return [];
 		const providerData = MODEL_OPTIONS_BY_PROVIDER[selectedProvider];
 		return providerData?.models || [];
-	}, [selectedProvider]);
+	}, [isUsingGateway, modelsData, selectedProvider]);
 
+  // Auto-select first provider when available (create mode)
   useEffect(() => {
-    if (isUsingGateway) {
-      form.setValue(fieldNames.provider, GATEWAY_HARDCODED_PROVIDER);
-      form.setValue(fieldNames.model, GATEWAY_HARDCODED_MODEL);
-      form.setValue(fieldNames.apiKeySecret, '');
+    if (mode === 'create' && isUsingGateway && availableProviders.length > 0 && !isLoadingProviders) {
+      const currentProvider = form.getValues(fieldNames.provider);
+      // Check if current provider is in the available list
+      const isValidProvider = availableProviders.some((p) => p.id === currentProvider);
+
+      if (!currentProvider || !isValidProvider) {
+        // Auto-select first available provider
+        form.setValue(fieldNames.provider, availableProviders[0].id, { shouldValidate: true });
+      }
     }
-  }, [isUsingGateway, form, fieldNames]);
+  }, [mode, isUsingGateway, availableProviders, isLoadingProviders, form, fieldNames]);
 
+  // Clear model field when provider changes to show loading state
   useEffect(() => {
-    if (mode === 'create' && filteredModels.length > 0 && filteredModels[0] && !isUsingGateway) {
+    if (isUsingGateway && selectedProvider) {
       const currentModel = form.getValues(fieldNames.model);
-      const isValid = filteredModels.some((m: { value: string }) => m.value === currentModel);
+      // When models are loading or unavailable, clear the field to show placeholder
+      if (currentModel && (isLoadingModels || filteredModels.length === 0)) {
+        form.setValue(fieldNames.model, '', { shouldValidate: false });
+      }
+    }
+  }, [isUsingGateway, selectedProvider, isLoadingModels, filteredModels.length, form, fieldNames]);
+
+  // Auto-select first model when available (create mode)
+  useEffect(() => {
+    if (mode === 'create' && isUsingGateway && filteredModels.length > 0 && filteredModels[0] && !isLoadingModels && selectedProvider) {
+      const currentModel = form.getValues(fieldNames.model);
+      const isValid = currentModel && filteredModels.some((m: { value: string }) => m.value === currentModel);
 
       if (!isValid) {
-        form.setValue(fieldNames.model, filteredModels[0].value);
+        // Auto-select first available model
+        form.setValue(fieldNames.model, filteredModels[0].value, { shouldValidate: true });
       }
     }
-  }, [selectedProvider, mode, filteredModels, form, fieldNames, isUsingGateway]);
+  }, [mode, isUsingGateway, selectedProvider, filteredModels, isLoadingModels, form, fieldNames]);
+
+  // Clear API key when using gateway
+  useEffect(() => {
+    if (isUsingGateway) {
+      form.setValue(fieldNames.apiKeySecret, '');
+    }
+  }, [isUsingGateway, form, fieldNames]);
 
   return (
     <div className="space-y-4">
-      {hasGatewayDeployed && availableGateways.length > 0 && fieldNames.gatewayId && (
+      {fieldNames.gatewayId && (
         <Field data-invalid={!!form.formState.errors[fieldNames.gatewayId]}>
-          <FieldLabel htmlFor="gateway">AI Gateway</FieldLabel>
-          <FieldDescription>Route requests through an AI Gateway</FieldDescription>
+          <FieldLabel htmlFor="gateway" required>AI Gateway</FieldLabel>
+          <FieldDescription>
+            {hasGatewayDeployed && availableGateways.length > 0
+              ? 'Route requests through an AI Gateway'
+              : 'Gateway not available. Please enable AI Gateway for your cluster.'}
+          </FieldDescription>
           <Controller
             control={form.control}
             name={fieldNames.gatewayId}
             render={({ field }) => (
-              <Select onValueChange={field.onChange} value={field.value || ''}>
+              <Select
+                disabled={isLoadingGateways || !hasGatewayDeployed || availableGateways.length === 0}
+                onValueChange={field.onChange}
+                value={field.value}
+              >
                 <SelectTrigger id="gateway">
-                  <SelectValue placeholder="No gateway" />
+                  <SelectValue
+                    placeholder={
+                      isLoadingGateways
+                        ? 'Loading gateways...'
+                        : hasGatewayDeployed && availableGateways.length > 0
+                          ? 'Select a gateway'
+                          : 'No gateways available'
+                    }
+                  />
                 </SelectTrigger>
                 <SelectContent>
-                  <SelectItem value="">No gateway</SelectItem>
                   {availableGateways.map((gw) => (
                     <SelectItem key={gw.id} value={gw.id}>
                       {gw.displayName}
@@ -137,19 +227,32 @@ export const LLMConfigSection: React.FC<LLMConfigSectionProps> = ({
           <FieldLabel htmlFor="provider" required>
             Provider
           </FieldLabel>
+          {isUsingGateway && availableProviders.length === 0 && !isLoadingProviders && (
+            <FieldDescription>No enabled providers available. Please enable providers in AI Gateway.</FieldDescription>
+          )}
           <Controller
             control={form.control}
             name={fieldNames.provider}
             render={({ field }) => (
-              <Select disabled={isUsingGateway} onValueChange={field.onChange} value={field.value}>
+              <Select
+                disabled={isLoadingProviders || (isUsingGateway && availableProviders.length === 0)}
+                onValueChange={field.onChange}
+                value={field.value}
+              >
                 <SelectTrigger id="provider">
-                  <SelectValue placeholder="Select provider" />
+                  <SelectValue placeholder={
+                    isLoadingProviders
+                      ? "Loading providers..."
+                      : (isUsingGateway && availableProviders.length === 0)
+                        ? "No providers available"
+                        : "Select provider"
+                  } />
                 </SelectTrigger>
                 <SelectContent>
-                  {Object.entries(MODEL_OPTIONS_BY_PROVIDER).map(([providerId, provider]) => (
-                    <SelectItem key={providerId} value={providerId}>
+                  {availableProviders.map((provider) => (
+                    <SelectItem key={provider.id} value={provider.id}>
                       <div className="flex items-center gap-2">
-                        <img alt={provider.label} className="h-4 w-4" src={provider.icon} />
+                        {provider.icon && <img alt={provider.label} className="h-4 w-4" src={provider.icon} />}
                         <span>{provider.label}</span>
                       </div>
                     </SelectItem>
@@ -181,6 +284,9 @@ export const LLMConfigSection: React.FC<LLMConfigSectionProps> = ({
 				<FieldLabel htmlFor="model" required>
 					Model
 				</FieldLabel>
+				{isUsingGateway && filteredModels.length === 0 && !isLoadingModels && selectedProvider && (
+					<FieldDescription>No enabled models available. Please enable models in AI Gateway.</FieldDescription>
+				)}
 				<Controller
 					control={form.control}
 					name={fieldNames.model}
@@ -188,17 +294,16 @@ export const LLMConfigSection: React.FC<LLMConfigSectionProps> = ({
 						const providerData = selectedProvider
 							? MODEL_OPTIONS_BY_PROVIDER[selectedProvider]
 							: null;
-						const detectedProvider = field.value
-							? detectProvider(field.value as string)
-							: null;
 						const isFreeTextMode =
 							providerData && providerData.models.length === 0;
+            const hasNoProviders = isUsingGateway && availableProviders.length === 0 && !isLoadingProviders;
+            const hasNoModels = isUsingGateway && filteredModels.length === 0 && !isLoadingModels && !!selectedProvider;
 
             if (isFreeTextMode) {
               return (
                 <>
                   <Input
-                    disabled={isUsingGateway}
+                    disabled={hasNoProviders || hasNoModels}
                     id="model"
                     placeholder="Enter model name (e.g., llama-3.1-70b)"
                     {...field}
@@ -211,36 +316,40 @@ export const LLMConfigSection: React.FC<LLMConfigSectionProps> = ({
             }
 
             return (
-              <Select disabled={isUsingGateway} onValueChange={field.onChange} value={field.value}>
+              <Select disabled={isLoadingModels || hasNoProviders || hasNoModels} onValueChange={field.onChange} value={field.value || undefined}>
                 <SelectTrigger id="model">
-                  <SelectValue placeholder="Select AI model">
-                    {field.value && detectedProvider ? (
-                      <div className="flex items-center gap-2">
-                        <img alt={detectedProvider.label} className="h-4 w-4" src={detectedProvider.icon} />
-                        <span>{field.value}</span>
-                      </div>
-                    ) : (
-                      'Select AI model'
-                    )}
-                  </SelectValue>
+                  <SelectValue placeholder={
+                    hasNoProviders
+                      ? "No providers available"
+                      : hasNoModels
+                        ? "No models available"
+                        : isLoadingModels
+                          ? "Loading models..."
+                          : "Select model"
+                  } />
                 </SelectTrigger>
                 <SelectContent>
-                  {providerData ? (
+                  {isLoadingModels ? (
+                    <div className="p-2">
+                      <Text variant="muted">Loading models...</Text>
+                    </div>
+                  ) : hasNoModels ? (
+                    <div className="p-2">
+                      <Text variant="muted">No enabled models available</Text>
+                    </div>
+                  ) : filteredModels.length > 0 ? (
                     <SelectGroup>
-                      <SelectLabel>
-                        <div className="flex items-center gap-2">
-                          <img alt={providerData.label} className="h-4 w-4" src={providerData.icon} />
-                          <span>{providerData.label}</span>
-                        </div>
-                      </SelectLabel>
+                      {providerData && !isUsingGateway && (
+                        <SelectLabel>
+                          <div className="flex items-center gap-2">
+                            <img alt={providerData.label} className="h-4 w-4" src={providerData.icon} />
+                            <span>{providerData.label}</span>
+                          </div>
+                        </SelectLabel>
+                      )}
                       {filteredModels.map((model: { value: string; name: string; description: string }) => (
                         <SelectItem key={model.value} value={model.value}>
-                          <div className="flex flex-col gap-0.5">
-                            <Text className="font-medium">{model.name}</Text>
-                            <Text className="text-xs" variant="muted">
-                              {model.description}
-                            </Text>
-                          </div>
+                          {model.name}
                         </SelectItem>
                       ))}
                     </SelectGroup>
diff --git a/frontend/src/hooks/use-ai-gateway-transport.ts b/frontend/src/hooks/use-ai-gateway-transport.ts
new file mode 100644
index 0000000000..66e46d53fd
--- /dev/null
+++ b/frontend/src/hooks/use-ai-gateway-transport.ts
@@ -0,0 +1,35 @@
+import type { Transport } from '@connectrpc/connect';
+import { createConnectTransport } from '@connectrpc/connect-web';
+import { addBearerTokenInterceptor } from 'config';
+import { protobufRegistry } from 'protobuf-registry';
+import { useMemo } from 'react';
+
+/**
+ * Custom hook to create and memoize a Connect transport for AI Gateway API calls
+ *
+ * Uses base path: /.redpanda/api/
+ * Connect Query will append the service path: redpanda.api.aigateway.v1.GatewayService/ListGateways
+ * Full path becomes: /.redpanda/api/redpanda.api.aigateway.v1.GatewayService/ListGateways
+ *
+ * Dev server proxies /.redpanda/api/redpanda.api.aigateway.v1 to:
+ *   https://ai-gateway.${CLUSTER_ID}.clusters.ign.rdpa.co
+ *
+ * @returns Transport instance configured for AI Gateway communication
+ */
+export const useAIGatewayTransport = (): Transport => {
+  const aiGatewayTransport = useMemo(() => {
+    // Use /.redpanda/api/ base path (AI Gateway's Connect RPC endpoint prefix)
+    // Dev server will proxy to the correct AI Gateway based on cluster ID
+    const baseUrl = '/.redpanda/api';
+
+    return createConnectTransport({
+      baseUrl,
+      interceptors: [addBearerTokenInterceptor],
+      jsonOptions: {
+        registry: protobufRegistry,
+      },
+    });
+  }, []);
+
+  return aiGatewayTransport;
+};
diff --git a/frontend/src/protogen/buf/validate/validate_pb.ts b/frontend/src/protogen/buf/validate/validate_pb.ts
index 3f98e73502..ac05cb4265 100644
--- a/frontend/src/protogen/buf/validate/validate_pb.ts
+++ b/frontend/src/protogen/buf/validate/validate_pb.ts
@@ -18,15 +18,15 @@
 
 import type { GenEnum, GenExtension, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
 import { enumDesc, extDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
-import type { Duration, FieldDescriptorProto_Type, FieldMask, FieldOptions, MessageOptions, OneofOptions, Timestamp } from "@bufbuild/protobuf/wkt";
-import { file_google_protobuf_descriptor, file_google_protobuf_duration, file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Duration, FieldDescriptorProto_Type, FieldOptions, MessageOptions, OneofOptions, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_descriptor, file_google_protobuf_duration, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 import type { Message } from "@bufbuild/protobuf";
 
 /**
  * Describes the file buf/validate/validate.proto.
  */
 export const file_buf_validate_validate: GenFile = /*@__PURE__*/
-  fileDesc("ChtidWYvdmFsaWRhdGUvdmFsaWRhdGUucHJvdG8SDGJ1Zi52YWxpZGF0ZSI3CgRSdWxlEgoKAmlkGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEgoKZXhwcmVzc2lvbhgDIAEoCSKGAQoMTWVzc2FnZVJ1bGVzEhYKDmNlbF9leHByZXNzaW9uGAUgAygJEh8KA2NlbBgDIAMoCzISLmJ1Zi52YWxpZGF0ZS5SdWxlEi0KBW9uZW9mGAQgAygLMh4uYnVmLnZhbGlkYXRlLk1lc3NhZ2VPbmVvZlJ1bGVKBAgBEAJSCGRpc2FibGVkIjQKEE1lc3NhZ2VPbmVvZlJ1bGUSDgoGZmllbGRzGAEgAygJEhAKCHJlcXVpcmVkGAIgASgIIh4KCk9uZW9mUnVsZXMSEAoIcmVxdWlyZWQYASABKAgiiwkKCkZpZWxkUnVsZXMSFgoOY2VsX2V4cHJlc3Npb24YHSADKAkSHwoDY2VsGBcgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGUSEAoIcmVxdWlyZWQYGSABKAgSJAoGaWdub3JlGBsgASgOMhQuYnVmLnZhbGlkYXRlLklnbm9yZRIpCgVmbG9hdBgBIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GbG9hdFJ1bGVzSAASKwoGZG91YmxlGAIgASgLMhkuYnVmLnZhbGlkYXRlLkRvdWJsZVJ1bGVzSAASKQoFaW50MzIYAyABKAsyGC5idWYudmFsaWRhdGUuSW50MzJSdWxlc0gAEikKBWludDY0GAQgASgLMhguYnVmLnZhbGlkYXRlLkludDY0UnVsZXNIABIrCgZ1aW50MzIYBSABKAsyGS5idWYudmFsaWRhdGUuVUludDMyUnVsZXNIABIrCgZ1aW50NjQYBiABKAsyGS5idWYudmFsaWRhdGUuVUludDY0UnVsZXNIABIrCgZzaW50MzIYByABKAsyGS5idWYudmFsaWRhdGUuU0ludDMyUnVsZXNIABIrCgZzaW50NjQYCCABKAsyGS5idWYudmFsaWRhdGUuU0ludDY0UnVsZXNIABItCgdmaXhlZDMyGAkgASgLMhouYnVmLnZhbGlkYXRlLkZpeGVkMzJSdWxlc0gAEi0KB2ZpeGVkNjQYCiABKAsyGi5idWYudmFsaWRhdGUuRml4ZWQ2NFJ1bGVzSAASLwoIc2ZpeGVkMzIYCyABKAsyGy5idWYudmFsaWRhdGUuU0ZpeGVkMzJSdWxlc0gAEi8KCHNmaXhlZDY0GAwgASgLMhsuYnVmLnZhbGlkYXRlLlNGaXhlZDY0UnVsZXNIABInCgRib29sGA0gASgLMhcuYnVmLnZhbGlkYXRlLkJvb2xSdWxlc0gAEisKBnN0cmluZxgOIAEoCzIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlc0gAEikKBWJ5dGVzGA8gASgLMhguYnVmLnZhbGlkYXRlLkJ5dGVzUnVsZXNIABInCgRlbnVtGBAgASgLMhcuYnVmLnZhbGlkYXRlLkVudW1SdWxlc0gAEi8KCHJlcGVhdGVkGBIgASgLMhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXNIABIlCgNtYXAYEyABKAsyFi5idWYudmFsaWRhdGUuTWFwUnVsZXNIABIlCgNhbnkYFCABKAsyFi5idWYudmFsaWRhdGUuQW55UnVsZXNIABIvCghkdXJhdGlvbhgVIAEoCzIbLmJ1Zi52YWxpZGF0ZS5EdXJhdGlvblJ1bGVzSAASMgoKZmllbGRfbWFzaxgcIAEoCzIcLmJ1Zi52YWxpZGF0ZS5GaWVsZE1hc2tSdWxlc0gAEjEKCXRpbWVzdGFtcBgWIAEoCzIcLmJ1Zi52YWxpZGF0ZS5UaW1lc3RhbXBSdWxlc0gAQgYKBHR5cGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSJVCg9QcmVkZWZpbmVkUnVsZXMSHwoDY2VsGAEgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGVKBAgYEBlKBAgaEBtSB3NraXBwZWRSDGlnbm9yZV9lbXB0eSLaFwoKRmxvYXRSdWxlcxKDAQoFY29uc3QYASABKAJCdMJIcQpvCgtmbG9hdC5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEp8BCgJsdBgCIAEoAkKQAcJIjAEKiQEKCGZsb2F0Lmx0Gn0haGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0KT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEq8BCgNsdGUYAyABKAJCnwHCSJsBCpgBCglmbG9hdC5sdGUaigEhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlKT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABLvBwoCZ3QYBCABKAJC4AfCSNwHCo0BCghmbG9hdC5ndBqAASFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCsMBCgtmbG9hdC5ndF9sdBqzAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCs0BChVmbG9hdC5ndF9sdF9leGNsdXNpdmUaswFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrTAQoMZmxvYXQuZ3RfbHRlGsIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycK3QEKFmZsb2F0Lmd0X2x0ZV9leGNsdXNpdmUawgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEroICgNndGUYBSABKAJCqgjCSKYICpsBCglmbG9hdC5ndGUajQEhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycK0gEKDGZsb2F0Lmd0ZV9sdBrBAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK3AEKFmZsb2F0Lmd0ZV9sdF9leGNsdXNpdmUawQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCuIBCg1mbG9hdC5ndGVfbHRlGtABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrsAQoXZmxvYXQuZ3RlX2x0ZV9leGNsdXNpdmUa0AFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESfwoCaW4YBiADKAJCc8JIcApuCghmbG9hdC5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSdgoGbm90X2luGAcgAygCQmbCSGMKYQoMZmxvYXQubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSdQoGZmluaXRlGAggASgIQmXCSGIKYAoMZmxvYXQuZmluaXRlGlBydWxlcy5maW5pdGUgPyAodGhpcy5pc05hbigpIHx8IHRoaXMuaXNJbmYoKSA/ICd2YWx1ZSBtdXN0IGJlIGZpbml0ZScgOiAnJykgOiAnJxIrCgdleGFtcGxlGAkgAygCQhrCSBcKFQoNZmxvYXQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i7RcKC0RvdWJsZVJ1bGVzEoQBCgVjb25zdBgBIAEoAUJ1wkhyCnAKDGRvdWJsZS5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEqABCgJsdBgCIAEoAUKRAcJIjQEKigEKCWRvdWJsZS5sdBp9IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCk/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKwAQoDbHRlGAMgASgBQqABwkicAQqZAQoKZG91YmxlLmx0ZRqKASFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUpPyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEvQHCgJndBgEIAEoAULlB8JI4QcKjgEKCWRvdWJsZS5ndBqAASFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCsQBCgxkb3VibGUuZ3RfbHQaswFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrOAQoWZG91YmxlLmd0X2x0X2V4Y2x1c2l2ZRqzAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCtQBCg1kb3VibGUuZ3RfbHRlGsIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycK3gEKF2RvdWJsZS5ndF9sdGVfZXhjbHVzaXZlGsIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARK/CAoDZ3RlGAUgASgBQq8IwkirCAqcAQoKZG91YmxlLmd0ZRqNASFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrTAQoNZG91YmxlLmd0ZV9sdBrBAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK3QEKF2RvdWJsZS5ndGVfbHRfZXhjbHVzaXZlGsEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrjAQoOZG91YmxlLmd0ZV9sdGUa0AFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCu0BChhkb3VibGUuZ3RlX2x0ZV9leGNsdXNpdmUa0AFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESgAEKAmluGAYgAygBQnTCSHEKbwoJZG91YmxlLmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ3CgZub3RfaW4YByADKAFCZ8JIZApiCg1kb3VibGUubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSdgoGZmluaXRlGAggASgIQmbCSGMKYQoNZG91YmxlLmZpbml0ZRpQcnVsZXMuZmluaXRlID8gKHRoaXMuaXNOYW4oKSB8fCB0aGlzLmlzSW5mKCkgPyAndmFsdWUgbXVzdCBiZSBmaW5pdGUnIDogJycpIDogJycSLAoHZXhhbXBsZRgJIAMoAUIbwkgYChYKDmRvdWJsZS5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiKMFQoKSW50MzJSdWxlcxKDAQoFY29uc3QYASABKAVCdMJIcQpvCgtpbnQzMi5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEooBCgJsdBgCIAEoBUJ8wkh5CncKCGludDMyLmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpwBCgNsdGUYAyABKAVCjAHCSIgBCoUBCglpbnQzMi5sdGUaeCFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEpcHCgJndBgEIAEoBUKIB8JIhAcKegoIaW50MzIuZ3QabiFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrMBCgtpbnQzMi5ndF9sdBqjAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKuwEKFWludDMyLmd0X2x0X2V4Y2x1c2l2ZRqhAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCsMBCgxpbnQzMi5ndF9sdGUasgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCssBChZpbnQzMi5ndF9sdGVfZXhjbHVzaXZlGrABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLjBwoDZ3RlGAUgASgFQtMHwkjPBwqIAQoJaW50MzIuZ3RlGnshaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKwgEKDGludDMyLmd0ZV9sdBqxAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrKAQoWaW50MzIuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK0gEKDWludDMyLmd0ZV9sdGUawAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK2gEKF2ludDMyLmd0ZV9sdGVfZXhjbHVzaXZlGr4BaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEn8KAmluGAYgAygFQnPCSHAKbgoIaW50MzIuaW4aYiEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ3ZhbHVlIG11c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnYKBm5vdF9pbhgHIAMoBUJmwkhjCmEKDGludDMyLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEisKB2V4YW1wbGUYCCADKAVCGsJIFwoVCg1pbnQzMi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiKMFQoKSW50NjRSdWxlcxKDAQoFY29uc3QYASABKANCdMJIcQpvCgtpbnQ2NC5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEooBCgJsdBgCIAEoA0J8wkh5CncKCGludDY0Lmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEpwBCgNsdGUYAyABKANCjAHCSIgBCoUBCglpbnQ2NC5sdGUaeCFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEpcHCgJndBgEIAEoA0KIB8JIhAcKegoIaW50NjQuZ3QabiFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrMBCgtpbnQ2NC5ndF9sdBqjAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKuwEKFWludDY0Lmd0X2x0X2V4Y2x1c2l2ZRqhAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCsMBCgxpbnQ2NC5ndF9sdGUasgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCssBChZpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGrABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLjBwoDZ3RlGAUgASgDQtMHwkjPBwqIAQoJaW50NjQuZ3RlGnshaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKwgEKDGludDY0Lmd0ZV9sdBqxAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrKAQoWaW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK0gEKDWludDY0Lmd0ZV9sdGUawAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK2gEKF2ludDY0Lmd0ZV9sdGVfZXhjbHVzaXZlGr4BaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEn8KAmluGAYgAygDQnPCSHAKbgoIaW50NjQuaW4aYiEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ3ZhbHVlIG11c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnYKBm5vdF9pbhgHIAMoA0JmwkhjCmEKDGludDY0Lm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEisKB2V4YW1wbGUYCSADKANCGsJIFwoVCg1pbnQ2NC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiKeFQoLVUludDMyUnVsZXMShAEKBWNvbnN0GAEgASgNQnXCSHIKcAoMdWludDMyLmNvbnN0GmB0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSiwEKAmx0GAIgASgNQn3CSHoKeAoJdWludDMyLmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEp0BCgNsdGUYAyABKA1CjQHCSIkBCoYBCgp1aW50MzIubHRlGnghaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKcBwoCZ3QYBCABKA1CjQfCSIkHCnsKCXVpbnQzMi5ndBpuIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKtAEKDHVpbnQzMi5ndF9sdBqjAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvAEKFnVpbnQzMi5ndF9sdF9leGNsdXNpdmUaoQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrEAQoNdWludDMyLmd0X2x0ZRqyAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKzAEKF3VpbnQzMi5ndF9sdGVfZXhjbHVzaXZlGrABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLoBwoDZ3RlGAUgASgNQtgHwkjUBwqJAQoKdWludDMyLmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsMBCg11aW50MzIuZ3RlX2x0GrEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCssBChd1aW50MzIuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK0wEKDnVpbnQzMi5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtsBChh1aW50MzIuZ3RlX2x0ZV9leGNsdXNpdmUavgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESgAEKAmluGAYgAygNQnTCSHEKbwoJdWludDMyLmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ3CgZub3RfaW4YByADKA1CZ8JIZApiCg11aW50MzIubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLAoHZXhhbXBsZRgIIAMoDUIbwkgYChYKDnVpbnQzMi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiKeFQoLVUludDY0UnVsZXMShAEKBWNvbnN0GAEgASgEQnXCSHIKcAoMdWludDY0LmNvbnN0GmB0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSiwEKAmx0GAIgASgEQn3CSHoKeAoJdWludDY0Lmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEp0BCgNsdGUYAyABKARCjQHCSIkBCoYBCgp1aW50NjQubHRlGnghaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKcBwoCZ3QYBCABKARCjQfCSIkHCnsKCXVpbnQ2NC5ndBpuIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKtAEKDHVpbnQ2NC5ndF9sdBqjAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvAEKFnVpbnQ2NC5ndF9sdF9leGNsdXNpdmUaoQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrEAQoNdWludDY0Lmd0X2x0ZRqyAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKzAEKF3VpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGrABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLoBwoDZ3RlGAUgASgEQtgHwkjUBwqJAQoKdWludDY0Lmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsMBCg11aW50NjQuZ3RlX2x0GrEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCssBChd1aW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK0wEKDnVpbnQ2NC5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtsBChh1aW50NjQuZ3RlX2x0ZV9leGNsdXNpdmUavgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESgAEKAmluGAYgAygEQnTCSHEKbwoJdWludDY0LmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ3CgZub3RfaW4YByADKARCZ8JIZApiCg11aW50NjQubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLAoHZXhhbXBsZRgIIAMoBEIbwkgYChYKDnVpbnQ2NC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiKeFQoLU0ludDMyUnVsZXMShAEKBWNvbnN0GAEgASgRQnXCSHIKcAoMc2ludDMyLmNvbnN0GmB0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSiwEKAmx0GAIgASgRQn3CSHoKeAoJc2ludDMyLmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEp0BCgNsdGUYAyABKBFCjQHCSIkBCoYBCgpzaW50MzIubHRlGnghaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKcBwoCZ3QYBCABKBFCjQfCSIkHCnsKCXNpbnQzMi5ndBpuIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKtAEKDHNpbnQzMi5ndF9sdBqjAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvAEKFnNpbnQzMi5ndF9sdF9leGNsdXNpdmUaoQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrEAQoNc2ludDMyLmd0X2x0ZRqyAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKzAEKF3NpbnQzMi5ndF9sdGVfZXhjbHVzaXZlGrABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLoBwoDZ3RlGAUgASgRQtgHwkjUBwqJAQoKc2ludDMyLmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsMBCg1zaW50MzIuZ3RlX2x0GrEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCssBChdzaW50MzIuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK0wEKDnNpbnQzMi5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtsBChhzaW50MzIuZ3RlX2x0ZV9leGNsdXNpdmUavgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESgAEKAmluGAYgAygRQnTCSHEKbwoJc2ludDMyLmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ3CgZub3RfaW4YByADKBFCZ8JIZApiCg1zaW50MzIubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLAoHZXhhbXBsZRgIIAMoEUIbwkgYChYKDnNpbnQzMi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiKeFQoLU0ludDY0UnVsZXMShAEKBWNvbnN0GAEgASgSQnXCSHIKcAoMc2ludDY0LmNvbnN0GmB0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSiwEKAmx0GAIgASgSQn3CSHoKeAoJc2ludDY0Lmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEp0BCgNsdGUYAyABKBJCjQHCSIkBCoYBCgpzaW50NjQubHRlGnghaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKcBwoCZ3QYBCABKBJCjQfCSIkHCnsKCXNpbnQ2NC5ndBpuIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKtAEKDHNpbnQ2NC5ndF9sdBqjAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvAEKFnNpbnQ2NC5ndF9sdF9leGNsdXNpdmUaoQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrEAQoNc2ludDY0Lmd0X2x0ZRqyAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKzAEKF3NpbnQ2NC5ndF9sdGVfZXhjbHVzaXZlGrABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLoBwoDZ3RlGAUgASgSQtgHwkjUBwqJAQoKc2ludDY0Lmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsMBCg1zaW50NjQuZ3RlX2x0GrEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCssBChdzaW50NjQuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK0wEKDnNpbnQ2NC5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtsBChhzaW50NjQuZ3RlX2x0ZV9leGNsdXNpdmUavgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESgAEKAmluGAYgAygSQnTCSHEKbwoJc2ludDY0LmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ3CgZub3RfaW4YByADKBJCZ8JIZApiCg1zaW50NjQubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLAoHZXhhbXBsZRgIIAMoEkIbwkgYChYKDnNpbnQ2NC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiKvFQoMRml4ZWQzMlJ1bGVzEoUBCgVjb25zdBgBIAEoB0J2wkhzCnEKDWZpeGVkMzIuY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKMAQoCbHQYAiABKAdCfsJIewp5CgpmaXhlZDMyLmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEp4BCgNsdGUYAyABKAdCjgHCSIoBCocBCgtmaXhlZDMyLmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASoQcKAmd0GAQgASgHQpIHwkiOBwp8CgpmaXhlZDMyLmd0Gm4haGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwq1AQoNZml4ZWQzMi5ndF9sdBqjAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvQEKF2ZpeGVkMzIuZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxQEKDmZpeGVkMzIuZ3RfbHRlGrIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrNAQoYZml4ZWQzMi5ndF9sdGVfZXhjbHVzaXZlGrABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLtBwoDZ3RlGAUgASgHQt0HwkjZBwqKAQoLZml4ZWQzMi5ndGUaeyFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrEAQoOZml4ZWQzMi5ndGVfbHQasQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzAEKGGZpeGVkMzIuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK1AEKD2ZpeGVkMzIuZ3RlX2x0ZRrAAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrcAQoZZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq+AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARKBAQoCaW4YBiADKAdCdcJIcgpwCgpmaXhlZDMyLmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ4CgZub3RfaW4YByADKAdCaMJIZQpjCg5maXhlZDMyLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEi0KB2V4YW1wbGUYCCADKAdCHMJIGQoXCg9maXhlZDMyLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIq8VCgxGaXhlZDY0UnVsZXMShQEKBWNvbnN0GAEgASgGQnbCSHMKcQoNZml4ZWQ2NC5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEowBCgJsdBgCIAEoBkJ+wkh7CnkKCmZpeGVkNjQubHQaayFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASngEKA2x0ZRgDIAEoBkKOAcJIigEKhwEKC2ZpeGVkNjQubHRlGnghaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKhBwoCZ3QYBCABKAZCkgfCSI4HCnwKCmZpeGVkNjQuZ3QabiFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrUBCg1maXhlZDY0Lmd0X2x0GqMBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq9AQoXZml4ZWQ2NC5ndF9sdF9leGNsdXNpdmUaoQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrFAQoOZml4ZWQ2NC5ndF9sdGUasgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCs0BChhmaXhlZDY0Lmd0X2x0ZV9leGNsdXNpdmUasAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEu0HCgNndGUYBSABKAZC3QfCSNkHCooBCgtmaXhlZDY0Lmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsQBCg5maXhlZDY0Lmd0ZV9sdBqxAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrMAQoYZml4ZWQ2NC5ndGVfbHRfZXhjbHVzaXZlGq8BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrUAQoPZml4ZWQ2NC5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtwBChlmaXhlZDY0Lmd0ZV9sdGVfZXhjbHVzaXZlGr4BaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEoEBCgJpbhgGIAMoBkJ1wkhyCnAKCmZpeGVkNjQuaW4aYiEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ3ZhbHVlIG11c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEngKBm5vdF9pbhgHIAMoBkJowkhlCmMKDmZpeGVkNjQubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLQoHZXhhbXBsZRgIIAMoBkIcwkgZChcKD2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iwBUKDVNGaXhlZDMyUnVsZXMShgEKBWNvbnN0GAEgASgPQnfCSHQKcgoOc2ZpeGVkMzIuY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKNAQoCbHQYAiABKA9Cf8JIfAp6CgtzZml4ZWQzMi5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKfAQoDbHRlGAMgASgPQo8BwkiLAQqIAQoMc2ZpeGVkMzIubHRlGnghaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKmBwoCZ3QYBCABKA9ClwfCSJMHCn0KC3NmaXhlZDMyLmd0Gm4haGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwq2AQoOc2ZpeGVkMzIuZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BChhzZml4ZWQzMi5ndF9sdF9leGNsdXNpdmUaoQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrGAQoPc2ZpeGVkMzIuZ3RfbHRlGrIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrOAQoZc2ZpeGVkMzIuZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES8gcKA2d0ZRgFIAEoD0LiB8JI3gcKiwEKDHNmaXhlZDMyLmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsUBCg9zZml4ZWQzMi5ndGVfbHQasQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzQEKGXNmaXhlZDMyLmd0ZV9sdF9leGNsdXNpdmUarwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtUBChBzZml4ZWQzMi5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCt0BChpzZml4ZWQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq+AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARKCAQoCaW4YBiADKA9CdsJIcwpxCgtzZml4ZWQzMi5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSeQoGbm90X2luGAcgAygPQmnCSGYKZAoPc2ZpeGVkMzIubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSLgoHZXhhbXBsZRgIIAMoD0IdwkgaChgKEHNmaXhlZDMyLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIsAVCg1TRml4ZWQ2NFJ1bGVzEoYBCgVjb25zdBgBIAEoEEJ3wkh0CnIKDnNmaXhlZDY0LmNvbnN0GmB0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSjQEKAmx0GAIgASgQQn/CSHwKegoLc2ZpeGVkNjQubHQaayFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASnwEKA2x0ZRgDIAEoEEKPAcJIiwEKiAEKDHNmaXhlZDY0Lmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASpgcKAmd0GAQgASgQQpcHwkiTBwp9CgtzZml4ZWQ2NC5ndBpuIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKtgEKDnNmaXhlZDY0Lmd0X2x0GqMBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq+AQoYc2ZpeGVkNjQuZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxgEKD3NmaXhlZDY0Lmd0X2x0ZRqyAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKzgEKGXNmaXhlZDY0Lmd0X2x0ZV9leGNsdXNpdmUasAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEvIHCgNndGUYBSABKBBC4gfCSN4HCosBCgxzZml4ZWQ2NC5ndGUaeyFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrFAQoPc2ZpeGVkNjQuZ3RlX2x0GrEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs0BChlzZml4ZWQ2NC5ndGVfbHRfZXhjbHVzaXZlGq8BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrVAQoQc2ZpeGVkNjQuZ3RlX2x0ZRrAAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrdAQoac2ZpeGVkNjQuZ3RlX2x0ZV9leGNsdXNpdmUavgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESggEKAmluGAYgAygQQnbCSHMKcQoLc2ZpeGVkNjQuaW4aYiEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ3ZhbHVlIG11c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnkKBm5vdF9pbhgHIAMoEEJpwkhmCmQKD3NmaXhlZDY0Lm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEi4KB2V4YW1wbGUYCCADKBBCHcJIGgoYChBzZml4ZWQ2NC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLHAQoJQm9vbFJ1bGVzEoIBCgVjb25zdBgBIAEoCEJzwkhwCm4KCmJvb2wuY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxIqCgdleGFtcGxlGAIgAygIQhnCSBYKFAoMYm9vbC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIiiDkKC1N0cmluZ1J1bGVzEoYBCgVjb25zdBgBIAEoCUJ3wkh0CnIKDHN0cmluZy5jb25zdBpidGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCBgJXNgJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSfgoDbGVuGBMgASgEQnHCSG4KbAoKc3RyaW5nLmxlbhpedWludCh0aGlzLnNpemUoKSkgIT0gcnVsZXMubGVuID8gJ3ZhbHVlIGxlbmd0aCBtdXN0IGJlICVzIGNoYXJhY3RlcnMnLmZvcm1hdChbcnVsZXMubGVuXSkgOiAnJxKZAQoHbWluX2xlbhgCIAEoBEKHAcJIgwEKgAEKDnN0cmluZy5taW5fbGVuGm51aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9sZW4gPyAndmFsdWUgbGVuZ3RoIG11c3QgYmUgYXQgbGVhc3QgJXMgY2hhcmFjdGVycycuZm9ybWF0KFtydWxlcy5taW5fbGVuXSkgOiAnJxKXAQoHbWF4X2xlbhgDIAEoBEKFAcJIgQEKfwoOc3RyaW5nLm1heF9sZW4abXVpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2xlbiA/ICd2YWx1ZSBsZW5ndGggbXVzdCBiZSBhdCBtb3N0ICVzIGNoYXJhY3RlcnMnLmZvcm1hdChbcnVsZXMubWF4X2xlbl0pIDogJycSmwEKCWxlbl9ieXRlcxgUIAEoBEKHAcJIgwEKgAEKEHN0cmluZy5sZW5fYnl0ZXMabHVpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSAhPSBydWxlcy5sZW5fYnl0ZXMgPyAndmFsdWUgbGVuZ3RoIG11c3QgYmUgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubGVuX2J5dGVzXSkgOiAnJxKjAQoJbWluX2J5dGVzGAQgASgEQo8BwkiLAQqIAQoQc3RyaW5nLm1pbl9ieXRlcxp0dWludChieXRlcyh0aGlzKS5zaXplKCkpIDwgcnVsZXMubWluX2J5dGVzID8gJ3ZhbHVlIGxlbmd0aCBtdXN0IGJlIGF0IGxlYXN0ICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLm1pbl9ieXRlc10pIDogJycSogEKCW1heF9ieXRlcxgFIAEoBEKOAcJIigEKhwEKEHN0cmluZy5tYXhfYnl0ZXMac3VpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA+IHJ1bGVzLm1heF9ieXRlcyA/ICd2YWx1ZSBsZW5ndGggbXVzdCBiZSBhdCBtb3N0ICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLm1heF9ieXRlc10pIDogJycSjQEKB3BhdHRlcm4YBiABKAlCfMJIeQp3Cg5zdHJpbmcucGF0dGVybhplIXRoaXMubWF0Y2hlcyhydWxlcy5wYXR0ZXJuKSA/ICd2YWx1ZSBkb2VzIG5vdCBtYXRjaCByZWdleCBwYXR0ZXJuIGAlc2AnLmZvcm1hdChbcnVsZXMucGF0dGVybl0pIDogJycShAEKBnByZWZpeBgHIAEoCUJ0wkhxCm8KDXN0cmluZy5wcmVmaXgaXiF0aGlzLnN0YXJ0c1dpdGgocnVsZXMucHJlZml4KSA/ICd2YWx1ZSBkb2VzIG5vdCBoYXZlIHByZWZpeCBgJXNgJy5mb3JtYXQoW3J1bGVzLnByZWZpeF0pIDogJycSggEKBnN1ZmZpeBgIIAEoCUJywkhvCm0KDXN0cmluZy5zdWZmaXgaXCF0aGlzLmVuZHNXaXRoKHJ1bGVzLnN1ZmZpeCkgPyAndmFsdWUgZG9lcyBub3QgaGF2ZSBzdWZmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5zdWZmaXhdKSA6ICcnEpABCghjb250YWlucxgJIAEoCUJ+wkh7CnkKD3N0cmluZy5jb250YWlucxpmIXRoaXMuY29udGFpbnMocnVsZXMuY29udGFpbnMpID8gJ3ZhbHVlIGRvZXMgbm90IGNvbnRhaW4gc3Vic3RyaW5nIGAlc2AnLmZvcm1hdChbcnVsZXMuY29udGFpbnNdKSA6ICcnEpgBCgxub3RfY29udGFpbnMYFyABKAlCgQHCSH4KfAoTc3RyaW5nLm5vdF9jb250YWlucxpldGhpcy5jb250YWlucyhydWxlcy5ub3RfY29udGFpbnMpID8gJ3ZhbHVlIGNvbnRhaW5zIHN1YnN0cmluZyBgJXNgJy5mb3JtYXQoW3J1bGVzLm5vdF9jb250YWluc10pIDogJycSgAEKAmluGAogAygJQnTCSHEKbwoJc3RyaW5nLmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ3CgZub3RfaW4YCyADKAlCZ8JIZApiCg1zdHJpbmcubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycS3wEKBWVtYWlsGAwgASgIQs0BwkjJAQphCgxzdHJpbmcuZW1haWwSI3ZhbHVlIG11c3QgYmUgYSB2YWxpZCBlbWFpbCBhZGRyZXNzGiwhcnVsZXMuZW1haWwgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzRW1haWwoKQpkChJzdHJpbmcuZW1haWxfZW1wdHkSMnZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBlbWFpbCBhZGRyZXNzGhohcnVsZXMuZW1haWwgfHwgdGhpcyAhPSAnJ0gAEucBCghob3N0bmFtZRgNIAEoCELSAcJIzgEKZQoPc3RyaW5nLmhvc3RuYW1lEh52YWx1ZSBtdXN0IGJlIGEgdmFsaWQgaG9zdG5hbWUaMiFydWxlcy5ob3N0bmFtZSB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0bmFtZSgpCmUKFXN0cmluZy5ob3N0bmFtZV9lbXB0eRItdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIGhvc3RuYW1lGh0hcnVsZXMuaG9zdG5hbWUgfHwgdGhpcyAhPSAnJ0gAEscBCgJpcBgOIAEoCEK4AcJItAEKVQoJc3RyaW5nLmlwEiB2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcxomIXJ1bGVzLmlwIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0lwKCkKWwoPc3RyaW5nLmlwX2VtcHR5Ei92YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVAgYWRkcmVzcxoXIXJ1bGVzLmlwIHx8IHRoaXMgIT0gJydIABLWAQoEaXB2NBgPIAEoCELFAcJIwQEKXAoLc3RyaW5nLmlwdjQSInZhbHVlIG11c3QgYmUgYSB2YWxpZCBJUHY0IGFkZHJlc3MaKSFydWxlcy5pcHY0IHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0lwKDQpCmEKEXN0cmluZy5pcHY0X2VtcHR5EjF2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzGhkhcnVsZXMuaXB2NCB8fCB0aGlzICE9ICcnSAAS1gEKBGlwdjYYECABKAhCxQHCSMEBClwKC3N0cmluZy5pcHY2EiJ2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSVB2NiBhZGRyZXNzGikhcnVsZXMuaXB2NiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCg2KQphChFzdHJpbmcuaXB2Nl9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgYWRkcmVzcxoZIXJ1bGVzLmlwdjYgfHwgdGhpcyAhPSAnJ0gAEr8BCgN1cmkYESABKAhCrwHCSKsBClEKCnN0cmluZy51cmkSGXZhbHVlIG11c3QgYmUgYSB2YWxpZCBVUkkaKCFydWxlcy51cmkgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzVXJpKCkKVgoQc3RyaW5nLnVyaV9lbXB0eRIodmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIFVSSRoYIXJ1bGVzLnVyaSB8fCB0aGlzICE9ICcnSAAScAoHdXJpX3JlZhgSIAEoCEJdwkhaClgKDnN0cmluZy51cmlfcmVmEiN2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgVVJJIFJlZmVyZW5jZRohIXJ1bGVzLnVyaV9yZWYgfHwgdGhpcy5pc1VyaVJlZigpSAASkAIKB2FkZHJlc3MYFSABKAhC/AHCSPgBCoEBCg5zdHJpbmcuYWRkcmVzcxItdmFsdWUgbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lLCBvciBpcCBhZGRyZXNzGkAhcnVsZXMuYWRkcmVzcyB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0bmFtZSgpIHx8IHRoaXMuaXNJcCgpCnIKFHN0cmluZy5hZGRyZXNzX2VtcHR5Ejx2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgaG9zdG5hbWUsIG9yIGlwIGFkZHJlc3MaHCFydWxlcy5hZGRyZXNzIHx8IHRoaXMgIT0gJydIABKYAgoEdXVpZBgWIAEoCEKHAsJIgwIKpQEKC3N0cmluZy51dWlkEhp2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgVVVJRBp6IXJ1bGVzLnV1aWQgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykKWQoRc3RyaW5nLnV1aWRfZW1wdHkSKXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVVUlEGhkhcnVsZXMudXVpZCB8fCB0aGlzICE9ICcnSAAS8AEKBXR1dWlkGCEgASgIQt4BwkjaAQpzCgxzdHJpbmcudHV1aWQSInZhbHVlIG11c3QgYmUgYSB2YWxpZCB0cmltbWVkIFVVSUQaPyFydWxlcy50dXVpZCB8fCB0aGlzID09ICcnIHx8IHRoaXMubWF0Y2hlcygnXlswLTlhLWZBLUZdezMyfSQnKQpjChJzdHJpbmcudHV1aWRfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCB0cmltbWVkIFVVSUQaGiFydWxlcy50dXVpZCB8fCB0aGlzICE9ICcnSAASlgIKEWlwX3dpdGhfcHJlZml4bGVuGBogASgIQvgBwkj0AQp4ChhzdHJpbmcuaXBfd2l0aF9wcmVmaXhsZW4SH3ZhbHVlIG11c3QgYmUgYSB2YWxpZCBJUCBwcmVmaXgaOyFydWxlcy5pcF93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCgpCngKHnN0cmluZy5pcF93aXRoX3ByZWZpeGxlbl9lbXB0eRIudmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIHByZWZpeBomIXJ1bGVzLmlwX3dpdGhfcHJlZml4bGVuIHx8IHRoaXMgIT0gJydIABLPAgoTaXB2NF93aXRoX3ByZWZpeGxlbhgbIAEoCEKvAsJIqwIKkwEKGnN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuEjV2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBo+IXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCkKkgEKIHN0cmluZy5pcHY0X3dpdGhfcHJlZml4bGVuX2VtcHR5EkR2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBooIXJ1bGVzLmlwdjRfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyAhPSAnJ0gAEs8CChNpcHY2X3dpdGhfcHJlZml4bGVuGBwgASgIQq8CwkirAgqTAQoac3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW4SNXZhbHVlIG11c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGj4hcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCg2KQqSAQogc3RyaW5nLmlwdjZfd2l0aF9wcmVmaXhsZW5fZW1wdHkSRHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3Mgd2l0aCBwcmVmaXggbGVuZ3RoGighcnVsZXMuaXB2Nl93aXRoX3ByZWZpeGxlbiB8fCB0aGlzICE9ICcnSAAS8gEKCWlwX3ByZWZpeBgdIAEoCELcAcJI2AEKbAoQc3RyaW5nLmlwX3ByZWZpeBIfdmFsdWUgbXVzdCBiZSBhIHZhbGlkIElQIHByZWZpeBo3IXJ1bGVzLmlwX3ByZWZpeCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCh0cnVlKQpoChZzdHJpbmcuaXBfcHJlZml4X2VtcHR5Ei52YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVAgcHJlZml4Gh4hcnVsZXMuaXBfcHJlZml4IHx8IHRoaXMgIT0gJydIABKDAgoLaXB2NF9wcmVmaXgYHiABKAhC6wHCSOcBCnUKEnN0cmluZy5pcHY0X3ByZWZpeBIhdmFsdWUgbXVzdCBiZSBhIHZhbGlkIElQdjQgcHJlZml4GjwhcnVsZXMuaXB2NF9wcmVmaXggfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNCwgdHJ1ZSkKbgoYc3RyaW5nLmlwdjRfcHJlZml4X2VtcHR5EjB2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBwcmVmaXgaICFydWxlcy5pcHY0X3ByZWZpeCB8fCB0aGlzICE9ICcnSAASgwIKC2lwdjZfcHJlZml4GB8gASgIQusBwkjnAQp1ChJzdHJpbmcuaXB2Nl9wcmVmaXgSIXZhbHVlIG11c3QgYmUgYSB2YWxpZCBJUHY2IHByZWZpeBo8IXJ1bGVzLmlwdjZfcHJlZml4IHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0lwUHJlZml4KDYsIHRydWUpCm4KGHN0cmluZy5pcHY2X3ByZWZpeF9lbXB0eRIwdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgcHJlZml4GiAhcnVsZXMuaXB2Nl9wcmVmaXggfHwgdGhpcyAhPSAnJ0gAErUCCg1ob3N0X2FuZF9wb3J0GCAgASgIQpsCwkiXAgqZAQoUc3RyaW5nLmhvc3RfYW5kX3BvcnQSQXZhbHVlIG11c3QgYmUgYSB2YWxpZCBob3N0IChob3N0bmFtZSBvciBJUCBhZGRyZXNzKSBhbmQgcG9ydCBwYWlyGj4hcnVsZXMuaG9zdF9hbmRfcG9ydCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNIb3N0QW5kUG9ydCh0cnVlKQp5ChpzdHJpbmcuaG9zdF9hbmRfcG9ydF9lbXB0eRI3dmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIGhvc3QgYW5kIHBvcnQgcGFpchoiIXJ1bGVzLmhvc3RfYW5kX3BvcnQgfHwgdGhpcyAhPSAnJ0gAEvUBCgR1bGlkGCMgASgIQuQBwkjgAQqCAQoLc3RyaW5nLnVsaWQSGnZhbHVlIG11c3QgYmUgYSB2YWxpZCBVTElEGlchcnVsZXMudWxpZCB8fCB0aGlzID09ICcnIHx8IHRoaXMubWF0Y2hlcygnXlswLTddWzAtOUEtSEpLTU5QLVRWLVphLWhqa21ucC10di16XXsyNX0kJykKWQoRc3RyaW5nLnVsaWRfZW1wdHkSKXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVTElEGhkhcnVsZXMudWxpZCB8fCB0aGlzICE9ICcnSAASqAUKEHdlbGxfa25vd25fcmVnZXgYGCABKA4yGC5idWYudmFsaWRhdGUuS25vd25SZWdleELxBMJI7QQK8AEKI3N0cmluZy53ZWxsX2tub3duX3JlZ2V4LmhlYWRlcl9uYW1lEiZ2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSFRUUCBoZWFkZXIgbmFtZRqgAXJ1bGVzLndlbGxfa25vd25fcmVnZXggIT0gMSB8fCB0aGlzID09ICcnIHx8IHRoaXMubWF0Y2hlcyghaGFzKHJ1bGVzLnN0cmljdCkgfHwgcnVsZXMuc3RyaWN0ID8nXjo/WzAtOWEtekEtWiEjJCUmXCcqKy0uXl98flx4NjBdKyQnIDonXlteXHUwMDAwXHUwMDBBXHUwMDBEXSskJykKjQEKKXN0cmluZy53ZWxsX2tub3duX3JlZ2V4LmhlYWRlcl9uYW1lX2VtcHR5EjV2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSFRUUCBoZWFkZXIgbmFtZRopcnVsZXMud2VsbF9rbm93bl9yZWdleCAhPSAxIHx8IHRoaXMgIT0gJycK5wEKJHN0cmluZy53ZWxsX2tub3duX3JlZ2V4LmhlYWRlcl92YWx1ZRIndmFsdWUgbXVzdCBiZSBhIHZhbGlkIEhUVFAgaGVhZGVyIHZhbHVlGpUBcnVsZXMud2VsbF9rbm93bl9yZWdleCAhPSAyIHx8IHRoaXMubWF0Y2hlcyghaGFzKHJ1bGVzLnN0cmljdCkgfHwgcnVsZXMuc3RyaWN0ID8nXlteXHUwMDAwLVx1MDAwOFx1MDAwQS1cdTAwMUZcdTAwN0ZdKiQnIDonXlteXHUwMDAwXHUwMDBBXHUwMDBEXSokJylIABIOCgZzdHJpY3QYGSABKAgSLAoHZXhhbXBsZRgiIAMoCUIbwkgYChYKDnN0cmluZy5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCDAoKd2VsbF9rbm93biLCEgoKQnl0ZXNSdWxlcxKAAQoFY29uc3QYASABKAxCccJIbgpsCgtieXRlcy5jb25zdBpddGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBiZSAleCcuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEngKA2xlbhgNIAEoBEJrwkhoCmYKCWJ5dGVzLmxlbhpZdWludCh0aGlzLnNpemUoKSkgIT0gcnVsZXMubGVuID8gJ3ZhbHVlIGxlbmd0aCBtdXN0IGJlICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLmxlbl0pIDogJycSkAEKB21pbl9sZW4YAiABKARCf8JIfAp6Cg1ieXRlcy5taW5fbGVuGml1aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9sZW4gPyAndmFsdWUgbGVuZ3RoIG11c3QgYmUgYXQgbGVhc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWluX2xlbl0pIDogJycSiAEKB21heF9sZW4YAyABKARCd8JIdApyCg1ieXRlcy5tYXhfbGVuGmF1aW50KHRoaXMuc2l6ZSgpKSA+IHJ1bGVzLm1heF9sZW4gPyAndmFsdWUgbXVzdCBiZSBhdCBtb3N0ICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLm1heF9sZW5dKSA6ICcnEpABCgdwYXR0ZXJuGAQgASgJQn/CSHwKegoNYnl0ZXMucGF0dGVybhppIXN0cmluZyh0aGlzKS5tYXRjaGVzKHJ1bGVzLnBhdHRlcm4pID8gJ3ZhbHVlIG11c3QgbWF0Y2ggcmVnZXggcGF0dGVybiBgJXNgJy5mb3JtYXQoW3J1bGVzLnBhdHRlcm5dKSA6ICcnEoEBCgZwcmVmaXgYBSABKAxCccJIbgpsCgxieXRlcy5wcmVmaXgaXCF0aGlzLnN0YXJ0c1dpdGgocnVsZXMucHJlZml4KSA/ICd2YWx1ZSBkb2VzIG5vdCBoYXZlIHByZWZpeCAleCcuZm9ybWF0KFtydWxlcy5wcmVmaXhdKSA6ICcnEn8KBnN1ZmZpeBgGIAEoDEJvwkhsCmoKDGJ5dGVzLnN1ZmZpeBpaIXRoaXMuZW5kc1dpdGgocnVsZXMuc3VmZml4KSA/ICd2YWx1ZSBkb2VzIG5vdCBoYXZlIHN1ZmZpeCAleCcuZm9ybWF0KFtydWxlcy5zdWZmaXhdKSA6ICcnEoMBCghjb250YWlucxgHIAEoDEJxwkhuCmwKDmJ5dGVzLmNvbnRhaW5zGlohdGhpcy5jb250YWlucyhydWxlcy5jb250YWlucykgPyAndmFsdWUgZG9lcyBub3QgY29udGFpbiAleCcuZm9ybWF0KFtydWxlcy5jb250YWluc10pIDogJycSpwEKAmluGAggAygMQpoBwkiWAQqTAQoIYnl0ZXMuaW4ahgFnZXRGaWVsZChydWxlcywgJ2luJykuc2l6ZSgpID4gMCAmJiAhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ2CgZub3RfaW4YCSADKAxCZsJIYwphCgxieXRlcy5ub3RfaW4aUXRoaXMgaW4gcnVsZXMubm90X2luID8gJ3ZhbHVlIG11c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxLrAQoCaXAYCiABKAhC3AHCSNgBCnQKCGJ5dGVzLmlwEiB2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcxpGIXJ1bGVzLmlwIHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNCB8fCB0aGlzLnNpemUoKSA9PSAxNgpgCg5ieXRlcy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaHSFydWxlcy5pcCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS5AEKBGlwdjQYCyABKAhC0wHCSM8BCmUKCmJ5dGVzLmlwdjQSInZhbHVlIG11c3QgYmUgYSB2YWxpZCBJUHY0IGFkZHJlc3MaMyFydWxlcy5pcHY0IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gNApmChBieXRlcy5pcHY0X2VtcHR5EjF2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NCBhZGRyZXNzGh8hcnVsZXMuaXB2NCB8fCB0aGlzLnNpemUoKSAhPSAwSAAS5QEKBGlwdjYYDCABKAhC1AHCSNABCmYKCmJ5dGVzLmlwdjYSInZhbHVlIG11c3QgYmUgYSB2YWxpZCBJUHY2IGFkZHJlc3MaNCFydWxlcy5pcHY2IHx8IHRoaXMuc2l6ZSgpID09IDAgfHwgdGhpcy5zaXplKCkgPT0gMTYKZgoQYnl0ZXMuaXB2Nl9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjYgYWRkcmVzcxofIXJ1bGVzLmlwdjYgfHwgdGhpcy5zaXplKCkgIT0gMEgAEtUBCgR1dWlkGA8gASgIQsQBwkjAAQpeCgpieXRlcy51dWlkEhp2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgVVVJRBo0IXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgPT0gMCB8fCB0aGlzLnNpemUoKSA9PSAxNgpeChBieXRlcy51dWlkX2VtcHR5Eil2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgVVVJRBofIXJ1bGVzLnV1aWQgfHwgdGhpcy5zaXplKCkgIT0gMEgAEisKB2V4YW1wbGUYDiADKAxCGsJIFwoVCg1ieXRlcy5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCDAoKd2VsbF9rbm93biLUAwoJRW51bVJ1bGVzEoIBCgVjb25zdBgBIAEoBUJzwkhwCm4KCmVudW0uY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxIUCgxkZWZpbmVkX29ubHkYAiABKAgSfgoCaW4YAyADKAVCcsJIbwptCgdlbnVtLmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ1CgZub3RfaW4YBCADKAVCZcJIYgpgCgtlbnVtLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEioKB2V4YW1wbGUYBSADKAVCGcJIFgoUCgxlbnVtLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAiL7AwoNUmVwZWF0ZWRSdWxlcxKeAQoJbWluX2l0ZW1zGAEgASgEQooBwkiGAQqDAQoScmVwZWF0ZWQubWluX2l0ZW1zGm11aW50KHRoaXMuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9pdGVtcyA/ICd2YWx1ZSBtdXN0IGNvbnRhaW4gYXQgbGVhc3QgJWQgaXRlbShzKScuZm9ybWF0KFtydWxlcy5taW5faXRlbXNdKSA6ICcnEqIBCgltYXhfaXRlbXMYAiABKARCjgHCSIoBCocBChJyZXBlYXRlZC5tYXhfaXRlbXMacXVpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2l0ZW1zID8gJ3ZhbHVlIG11c3QgY29udGFpbiBubyBtb3JlIHRoYW4gJXMgaXRlbShzKScuZm9ybWF0KFtydWxlcy5tYXhfaXRlbXNdKSA6ICcnEnAKBnVuaXF1ZRgDIAEoCEJgwkhdClsKD3JlcGVhdGVkLnVuaXF1ZRIocmVwZWF0ZWQgdmFsdWUgbXVzdCBjb250YWluIHVuaXF1ZSBpdGVtcxoeIXJ1bGVzLnVuaXF1ZSB8fCB0aGlzLnVuaXF1ZSgpEicKBWl0ZW1zGAQgASgLMhguYnVmLnZhbGlkYXRlLkZpZWxkUnVsZXMqCQjoBxCAgICAAiKKAwoITWFwUnVsZXMSjwEKCW1pbl9wYWlycxgBIAEoBEJ8wkh5CncKDW1hcC5taW5fcGFpcnMaZnVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX3BhaXJzID8gJ21hcCBtdXN0IGJlIGF0IGxlYXN0ICVkIGVudHJpZXMnLmZvcm1hdChbcnVsZXMubWluX3BhaXJzXSkgOiAnJxKOAQoJbWF4X3BhaXJzGAIgASgEQnvCSHgKdgoNbWFwLm1heF9wYWlycxpldWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfcGFpcnMgPyAnbWFwIG11c3QgYmUgYXQgbW9zdCAlZCBlbnRyaWVzJy5mb3JtYXQoW3J1bGVzLm1heF9wYWlyc10pIDogJycSJgoEa2V5cxgEIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzEigKBnZhbHVlcxgFIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzKgkI6AcQgICAgAIiJgoIQW55UnVsZXMSCgoCaW4YAiADKAkSDgoGbm90X2luGAMgAygJIpkXCg1EdXJhdGlvblJ1bGVzEqEBCgVjb25zdBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkJ3wkh0CnIKDmR1cmF0aW9uLmNvbnN0GmB0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSqAEKAmx0GAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQn/CSHwKegoLZHVyYXRpb24ubHQaayFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASugEKA2x0ZRgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkKPAcJIiwEKiAEKDGR1cmF0aW9uLmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASwQcKAmd0GAUgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQpcHwkiTBwp9CgtkdXJhdGlvbi5ndBpuIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKtgEKDmR1cmF0aW9uLmd0X2x0GqMBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq+AQoYZHVyYXRpb24uZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxgEKD2R1cmF0aW9uLmd0X2x0ZRqyAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKzgEKGWR1cmF0aW9uLmd0X2x0ZV9leGNsdXNpdmUasAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEo0ICgNndGUYBiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25C4gfCSN4HCosBCgxkdXJhdGlvbi5ndGUaeyFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrFAQoPZHVyYXRpb24uZ3RlX2x0GrEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs0BChlkdXJhdGlvbi5ndGVfbHRfZXhjbHVzaXZlGq8BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrVAQoQZHVyYXRpb24uZ3RlX2x0ZRrAAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrdAQoaZHVyYXRpb24uZ3RlX2x0ZV9leGNsdXNpdmUavgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESnQEKAmluGAcgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnbCSHMKcQoLZHVyYXRpb24uaW4aYiEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ3ZhbHVlIG11c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEpQBCgZub3RfaW4YCCADKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CacJIZgpkCg9kdXJhdGlvbi5ub3RfaW4aUXRoaXMgaW4gcnVsZXMubm90X2luID8gJ3ZhbHVlIG11c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxJJCgdleGFtcGxlGAkgAygLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQh3CSBoKGAoQZHVyYXRpb24uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4i/QUKDkZpZWxkTWFza1J1bGVzEr8BCgVjb25zdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCkwHCSI8BCowBChBmaWVsZF9tYXNrLmNvbnN0Gnh0aGlzLnBhdGhzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRocyA/ICd2YWx1ZSBtdXN0IGVxdWFsIHBhdGhzICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKS5wYXRoc10pIDogJycS2QEKAmluGAIgAygJQswBwkjIAQrFAQoNZmllbGRfbWFzay5pbhqzASF0aGlzLnBhdGhzLmFsbChwLCBwIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ2luJykuZXhpc3RzKGYsIHAuc3RhcnRzV2l0aChmKycuJykpKSA/ICd2YWx1ZSBtdXN0IG9ubHkgY29udGFpbiBwYXRocyBpbiAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEvMBCgZub3RfaW4YAyADKAlC4gHCSN4BCtsBChFmaWVsZF9tYXNrLm5vdF9pbhrFASF0aGlzLnBhdGhzLmFsbChwLCAhKHAgaW4gZ2V0RmllbGQocnVsZXMsICdub3RfaW4nKSB8fCBnZXRGaWVsZChydWxlcywgJ25vdF9pbicpLmV4aXN0cyhmLCBwLnN0YXJ0c1dpdGgoZisnLicpKSkpID8gJ3ZhbHVlIG11c3Qgbm90IGNvbnRhaW4gYW55IHBhdGhzIGluICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnbm90X2luJyldKSA6ICcnEkwKB2V4YW1wbGUYBCADKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQh/CSBwKGgoSZmllbGRfbWFzay5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAIikhgKDlRpbWVzdGFtcFJ1bGVzEqMBCgVjb25zdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCeMJIdQpzCg90aW1lc3RhbXAuY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKrAQoCbHQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQoABwkh9CnsKDHRpbWVzdGFtcC5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABK8AQoDbHRlGAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEKQAcJIjAEKiQEKDXRpbWVzdGFtcC5sdGUaeCFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEmwKBmx0X25vdxgHIAEoCEJawkhXClUKEHRpbWVzdGFtcC5sdF9ub3caQShydWxlcy5sdF9ub3cgJiYgdGhpcyA+IG5vdykgPyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gbm93JyA6ICcnSAASxwcKAmd0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEKcB8JImAcKfgoMdGltZXN0YW1wLmd0Gm4haGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwq3AQoPdGltZXN0YW1wLmd0X2x0GqMBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq/AQoZdGltZXN0YW1wLmd0X2x0X2V4Y2x1c2l2ZRqhAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCscBChB0aW1lc3RhbXAuZ3RfbHRlGrIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrPAQoadGltZXN0YW1wLmd0X2x0ZV9leGNsdXNpdmUasAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEpMICgNndGUYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQucHwkjjBwqMAQoNdGltZXN0YW1wLmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsYBChB0aW1lc3RhbXAuZ3RlX2x0GrEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs4BChp0aW1lc3RhbXAuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK1gEKEXRpbWVzdGFtcC5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCt4BCht0aW1lc3RhbXAuZ3RlX2x0ZV9leGNsdXNpdmUavgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESbwoGZ3Rfbm93GAggASgIQl3CSFoKWAoQdGltZXN0YW1wLmd0X25vdxpEKHJ1bGVzLmd0X25vdyAmJiB0aGlzIDwgbm93KSA/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBub3cnIDogJydIARK4AQoGd2l0aGluGAkgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQowBwkiIAQqFAQoQdGltZXN0YW1wLndpdGhpbhpxdGhpcyA8IG5vdy1ydWxlcy53aXRoaW4gfHwgdGhpcyA+IG5vdytydWxlcy53aXRoaW4gPyAndmFsdWUgbXVzdCBiZSB3aXRoaW4gJXMgb2Ygbm93Jy5mb3JtYXQoW3J1bGVzLndpdGhpbl0pIDogJycSSwoHZXhhbXBsZRgKIAMoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCHsJIGwoZChF0aW1lc3RhbXAuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4iOQoKVmlvbGF0aW9ucxIrCgp2aW9sYXRpb25zGAEgAygLMhcuYnVmLnZhbGlkYXRlLlZpb2xhdGlvbiKfAQoJVmlvbGF0aW9uEiYKBWZpZWxkGAUgASgLMhcuYnVmLnZhbGlkYXRlLkZpZWxkUGF0aBIlCgRydWxlGAYgASgLMhcuYnVmLnZhbGlkYXRlLkZpZWxkUGF0aBIPCgdydWxlX2lkGAIgASgJEg8KB21lc3NhZ2UYAyABKAkSDwoHZm9yX2tleRgEIAEoCEoECAEQAlIKZmllbGRfcGF0aCI9CglGaWVsZFBhdGgSMAoIZWxlbWVudHMYASADKAsyHi5idWYudmFsaWRhdGUuRmllbGRQYXRoRWxlbWVudCLpAgoQRmllbGRQYXRoRWxlbWVudBIUCgxmaWVsZF9udW1iZXIYASABKAUSEgoKZmllbGRfbmFtZRgCIAEoCRI+CgpmaWVsZF90eXBlGAMgASgOMiouZ29vZ2xlLnByb3RvYnVmLkZpZWxkRGVzY3JpcHRvclByb3RvLlR5cGUSPAoIa2V5X3R5cGUYBCABKA4yKi5nb29nbGUucHJvdG9idWYuRmllbGREZXNjcmlwdG9yUHJvdG8uVHlwZRI+Cgp2YWx1ZV90eXBlGAUgASgOMiouZ29vZ2xlLnByb3RvYnVmLkZpZWxkRGVzY3JpcHRvclByb3RvLlR5cGUSDwoFaW5kZXgYBiABKARIABISCghib29sX2tleRgHIAEoCEgAEhEKB2ludF9rZXkYCCABKANIABISCgh1aW50X2tleRgJIAEoBEgAEhQKCnN0cmluZ19rZXkYCiABKAlIAEILCglzdWJzY3JpcHQqoQEKBklnbm9yZRIWChJJR05PUkVfVU5TUEVDSUZJRUQQABIYChRJR05PUkVfSUZfWkVST19WQUxVRRABEhEKDUlHTk9SRV9BTFdBWVMQAyIECAIQAioMSUdOT1JFX0VNUFRZKg5JR05PUkVfREVGQVVMVCoXSUdOT1JFX0lGX0RFRkFVTFRfVkFMVUUqFUlHTk9SRV9JRl9VTlBPUFVMQVRFRCpuCgpLbm93blJlZ2V4EhsKF0tOT1dOX1JFR0VYX1VOU1BFQ0lGSUVEEAASIAocS05PV05fUkVHRVhfSFRUUF9IRUFERVJfTkFNRRABEiEKHUtOT1dOX1JFR0VYX0hUVFBfSEVBREVSX1ZBTFVFEAI6VgoHbWVzc2FnZRIfLmdvb2dsZS5wcm90b2J1Zi5NZXNzYWdlT3B0aW9ucxiHCSABKAsyGi5idWYudmFsaWRhdGUuTWVzc2FnZVJ1bGVzUgdtZXNzYWdlOk4KBW9uZW9mEh0uZ29vZ2xlLnByb3RvYnVmLk9uZW9mT3B0aW9ucxiHCSABKAsyGC5idWYudmFsaWRhdGUuT25lb2ZSdWxlc1IFb25lb2Y6TgoFZmllbGQSHS5nb29nbGUucHJvdG9idWYuRmllbGRPcHRpb25zGIcJIAEoCzIYLmJ1Zi52YWxpZGF0ZS5GaWVsZFJ1bGVzUgVmaWVsZDpdCgpwcmVkZWZpbmVkEh0uZ29vZ2xlLnByb3RvYnVmLkZpZWxkT3B0aW9ucxiICSABKAsyHS5idWYudmFsaWRhdGUuUHJlZGVmaW5lZFJ1bGVzUgpwcmVkZWZpbmVkQrsBChBjb20uYnVmLnZhbGlkYXRlQg1WYWxpZGF0ZVByb3RvUAFaR2J1Zi5idWlsZC9nZW4vZ28vYnVmYnVpbGQvcHJvdG92YWxpZGF0ZS9wcm90b2NvbGJ1ZmZlcnMvZ28vYnVmL3ZhbGlkYXRlogIDQlZYqgIMQnVmLlZhbGlkYXRlygIMQnVmXFZhbGlkYXRl4gIYQnVmXFZhbGlkYXRlXEdQQk1ldGFkYXRh6gINQnVmOjpWYWxpZGF0ZQ", [file_google_protobuf_descriptor, file_google_protobuf_duration, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+  fileDesc("ChtidWYvdmFsaWRhdGUvdmFsaWRhdGUucHJvdG8SDGJ1Zi52YWxpZGF0ZSI3CgRSdWxlEgoKAmlkGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEgoKZXhwcmVzc2lvbhgDIAEoCSJuCgxNZXNzYWdlUnVsZXMSHwoDY2VsGAMgAygLMhIuYnVmLnZhbGlkYXRlLlJ1bGUSLQoFb25lb2YYBCADKAsyHi5idWYudmFsaWRhdGUuTWVzc2FnZU9uZW9mUnVsZUoECAEQAlIIZGlzYWJsZWQiNAoQTWVzc2FnZU9uZW9mUnVsZRIOCgZmaWVsZHMYASADKAkSEAoIcmVxdWlyZWQYAiABKAgiHgoKT25lb2ZSdWxlcxIQCghyZXF1aXJlZBgBIAEoCCK/CAoKRmllbGRSdWxlcxIfCgNjZWwYFyADKAsyEi5idWYudmFsaWRhdGUuUnVsZRIQCghyZXF1aXJlZBgZIAEoCBIkCgZpZ25vcmUYGyABKA4yFC5idWYudmFsaWRhdGUuSWdub3JlEikKBWZsb2F0GAEgASgLMhguYnVmLnZhbGlkYXRlLkZsb2F0UnVsZXNIABIrCgZkb3VibGUYAiABKAsyGS5idWYudmFsaWRhdGUuRG91YmxlUnVsZXNIABIpCgVpbnQzMhgDIAEoCzIYLmJ1Zi52YWxpZGF0ZS5JbnQzMlJ1bGVzSAASKQoFaW50NjQYBCABKAsyGC5idWYudmFsaWRhdGUuSW50NjRSdWxlc0gAEisKBnVpbnQzMhgFIAEoCzIZLmJ1Zi52YWxpZGF0ZS5VSW50MzJSdWxlc0gAEisKBnVpbnQ2NBgGIAEoCzIZLmJ1Zi52YWxpZGF0ZS5VSW50NjRSdWxlc0gAEisKBnNpbnQzMhgHIAEoCzIZLmJ1Zi52YWxpZGF0ZS5TSW50MzJSdWxlc0gAEisKBnNpbnQ2NBgIIAEoCzIZLmJ1Zi52YWxpZGF0ZS5TSW50NjRSdWxlc0gAEi0KB2ZpeGVkMzIYCSABKAsyGi5idWYudmFsaWRhdGUuRml4ZWQzMlJ1bGVzSAASLQoHZml4ZWQ2NBgKIAEoCzIaLmJ1Zi52YWxpZGF0ZS5GaXhlZDY0UnVsZXNIABIvCghzZml4ZWQzMhgLIAEoCzIbLmJ1Zi52YWxpZGF0ZS5TRml4ZWQzMlJ1bGVzSAASLwoIc2ZpeGVkNjQYDCABKAsyGy5idWYudmFsaWRhdGUuU0ZpeGVkNjRSdWxlc0gAEicKBGJvb2wYDSABKAsyFy5idWYudmFsaWRhdGUuQm9vbFJ1bGVzSAASKwoGc3RyaW5nGA4gASgLMhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzSAASKQoFYnl0ZXMYDyABKAsyGC5idWYudmFsaWRhdGUuQnl0ZXNSdWxlc0gAEicKBGVudW0YECABKAsyFy5idWYudmFsaWRhdGUuRW51bVJ1bGVzSAASLwoIcmVwZWF0ZWQYEiABKAsyGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlc0gAEiUKA21hcBgTIAEoCzIWLmJ1Zi52YWxpZGF0ZS5NYXBSdWxlc0gAEiUKA2FueRgUIAEoCzIWLmJ1Zi52YWxpZGF0ZS5BbnlSdWxlc0gAEi8KCGR1cmF0aW9uGBUgASgLMhsuYnVmLnZhbGlkYXRlLkR1cmF0aW9uUnVsZXNIABIxCgl0aW1lc3RhbXAYFiABKAsyHC5idWYudmFsaWRhdGUuVGltZXN0YW1wUnVsZXNIAEIGCgR0eXBlSgQIGBAZSgQIGhAbUgdza2lwcGVkUgxpZ25vcmVfZW1wdHkiVQoPUHJlZGVmaW5lZFJ1bGVzEh8KA2NlbBgBIAMoCzISLmJ1Zi52YWxpZGF0ZS5SdWxlSgQIGBAZSgQIGhAbUgdza2lwcGVkUgxpZ25vcmVfZW1wdHki2hcKCkZsb2F0UnVsZXMSgwEKBWNvbnN0GAEgASgCQnTCSHEKbwoLZmxvYXQuY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKfAQoCbHQYAiABKAJCkAHCSIwBCokBCghmbG9hdC5sdBp9IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCk/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKvAQoDbHRlGAMgASgCQp8BwkibAQqYAQoJZmxvYXQubHRlGooBIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+IHJ1bGVzLmx0ZSk/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAAS7wcKAmd0GAQgASgCQuAHwkjcBwqNAQoIZmxvYXQuZ3QagAEhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwrDAQoLZmxvYXQuZ3RfbHQaswFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrNAQoVZmxvYXQuZ3RfbHRfZXhjbHVzaXZlGrMBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycK0wEKDGZsb2F0Lmd0X2x0ZRrCAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCt0BChZmbG9hdC5ndF9sdGVfZXhjbHVzaXZlGsIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARK6CAoDZ3RlGAUgASgCQqoIwkimCAqbAQoJZmxvYXQuZ3RlGo0BIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmICh0aGlzLmlzTmFuKCkgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCtIBCgxmbG9hdC5ndGVfbHQawQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtwBChZmbG9hdC5ndGVfbHRfZXhjbHVzaXZlGsEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwriAQoNZmxvYXQuZ3RlX2x0ZRrQAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK7AEKF2Zsb2F0Lmd0ZV9sdGVfZXhjbHVzaXZlGtABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEn8KAmluGAYgAygCQnPCSHAKbgoIZmxvYXQuaW4aYiEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ3ZhbHVlIG11c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnYKBm5vdF9pbhgHIAMoAkJmwkhjCmEKDGZsb2F0Lm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEnUKBmZpbml0ZRgIIAEoCEJlwkhiCmAKDGZsb2F0LmZpbml0ZRpQcnVsZXMuZmluaXRlID8gKHRoaXMuaXNOYW4oKSB8fCB0aGlzLmlzSW5mKCkgPyAndmFsdWUgbXVzdCBiZSBmaW5pdGUnIDogJycpIDogJycSKwoHZXhhbXBsZRgJIAMoAkIawkgXChUKDWZsb2F0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIu0XCgtEb3VibGVSdWxlcxKEAQoFY29uc3QYASABKAFCdcJIcgpwCgxkb3VibGUuY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKgAQoCbHQYAiABKAFCkQHCSI0BCooBCglkb3VibGUubHQafSFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQpPyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASsAEKA2x0ZRgDIAEoAUKgAcJInAEKmQEKCmRvdWJsZS5sdGUaigEhaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzID4gcnVsZXMubHRlKT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABL0BwoCZ3QYBCABKAFC5QfCSOEHCo4BCglkb3VibGUuZ3QagAEhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwrEAQoMZG91YmxlLmd0X2x0GrMBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKzgEKFmRvdWJsZS5ndF9sdF9leGNsdXNpdmUaswFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrUAQoNZG91YmxlLmd0X2x0ZRrCAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCt4BChdkb3VibGUuZ3RfbHRlX2V4Y2x1c2l2ZRrCAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCkpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAESvwgKA2d0ZRgFIAEoAUKvCMJIqwgKnAEKCmRvdWJsZS5ndGUajQEhaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgKHRoaXMuaXNOYW4oKSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycK0wEKDWRvdWJsZS5ndGVfbHQawQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCt0BChdkb3VibGUuZ3RlX2x0X2V4Y2x1c2l2ZRrBAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHRoaXMuaXNOYW4oKSB8fCAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK4wEKDmRvdWJsZS5ndGVfbHRlGtABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcy5pc05hbigpIHx8IHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrtAQoYZG91YmxlLmd0ZV9sdGVfZXhjbHVzaXZlGtABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmICh0aGlzLmlzTmFuKCkgfHwgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSkpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEoABCgJpbhgGIAMoAUJ0wkhxCm8KCWRvdWJsZS5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSdwoGbm90X2luGAcgAygBQmfCSGQKYgoNZG91YmxlLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEnYKBmZpbml0ZRgIIAEoCEJmwkhjCmEKDWRvdWJsZS5maW5pdGUaUHJ1bGVzLmZpbml0ZSA/ICh0aGlzLmlzTmFuKCkgfHwgdGhpcy5pc0luZigpID8gJ3ZhbHVlIG11c3QgYmUgZmluaXRlJyA6ICcnKSA6ICcnEiwKB2V4YW1wbGUYCSADKAFCG8JIGAoWCg5kb3VibGUuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4ijBUKCkludDMyUnVsZXMSgwEKBWNvbnN0GAEgASgFQnTCSHEKbwoLaW50MzIuY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKKAQoCbHQYAiABKAVCfMJIeQp3CghpbnQzMi5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKcAQoDbHRlGAMgASgFQowBwkiIAQqFAQoJaW50MzIubHRlGnghaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKXBwoCZ3QYBCABKAVCiAfCSIQHCnoKCGludDMyLmd0Gm4haGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqzAQoLaW50MzIuZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrsBChVpbnQzMi5ndF9sdF9leGNsdXNpdmUaoQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrDAQoMaW50MzIuZ3RfbHRlGrIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrLAQoWaW50MzIuZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES4wcKA2d0ZRgFIAEoBULTB8JIzwcKiAEKCWludDMyLmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsIBCgxpbnQzMi5ndGVfbHQasQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKygEKFmludDMyLmd0ZV9sdF9leGNsdXNpdmUarwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtIBCg1pbnQzMi5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtoBChdpbnQzMi5ndGVfbHRlX2V4Y2x1c2l2ZRq+AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ/CgJpbhgGIAMoBUJzwkhwCm4KCGludDMyLmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ2CgZub3RfaW4YByADKAVCZsJIYwphCgxpbnQzMi5ub3RfaW4aUXRoaXMgaW4gcnVsZXMubm90X2luID8gJ3ZhbHVlIG11c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIrCgdleGFtcGxlGAggAygFQhrCSBcKFQoNaW50MzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4ijBUKCkludDY0UnVsZXMSgwEKBWNvbnN0GAEgASgDQnTCSHEKbwoLaW50NjQuY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKKAQoCbHQYAiABKANCfMJIeQp3CghpbnQ2NC5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKcAQoDbHRlGAMgASgDQowBwkiIAQqFAQoJaW50NjQubHRlGnghaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABKXBwoCZ3QYBCABKANCiAfCSIQHCnoKCGludDY0Lmd0Gm4haGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwqzAQoLaW50NjQuZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrsBChVpbnQ2NC5ndF9sdF9leGNsdXNpdmUaoQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrDAQoMaW50NjQuZ3RfbHRlGrIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrLAQoWaW50NjQuZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES4wcKA2d0ZRgFIAEoA0LTB8JIzwcKiAEKCWludDY0Lmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsIBCgxpbnQ2NC5ndGVfbHQasQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKygEKFmludDY0Lmd0ZV9sdF9leGNsdXNpdmUarwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtIBCg1pbnQ2NC5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCtoBChdpbnQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq+AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJ/CgJpbhgGIAMoA0JzwkhwCm4KCGludDY0LmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ2CgZub3RfaW4YByADKANCZsJIYwphCgxpbnQ2NC5ub3RfaW4aUXRoaXMgaW4gcnVsZXMubm90X2luID8gJ3ZhbHVlIG11c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIrCgdleGFtcGxlGAkgAygDQhrCSBcKFQoNaW50NjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4inhUKC1VJbnQzMlJ1bGVzEoQBCgVjb25zdBgBIAEoDUJ1wkhyCnAKDHVpbnQzMi5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEosBCgJsdBgCIAEoDUJ9wkh6CngKCXVpbnQzMi5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKdAQoDbHRlGAMgASgNQo0BwkiJAQqGAQoKdWludDMyLmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASnAcKAmd0GAQgASgNQo0HwkiJBwp7Cgl1aW50MzIuZ3QabiFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrQBCgx1aW50MzIuZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrwBChZ1aW50MzIuZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxAEKDXVpbnQzMi5ndF9sdGUasgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCswBChd1aW50MzIuZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES6AcKA2d0ZRgFIAEoDULYB8JI1AcKiQEKCnVpbnQzMi5ndGUaeyFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrDAQoNdWludDMyLmd0ZV9sdBqxAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrLAQoXdWludDMyLmd0ZV9sdF9leGNsdXNpdmUarwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtMBCg51aW50MzIuZ3RlX2x0ZRrAAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrbAQoYdWludDMyLmd0ZV9sdGVfZXhjbHVzaXZlGr4BaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEoABCgJpbhgGIAMoDUJ0wkhxCm8KCXVpbnQzMi5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSdwoGbm90X2luGAcgAygNQmfCSGQKYgoNdWludDMyLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKA1CG8JIGAoWCg51aW50MzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4inhUKC1VJbnQ2NFJ1bGVzEoQBCgVjb25zdBgBIAEoBEJ1wkhyCnAKDHVpbnQ2NC5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEosBCgJsdBgCIAEoBEJ9wkh6CngKCXVpbnQ2NC5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKdAQoDbHRlGAMgASgEQo0BwkiJAQqGAQoKdWludDY0Lmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASnAcKAmd0GAQgASgEQo0HwkiJBwp7Cgl1aW50NjQuZ3QabiFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrQBCgx1aW50NjQuZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrwBChZ1aW50NjQuZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxAEKDXVpbnQ2NC5ndF9sdGUasgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCswBChd1aW50NjQuZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES6AcKA2d0ZRgFIAEoBELYB8JI1AcKiQEKCnVpbnQ2NC5ndGUaeyFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrDAQoNdWludDY0Lmd0ZV9sdBqxAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrLAQoXdWludDY0Lmd0ZV9sdF9leGNsdXNpdmUarwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtMBCg51aW50NjQuZ3RlX2x0ZRrAAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrbAQoYdWludDY0Lmd0ZV9sdGVfZXhjbHVzaXZlGr4BaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEoABCgJpbhgGIAMoBEJ0wkhxCm8KCXVpbnQ2NC5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSdwoGbm90X2luGAcgAygEQmfCSGQKYgoNdWludDY0Lm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKARCG8JIGAoWCg51aW50NjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4inhUKC1NJbnQzMlJ1bGVzEoQBCgVjb25zdBgBIAEoEUJ1wkhyCnAKDHNpbnQzMi5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEosBCgJsdBgCIAEoEUJ9wkh6CngKCXNpbnQzMi5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKdAQoDbHRlGAMgASgRQo0BwkiJAQqGAQoKc2ludDMyLmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASnAcKAmd0GAQgASgRQo0HwkiJBwp7CglzaW50MzIuZ3QabiFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrQBCgxzaW50MzIuZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrwBChZzaW50MzIuZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxAEKDXNpbnQzMi5ndF9sdGUasgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCswBChdzaW50MzIuZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES6AcKA2d0ZRgFIAEoEULYB8JI1AcKiQEKCnNpbnQzMi5ndGUaeyFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrDAQoNc2ludDMyLmd0ZV9sdBqxAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrLAQoXc2ludDMyLmd0ZV9sdF9leGNsdXNpdmUarwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtMBCg5zaW50MzIuZ3RlX2x0ZRrAAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrbAQoYc2ludDMyLmd0ZV9sdGVfZXhjbHVzaXZlGr4BaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEoABCgJpbhgGIAMoEUJ0wkhxCm8KCXNpbnQzMi5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSdwoGbm90X2luGAcgAygRQmfCSGQKYgoNc2ludDMyLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKBFCG8JIGAoWCg5zaW50MzIuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4inhUKC1NJbnQ2NFJ1bGVzEoQBCgVjb25zdBgBIAEoEkJ1wkhyCnAKDHNpbnQ2NC5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEosBCgJsdBgCIAEoEkJ9wkh6CngKCXNpbnQ2NC5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKdAQoDbHRlGAMgASgSQo0BwkiJAQqGAQoKc2ludDY0Lmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASnAcKAmd0GAQgASgSQo0HwkiJBwp7CglzaW50NjQuZ3QabiFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrQBCgxzaW50NjQuZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCrwBChZzaW50NjQuZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxAEKDXNpbnQ2NC5ndF9sdGUasgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCswBChdzaW50NjQuZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES6AcKA2d0ZRgFIAEoEkLYB8JI1AcKiQEKCnNpbnQ2NC5ndGUaeyFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrDAQoNc2ludDY0Lmd0ZV9sdBqxAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrLAQoXc2ludDY0Lmd0ZV9sdF9leGNsdXNpdmUarwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtMBCg5zaW50NjQuZ3RlX2x0ZRrAAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrbAQoYc2ludDY0Lmd0ZV9sdGVfZXhjbHVzaXZlGr4BaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEoABCgJpbhgGIAMoEkJ0wkhxCm8KCXNpbnQ2NC5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSdwoGbm90X2luGAcgAygSQmfCSGQKYgoNc2ludDY0Lm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEiwKB2V4YW1wbGUYCCADKBJCG8JIGAoWCg5zaW50NjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4irxUKDEZpeGVkMzJSdWxlcxKFAQoFY29uc3QYASABKAdCdsJIcwpxCg1maXhlZDMyLmNvbnN0GmB0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSjAEKAmx0GAIgASgHQn7CSHsKeQoKZml4ZWQzMi5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABKeAQoDbHRlGAMgASgHQo4BwkiKAQqHAQoLZml4ZWQzMi5sdGUaeCFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEqEHCgJndBgEIAEoB0KSB8JIjgcKfAoKZml4ZWQzMi5ndBpuIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKtQEKDWZpeGVkMzIuZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr0BChdmaXhlZDMyLmd0X2x0X2V4Y2x1c2l2ZRqhAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCsUBCg5maXhlZDMyLmd0X2x0ZRqyAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKzQEKGGZpeGVkMzIuZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAES7QcKA2d0ZRgFIAEoB0LdB8JI2QcKigEKC2ZpeGVkMzIuZ3RlGnshaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKxAEKDmZpeGVkMzIuZ3RlX2x0GrEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCswBChhmaXhlZDMyLmd0ZV9sdF9leGNsdXNpdmUarwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtQBCg9maXhlZDMyLmd0ZV9sdGUawAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK3AEKGWZpeGVkMzIuZ3RlX2x0ZV9leGNsdXNpdmUavgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESgQEKAmluGAYgAygHQnXCSHIKcAoKZml4ZWQzMi5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSeAoGbm90X2luGAcgAygHQmjCSGUKYwoOZml4ZWQzMi5ub3RfaW4aUXRoaXMgaW4gcnVsZXMubm90X2luID8gJ3ZhbHVlIG11c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxItCgdleGFtcGxlGAggAygHQhzCSBkKFwoPZml4ZWQzMi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiKvFQoMRml4ZWQ2NFJ1bGVzEoUBCgVjb25zdBgBIAEoBkJ2wkhzCnEKDWZpeGVkNjQuY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKMAQoCbHQYAiABKAZCfsJIewp5CgpmaXhlZDY0Lmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEp4BCgNsdGUYAyABKAZCjgHCSIoBCocBCgtmaXhlZDY0Lmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASoQcKAmd0GAQgASgGQpIHwkiOBwp8CgpmaXhlZDY0Lmd0Gm4haGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwq1AQoNZml4ZWQ2NC5ndF9sdBqjAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvQEKF2ZpeGVkNjQuZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxQEKDmZpeGVkNjQuZ3RfbHRlGrIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrNAQoYZml4ZWQ2NC5ndF9sdGVfZXhjbHVzaXZlGrABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLtBwoDZ3RlGAUgASgGQt0HwkjZBwqKAQoLZml4ZWQ2NC5ndGUaeyFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrEAQoOZml4ZWQ2NC5ndGVfbHQasQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzAEKGGZpeGVkNjQuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK1AEKD2ZpeGVkNjQuZ3RlX2x0ZRrAAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrcAQoZZml4ZWQ2NC5ndGVfbHRlX2V4Y2x1c2l2ZRq+AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARKBAQoCaW4YBiADKAZCdcJIcgpwCgpmaXhlZDY0LmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ4CgZub3RfaW4YByADKAZCaMJIZQpjCg5maXhlZDY0Lm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEi0KB2V4YW1wbGUYCCADKAZCHMJIGQoXCg9maXhlZDY0LmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkILCglsZXNzX3RoYW5CDgoMZ3JlYXRlcl90aGFuIsAVCg1TRml4ZWQzMlJ1bGVzEoYBCgVjb25zdBgBIAEoD0J3wkh0CnIKDnNmaXhlZDMyLmNvbnN0GmB0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSjQEKAmx0GAIgASgPQn/CSHwKegoLc2ZpeGVkMzIubHQaayFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID49IHJ1bGVzLmx0PyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMubHRdKSA6ICcnSAASnwEKA2x0ZRgDIAEoD0KPAcJIiwEKiAEKDHNmaXhlZDMyLmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASpgcKAmd0GAQgASgPQpcHwkiTBwp9CgtzZml4ZWQzMi5ndBpuIWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPD0gcnVsZXMuZ3Q/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndF0pIDogJycKtgEKDnNmaXhlZDMyLmd0X2x0GqMBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndCAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwq+AQoYc2ZpeGVkMzIuZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxgEKD3NmaXhlZDMyLmd0X2x0ZRqyAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndCAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJycKzgEKGXNmaXhlZDMyLmd0X2x0ZV9leGNsdXNpdmUasAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndCAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJ0gBEvIHCgNndGUYBSABKA9C4gfCSN4HCosBCgxzZml4ZWQzMi5ndGUaeyFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDwgcnVsZXMuZ3RlPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlXSkgOiAnJwrFAQoPc2ZpeGVkMzIuZ3RlX2x0GrEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCs0BChlzZml4ZWQzMi5ndGVfbHRfZXhjbHVzaXZlGq8BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrVAQoQc2ZpeGVkMzIuZ3RlX2x0ZRrAAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA+PSBydWxlcy5ndGUgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJwrdAQoac2ZpeGVkMzIuZ3RlX2x0ZV9leGNsdXNpdmUavgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnSAESggEKAmluGAYgAygPQnbCSHMKcQoLc2ZpeGVkMzIuaW4aYiEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ3ZhbHVlIG11c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnkKBm5vdF9pbhgHIAMoD0JpwkhmCmQKD3NmaXhlZDMyLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEi4KB2V4YW1wbGUYCCADKA9CHcJIGgoYChBzZml4ZWQzMi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiLAFQoNU0ZpeGVkNjRSdWxlcxKGAQoFY29uc3QYASABKBBCd8JIdApyCg5zZml4ZWQ2NC5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEo0BCgJsdBgCIAEoEEJ/wkh8CnoKC3NmaXhlZDY0Lmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAEp8BCgNsdGUYAyABKBBCjwHCSIsBCogBCgxzZml4ZWQ2NC5sdGUaeCFoYXMocnVsZXMuZ3RlKSAmJiAhaGFzKHJ1bGVzLmd0KSAmJiB0aGlzID4gcnVsZXMubHRlPyAndmFsdWUgbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMubHRlXSkgOiAnJ0gAEqYHCgJndBgEIAEoEEKXB8JIkwcKfQoLc2ZpeGVkNjQuZ3QabiFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrYBCg5zZml4ZWQ2NC5ndF9sdBqjAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPj0gcnVsZXMubHQgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKvgEKGHNmaXhlZDY0Lmd0X2x0X2V4Y2x1c2l2ZRqhAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndCAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDw9IHJ1bGVzLmd0KT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCsYBCg9zZml4ZWQ2NC5ndF9sdGUasgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCs4BChlzZml4ZWQ2NC5ndF9sdGVfZXhjbHVzaXZlGrABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0ZSA8IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0ZV0pIDogJydIARLyBwoDZ3RlGAUgASgQQuIHwkjeBwqLAQoMc2ZpeGVkNjQuZ3RlGnshaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKxQEKD3NmaXhlZDY0Lmd0ZV9sdBqxAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPj0gcnVsZXMuZ3RlICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrNAQoZc2ZpeGVkNjQuZ3RlX2x0X2V4Y2x1c2l2ZRqvAWhhcyhydWxlcy5sdCkgJiYgcnVsZXMubHQgPCBydWxlcy5ndGUgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8IHJ1bGVzLmd0ZSk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycK1QEKEHNmaXhlZDY0Lmd0ZV9sdGUawAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK3QEKGnNmaXhlZDY0Lmd0ZV9sdGVfZXhjbHVzaXZlGr4BaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlIDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRlXSkgOiAnJ0gBEoIBCgJpbhgGIAMoEEJ2wkhzCnEKC3NmaXhlZDY0LmluGmIhKHRoaXMgaW4gZ2V0RmllbGQocnVsZXMsICdpbicpKSA/ICd2YWx1ZSBtdXN0IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdpbicpXSkgOiAnJxJ5CgZub3RfaW4YByADKBBCacJIZgpkCg9zZml4ZWQ2NC5ub3RfaW4aUXRoaXMgaW4gcnVsZXMubm90X2luID8gJ3ZhbHVlIG11c3Qgbm90IGJlIGluIGxpc3QgJXMnLmZvcm1hdChbcnVsZXMubm90X2luXSkgOiAnJxIuCgdleGFtcGxlGAggAygQQh3CSBoKGAoQc2ZpeGVkNjQuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACQgsKCWxlc3NfdGhhbkIOCgxncmVhdGVyX3RoYW4ixwEKCUJvb2xSdWxlcxKCAQoFY29uc3QYASABKAhCc8JIcApuCgpib29sLmNvbnN0GmB0aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGVxdWFsICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSKgoHZXhhbXBsZRgCIAMoCEIZwkgWChQKDGJvb2wuZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACIpA3CgtTdHJpbmdSdWxlcxKGAQoFY29uc3QYASABKAlCd8JIdApyCgxzdHJpbmcuY29uc3QaYnRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgYCVzYCcuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEn4KA2xlbhgTIAEoBEJxwkhuCmwKCnN0cmluZy5sZW4aXnVpbnQodGhpcy5zaXplKCkpICE9IHJ1bGVzLmxlbiA/ICd2YWx1ZSBsZW5ndGggbXVzdCBiZSAlcyBjaGFyYWN0ZXJzJy5mb3JtYXQoW3J1bGVzLmxlbl0pIDogJycSmQEKB21pbl9sZW4YAiABKARChwHCSIMBCoABCg5zdHJpbmcubWluX2xlbhpudWludCh0aGlzLnNpemUoKSkgPCBydWxlcy5taW5fbGVuID8gJ3ZhbHVlIGxlbmd0aCBtdXN0IGJlIGF0IGxlYXN0ICVzIGNoYXJhY3RlcnMnLmZvcm1hdChbcnVsZXMubWluX2xlbl0pIDogJycSlwEKB21heF9sZW4YAyABKARChQHCSIEBCn8KDnN0cmluZy5tYXhfbGVuGm11aW50KHRoaXMuc2l6ZSgpKSA+IHJ1bGVzLm1heF9sZW4gPyAndmFsdWUgbGVuZ3RoIG11c3QgYmUgYXQgbW9zdCAlcyBjaGFyYWN0ZXJzJy5mb3JtYXQoW3J1bGVzLm1heF9sZW5dKSA6ICcnEpsBCglsZW5fYnl0ZXMYFCABKARChwHCSIMBCoABChBzdHJpbmcubGVuX2J5dGVzGmx1aW50KGJ5dGVzKHRoaXMpLnNpemUoKSkgIT0gcnVsZXMubGVuX2J5dGVzID8gJ3ZhbHVlIGxlbmd0aCBtdXN0IGJlICVzIGJ5dGVzJy5mb3JtYXQoW3J1bGVzLmxlbl9ieXRlc10pIDogJycSowEKCW1pbl9ieXRlcxgEIAEoBEKPAcJIiwEKiAEKEHN0cmluZy5taW5fYnl0ZXMadHVpbnQoYnl0ZXModGhpcykuc2l6ZSgpKSA8IHJ1bGVzLm1pbl9ieXRlcyA/ICd2YWx1ZSBsZW5ndGggbXVzdCBiZSBhdCBsZWFzdCAlcyBieXRlcycuZm9ybWF0KFtydWxlcy5taW5fYnl0ZXNdKSA6ICcnEqIBCgltYXhfYnl0ZXMYBSABKARCjgHCSIoBCocBChBzdHJpbmcubWF4X2J5dGVzGnN1aW50KGJ5dGVzKHRoaXMpLnNpemUoKSkgPiBydWxlcy5tYXhfYnl0ZXMgPyAndmFsdWUgbGVuZ3RoIG11c3QgYmUgYXQgbW9zdCAlcyBieXRlcycuZm9ybWF0KFtydWxlcy5tYXhfYnl0ZXNdKSA6ICcnEo0BCgdwYXR0ZXJuGAYgASgJQnzCSHkKdwoOc3RyaW5nLnBhdHRlcm4aZSF0aGlzLm1hdGNoZXMocnVsZXMucGF0dGVybikgPyAndmFsdWUgZG9lcyBub3QgbWF0Y2ggcmVnZXggcGF0dGVybiBgJXNgJy5mb3JtYXQoW3J1bGVzLnBhdHRlcm5dKSA6ICcnEoQBCgZwcmVmaXgYByABKAlCdMJIcQpvCg1zdHJpbmcucHJlZml4Gl4hdGhpcy5zdGFydHNXaXRoKHJ1bGVzLnByZWZpeCkgPyAndmFsdWUgZG9lcyBub3QgaGF2ZSBwcmVmaXggYCVzYCcuZm9ybWF0KFtydWxlcy5wcmVmaXhdKSA6ICcnEoIBCgZzdWZmaXgYCCABKAlCcsJIbwptCg1zdHJpbmcuc3VmZml4GlwhdGhpcy5lbmRzV2l0aChydWxlcy5zdWZmaXgpID8gJ3ZhbHVlIGRvZXMgbm90IGhhdmUgc3VmZml4IGAlc2AnLmZvcm1hdChbcnVsZXMuc3VmZml4XSkgOiAnJxKQAQoIY29udGFpbnMYCSABKAlCfsJIewp5Cg9zdHJpbmcuY29udGFpbnMaZiF0aGlzLmNvbnRhaW5zKHJ1bGVzLmNvbnRhaW5zKSA/ICd2YWx1ZSBkb2VzIG5vdCBjb250YWluIHN1YnN0cmluZyBgJXNgJy5mb3JtYXQoW3J1bGVzLmNvbnRhaW5zXSkgOiAnJxKYAQoMbm90X2NvbnRhaW5zGBcgASgJQoEBwkh+CnwKE3N0cmluZy5ub3RfY29udGFpbnMaZXRoaXMuY29udGFpbnMocnVsZXMubm90X2NvbnRhaW5zKSA/ICd2YWx1ZSBjb250YWlucyBzdWJzdHJpbmcgYCVzYCcuZm9ybWF0KFtydWxlcy5ub3RfY29udGFpbnNdKSA6ICcnEoABCgJpbhgKIAMoCUJ0wkhxCm8KCXN0cmluZy5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSdwoGbm90X2luGAsgAygJQmfCSGQKYgoNc3RyaW5nLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEt8BCgVlbWFpbBgMIAEoCELNAcJIyQEKYQoMc3RyaW5nLmVtYWlsEiN2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgZW1haWwgYWRkcmVzcxosIXJ1bGVzLmVtYWlsIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0VtYWlsKCkKZAoSc3RyaW5nLmVtYWlsX2VtcHR5EjJ2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgZW1haWwgYWRkcmVzcxoaIXJ1bGVzLmVtYWlsIHx8IHRoaXMgIT0gJydIABLnAQoIaG9zdG5hbWUYDSABKAhC0gHCSM4BCmUKD3N0cmluZy5ob3N0bmFtZRIedmFsdWUgbXVzdCBiZSBhIHZhbGlkIGhvc3RuYW1lGjIhcnVsZXMuaG9zdG5hbWUgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSG9zdG5hbWUoKQplChVzdHJpbmcuaG9zdG5hbWVfZW1wdHkSLXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBob3N0bmFtZRodIXJ1bGVzLmhvc3RuYW1lIHx8IHRoaXMgIT0gJydIABLHAQoCaXAYDiABKAhCuAHCSLQBClUKCXN0cmluZy5pcBIgdmFsdWUgbXVzdCBiZSBhIHZhbGlkIElQIGFkZHJlc3MaJiFydWxlcy5pcCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCgpClsKD3N0cmluZy5pcF9lbXB0eRIvdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIGFkZHJlc3MaFyFydWxlcy5pcCB8fCB0aGlzICE9ICcnSAAS1gEKBGlwdjQYDyABKAhCxQHCSMEBClwKC3N0cmluZy5pcHY0EiJ2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSVB2NCBhZGRyZXNzGikhcnVsZXMuaXB2NCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcCg0KQphChFzdHJpbmcuaXB2NF9lbXB0eRIxdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjQgYWRkcmVzcxoZIXJ1bGVzLmlwdjQgfHwgdGhpcyAhPSAnJ0gAEtYBCgRpcHY2GBAgASgIQsUBwkjBAQpcCgtzdHJpbmcuaXB2NhIidmFsdWUgbXVzdCBiZSBhIHZhbGlkIElQdjYgYWRkcmVzcxopIXJ1bGVzLmlwdjYgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXAoNikKYQoRc3RyaW5nLmlwdjZfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IGFkZHJlc3MaGSFydWxlcy5pcHY2IHx8IHRoaXMgIT0gJydIABK/AQoDdXJpGBEgASgIQq8BwkirAQpRCgpzdHJpbmcudXJpEhl2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgVVJJGighcnVsZXMudXJpIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc1VyaSgpClYKEHN0cmluZy51cmlfZW1wdHkSKHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBVUkkaGCFydWxlcy51cmkgfHwgdGhpcyAhPSAnJ0gAEnAKB3VyaV9yZWYYEiABKAhCXcJIWgpYCg5zdHJpbmcudXJpX3JlZhIjdmFsdWUgbXVzdCBiZSBhIHZhbGlkIFVSSSBSZWZlcmVuY2UaISFydWxlcy51cmlfcmVmIHx8IHRoaXMuaXNVcmlSZWYoKUgAEpACCgdhZGRyZXNzGBUgASgIQvwBwkj4AQqBAQoOc3RyaW5nLmFkZHJlc3MSLXZhbHVlIG11c3QgYmUgYSB2YWxpZCBob3N0bmFtZSwgb3IgaXAgYWRkcmVzcxpAIXJ1bGVzLmFkZHJlc3MgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSG9zdG5hbWUoKSB8fCB0aGlzLmlzSXAoKQpyChRzdHJpbmcuYWRkcmVzc19lbXB0eRI8dmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIGhvc3RuYW1lLCBvciBpcCBhZGRyZXNzGhwhcnVsZXMuYWRkcmVzcyB8fCB0aGlzICE9ICcnSAASmAIKBHV1aWQYFiABKAhChwLCSIMCCqUBCgtzdHJpbmcudXVpZBIadmFsdWUgbXVzdCBiZSBhIHZhbGlkIFVVSUQaeiFydWxlcy51dWlkIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpClkKEXN0cmluZy51dWlkX2VtcHR5Eil2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgVVVJRBoZIXJ1bGVzLnV1aWQgfHwgdGhpcyAhPSAnJ0gAEvABCgV0dXVpZBghIAEoCELeAcJI2gEKcwoMc3RyaW5nLnR1dWlkEiJ2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgdHJpbW1lZCBVVUlEGj8hcnVsZXMudHV1aWQgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLm1hdGNoZXMoJ15bMC05YS1mQS1GXXszMn0kJykKYwoSc3RyaW5nLnR1dWlkX2VtcHR5EjF2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgdHJpbW1lZCBVVUlEGhohcnVsZXMudHV1aWQgfHwgdGhpcyAhPSAnJ0gAEpYCChFpcF93aXRoX3ByZWZpeGxlbhgaIAEoCEL4AcJI9AEKeAoYc3RyaW5nLmlwX3dpdGhfcHJlZml4bGVuEh92YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSVAgcHJlZml4GjshcnVsZXMuaXBfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoKQp4Ch5zdHJpbmcuaXBfd2l0aF9wcmVmaXhsZW5fZW1wdHkSLnZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUCBwcmVmaXgaJiFydWxlcy5pcF93aXRoX3ByZWZpeGxlbiB8fCB0aGlzICE9ICcnSAASzwIKE2lwdjRfd2l0aF9wcmVmaXhsZW4YGyABKAhCrwLCSKsCCpMBChpzdHJpbmcuaXB2NF93aXRoX3ByZWZpeGxlbhI1dmFsdWUgbXVzdCBiZSBhIHZhbGlkIElQdjQgYWRkcmVzcyB3aXRoIHByZWZpeCBsZW5ndGgaPiFydWxlcy5pcHY0X3dpdGhfcHJlZml4bGVuIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0lwUHJlZml4KDQpCpIBCiBzdHJpbmcuaXB2NF93aXRoX3ByZWZpeGxlbl9lbXB0eRJEdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjQgYWRkcmVzcyB3aXRoIHByZWZpeCBsZW5ndGgaKCFydWxlcy5pcHY0X3dpdGhfcHJlZml4bGVuIHx8IHRoaXMgIT0gJydIABLPAgoTaXB2Nl93aXRoX3ByZWZpeGxlbhgcIAEoCEKvAsJIqwIKkwEKGnN0cmluZy5pcHY2X3dpdGhfcHJlZml4bGVuEjV2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSVB2NiBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBo+IXJ1bGVzLmlwdjZfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgoNikKkgEKIHN0cmluZy5pcHY2X3dpdGhfcHJlZml4bGVuX2VtcHR5EkR2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NiBhZGRyZXNzIHdpdGggcHJlZml4IGxlbmd0aBooIXJ1bGVzLmlwdjZfd2l0aF9wcmVmaXhsZW4gfHwgdGhpcyAhPSAnJ0gAEvIBCglpcF9wcmVmaXgYHSABKAhC3AHCSNgBCmwKEHN0cmluZy5pcF9wcmVmaXgSH3ZhbHVlIG11c3QgYmUgYSB2YWxpZCBJUCBwcmVmaXgaNyFydWxlcy5pcF9wcmVmaXggfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSXBQcmVmaXgodHJ1ZSkKaAoWc3RyaW5nLmlwX3ByZWZpeF9lbXB0eRIudmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQIHByZWZpeBoeIXJ1bGVzLmlwX3ByZWZpeCB8fCB0aGlzICE9ICcnSAASgwIKC2lwdjRfcHJlZml4GB4gASgIQusBwkjnAQp1ChJzdHJpbmcuaXB2NF9wcmVmaXgSIXZhbHVlIG11c3QgYmUgYSB2YWxpZCBJUHY0IHByZWZpeBo8IXJ1bGVzLmlwdjRfcHJlZml4IHx8IHRoaXMgPT0gJycgfHwgdGhpcy5pc0lwUHJlZml4KDQsIHRydWUpCm4KGHN0cmluZy5pcHY0X3ByZWZpeF9lbXB0eRIwdmFsdWUgaXMgZW1wdHksIHdoaWNoIGlzIG5vdCBhIHZhbGlkIElQdjQgcHJlZml4GiAhcnVsZXMuaXB2NF9wcmVmaXggfHwgdGhpcyAhPSAnJ0gAEoMCCgtpcHY2X3ByZWZpeBgfIAEoCELrAcJI5wEKdQoSc3RyaW5nLmlwdjZfcHJlZml4EiF2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSVB2NiBwcmVmaXgaPCFydWxlcy5pcHY2X3ByZWZpeCB8fCB0aGlzID09ICcnIHx8IHRoaXMuaXNJcFByZWZpeCg2LCB0cnVlKQpuChhzdHJpbmcuaXB2Nl9wcmVmaXhfZW1wdHkSMHZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY2IHByZWZpeBogIXJ1bGVzLmlwdjZfcHJlZml4IHx8IHRoaXMgIT0gJydIABK1AgoNaG9zdF9hbmRfcG9ydBggIAEoCEKbAsJIlwIKmQEKFHN0cmluZy5ob3N0X2FuZF9wb3J0EkF2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgaG9zdCAoaG9zdG5hbWUgb3IgSVAgYWRkcmVzcykgYW5kIHBvcnQgcGFpcho+IXJ1bGVzLmhvc3RfYW5kX3BvcnQgfHwgdGhpcyA9PSAnJyB8fCB0aGlzLmlzSG9zdEFuZFBvcnQodHJ1ZSkKeQoac3RyaW5nLmhvc3RfYW5kX3BvcnRfZW1wdHkSN3ZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBob3N0IGFuZCBwb3J0IHBhaXIaIiFydWxlcy5ob3N0X2FuZF9wb3J0IHx8IHRoaXMgIT0gJydIABKoBQoQd2VsbF9rbm93bl9yZWdleBgYIAEoDjIYLmJ1Zi52YWxpZGF0ZS5Lbm93blJlZ2V4QvEEwkjtBArwAQojc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWUSJnZhbHVlIG11c3QgYmUgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGqABcnVsZXMud2VsbF9rbm93bl9yZWdleCAhPSAxIHx8IHRoaXMgPT0gJycgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeOj9bMC05YS16QS1aISMkJSZcJyorLS5eX3x+XHg2MF0rJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKyQnKQqNAQopc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX25hbWVfZW1wdHkSNXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBIVFRQIGhlYWRlciBuYW1lGilydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDEgfHwgdGhpcyAhPSAnJwrnAQokc3RyaW5nLndlbGxfa25vd25fcmVnZXguaGVhZGVyX3ZhbHVlEid2YWx1ZSBtdXN0IGJlIGEgdmFsaWQgSFRUUCBoZWFkZXIgdmFsdWUalQFydWxlcy53ZWxsX2tub3duX3JlZ2V4ICE9IDIgfHwgdGhpcy5tYXRjaGVzKCFoYXMocnVsZXMuc3RyaWN0KSB8fCBydWxlcy5zdHJpY3QgPydeW15cdTAwMDAtXHUwMDA4XHUwMDBBLVx1MDAxRlx1MDA3Rl0qJCcgOideW15cdTAwMDBcdTAwMEFcdTAwMERdKiQnKUgAEg4KBnN0cmljdBgZIAEoCBIsCgdleGFtcGxlGCIgAygJQhvCSBgKFgoOc3RyaW5nLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkIMCgp3ZWxsX2tub3duIuoQCgpCeXRlc1J1bGVzEoABCgVjb25zdBgBIAEoDEJxwkhuCmwKC2J5dGVzLmNvbnN0Gl10aGlzICE9IGdldEZpZWxkKHJ1bGVzLCAnY29uc3QnKSA/ICd2YWx1ZSBtdXN0IGJlICV4Jy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnY29uc3QnKV0pIDogJycSeAoDbGVuGA0gASgEQmvCSGgKZgoJYnl0ZXMubGVuGll1aW50KHRoaXMuc2l6ZSgpKSAhPSBydWxlcy5sZW4gPyAndmFsdWUgbGVuZ3RoIG11c3QgYmUgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubGVuXSkgOiAnJxKQAQoHbWluX2xlbhgCIAEoBEJ/wkh8CnoKDWJ5dGVzLm1pbl9sZW4aaXVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX2xlbiA/ICd2YWx1ZSBsZW5ndGggbXVzdCBiZSBhdCBsZWFzdCAlcyBieXRlcycuZm9ybWF0KFtydWxlcy5taW5fbGVuXSkgOiAnJxKIAQoHbWF4X2xlbhgDIAEoBEJ3wkh0CnIKDWJ5dGVzLm1heF9sZW4aYXVpbnQodGhpcy5zaXplKCkpID4gcnVsZXMubWF4X2xlbiA/ICd2YWx1ZSBtdXN0IGJlIGF0IG1vc3QgJXMgYnl0ZXMnLmZvcm1hdChbcnVsZXMubWF4X2xlbl0pIDogJycSkAEKB3BhdHRlcm4YBCABKAlCf8JIfAp6Cg1ieXRlcy5wYXR0ZXJuGmkhc3RyaW5nKHRoaXMpLm1hdGNoZXMocnVsZXMucGF0dGVybikgPyAndmFsdWUgbXVzdCBtYXRjaCByZWdleCBwYXR0ZXJuIGAlc2AnLmZvcm1hdChbcnVsZXMucGF0dGVybl0pIDogJycSgQEKBnByZWZpeBgFIAEoDEJxwkhuCmwKDGJ5dGVzLnByZWZpeBpcIXRoaXMuc3RhcnRzV2l0aChydWxlcy5wcmVmaXgpID8gJ3ZhbHVlIGRvZXMgbm90IGhhdmUgcHJlZml4ICV4Jy5mb3JtYXQoW3J1bGVzLnByZWZpeF0pIDogJycSfwoGc3VmZml4GAYgASgMQm/CSGwKagoMYnl0ZXMuc3VmZml4GlohdGhpcy5lbmRzV2l0aChydWxlcy5zdWZmaXgpID8gJ3ZhbHVlIGRvZXMgbm90IGhhdmUgc3VmZml4ICV4Jy5mb3JtYXQoW3J1bGVzLnN1ZmZpeF0pIDogJycSgwEKCGNvbnRhaW5zGAcgASgMQnHCSG4KbAoOYnl0ZXMuY29udGFpbnMaWiF0aGlzLmNvbnRhaW5zKHJ1bGVzLmNvbnRhaW5zKSA/ICd2YWx1ZSBkb2VzIG5vdCBjb250YWluICV4Jy5mb3JtYXQoW3J1bGVzLmNvbnRhaW5zXSkgOiAnJxKnAQoCaW4YCCADKAxCmgHCSJYBCpMBCghieXRlcy5pbhqGAWdldEZpZWxkKHJ1bGVzLCAnaW4nKS5zaXplKCkgPiAwICYmICEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ3ZhbHVlIG11c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnYKBm5vdF9pbhgJIAMoDEJmwkhjCmEKDGJ5dGVzLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEusBCgJpcBgKIAEoCELcAcJI2AEKdAoIYnl0ZXMuaXASIHZhbHVlIG11c3QgYmUgYSB2YWxpZCBJUCBhZGRyZXNzGkYhcnVsZXMuaXAgfHwgdGhpcy5zaXplKCkgPT0gMCB8fCB0aGlzLnNpemUoKSA9PSA0IHx8IHRoaXMuc2l6ZSgpID09IDE2CmAKDmJ5dGVzLmlwX2VtcHR5Ei92YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVAgYWRkcmVzcxodIXJ1bGVzLmlwIHx8IHRoaXMuc2l6ZSgpICE9IDBIABLkAQoEaXB2NBgLIAEoCELTAcJIzwEKZQoKYnl0ZXMuaXB2NBIidmFsdWUgbXVzdCBiZSBhIHZhbGlkIElQdjQgYWRkcmVzcxozIXJ1bGVzLmlwdjQgfHwgdGhpcy5zaXplKCkgPT0gMCB8fCB0aGlzLnNpemUoKSA9PSA0CmYKEGJ5dGVzLmlwdjRfZW1wdHkSMXZhbHVlIGlzIGVtcHR5LCB3aGljaCBpcyBub3QgYSB2YWxpZCBJUHY0IGFkZHJlc3MaHyFydWxlcy5pcHY0IHx8IHRoaXMuc2l6ZSgpICE9IDBIABLlAQoEaXB2NhgMIAEoCELUAcJI0AEKZgoKYnl0ZXMuaXB2NhIidmFsdWUgbXVzdCBiZSBhIHZhbGlkIElQdjYgYWRkcmVzcxo0IXJ1bGVzLmlwdjYgfHwgdGhpcy5zaXplKCkgPT0gMCB8fCB0aGlzLnNpemUoKSA9PSAxNgpmChBieXRlcy5pcHY2X2VtcHR5EjF2YWx1ZSBpcyBlbXB0eSwgd2hpY2ggaXMgbm90IGEgdmFsaWQgSVB2NiBhZGRyZXNzGh8hcnVsZXMuaXB2NiB8fCB0aGlzLnNpemUoKSAhPSAwSAASKwoHZXhhbXBsZRgOIAMoDEIawkgXChUKDWJ5dGVzLmV4YW1wbGUaBHRydWUqCQjoBxCAgICAAkIMCgp3ZWxsX2tub3duItQDCglFbnVtUnVsZXMSggEKBWNvbnN0GAEgASgFQnPCSHAKbgoKZW51bS5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEhQKDGRlZmluZWRfb25seRgCIAEoCBJ+CgJpbhgDIAMoBUJywkhvCm0KB2VudW0uaW4aYiEodGhpcyBpbiBnZXRGaWVsZChydWxlcywgJ2luJykpID8gJ3ZhbHVlIG11c3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2luJyldKSA6ICcnEnUKBm5vdF9pbhgEIAMoBUJlwkhiCmAKC2VudW0ubm90X2luGlF0aGlzIGluIHJ1bGVzLm5vdF9pbiA/ICd2YWx1ZSBtdXN0IG5vdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW3J1bGVzLm5vdF9pbl0pIDogJycSKgoHZXhhbXBsZRgFIAMoBUIZwkgWChQKDGVudW0uZXhhbXBsZRoEdHJ1ZSoJCOgHEICAgIACIvsDCg1SZXBlYXRlZFJ1bGVzEp4BCgltaW5faXRlbXMYASABKARCigHCSIYBCoMBChJyZXBlYXRlZC5taW5faXRlbXMabXVpbnQodGhpcy5zaXplKCkpIDwgcnVsZXMubWluX2l0ZW1zID8gJ3ZhbHVlIG11c3QgY29udGFpbiBhdCBsZWFzdCAlZCBpdGVtKHMpJy5mb3JtYXQoW3J1bGVzLm1pbl9pdGVtc10pIDogJycSogEKCW1heF9pdGVtcxgCIAEoBEKOAcJIigEKhwEKEnJlcGVhdGVkLm1heF9pdGVtcxpxdWludCh0aGlzLnNpemUoKSkgPiBydWxlcy5tYXhfaXRlbXMgPyAndmFsdWUgbXVzdCBjb250YWluIG5vIG1vcmUgdGhhbiAlcyBpdGVtKHMpJy5mb3JtYXQoW3J1bGVzLm1heF9pdGVtc10pIDogJycScAoGdW5pcXVlGAMgASgIQmDCSF0KWwoPcmVwZWF0ZWQudW5pcXVlEihyZXBlYXRlZCB2YWx1ZSBtdXN0IGNvbnRhaW4gdW5pcXVlIGl0ZW1zGh4hcnVsZXMudW5pcXVlIHx8IHRoaXMudW5pcXVlKCkSJwoFaXRlbXMYBCABKAsyGC5idWYudmFsaWRhdGUuRmllbGRSdWxlcyoJCOgHEICAgIACIooDCghNYXBSdWxlcxKPAQoJbWluX3BhaXJzGAEgASgEQnzCSHkKdwoNbWFwLm1pbl9wYWlycxpmdWludCh0aGlzLnNpemUoKSkgPCBydWxlcy5taW5fcGFpcnMgPyAnbWFwIG11c3QgYmUgYXQgbGVhc3QgJWQgZW50cmllcycuZm9ybWF0KFtydWxlcy5taW5fcGFpcnNdKSA6ICcnEo4BCgltYXhfcGFpcnMYAiABKARCe8JIeAp2Cg1tYXAubWF4X3BhaXJzGmV1aW50KHRoaXMuc2l6ZSgpKSA+IHJ1bGVzLm1heF9wYWlycyA/ICdtYXAgbXVzdCBiZSBhdCBtb3N0ICVkIGVudHJpZXMnLmZvcm1hdChbcnVsZXMubWF4X3BhaXJzXSkgOiAnJxImCgRrZXlzGAQgASgLMhguYnVmLnZhbGlkYXRlLkZpZWxkUnVsZXMSKAoGdmFsdWVzGAUgASgLMhguYnVmLnZhbGlkYXRlLkZpZWxkUnVsZXMqCQjoBxCAgICAAiImCghBbnlSdWxlcxIKCgJpbhgCIAMoCRIOCgZub3RfaW4YAyADKAkimRcKDUR1cmF0aW9uUnVsZXMSoQEKBWNvbnN0GAIgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQnfCSHQKcgoOZHVyYXRpb24uY29uc3QaYHRoaXMgIT0gZ2V0RmllbGQocnVsZXMsICdjb25zdCcpID8gJ3ZhbHVlIG11c3QgZXF1YWwgJXMnLmZvcm1hdChbZ2V0RmllbGQocnVsZXMsICdjb25zdCcpXSkgOiAnJxKoAQoCbHQYAyABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25Cf8JIfAp6CgtkdXJhdGlvbi5sdBprIWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPj0gcnVsZXMubHQ/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5sdF0pIDogJydIABK6AQoDbHRlGAQgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQo8BwkiLAQqIAQoMZHVyYXRpb24ubHRlGnghaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+IHJ1bGVzLmx0ZT8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmx0ZV0pIDogJydIABLBBwoCZ3QYBSABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25ClwfCSJMHCn0KC2R1cmF0aW9uLmd0Gm4haGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8PSBydWxlcy5ndD8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0XSkgOiAnJwq2AQoOZHVyYXRpb24uZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr4BChhkdXJhdGlvbi5ndF9sdF9leGNsdXNpdmUaoQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3QgJiYgKHJ1bGVzLmx0IDw9IHRoaXMgJiYgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBvciBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3QsIHJ1bGVzLmx0XSkgOiAnJwrGAQoPZHVyYXRpb24uZ3RfbHRlGrIBaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRlXSkgOiAnJwrOAQoZZHVyYXRpb24uZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAESjQgKA2d0ZRgGIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkLiB8JI3gcKiwEKDGR1cmF0aW9uLmd0ZRp7IWhhcyhydWxlcy5sdCkgJiYgIWhhcyhydWxlcy5sdGUpICYmIHRoaXMgPCBydWxlcy5ndGU/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGVdKSA6ICcnCsUBCg9kdXJhdGlvbi5ndGVfbHQasQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzQEKGWR1cmF0aW9uLmd0ZV9sdF9leGNsdXNpdmUarwFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0IDwgcnVsZXMuZ3RlICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0ZSwgcnVsZXMubHRdKSA6ICcnCtUBChBkdXJhdGlvbi5ndGVfbHRlGsABaGFzKHJ1bGVzLmx0ZSkgJiYgcnVsZXMubHRlID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+IHJ1bGVzLmx0ZSB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdGVdKSA6ICcnCt0BChpkdXJhdGlvbi5ndGVfbHRlX2V4Y2x1c2l2ZRq+AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARKdAQoCaW4YByADKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CdsJIcwpxCgtkdXJhdGlvbi5pbhpiISh0aGlzIGluIGdldEZpZWxkKHJ1bGVzLCAnaW4nKSkgPyAndmFsdWUgbXVzdCBiZSBpbiBsaXN0ICVzJy5mb3JtYXQoW2dldEZpZWxkKHJ1bGVzLCAnaW4nKV0pIDogJycSlAEKBm5vdF9pbhgIIAMoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkJpwkhmCmQKD2R1cmF0aW9uLm5vdF9pbhpRdGhpcyBpbiBydWxlcy5ub3RfaW4gPyAndmFsdWUgbXVzdCBub3QgYmUgaW4gbGlzdCAlcycuZm9ybWF0KFtydWxlcy5ub3RfaW5dKSA6ICcnEkkKB2V4YW1wbGUYCSADKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CHcJIGgoYChBkdXJhdGlvbi5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiKSGAoOVGltZXN0YW1wUnVsZXMSowEKBWNvbnN0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEJ4wkh1CnMKD3RpbWVzdGFtcC5jb25zdBpgdGhpcyAhPSBnZXRGaWVsZChydWxlcywgJ2NvbnN0JykgPyAndmFsdWUgbXVzdCBlcXVhbCAlcycuZm9ybWF0KFtnZXRGaWVsZChydWxlcywgJ2NvbnN0JyldKSA6ICcnEqsBCgJsdBgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCgAHCSH0KewoMdGltZXN0YW1wLmx0GmshaGFzKHJ1bGVzLmd0ZSkgJiYgIWhhcyhydWxlcy5ndCkgJiYgdGhpcyA+PSBydWxlcy5sdD8gJ3ZhbHVlIG11c3QgYmUgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmx0XSkgOiAnJ0gAErwBCgNsdGUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQpABwkiMAQqJAQoNdGltZXN0YW1wLmx0ZRp4IWhhcyhydWxlcy5ndGUpICYmICFoYXMocnVsZXMuZ3QpICYmIHRoaXMgPiBydWxlcy5sdGU/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5sdGVdKSA6ICcnSAASbAoGbHRfbm93GAcgASgIQlrCSFcKVQoQdGltZXN0YW1wLmx0X25vdxpBKHJ1bGVzLmx0X25vdyAmJiB0aGlzID4gbm93KSA/ICd2YWx1ZSBtdXN0IGJlIGxlc3MgdGhhbiBub3cnIDogJydIABLHBwoCZ3QYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQpwHwkiYBwp+Cgx0aW1lc3RhbXAuZ3QabiFoYXMocnVsZXMubHQpICYmICFoYXMocnVsZXMubHRlKSAmJiB0aGlzIDw9IHJ1bGVzLmd0PyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RdKSA6ICcnCrcBCg90aW1lc3RhbXAuZ3RfbHQaowFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ICYmICh0aGlzID49IHJ1bGVzLmx0IHx8IHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgYW5kIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndCwgcnVsZXMubHRdKSA6ICcnCr8BChl0aW1lc3RhbXAuZ3RfbHRfZXhjbHVzaXZlGqEBaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdCA8PSB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdF0pIDogJycKxwEKEHRpbWVzdGFtcC5ndF9sdGUasgFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3QgJiYgKHRoaXMgPiBydWxlcy5sdGUgfHwgdGhpcyA8PSBydWxlcy5ndCk/ICd2YWx1ZSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAlcyBhbmQgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnCs8BChp0aW1lc3RhbXAuZ3RfbHRlX2V4Y2x1c2l2ZRqwAWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ICYmIChydWxlcy5sdGUgPCB0aGlzICYmIHRoaXMgPD0gcnVsZXMuZ3QpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gJXMgb3IgbGVzcyB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0LCBydWxlcy5sdGVdKSA6ICcnSAESkwgKA2d0ZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBC5wfCSOMHCowBCg10aW1lc3RhbXAuZ3RlGnshaGFzKHJ1bGVzLmx0KSAmJiAhaGFzKHJ1bGVzLmx0ZSkgJiYgdGhpcyA8IHJ1bGVzLmd0ZT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzJy5mb3JtYXQoW3J1bGVzLmd0ZV0pIDogJycKxgEKEHRpbWVzdGFtcC5ndGVfbHQasQFoYXMocnVsZXMubHQpICYmIHJ1bGVzLmx0ID49IHJ1bGVzLmd0ZSAmJiAodGhpcyA+PSBydWxlcy5sdCB8fCB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIGFuZCBsZXNzIHRoYW4gJXMnLmZvcm1hdChbcnVsZXMuZ3RlLCBydWxlcy5sdF0pIDogJycKzgEKGnRpbWVzdGFtcC5ndGVfbHRfZXhjbHVzaXZlGq8BaGFzKHJ1bGVzLmx0KSAmJiBydWxlcy5sdCA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHQgPD0gdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0XSkgOiAnJwrWAQoRdGltZXN0YW1wLmd0ZV9sdGUawAFoYXMocnVsZXMubHRlKSAmJiBydWxlcy5sdGUgPj0gcnVsZXMuZ3RlICYmICh0aGlzID4gcnVsZXMubHRlIHx8IHRoaXMgPCBydWxlcy5ndGUpPyAndmFsdWUgbXVzdCBiZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gJXMgYW5kIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJycK3gEKG3RpbWVzdGFtcC5ndGVfbHRlX2V4Y2x1c2l2ZRq+AWhhcyhydWxlcy5sdGUpICYmIHJ1bGVzLmx0ZSA8IHJ1bGVzLmd0ZSAmJiAocnVsZXMubHRlIDwgdGhpcyAmJiB0aGlzIDwgcnVsZXMuZ3RlKT8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG9yIGVxdWFsIHRvICVzIG9yIGxlc3MgdGhhbiBvciBlcXVhbCB0byAlcycuZm9ybWF0KFtydWxlcy5ndGUsIHJ1bGVzLmx0ZV0pIDogJydIARJvCgZndF9ub3cYCCABKAhCXcJIWgpYChB0aW1lc3RhbXAuZ3Rfbm93GkQocnVsZXMuZ3Rfbm93ICYmIHRoaXMgPCBub3cpID8gJ3ZhbHVlIG11c3QgYmUgZ3JlYXRlciB0aGFuIG5vdycgOiAnJ0gBErgBCgZ3aXRoaW4YCSABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CjAHCSIgBCoUBChB0aW1lc3RhbXAud2l0aGluGnF0aGlzIDwgbm93LXJ1bGVzLndpdGhpbiB8fCB0aGlzID4gbm93K3J1bGVzLndpdGhpbiA/ICd2YWx1ZSBtdXN0IGJlIHdpdGhpbiAlcyBvZiBub3cnLmZvcm1hdChbcnVsZXMud2l0aGluXSkgOiAnJxJLCgdleGFtcGxlGAogAygLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEIewkgbChkKEXRpbWVzdGFtcC5leGFtcGxlGgR0cnVlKgkI6AcQgICAgAJCCwoJbGVzc190aGFuQg4KDGdyZWF0ZXJfdGhhbiI5CgpWaW9sYXRpb25zEisKCnZpb2xhdGlvbnMYASADKAsyFy5idWYudmFsaWRhdGUuVmlvbGF0aW9uIp8BCglWaW9sYXRpb24SJgoFZmllbGQYBSABKAsyFy5idWYudmFsaWRhdGUuRmllbGRQYXRoEiUKBHJ1bGUYBiABKAsyFy5idWYudmFsaWRhdGUuRmllbGRQYXRoEg8KB3J1bGVfaWQYAiABKAkSDwoHbWVzc2FnZRgDIAEoCRIPCgdmb3Jfa2V5GAQgASgISgQIARACUgpmaWVsZF9wYXRoIj0KCUZpZWxkUGF0aBIwCghlbGVtZW50cxgBIAMoCzIeLmJ1Zi52YWxpZGF0ZS5GaWVsZFBhdGhFbGVtZW50IukCChBGaWVsZFBhdGhFbGVtZW50EhQKDGZpZWxkX251bWJlchgBIAEoBRISCgpmaWVsZF9uYW1lGAIgASgJEj4KCmZpZWxkX3R5cGUYAyABKA4yKi5nb29nbGUucHJvdG9idWYuRmllbGREZXNjcmlwdG9yUHJvdG8uVHlwZRI8CghrZXlfdHlwZRgEIAEoDjIqLmdvb2dsZS5wcm90b2J1Zi5GaWVsZERlc2NyaXB0b3JQcm90by5UeXBlEj4KCnZhbHVlX3R5cGUYBSABKA4yKi5nb29nbGUucHJvdG9idWYuRmllbGREZXNjcmlwdG9yUHJvdG8uVHlwZRIPCgVpbmRleBgGIAEoBEgAEhIKCGJvb2xfa2V5GAcgASgISAASEQoHaW50X2tleRgIIAEoA0gAEhIKCHVpbnRfa2V5GAkgASgESAASFAoKc3RyaW5nX2tleRgKIAEoCUgAQgsKCXN1YnNjcmlwdCqhAQoGSWdub3JlEhYKEklHTk9SRV9VTlNQRUNJRklFRBAAEhgKFElHTk9SRV9JRl9aRVJPX1ZBTFVFEAESEQoNSUdOT1JFX0FMV0FZUxADIgQIAhACKgxJR05PUkVfRU1QVFkqDklHTk9SRV9ERUZBVUxUKhdJR05PUkVfSUZfREVGQVVMVF9WQUxVRSoVSUdOT1JFX0lGX1VOUE9QVUxBVEVEKm4KCktub3duUmVnZXgSGwoXS05PV05fUkVHRVhfVU5TUEVDSUZJRUQQABIgChxLTk9XTl9SRUdFWF9IVFRQX0hFQURFUl9OQU1FEAESIQodS05PV05fUkVHRVhfSFRUUF9IRUFERVJfVkFMVUUQAjpWCgdtZXNzYWdlEh8uZ29vZ2xlLnByb3RvYnVmLk1lc3NhZ2VPcHRpb25zGIcJIAEoCzIaLmJ1Zi52YWxpZGF0ZS5NZXNzYWdlUnVsZXNSB21lc3NhZ2U6TgoFb25lb2YSHS5nb29nbGUucHJvdG9idWYuT25lb2ZPcHRpb25zGIcJIAEoCzIYLmJ1Zi52YWxpZGF0ZS5PbmVvZlJ1bGVzUgVvbmVvZjpOCgVmaWVsZBIdLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE9wdGlvbnMYhwkgASgLMhguYnVmLnZhbGlkYXRlLkZpZWxkUnVsZXNSBWZpZWxkOl0KCnByZWRlZmluZWQSHS5nb29nbGUucHJvdG9idWYuRmllbGRPcHRpb25zGIgJIAEoCzIdLmJ1Zi52YWxpZGF0ZS5QcmVkZWZpbmVkUnVsZXNSCnByZWRlZmluZWRCuwEKEGNvbS5idWYudmFsaWRhdGVCDVZhbGlkYXRlUHJvdG9QAVpHYnVmLmJ1aWxkL2dlbi9nby9idWZidWlsZC9wcm90b3ZhbGlkYXRlL3Byb3RvY29sYnVmZmVycy9nby9idWYvdmFsaWRhdGWiAgNCVliqAgxCdWYuVmFsaWRhdGXKAgxCdWZcVmFsaWRhdGXiAhhCdWZcVmFsaWRhdGVcR1BCTWV0YWRhdGHqAg1CdWY6OlZhbGlkYXRl", [file_google_protobuf_descriptor, file_google_protobuf_duration, file_google_protobuf_timestamp]);
 
 /**
  * `Rule` represents a validation rule written in the Common Expression
@@ -91,30 +91,6 @@ export const RuleSchema: GenMessage<Rule> = /*@__PURE__*/
  * @generated from message buf.validate.MessageRules
  */
 export type MessageRules = Message<"buf.validate.MessageRules"> & {
-  /**
-   * `cel_expression` is a repeated field CEL expressions. Each expression specifies a validation
-   * rule to be applied to this message. These rules are written in Common Expression Language (CEL) syntax.
-   *
-   * This is a simplified form of the `cel` Rule field, where only `expression` is set. This allows for
-   * simpler syntax when defining CEL Rules where `id` and `message` derived from the `expression`. `id` will
-   * be same as the `expression`.
-   *
-   * For more information, [see our documentation](https://buf.build/docs/protovalidate/schemas/custom-rules/).
-   *
-   * ```proto
-   * message MyMessage {
-   *   // The field `foo` must be greater than 42.
-   *   option (buf.validate.message).cel_expression = "this.foo > 42";
-   *   // The field `foo` must be less than 84.
-   *   option (buf.validate.message).cel_expression = "this.foo < 84";
-   *   optional int32 foo = 1;
-   * }
-   * ```
-   *
-   * @generated from field: repeated string cel_expression = 5;
-   */
-  celExpression: string[];
-
   /**
    * `cel` is a repeated field of type Rule. Each Rule specifies a validation rule to be applied to this message.
    * These rules are written in Common Expression Language (CEL) syntax. For more information,
@@ -257,27 +233,6 @@ export const OneofRulesSchema: GenMessage<OneofRules> = /*@__PURE__*/
  * @generated from message buf.validate.FieldRules
  */
 export type FieldRules = Message<"buf.validate.FieldRules"> & {
-  /**
-   * `cel_expression` is a repeated field CEL expressions. Each expression specifies a validation
-   * rule to be applied to this message. These rules are written in Common Expression Language (CEL) syntax.
-   *
-   * This is a simplified form of the `cel` Rule field, where only `expression` is set. This allows for
-   * simpler syntax when defining CEL Rules where `id` and `message` derived from the `expression`. `id` will
-   * be same as the `expression`.
-   *
-   * For more information, [see our documentation](https://buf.build/docs/protovalidate/schemas/custom-rules/).
-   *
-   * ```proto
-   * message MyMessage {
-   *   // The field `value` must be greater than 42.
-   *   optional int32 value = 1 [(buf.validate.field).cel_expression = "this > 42"];
-   * }
-   * ```
-   *
-   * @generated from field: repeated string cel_expression = 29;
-   */
-  celExpression: string[];
-
   /**
    * `cel` is a repeated field used to represent a textual expression
    * in the Common Expression Language (CEL) syntax. For more information,
@@ -507,12 +462,6 @@ export type FieldRules = Message<"buf.validate.FieldRules"> & {
      */
     value: DurationRules;
     case: "duration";
-  } | {
-    /**
-     * @generated from field: buf.validate.FieldMaskRules field_mask = 28;
-     */
-    value: FieldMaskRules;
-    case: "fieldMask";
   } | {
     /**
      * @generated from field: buf.validate.TimestampRules timestamp = 22;
@@ -3297,23 +3246,6 @@ export type StringRules = Message<"buf.validate.StringRules"> & {
      */
     value: boolean;
     case: "hostAndPort";
-  } | {
-    /**
-     * `ulid` specifies that the field value must be a valid ULID (Universally Unique
-     * Lexicographically Sortable Identifier) as defined by the [ULID specification](https://github.com/ulid/spec).
-     * If the field value isn't a valid ULID, an error message will be generated.
-     *
-     * ```proto
-     * message MyString {
-     *   // value must be a valid ULID
-     *   string value = 1 [(buf.validate.field).string.ulid = true];
-     * }
-     * ```
-     *
-     * @generated from field: bool ulid = 35;
-     */
-    value: boolean;
-    case: "ulid";
   } | {
     /**
      * `well_known_regex` specifies a common well-known pattern
@@ -3511,7 +3443,7 @@ export type BytesRules = Message<"buf.validate.BytesRules"> & {
    * the string.
    * If the field value doesn't meet the requirement, an error message is generated.
    *
-   * ```proto
+   * ```protobuf
    * message MyBytes {
    *   // value does not contain \x02\x03
    *   optional bytes value = 1 [(buf.validate.field).bytes.contains = "\x02\x03"];
@@ -3527,7 +3459,7 @@ export type BytesRules = Message<"buf.validate.BytesRules"> & {
    * values. If the field value doesn't match any of the specified values, an
    * error message is generated.
    *
-   * ```proto
+   * ```protobuf
    * message MyBytes {
    *   // value must in ["\x01\x02", "\x02\x03", "\x03\x04"]
    *   optional bytes value = 1 [(buf.validate.field).bytes.in = {"\x01\x02", "\x02\x03", "\x03\x04"}];
@@ -3608,25 +3540,6 @@ export type BytesRules = Message<"buf.validate.BytesRules"> & {
      */
     value: boolean;
     case: "ipv6";
-  } | {
-    /**
-     * `uuid` ensures that the field `value` encodes the 128-bit UUID data as
-     * defined by [RFC 4122](https://datatracker.ietf.org/doc/html/rfc4122#section-4.1.2).
-     * The field must contain exactly 16 bytes
-     * representing the UUID. If the field value isn't a valid UUID, an error
-     * message will be generated.
-     *
-     * ```proto
-     * message MyBytes {
-     *   // value must be a valid UUID
-     *   optional bytes value = 1 [(buf.validate.field).bytes.uuid = true];
-     * }
-     * ```
-     *
-     * @generated from field: bool uuid = 15;
-     */
-    value: boolean;
-    case: "uuid";
   } | { case: undefined; value?: undefined };
 
   /**
@@ -4175,96 +4088,6 @@ export type DurationRules = Message<"buf.validate.DurationRules"> & {
 export const DurationRulesSchema: GenMessage<DurationRules> = /*@__PURE__*/
   messageDesc(file_buf_validate_validate, 25);
 
-/**
- * FieldMaskRules describe rules applied exclusively to the `google.protobuf.FieldMask` well-known type.
- *
- * @generated from message buf.validate.FieldMaskRules
- */
-export type FieldMaskRules = Message<"buf.validate.FieldMaskRules"> & {
-  /**
-   * `const` dictates that the field must match the specified value of the `google.protobuf.FieldMask` type exactly.
-   * If the field's value deviates from the specified value, an error message
-   * will be generated.
-   *
-   * ```proto
-   * message MyFieldMask {
-   *   // value must equal ["a"]
-   *   google.protobuf.FieldMask value = 1 [(buf.validate.field).field_mask.const = {
-   *       paths: ["a"]
-   *   }];
-   * }
-   * ```
-   *
-   * @generated from field: optional google.protobuf.FieldMask const = 1;
-   */
-  const?: FieldMask;
-
-  /**
-   * `in` requires the field value to only contain paths matching specified
-   * values or their subpaths.
-   * If any of the field value's paths doesn't match the rule,
-   * an error message is generated.
-   * See: https://protobuf.dev/reference/protobuf/google.protobuf/#field-mask
-   *
-   * ```proto
-   * message MyFieldMask {
-   *   //  The `value` FieldMask must only contain paths listed in `in`.
-   *   google.protobuf.FieldMask value = 1 [(buf.validate.field).field_mask = {
-   *       in: ["a", "b", "c.a"]
-   *   }];
-   * }
-   * ```
-   *
-   * @generated from field: repeated string in = 2;
-   */
-  in: string[];
-
-  /**
-   * `not_in` requires the field value to not contain paths matching specified
-   * values or their subpaths.
-   * If any of the field value's paths matches the rule,
-   * an error message is generated.
-   * See: https://protobuf.dev/reference/protobuf/google.protobuf/#field-mask
-   *
-   * ```proto
-   * message MyFieldMask {
-   *   //  The `value` FieldMask shall not contain paths listed in `not_in`.
-   *   google.protobuf.FieldMask value = 1 [(buf.validate.field).field_mask = {
-   *       not_in: ["forbidden", "immutable", "c.a"]
-   *   }];
-   * }
-   * ```
-   *
-   * @generated from field: repeated string not_in = 3;
-   */
-  notIn: string[];
-
-  /**
-   * `example` specifies values that the field may have. These values SHOULD
-   * conform to other rules. `example` values will not impact validation
-   * but may be used as helpful guidance on how to populate the given field.
-   *
-   * ```proto
-   * message MyFieldMask {
-   *   google.protobuf.FieldMask value = 1 [
-   *     (buf.validate.field).field_mask.example = { paths: ["a", "b"] },
-   *     (buf.validate.field).field_mask.example = { paths: ["c.a", "d"] },
-   *   ];
-   * }
-   * ```
-   *
-   * @generated from field: repeated google.protobuf.FieldMask example = 4;
-   */
-  example: FieldMask[];
-};
-
-/**
- * Describes the message buf.validate.FieldMaskRules.
- * Use `create(FieldMaskRulesSchema)` to create a new message.
- */
-export const FieldMaskRulesSchema: GenMessage<FieldMaskRules> = /*@__PURE__*/
-  messageDesc(file_buf_validate_validate, 26);
-
 /**
  * TimestampRules describe the rules applied exclusively to the `google.protobuf.Timestamp` well-known type.
  *
@@ -4443,7 +4266,7 @@ export type TimestampRules = Message<"buf.validate.TimestampRules"> & {
  * Use `create(TimestampRulesSchema)` to create a new message.
  */
 export const TimestampRulesSchema: GenMessage<TimestampRules> = /*@__PURE__*/
-  messageDesc(file_buf_validate_validate, 27);
+  messageDesc(file_buf_validate_validate, 26);
 
 /**
  * `Violations` is a collection of `Violation` messages. This message type is returned by
@@ -4466,7 +4289,7 @@ export type Violations = Message<"buf.validate.Violations"> & {
  * Use `create(ViolationsSchema)` to create a new message.
  */
 export const ViolationsSchema: GenMessage<Violations> = /*@__PURE__*/
-  messageDesc(file_buf_validate_validate, 28);
+  messageDesc(file_buf_validate_validate, 27);
 
 /**
  * `Violation` represents a single instance where a validation rule, expressed
@@ -4604,7 +4427,7 @@ export type Violation = Message<"buf.validate.Violation"> & {
  * Use `create(ViolationSchema)` to create a new message.
  */
 export const ViolationSchema: GenMessage<Violation> = /*@__PURE__*/
-  messageDesc(file_buf_validate_validate, 29);
+  messageDesc(file_buf_validate_validate, 28);
 
 /**
  * `FieldPath` provides a path to a nested protobuf field.
@@ -4628,7 +4451,7 @@ export type FieldPath = Message<"buf.validate.FieldPath"> & {
  * Use `create(FieldPathSchema)` to create a new message.
  */
 export const FieldPathSchema: GenMessage<FieldPath> = /*@__PURE__*/
-  messageDesc(file_buf_validate_validate, 30);
+  messageDesc(file_buf_validate_validate, 29);
 
 /**
  * `FieldPathElement` provides enough information to nest through a single protobuf field.
@@ -4741,7 +4564,7 @@ export type FieldPathElement = Message<"buf.validate.FieldPathElement"> & {
  * Use `create(FieldPathElementSchema)` to create a new message.
  */
 export const FieldPathElementSchema: GenMessage<FieldPathElement> = /*@__PURE__*/
-  messageDesc(file_buf_validate_validate, 31);
+  messageDesc(file_buf_validate_validate, 30);
 
 /**
  * Specifies how `FieldRules.ignore` behaves, depending on the field's value, and
diff --git a/frontend/src/protogen/google/api/client_pb.ts b/frontend/src/protogen/google/api/client_pb.ts
new file mode 100644
index 0000000000..4b6d969616
--- /dev/null
+++ b/frontend/src/protogen/google/api/client_pb.ts
@@ -0,0 +1,953 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file google/api/client.proto (package google.api, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenExtension, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, extDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import type { LaunchStage } from "./launch_stage_pb";
+import { file_google_api_launch_stage } from "./launch_stage_pb";
+import type { Duration, MethodOptions, ServiceOptions } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_descriptor, file_google_protobuf_duration } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file google/api/client.proto.
+ */
+export const file_google_api_client: GenFile = /*@__PURE__*/
+  fileDesc("Chdnb29nbGUvYXBpL2NsaWVudC5wcm90bxIKZ29vZ2xlLmFwaSK+AQoWQ29tbW9uTGFuZ3VhZ2VTZXR0aW5ncxIeChJyZWZlcmVuY2VfZG9jc191cmkYASABKAlCAhgBEjoKDGRlc3RpbmF0aW9ucxgCIAMoDjIkLmdvb2dsZS5hcGkuQ2xpZW50TGlicmFyeURlc3RpbmF0aW9uEkgKGnNlbGVjdGl2ZV9nYXBpY19nZW5lcmF0aW9uGAMgASgLMiQuZ29vZ2xlLmFwaS5TZWxlY3RpdmVHYXBpY0dlbmVyYXRpb24i+wMKFUNsaWVudExpYnJhcnlTZXR0aW5ncxIPCgd2ZXJzaW9uGAEgASgJEi0KDGxhdW5jaF9zdGFnZRgCIAEoDjIXLmdvb2dsZS5hcGkuTGF1bmNoU3RhZ2USGgoScmVzdF9udW1lcmljX2VudW1zGAMgASgIEi8KDWphdmFfc2V0dGluZ3MYFSABKAsyGC5nb29nbGUuYXBpLkphdmFTZXR0aW5ncxItCgxjcHBfc2V0dGluZ3MYFiABKAsyFy5nb29nbGUuYXBpLkNwcFNldHRpbmdzEi0KDHBocF9zZXR0aW5ncxgXIAEoCzIXLmdvb2dsZS5hcGkuUGhwU2V0dGluZ3MSMwoPcHl0aG9uX3NldHRpbmdzGBggASgLMhouZ29vZ2xlLmFwaS5QeXRob25TZXR0aW5ncxIvCg1ub2RlX3NldHRpbmdzGBkgASgLMhguZ29vZ2xlLmFwaS5Ob2RlU2V0dGluZ3MSMwoPZG90bmV0X3NldHRpbmdzGBogASgLMhouZ29vZ2xlLmFwaS5Eb3RuZXRTZXR0aW5ncxIvCg1ydWJ5X3NldHRpbmdzGBsgASgLMhguZ29vZ2xlLmFwaS5SdWJ5U2V0dGluZ3MSKwoLZ29fc2V0dGluZ3MYHCABKAsyFi5nb29nbGUuYXBpLkdvU2V0dGluZ3MiqAMKClB1Ymxpc2hpbmcSMwoPbWV0aG9kX3NldHRpbmdzGAIgAygLMhouZ29vZ2xlLmFwaS5NZXRob2RTZXR0aW5ncxIVCg1uZXdfaXNzdWVfdXJpGGUgASgJEhkKEWRvY3VtZW50YXRpb25fdXJpGGYgASgJEhYKDmFwaV9zaG9ydF9uYW1lGGcgASgJEhQKDGdpdGh1Yl9sYWJlbBhoIAEoCRIeChZjb2Rlb3duZXJfZ2l0aHViX3RlYW1zGGkgAygJEhYKDmRvY190YWdfcHJlZml4GGogASgJEjsKDG9yZ2FuaXphdGlvbhhrIAEoDjIlLmdvb2dsZS5hcGkuQ2xpZW50TGlicmFyeU9yZ2FuaXphdGlvbhI7ChBsaWJyYXJ5X3NldHRpbmdzGG0gAygLMiEuZ29vZ2xlLmFwaS5DbGllbnRMaWJyYXJ5U2V0dGluZ3MSKQohcHJvdG9fcmVmZXJlbmNlX2RvY3VtZW50YXRpb25fdXJpGG4gASgJEigKIHJlc3RfcmVmZXJlbmNlX2RvY3VtZW50YXRpb25fdXJpGG8gASgJIuMBCgxKYXZhU2V0dGluZ3MSFwoPbGlicmFyeV9wYWNrYWdlGAEgASgJEkwKE3NlcnZpY2VfY2xhc3NfbmFtZXMYAiADKAsyLy5nb29nbGUuYXBpLkphdmFTZXR0aW5ncy5TZXJ2aWNlQ2xhc3NOYW1lc0VudHJ5EjIKBmNvbW1vbhgDIAEoCzIiLmdvb2dsZS5hcGkuQ29tbW9uTGFuZ3VhZ2VTZXR0aW5ncxo4ChZTZXJ2aWNlQ2xhc3NOYW1lc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiQQoLQ3BwU2V0dGluZ3MSMgoGY29tbW9uGAEgASgLMiIuZ29vZ2xlLmFwaS5Db21tb25MYW5ndWFnZVNldHRpbmdzIkEKC1BocFNldHRpbmdzEjIKBmNvbW1vbhgBIAEoCzIiLmdvb2dsZS5hcGkuQ29tbW9uTGFuZ3VhZ2VTZXR0aW5ncyKbAgoOUHl0aG9uU2V0dGluZ3MSMgoGY29tbW9uGAEgASgLMiIuZ29vZ2xlLmFwaS5Db21tb25MYW5ndWFnZVNldHRpbmdzEk4KFWV4cGVyaW1lbnRhbF9mZWF0dXJlcxgCIAEoCzIvLmdvb2dsZS5hcGkuUHl0aG9uU2V0dGluZ3MuRXhwZXJpbWVudGFsRmVhdHVyZXMahAEKFEV4cGVyaW1lbnRhbEZlYXR1cmVzEh0KFXJlc3RfYXN5bmNfaW9fZW5hYmxlZBgBIAEoCBInCh9wcm90b2J1Zl9weXRob25pY190eXBlc19lbmFibGVkGAIgASgIEiQKHHVudmVyc2lvbmVkX3BhY2thZ2VfZGlzYWJsZWQYAyABKAgiQgoMTm9kZVNldHRpbmdzEjIKBmNvbW1vbhgBIAEoCzIiLmdvb2dsZS5hcGkuQ29tbW9uTGFuZ3VhZ2VTZXR0aW5ncyKqAwoORG90bmV0U2V0dGluZ3MSMgoGY29tbW9uGAEgASgLMiIuZ29vZ2xlLmFwaS5Db21tb25MYW5ndWFnZVNldHRpbmdzEkkKEHJlbmFtZWRfc2VydmljZXMYAiADKAsyLy5nb29nbGUuYXBpLkRvdG5ldFNldHRpbmdzLlJlbmFtZWRTZXJ2aWNlc0VudHJ5EksKEXJlbmFtZWRfcmVzb3VyY2VzGAMgAygLMjAuZ29vZ2xlLmFwaS5Eb3RuZXRTZXR0aW5ncy5SZW5hbWVkUmVzb3VyY2VzRW50cnkSGQoRaWdub3JlZF9yZXNvdXJjZXMYBCADKAkSIAoYZm9yY2VkX25hbWVzcGFjZV9hbGlhc2VzGAUgAygJEh4KFmhhbmR3cml0dGVuX3NpZ25hdHVyZXMYBiADKAkaNgoUUmVuYW1lZFNlcnZpY2VzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ARo3ChVSZW5hbWVkUmVzb3VyY2VzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJCCgxSdWJ5U2V0dGluZ3MSMgoGY29tbW9uGAEgASgLMiIuZ29vZ2xlLmFwaS5Db21tb25MYW5ndWFnZVNldHRpbmdzIr8BCgpHb1NldHRpbmdzEjIKBmNvbW1vbhgBIAEoCzIiLmdvb2dsZS5hcGkuQ29tbW9uTGFuZ3VhZ2VTZXR0aW5ncxJFChByZW5hbWVkX3NlcnZpY2VzGAIgAygLMisuZ29vZ2xlLmFwaS5Hb1NldHRpbmdzLlJlbmFtZWRTZXJ2aWNlc0VudHJ5GjYKFFJlbmFtZWRTZXJ2aWNlc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEizwIKDk1ldGhvZFNldHRpbmdzEhAKCHNlbGVjdG9yGAEgASgJEjwKDGxvbmdfcnVubmluZxgCIAEoCzImLmdvb2dsZS5hcGkuTWV0aG9kU2V0dGluZ3MuTG9uZ1J1bm5pbmcSHQoVYXV0b19wb3B1bGF0ZWRfZmllbGRzGAMgAygJGs0BCgtMb25nUnVubmluZxI1ChJpbml0aWFsX3BvbGxfZGVsYXkYASABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24SHQoVcG9sbF9kZWxheV9tdWx0aXBsaWVyGAIgASgCEjEKDm1heF9wb2xsX2RlbGF5GAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uEjUKEnRvdGFsX3BvbGxfdGltZW91dBgEIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbiJRChhTZWxlY3RpdmVHYXBpY0dlbmVyYXRpb24SDwoHbWV0aG9kcxgBIAMoCRIkChxnZW5lcmF0ZV9vbWl0dGVkX2FzX2ludGVybmFsGAIgASgIKqMBChlDbGllbnRMaWJyYXJ5T3JnYW5pemF0aW9uEisKJ0NMSUVOVF9MSUJSQVJZX09SR0FOSVpBVElPTl9VTlNQRUNJRklFRBAAEgkKBUNMT1VEEAESBwoDQURTEAISCgoGUEhPVE9TEAMSDwoLU1RSRUVUX1ZJRVcQBBIMCghTSE9QUElORxAFEgcKA0dFTxAGEhEKDUdFTkVSQVRJVkVfQUkQBypnChhDbGllbnRMaWJyYXJ5RGVzdGluYXRpb24SKgomQ0xJRU5UX0xJQlJBUllfREVTVElOQVRJT05fVU5TUEVDSUZJRUQQABIKCgZHSVRIVUIQChITCg9QQUNLQUdFX01BTkFHRVIQFDpKChBtZXRob2Rfc2lnbmF0dXJlEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYmwggAygJUg9tZXRob2RTaWduYXR1cmU6QwoMZGVmYXVsdF9ob3N0Eh8uZ29vZ2xlLnByb3RvYnVmLlNlcnZpY2VPcHRpb25zGJkIIAEoCVILZGVmYXVsdEhvc3Q6QwoMb2F1dGhfc2NvcGVzEh8uZ29vZ2xlLnByb3RvYnVmLlNlcnZpY2VPcHRpb25zGJoIIAEoCVILb2F1dGhTY29wZXM6RAoLYXBpX3ZlcnNpb24SHy5nb29nbGUucHJvdG9idWYuU2VydmljZU9wdGlvbnMYwbqr+gEgASgJUgphcGlWZXJzaW9uQqkBCg5jb20uZ29vZ2xlLmFwaUILQ2xpZW50UHJvdG9QAVpBZ29vZ2xlLmdvbGFuZy5vcmcvZ2VucHJvdG8vZ29vZ2xlYXBpcy9hcGkvYW5ub3RhdGlvbnM7YW5ub3RhdGlvbnOiAgNHQViqAgpHb29nbGUuQXBpygIKR29vZ2xlXEFwaeICFkdvb2dsZVxBcGlcR1BCTWV0YWRhdGHqAgtHb29nbGU6OkFwaWIGcHJvdG8z", [file_google_api_launch_stage, file_google_protobuf_descriptor, file_google_protobuf_duration]);
+
+/**
+ * Required information for every language.
+ *
+ * @generated from message google.api.CommonLanguageSettings
+ */
+export type CommonLanguageSettings = Message<"google.api.CommonLanguageSettings"> & {
+  /**
+   * Link to automatically generated reference documentation.  Example:
+   * https://cloud.google.com/nodejs/docs/reference/asset/latest
+   *
+   * @generated from field: string reference_docs_uri = 1 [deprecated = true];
+   * @deprecated
+   */
+  referenceDocsUri: string;
+
+  /**
+   * The destination where API teams want this client library to be published.
+   *
+   * @generated from field: repeated google.api.ClientLibraryDestination destinations = 2;
+   */
+  destinations: ClientLibraryDestination[];
+
+  /**
+   * Configuration for which RPCs should be generated in the GAPIC client.
+   *
+   * @generated from field: google.api.SelectiveGapicGeneration selective_gapic_generation = 3;
+   */
+  selectiveGapicGeneration?: SelectiveGapicGeneration;
+};
+
+/**
+ * Describes the message google.api.CommonLanguageSettings.
+ * Use `create(CommonLanguageSettingsSchema)` to create a new message.
+ */
+export const CommonLanguageSettingsSchema: GenMessage<CommonLanguageSettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 0);
+
+/**
+ * Details about how and where to publish client libraries.
+ *
+ * @generated from message google.api.ClientLibrarySettings
+ */
+export type ClientLibrarySettings = Message<"google.api.ClientLibrarySettings"> & {
+  /**
+   * Version of the API to apply these settings to. This is the full protobuf
+   * package for the API, ending in the version element.
+   * Examples: "google.cloud.speech.v1" and "google.spanner.admin.database.v1".
+   *
+   * @generated from field: string version = 1;
+   */
+  version: string;
+
+  /**
+   * Launch stage of this version of the API.
+   *
+   * @generated from field: google.api.LaunchStage launch_stage = 2;
+   */
+  launchStage: LaunchStage;
+
+  /**
+   * When using transport=rest, the client request will encode enums as
+   * numbers rather than strings.
+   *
+   * @generated from field: bool rest_numeric_enums = 3;
+   */
+  restNumericEnums: boolean;
+
+  /**
+   * Settings for legacy Java features, supported in the Service YAML.
+   *
+   * @generated from field: google.api.JavaSettings java_settings = 21;
+   */
+  javaSettings?: JavaSettings;
+
+  /**
+   * Settings for C++ client libraries.
+   *
+   * @generated from field: google.api.CppSettings cpp_settings = 22;
+   */
+  cppSettings?: CppSettings;
+
+  /**
+   * Settings for PHP client libraries.
+   *
+   * @generated from field: google.api.PhpSettings php_settings = 23;
+   */
+  phpSettings?: PhpSettings;
+
+  /**
+   * Settings for Python client libraries.
+   *
+   * @generated from field: google.api.PythonSettings python_settings = 24;
+   */
+  pythonSettings?: PythonSettings;
+
+  /**
+   * Settings for Node client libraries.
+   *
+   * @generated from field: google.api.NodeSettings node_settings = 25;
+   */
+  nodeSettings?: NodeSettings;
+
+  /**
+   * Settings for .NET client libraries.
+   *
+   * @generated from field: google.api.DotnetSettings dotnet_settings = 26;
+   */
+  dotnetSettings?: DotnetSettings;
+
+  /**
+   * Settings for Ruby client libraries.
+   *
+   * @generated from field: google.api.RubySettings ruby_settings = 27;
+   */
+  rubySettings?: RubySettings;
+
+  /**
+   * Settings for Go client libraries.
+   *
+   * @generated from field: google.api.GoSettings go_settings = 28;
+   */
+  goSettings?: GoSettings;
+};
+
+/**
+ * Describes the message google.api.ClientLibrarySettings.
+ * Use `create(ClientLibrarySettingsSchema)` to create a new message.
+ */
+export const ClientLibrarySettingsSchema: GenMessage<ClientLibrarySettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 1);
+
+/**
+ * This message configures the settings for publishing [Google Cloud Client
+ * libraries](https://cloud.google.com/apis/docs/cloud-client-libraries)
+ * generated from the service config.
+ *
+ * @generated from message google.api.Publishing
+ */
+export type Publishing = Message<"google.api.Publishing"> & {
+  /**
+   * A list of API method settings, e.g. the behavior for methods that use the
+   * long-running operation pattern.
+   *
+   * @generated from field: repeated google.api.MethodSettings method_settings = 2;
+   */
+  methodSettings: MethodSettings[];
+
+  /**
+   * Link to a *public* URI where users can report issues.  Example:
+   * https://issuetracker.google.com/issues/new?component=190865&template=1161103
+   *
+   * @generated from field: string new_issue_uri = 101;
+   */
+  newIssueUri: string;
+
+  /**
+   * Link to product home page.  Example:
+   * https://cloud.google.com/asset-inventory/docs/overview
+   *
+   * @generated from field: string documentation_uri = 102;
+   */
+  documentationUri: string;
+
+  /**
+   * Used as a tracking tag when collecting data about the APIs developer
+   * relations artifacts like docs, packages delivered to package managers,
+   * etc.  Example: "speech".
+   *
+   * @generated from field: string api_short_name = 103;
+   */
+  apiShortName: string;
+
+  /**
+   * GitHub label to apply to issues and pull requests opened for this API.
+   *
+   * @generated from field: string github_label = 104;
+   */
+  githubLabel: string;
+
+  /**
+   * GitHub teams to be added to CODEOWNERS in the directory in GitHub
+   * containing source code for the client libraries for this API.
+   *
+   * @generated from field: repeated string codeowner_github_teams = 105;
+   */
+  codeownerGithubTeams: string[];
+
+  /**
+   * A prefix used in sample code when demarking regions to be included in
+   * documentation.
+   *
+   * @generated from field: string doc_tag_prefix = 106;
+   */
+  docTagPrefix: string;
+
+  /**
+   * For whom the client library is being published.
+   *
+   * @generated from field: google.api.ClientLibraryOrganization organization = 107;
+   */
+  organization: ClientLibraryOrganization;
+
+  /**
+   * Client library settings.  If the same version string appears multiple
+   * times in this list, then the last one wins.  Settings from earlier
+   * settings with the same version string are discarded.
+   *
+   * @generated from field: repeated google.api.ClientLibrarySettings library_settings = 109;
+   */
+  librarySettings: ClientLibrarySettings[];
+
+  /**
+   * Optional link to proto reference documentation.  Example:
+   * https://cloud.google.com/pubsub/lite/docs/reference/rpc
+   *
+   * @generated from field: string proto_reference_documentation_uri = 110;
+   */
+  protoReferenceDocumentationUri: string;
+
+  /**
+   * Optional link to REST reference documentation.  Example:
+   * https://cloud.google.com/pubsub/lite/docs/reference/rest
+   *
+   * @generated from field: string rest_reference_documentation_uri = 111;
+   */
+  restReferenceDocumentationUri: string;
+};
+
+/**
+ * Describes the message google.api.Publishing.
+ * Use `create(PublishingSchema)` to create a new message.
+ */
+export const PublishingSchema: GenMessage<Publishing> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 2);
+
+/**
+ * Settings for Java client libraries.
+ *
+ * @generated from message google.api.JavaSettings
+ */
+export type JavaSettings = Message<"google.api.JavaSettings"> & {
+  /**
+   * The package name to use in Java. Clobbers the java_package option
+   * set in the protobuf. This should be used **only** by APIs
+   * who have already set the language_settings.java.package_name" field
+   * in gapic.yaml. API teams should use the protobuf java_package option
+   * where possible.
+   *
+   * Example of a YAML configuration::
+   *
+   *  publishing:
+   *    java_settings:
+   *      library_package: com.google.cloud.pubsub.v1
+   *
+   * @generated from field: string library_package = 1;
+   */
+  libraryPackage: string;
+
+  /**
+   * Configure the Java class name to use instead of the service's for its
+   * corresponding generated GAPIC client. Keys are fully-qualified
+   * service names as they appear in the protobuf (including the full
+   * the language_settings.java.interface_names" field in gapic.yaml. API
+   * teams should otherwise use the service name as it appears in the
+   * protobuf.
+   *
+   * Example of a YAML configuration::
+   *
+   *  publishing:
+   *    java_settings:
+   *      service_class_names:
+   *        - google.pubsub.v1.Publisher: TopicAdmin
+   *        - google.pubsub.v1.Subscriber: SubscriptionAdmin
+   *
+   * @generated from field: map<string, string> service_class_names = 2;
+   */
+  serviceClassNames: { [key: string]: string };
+
+  /**
+   * Some settings.
+   *
+   * @generated from field: google.api.CommonLanguageSettings common = 3;
+   */
+  common?: CommonLanguageSettings;
+};
+
+/**
+ * Describes the message google.api.JavaSettings.
+ * Use `create(JavaSettingsSchema)` to create a new message.
+ */
+export const JavaSettingsSchema: GenMessage<JavaSettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 3);
+
+/**
+ * Settings for C++ client libraries.
+ *
+ * @generated from message google.api.CppSettings
+ */
+export type CppSettings = Message<"google.api.CppSettings"> & {
+  /**
+   * Some settings.
+   *
+   * @generated from field: google.api.CommonLanguageSettings common = 1;
+   */
+  common?: CommonLanguageSettings;
+};
+
+/**
+ * Describes the message google.api.CppSettings.
+ * Use `create(CppSettingsSchema)` to create a new message.
+ */
+export const CppSettingsSchema: GenMessage<CppSettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 4);
+
+/**
+ * Settings for Php client libraries.
+ *
+ * @generated from message google.api.PhpSettings
+ */
+export type PhpSettings = Message<"google.api.PhpSettings"> & {
+  /**
+   * Some settings.
+   *
+   * @generated from field: google.api.CommonLanguageSettings common = 1;
+   */
+  common?: CommonLanguageSettings;
+};
+
+/**
+ * Describes the message google.api.PhpSettings.
+ * Use `create(PhpSettingsSchema)` to create a new message.
+ */
+export const PhpSettingsSchema: GenMessage<PhpSettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 5);
+
+/**
+ * Settings for Python client libraries.
+ *
+ * @generated from message google.api.PythonSettings
+ */
+export type PythonSettings = Message<"google.api.PythonSettings"> & {
+  /**
+   * Some settings.
+   *
+   * @generated from field: google.api.CommonLanguageSettings common = 1;
+   */
+  common?: CommonLanguageSettings;
+
+  /**
+   * Experimental features to be included during client library generation.
+   *
+   * @generated from field: google.api.PythonSettings.ExperimentalFeatures experimental_features = 2;
+   */
+  experimentalFeatures?: PythonSettings_ExperimentalFeatures;
+};
+
+/**
+ * Describes the message google.api.PythonSettings.
+ * Use `create(PythonSettingsSchema)` to create a new message.
+ */
+export const PythonSettingsSchema: GenMessage<PythonSettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 6);
+
+/**
+ * Experimental features to be included during client library generation.
+ * These fields will be deprecated once the feature graduates and is enabled
+ * by default.
+ *
+ * @generated from message google.api.PythonSettings.ExperimentalFeatures
+ */
+export type PythonSettings_ExperimentalFeatures = Message<"google.api.PythonSettings.ExperimentalFeatures"> & {
+  /**
+   * Enables generation of asynchronous REST clients if `rest` transport is
+   * enabled. By default, asynchronous REST clients will not be generated.
+   * This feature will be enabled by default 1 month after launching the
+   * feature in preview packages.
+   *
+   * @generated from field: bool rest_async_io_enabled = 1;
+   */
+  restAsyncIoEnabled: boolean;
+
+  /**
+   * Enables generation of protobuf code using new types that are more
+   * Pythonic which are included in `protobuf>=5.29.x`. This feature will be
+   * enabled by default 1 month after launching the feature in preview
+   * packages.
+   *
+   * @generated from field: bool protobuf_pythonic_types_enabled = 2;
+   */
+  protobufPythonicTypesEnabled: boolean;
+
+  /**
+   * Disables generation of an unversioned Python package for this client
+   * library. This means that the module names will need to be versioned in
+   * import statements. For example `import google.cloud.library_v2` instead
+   * of `import google.cloud.library`.
+   *
+   * @generated from field: bool unversioned_package_disabled = 3;
+   */
+  unversionedPackageDisabled: boolean;
+};
+
+/**
+ * Describes the message google.api.PythonSettings.ExperimentalFeatures.
+ * Use `create(PythonSettings_ExperimentalFeaturesSchema)` to create a new message.
+ */
+export const PythonSettings_ExperimentalFeaturesSchema: GenMessage<PythonSettings_ExperimentalFeatures> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 6, 0);
+
+/**
+ * Settings for Node client libraries.
+ *
+ * @generated from message google.api.NodeSettings
+ */
+export type NodeSettings = Message<"google.api.NodeSettings"> & {
+  /**
+   * Some settings.
+   *
+   * @generated from field: google.api.CommonLanguageSettings common = 1;
+   */
+  common?: CommonLanguageSettings;
+};
+
+/**
+ * Describes the message google.api.NodeSettings.
+ * Use `create(NodeSettingsSchema)` to create a new message.
+ */
+export const NodeSettingsSchema: GenMessage<NodeSettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 7);
+
+/**
+ * Settings for Dotnet client libraries.
+ *
+ * @generated from message google.api.DotnetSettings
+ */
+export type DotnetSettings = Message<"google.api.DotnetSettings"> & {
+  /**
+   * Some settings.
+   *
+   * @generated from field: google.api.CommonLanguageSettings common = 1;
+   */
+  common?: CommonLanguageSettings;
+
+  /**
+   * Map from original service names to renamed versions.
+   * This is used when the default generated types
+   * would cause a naming conflict. (Neither name is
+   * fully-qualified.)
+   * Example: Subscriber to SubscriberServiceApi.
+   *
+   * @generated from field: map<string, string> renamed_services = 2;
+   */
+  renamedServices: { [key: string]: string };
+
+  /**
+   * Map from full resource types to the effective short name
+   * for the resource. This is used when otherwise resource
+   * named from different services would cause naming collisions.
+   * Example entry:
+   * "datalabeling.googleapis.com/Dataset": "DataLabelingDataset"
+   *
+   * @generated from field: map<string, string> renamed_resources = 3;
+   */
+  renamedResources: { [key: string]: string };
+
+  /**
+   * List of full resource types to ignore during generation.
+   * This is typically used for API-specific Location resources,
+   * which should be handled by the generator as if they were actually
+   * the common Location resources.
+   * Example entry: "documentai.googleapis.com/Location"
+   *
+   * @generated from field: repeated string ignored_resources = 4;
+   */
+  ignoredResources: string[];
+
+  /**
+   * Namespaces which must be aliased in snippets due to
+   * a known (but non-generator-predictable) naming collision
+   *
+   * @generated from field: repeated string forced_namespace_aliases = 5;
+   */
+  forcedNamespaceAliases: string[];
+
+  /**
+   * Method signatures (in the form "service.method(signature)")
+   * which are provided separately, so shouldn't be generated.
+   * Snippets *calling* these methods are still generated, however.
+   *
+   * @generated from field: repeated string handwritten_signatures = 6;
+   */
+  handwrittenSignatures: string[];
+};
+
+/**
+ * Describes the message google.api.DotnetSettings.
+ * Use `create(DotnetSettingsSchema)` to create a new message.
+ */
+export const DotnetSettingsSchema: GenMessage<DotnetSettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 8);
+
+/**
+ * Settings for Ruby client libraries.
+ *
+ * @generated from message google.api.RubySettings
+ */
+export type RubySettings = Message<"google.api.RubySettings"> & {
+  /**
+   * Some settings.
+   *
+   * @generated from field: google.api.CommonLanguageSettings common = 1;
+   */
+  common?: CommonLanguageSettings;
+};
+
+/**
+ * Describes the message google.api.RubySettings.
+ * Use `create(RubySettingsSchema)` to create a new message.
+ */
+export const RubySettingsSchema: GenMessage<RubySettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 9);
+
+/**
+ * Settings for Go client libraries.
+ *
+ * @generated from message google.api.GoSettings
+ */
+export type GoSettings = Message<"google.api.GoSettings"> & {
+  /**
+   * Some settings.
+   *
+   * @generated from field: google.api.CommonLanguageSettings common = 1;
+   */
+  common?: CommonLanguageSettings;
+
+  /**
+   * Map of service names to renamed services. Keys are the package relative
+   * service names and values are the name to be used for the service client
+   * and call options.
+   *
+   * publishing:
+   *   go_settings:
+   *     renamed_services:
+   *       Publisher: TopicAdmin
+   *
+   * @generated from field: map<string, string> renamed_services = 2;
+   */
+  renamedServices: { [key: string]: string };
+};
+
+/**
+ * Describes the message google.api.GoSettings.
+ * Use `create(GoSettingsSchema)` to create a new message.
+ */
+export const GoSettingsSchema: GenMessage<GoSettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 10);
+
+/**
+ * Describes the generator configuration for a method.
+ *
+ * @generated from message google.api.MethodSettings
+ */
+export type MethodSettings = Message<"google.api.MethodSettings"> & {
+  /**
+   * The fully qualified name of the method, for which the options below apply.
+   * This is used to find the method to apply the options.
+   *
+   * Example:
+   *
+   *    publishing:
+   *      method_settings:
+   *      - selector: google.storage.control.v2.StorageControl.CreateFolder
+   *        # method settings for CreateFolder...
+   *
+   * @generated from field: string selector = 1;
+   */
+  selector: string;
+
+  /**
+   * Describes settings to use for long-running operations when generating
+   * API methods for RPCs. Complements RPCs that use the annotations in
+   * google/longrunning/operations.proto.
+   *
+   * Example of a YAML configuration::
+   *
+   *    publishing:
+   *      method_settings:
+   *      - selector: google.cloud.speech.v2.Speech.BatchRecognize
+   *        long_running:
+   *          initial_poll_delay: 60s # 1 minute
+   *          poll_delay_multiplier: 1.5
+   *          max_poll_delay: 360s # 6 minutes
+   *          total_poll_timeout: 54000s # 90 minutes
+   *
+   * @generated from field: google.api.MethodSettings.LongRunning long_running = 2;
+   */
+  longRunning?: MethodSettings_LongRunning;
+
+  /**
+   * List of top-level fields of the request message, that should be
+   * automatically populated by the client libraries based on their
+   * (google.api.field_info).format. Currently supported format: UUID4.
+   *
+   * Example of a YAML configuration:
+   *
+   *    publishing:
+   *      method_settings:
+   *      - selector: google.example.v1.ExampleService.CreateExample
+   *        auto_populated_fields:
+   *        - request_id
+   *
+   * @generated from field: repeated string auto_populated_fields = 3;
+   */
+  autoPopulatedFields: string[];
+};
+
+/**
+ * Describes the message google.api.MethodSettings.
+ * Use `create(MethodSettingsSchema)` to create a new message.
+ */
+export const MethodSettingsSchema: GenMessage<MethodSettings> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 11);
+
+/**
+ * Describes settings to use when generating API methods that use the
+ * long-running operation pattern.
+ * All default values below are from those used in the client library
+ * generators (e.g.
+ * [Java](https://github.com/googleapis/gapic-generator-java/blob/04c2faa191a9b5a10b92392fe8482279c4404803/src/main/java/com/google/api/generator/gapic/composer/common/RetrySettingsComposer.java)).
+ *
+ * @generated from message google.api.MethodSettings.LongRunning
+ */
+export type MethodSettings_LongRunning = Message<"google.api.MethodSettings.LongRunning"> & {
+  /**
+   * Initial delay after which the first poll request will be made.
+   * Default value: 5 seconds.
+   *
+   * @generated from field: google.protobuf.Duration initial_poll_delay = 1;
+   */
+  initialPollDelay?: Duration;
+
+  /**
+   * Multiplier to gradually increase delay between subsequent polls until it
+   * reaches max_poll_delay.
+   * Default value: 1.5.
+   *
+   * @generated from field: float poll_delay_multiplier = 2;
+   */
+  pollDelayMultiplier: number;
+
+  /**
+   * Maximum time between two subsequent poll requests.
+   * Default value: 45 seconds.
+   *
+   * @generated from field: google.protobuf.Duration max_poll_delay = 3;
+   */
+  maxPollDelay?: Duration;
+
+  /**
+   * Total polling timeout.
+   * Default value: 5 minutes.
+   *
+   * @generated from field: google.protobuf.Duration total_poll_timeout = 4;
+   */
+  totalPollTimeout?: Duration;
+};
+
+/**
+ * Describes the message google.api.MethodSettings.LongRunning.
+ * Use `create(MethodSettings_LongRunningSchema)` to create a new message.
+ */
+export const MethodSettings_LongRunningSchema: GenMessage<MethodSettings_LongRunning> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 11, 0);
+
+/**
+ * This message is used to configure the generation of a subset of the RPCs in
+ * a service for client libraries.
+ *
+ * @generated from message google.api.SelectiveGapicGeneration
+ */
+export type SelectiveGapicGeneration = Message<"google.api.SelectiveGapicGeneration"> & {
+  /**
+   * An allowlist of the fully qualified names of RPCs that should be included
+   * on public client surfaces.
+   *
+   * @generated from field: repeated string methods = 1;
+   */
+  methods: string[];
+
+  /**
+   * Setting this to true indicates to the client generators that methods
+   * that would be excluded from the generation should instead be generated
+   * in a way that indicates these methods should not be consumed by
+   * end users. How this is expressed is up to individual language
+   * implementations to decide. Some examples may be: added annotations,
+   * obfuscated identifiers, or other language idiomatic patterns.
+   *
+   * @generated from field: bool generate_omitted_as_internal = 2;
+   */
+  generateOmittedAsInternal: boolean;
+};
+
+/**
+ * Describes the message google.api.SelectiveGapicGeneration.
+ * Use `create(SelectiveGapicGenerationSchema)` to create a new message.
+ */
+export const SelectiveGapicGenerationSchema: GenMessage<SelectiveGapicGeneration> = /*@__PURE__*/
+  messageDesc(file_google_api_client, 12);
+
+/**
+ * The organization for which the client libraries are being published.
+ * Affects the url where generated docs are published, etc.
+ *
+ * @generated from enum google.api.ClientLibraryOrganization
+ */
+export enum ClientLibraryOrganization {
+  /**
+   * Not useful.
+   *
+   * @generated from enum value: CLIENT_LIBRARY_ORGANIZATION_UNSPECIFIED = 0;
+   */
+  CLIENT_LIBRARY_ORGANIZATION_UNSPECIFIED = 0,
+
+  /**
+   * Google Cloud Platform Org.
+   *
+   * @generated from enum value: CLOUD = 1;
+   */
+  CLOUD = 1,
+
+  /**
+   * Ads (Advertising) Org.
+   *
+   * @generated from enum value: ADS = 2;
+   */
+  ADS = 2,
+
+  /**
+   * Photos Org.
+   *
+   * @generated from enum value: PHOTOS = 3;
+   */
+  PHOTOS = 3,
+
+  /**
+   * Street View Org.
+   *
+   * @generated from enum value: STREET_VIEW = 4;
+   */
+  STREET_VIEW = 4,
+
+  /**
+   * Shopping Org.
+   *
+   * @generated from enum value: SHOPPING = 5;
+   */
+  SHOPPING = 5,
+
+  /**
+   * Geo Org.
+   *
+   * @generated from enum value: GEO = 6;
+   */
+  GEO = 6,
+
+  /**
+   * Generative AI - https://developers.generativeai.google
+   *
+   * @generated from enum value: GENERATIVE_AI = 7;
+   */
+  GENERATIVE_AI = 7,
+}
+
+/**
+ * Describes the enum google.api.ClientLibraryOrganization.
+ */
+export const ClientLibraryOrganizationSchema: GenEnum<ClientLibraryOrganization> = /*@__PURE__*/
+  enumDesc(file_google_api_client, 0);
+
+/**
+ * To where should client libraries be published?
+ *
+ * @generated from enum google.api.ClientLibraryDestination
+ */
+export enum ClientLibraryDestination {
+  /**
+   * Client libraries will neither be generated nor published to package
+   * managers.
+   *
+   * @generated from enum value: CLIENT_LIBRARY_DESTINATION_UNSPECIFIED = 0;
+   */
+  CLIENT_LIBRARY_DESTINATION_UNSPECIFIED = 0,
+
+  /**
+   * Generate the client library in a repo under github.com/googleapis,
+   * but don't publish it to package managers.
+   *
+   * @generated from enum value: GITHUB = 10;
+   */
+  GITHUB = 10,
+
+  /**
+   * Publish the library to package managers like nuget.org and npmjs.com.
+   *
+   * @generated from enum value: PACKAGE_MANAGER = 20;
+   */
+  PACKAGE_MANAGER = 20,
+}
+
+/**
+ * Describes the enum google.api.ClientLibraryDestination.
+ */
+export const ClientLibraryDestinationSchema: GenEnum<ClientLibraryDestination> = /*@__PURE__*/
+  enumDesc(file_google_api_client, 1);
+
+/**
+ * A definition of a client library method signature.
+ *
+ * In client libraries, each proto RPC corresponds to one or more methods
+ * which the end user is able to call, and calls the underlying RPC.
+ * Normally, this method receives a single argument (a struct or instance
+ * corresponding to the RPC request object). Defining this field will
+ * add one or more overloads providing flattened or simpler method signatures
+ * in some languages.
+ *
+ * The fields on the method signature are provided as a comma-separated
+ * string.
+ *
+ * For example, the proto RPC and annotation:
+ *
+ *   rpc CreateSubscription(CreateSubscriptionRequest)
+ *       returns (Subscription) {
+ *     option (google.api.method_signature) = "name,topic";
+ *   }
+ *
+ * Would add the following Java overload (in addition to the method accepting
+ * the request object):
+ *
+ *   public final Subscription createSubscription(String name, String topic)
+ *
+ * The following backwards-compatibility guidelines apply:
+ *
+ *   * Adding this annotation to an unannotated method is backwards
+ *     compatible.
+ *   * Adding this annotation to a method which already has existing
+ *     method signature annotations is backwards compatible if and only if
+ *     the new method signature annotation is last in the sequence.
+ *   * Modifying or removing an existing method signature annotation is
+ *     a breaking change.
+ *   * Re-ordering existing method signature annotations is a breaking
+ *     change.
+ *
+ * @generated from extension: repeated string method_signature = 1051;
+ */
+export const method_signature: GenExtension<MethodOptions, string[]> = /*@__PURE__*/
+  extDesc(file_google_api_client, 0);
+
+/**
+ * The hostname for this service.
+ * This should be specified with no prefix or protocol.
+ *
+ * Example:
+ *
+ *   service Foo {
+ *     option (google.api.default_host) = "foo.googleapi.com";
+ *     ...
+ *   }
+ *
+ * @generated from extension: string default_host = 1049;
+ */
+export const default_host: GenExtension<ServiceOptions, string> = /*@__PURE__*/
+  extDesc(file_google_api_client, 1);
+
+/**
+ * OAuth scopes needed for the client.
+ *
+ * Example:
+ *
+ *   service Foo {
+ *     option (google.api.oauth_scopes) = \
+ *       "https://www.googleapis.com/auth/cloud-platform";
+ *     ...
+ *   }
+ *
+ * If there is more than one scope, use a comma-separated string:
+ *
+ * Example:
+ *
+ *   service Foo {
+ *     option (google.api.oauth_scopes) = \
+ *       "https://www.googleapis.com/auth/cloud-platform,"
+ *       "https://www.googleapis.com/auth/monitoring";
+ *     ...
+ *   }
+ *
+ * @generated from extension: string oauth_scopes = 1050;
+ */
+export const oauth_scopes: GenExtension<ServiceOptions, string> = /*@__PURE__*/
+  extDesc(file_google_api_client, 2);
+
+/**
+ * The API version of this service, which should be sent by version-aware
+ * clients to the service. This allows services to abide by the schema and
+ * behavior of the service at the time this API version was deployed.
+ * The format of the API version must be treated as opaque by clients.
+ * Services may use a format with an apparent structure, but clients must
+ * not rely on this to determine components within an API version, or attempt
+ * to construct other valid API versions. Note that this is for upcoming
+ * functionality and may not be implemented for all services.
+ *
+ * Example:
+ *
+ *   service Foo {
+ *     option (google.api.api_version) = "v1_20230821_preview";
+ *   }
+ *
+ * @generated from extension: string api_version = 525000001;
+ */
+export const api_version: GenExtension<ServiceOptions, string> = /*@__PURE__*/
+  extDesc(file_google_api_client, 3);
+
diff --git a/frontend/src/protogen/google/api/launch_stage_pb.ts b/frontend/src/protogen/google/api/launch_stage_pb.ts
new file mode 100644
index 0000000000..d208bdfa08
--- /dev/null
+++ b/frontend/src/protogen/google/api/launch_stage_pb.ts
@@ -0,0 +1,118 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file google/api/launch_stage.proto (package google.api, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc } from "@bufbuild/protobuf/codegenv1";
+
+/**
+ * Describes the file google/api/launch_stage.proto.
+ */
+export const file_google_api_launch_stage: GenFile = /*@__PURE__*/
+  fileDesc("Ch1nb29nbGUvYXBpL2xhdW5jaF9zdGFnZS5wcm90bxIKZ29vZ2xlLmFwaSqMAQoLTGF1bmNoU3RhZ2USHAoYTEFVTkNIX1NUQUdFX1VOU1BFQ0lGSUVEEAASEQoNVU5JTVBMRU1FTlRFRBAGEg0KCVBSRUxBVU5DSBAHEhAKDEVBUkxZX0FDQ0VTUxABEgkKBUFMUEhBEAISCAoEQkVUQRADEgYKAkdBEAQSDgoKREVQUkVDQVRFRBAFQpoBCg5jb20uZ29vZ2xlLmFwaUIQTGF1bmNoU3RhZ2VQcm90b1ABWi1nb29nbGUuZ29sYW5nLm9yZy9nZW5wcm90by9nb29nbGVhcGlzL2FwaTthcGmiAgNHQViqAgpHb29nbGUuQXBpygIKR29vZ2xlXEFwaeICFkdvb2dsZVxBcGlcR1BCTWV0YWRhdGHqAgtHb29nbGU6OkFwaWIGcHJvdG8z");
+
+/**
+ * The launch stage as defined by [Google Cloud Platform
+ * Launch Stages](https://cloud.google.com/terms/launch-stages).
+ *
+ * @generated from enum google.api.LaunchStage
+ */
+export enum LaunchStage {
+  /**
+   * Do not use this default value.
+   *
+   * @generated from enum value: LAUNCH_STAGE_UNSPECIFIED = 0;
+   */
+  LAUNCH_STAGE_UNSPECIFIED = 0,
+
+  /**
+   * The feature is not yet implemented. Users can not use it.
+   *
+   * @generated from enum value: UNIMPLEMENTED = 6;
+   */
+  UNIMPLEMENTED = 6,
+
+  /**
+   * Prelaunch features are hidden from users and are only visible internally.
+   *
+   * @generated from enum value: PRELAUNCH = 7;
+   */
+  PRELAUNCH = 7,
+
+  /**
+   * Early Access features are limited to a closed group of testers. To use
+   * these features, you must sign up in advance and sign a Trusted Tester
+   * agreement (which includes confidentiality provisions). These features may
+   * be unstable, changed in backward-incompatible ways, and are not
+   * guaranteed to be released.
+   *
+   * @generated from enum value: EARLY_ACCESS = 1;
+   */
+  EARLY_ACCESS = 1,
+
+  /**
+   * Alpha is a limited availability test for releases before they are cleared
+   * for widespread use. By Alpha, all significant design issues are resolved
+   * and we are in the process of verifying functionality. Alpha customers
+   * need to apply for access, agree to applicable terms, and have their
+   * projects allowlisted. Alpha releases don't have to be feature complete,
+   * no SLAs are provided, and there are no technical support obligations, but
+   * they will be far enough along that customers can actually use them in
+   * test environments or for limited-use tests -- just like they would in
+   * normal production cases.
+   *
+   * @generated from enum value: ALPHA = 2;
+   */
+  ALPHA = 2,
+
+  /**
+   * Beta is the point at which we are ready to open a release for any
+   * customer to use. There are no SLA or technical support obligations in a
+   * Beta release. Products will be complete from a feature perspective, but
+   * may have some open outstanding issues. Beta releases are suitable for
+   * limited production use cases.
+   *
+   * @generated from enum value: BETA = 3;
+   */
+  BETA = 3,
+
+  /**
+   * GA features are open to all developers and are considered stable and
+   * fully qualified for production use.
+   *
+   * @generated from enum value: GA = 4;
+   */
+  GA = 4,
+
+  /**
+   * Deprecated features are scheduled to be shut down and removed. For more
+   * information, see the "Deprecation Policy" section of our [Terms of
+   * Service](https://cloud.google.com/terms/)
+   * and the [Google Cloud Platform Subject to the Deprecation
+   * Policy](https://cloud.google.com/terms/deprecation) documentation.
+   *
+   * @generated from enum value: DEPRECATED = 5;
+   */
+  DEPRECATED = 5,
+}
+
+/**
+ * Describes the enum google.api.LaunchStage.
+ */
+export const LaunchStageSchema: GenEnum<LaunchStage> = /*@__PURE__*/
+  enumDesc(file_google_api_launch_stage, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/access_control-AccessControlService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/access_control-AccessControlService_connectquery.ts
new file mode 100644
index 0000000000..d3a0f107a7
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/access_control-AccessControlService_connectquery.ts
@@ -0,0 +1,68 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/access_control.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { AccessControlService } from "./access_control_pb";
+
+/**
+ * Creates a new Cedar policy.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.CreatePolicy
+ */
+export const createPolicy = AccessControlService.method.createPolicy;
+
+/**
+ * Gets a policy by name.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.GetPolicy
+ */
+export const getPolicy = AccessControlService.method.getPolicy;
+
+/**
+ * Lists policies within a workspace.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.ListPolicies
+ */
+export const listPolicies = AccessControlService.method.listPolicies;
+
+/**
+ * Updates a policy.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.UpdatePolicy
+ */
+export const updatePolicy = AccessControlService.method.updatePolicy;
+
+/**
+ * Deletes a policy.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.DeletePolicy
+ */
+export const deletePolicy = AccessControlService.method.deletePolicy;
+
+/**
+ * Validates a Cedar policy without saving it.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.ValidatePolicy
+ */
+export const validatePolicy = AccessControlService.method.validatePolicy;
+
+/**
+ * Evaluates an authorization request against policies.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.EvaluateAccess
+ */
+export const evaluateAccess = AccessControlService.method.evaluateAccess;
+
+/**
+ * Lists policy versions (audit trail).
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.ListPolicyVersions
+ */
+export const listPolicyVersions = AccessControlService.method.listPolicyVersions;
+
+/**
+ * Gets available entities for policy authoring (autocomplete).
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.GetPolicyEntities
+ */
+export const getPolicyEntities = AccessControlService.method.getPolicyEntities;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/access_control_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/access_control_pb.ts
new file mode 100644
index 0000000000..4a0fd44595
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/access_control_pb.ts
@@ -0,0 +1,1117 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/access_control.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/access_control.proto.
+ */
+export const file_redpanda_api_aigateway_v1_access_control: GenFile = /*@__PURE__*/
+  fileDesc("Ci5yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2FjY2Vzc19jb250cm9sLnByb3RvEhlyZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxIusFCgxBY2Nlc3NQb2xpY3kSEQoEbmFtZRgBIAEoCUID4EEIEhkKDGRpc3BsYXlfbmFtZRgCIAEoCUID4EECEhgKC2Rlc2NyaXB0aW9uGAMgASgJQgPgQQESGAoLcG9saWN5X3RleHQYBCABKAlCA+BBAhI/Cgtwb2xpY3lfdHlwZRgFIAEoDjIlLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUG9saWN5VHlwZUID4EEBEjwKBmVmZmVjdBgGIAEoDjInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUG9saWN5RWZmZWN0QgPgQQMSHAoPcHJpbmNpcGFsX3R5cGVzGAcgAygJQgPgQQMSGwoOcmVzb3VyY2VfdHlwZXMYCCADKAlCA+BBAxIZCgxhY3Rpb25fdHlwZXMYCSADKAlCA+BBAxIPCgdlbmFibGVkGAogASgIEhAKCHByaW9yaXR5GAsgASgFEhQKB3ZlcnNpb24YDCABKAVCA+BBAxJHCghtZXRhZGF0YRgNIAMoCzI1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQWNjZXNzUG9saWN5Lk1ldGFkYXRhRW50cnkSNAoLY3JlYXRlX3RpbWUYDiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSNAoLdXBkYXRlX3RpbWUYDyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSFAoHY3JlYXRvchgQIAEoCUID4EEDEhQKB3VwZGF0ZXIYESABKAlCA+BBAxovCg1NZXRhZGF0YUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAE6WepBVgojYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9BY2Nlc3NQb2xpY3kSL3dvcmtzcGFjZXMve3dvcmtzcGFjZX0vYWNjZXNzLXBvbGljaWVzL3twb2xpY3l9Io4BCg1Qb2xpY3lWZXJzaW9uEg8KB3ZlcnNpb24YASABKAUSEwoLcG9saWN5X3RleHQYAiABKAkSFQoNY2hhbmdlX3JlYXNvbhgDIAEoCRIvCgtjcmVhdGVfdGltZRgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASDwoHY3JlYXRvchgFIAEoCSKlAQoTQ3JlYXRlUG9saWN5UmVxdWVzdBI4CgZwYXJlbnQYASABKAlCKOBBAvpBIgogYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Xb3Jrc3BhY2USFgoJcG9saWN5X2lkGAIgASgJQgPgQQESPAoGcG9saWN5GAMgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY2Nlc3NQb2xpY3lCA+BBAiJPChRDcmVhdGVQb2xpY3lSZXNwb25zZRI3CgZwb2xpY3kYASABKAsyJy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkFjY2Vzc1BvbGljeSJNChBHZXRQb2xpY3lSZXF1ZXN0EjkKBG5hbWUYASABKAlCK+BBAvpBJQojYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9BY2Nlc3NQb2xpY3kiTAoRR2V0UG9saWN5UmVzcG9uc2USNwoGcG9saWN5GAEgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY2Nlc3NQb2xpY3kirAEKE0xpc3RQb2xpY2llc1JlcXVlc3QSOAoGcGFyZW50GAEgASgJQijgQQL6QSIKIGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vV29ya3NwYWNlEhYKCXBhZ2Vfc2l6ZRgCIAEoBUID4EEBEhcKCnBhZ2VfdG9rZW4YAyABKAlCA+BBARITCgZmaWx0ZXIYBCABKAlCA+BBARIVCghvcmRlcl9ieRgFIAEoCUID4EEBIn4KFExpc3RQb2xpY2llc1Jlc3BvbnNlEjkKCHBvbGljaWVzGAEgAygLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY2Nlc3NQb2xpY3kSFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJEhIKCnRvdGFsX3NpemUYAyABKAUipQEKE1VwZGF0ZVBvbGljeVJlcXVlc3QSPAoGcG9saWN5GAEgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY2Nlc3NQb2xpY3lCA+BBAhI0Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCA+BBARIaCg1jaGFuZ2VfcmVhc29uGAMgASgJQgPgQQEiTwoUVXBkYXRlUG9saWN5UmVzcG9uc2USNwoGcG9saWN5GAEgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY2Nlc3NQb2xpY3kiUAoTRGVsZXRlUG9saWN5UmVxdWVzdBI5CgRuYW1lGAEgASgJQivgQQL6QSUKI2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vQWNjZXNzUG9saWN5IhYKFERlbGV0ZVBvbGljeVJlc3BvbnNlImsKFVZhbGlkYXRlUG9saWN5UmVxdWVzdBI4CgZwYXJlbnQYASABKAlCKOBBAvpBIgogYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Xb3Jrc3BhY2USGAoLcG9saWN5X3RleHQYAiABKAlCA+BBAiLpAQoWVmFsaWRhdGVQb2xpY3lSZXNwb25zZRINCgV2YWxpZBgBIAEoCBJACgZlcnJvcnMYAiADKAsyMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlBvbGljeVZhbGlkYXRpb25FcnJvchI3CgZlZmZlY3QYAyABKA4yJy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlBvbGljeUVmZmVjdBIXCg9wcmluY2lwYWxfdHlwZXMYBCADKAkSFgoOcmVzb3VyY2VfdHlwZXMYBSADKAkSFAoMYWN0aW9uX3R5cGVzGAYgAygJIkYKFVBvbGljeVZhbGlkYXRpb25FcnJvchIMCgRsaW5lGAEgASgFEg4KBmNvbHVtbhgCIAEoBRIPCgdtZXNzYWdlGAMgASgJIpADChVFdmFsdWF0ZUFjY2Vzc1JlcXVlc3QSOwoJd29ya3NwYWNlGAEgASgJQijgQQL6QSIKIGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vV29ya3NwYWNlEj4KCXByaW5jaXBhbBgCIAEoCzImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ2VkYXJFbnRpdHlCA+BBAhI7CgZhY3Rpb24YAyABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNlZGFyRW50aXR5QgPgQQISPQoIcmVzb3VyY2UYBCABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNlZGFyRW50aXR5QgPgQQISTgoHY29udGV4dBgFIAMoCzI9LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRXZhbHVhdGVBY2Nlc3NSZXF1ZXN0LkNvbnRleHRFbnRyeRouCgxDb250ZXh0RW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKTAQoWRXZhbHVhdGVBY2Nlc3NSZXNwb25zZRIPCgdhbGxvd2VkGAEgASgIEjUKCGRlY2lzaW9uGAIgASgOMiMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWNpc2lvbhIcChRkZXRlcm1pbmluZ19wb2xpY2llcxgDIAMoCRITCgtkaWFnbm9zdGljcxgEIAMoCSIxCgtDZWRhckVudGl0eRIRCgR0eXBlGAEgASgJQgPgQQISDwoCaWQYAiABKAlCA+BBAiKJAQoZTGlzdFBvbGljeVZlcnNpb25zUmVxdWVzdBI7CgZwYXJlbnQYASABKAlCK+BBAvpBJQojYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9BY2Nlc3NQb2xpY3kSFgoJcGFnZV9zaXplGAIgASgFQgPgQQESFwoKcGFnZV90b2tlbhgDIAEoCUID4EEBInEKGkxpc3RQb2xpY3lWZXJzaW9uc1Jlc3BvbnNlEjoKCHZlcnNpb25zGAEgAygLMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Qb2xpY3lWZXJzaW9uEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCSJUChhHZXRQb2xpY3lFbnRpdGllc1JlcXVlc3QSOAoGcGFyZW50GAEgASgJQijgQQL6QSIKIGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vV29ya3NwYWNlIqcCChlHZXRQb2xpY3lFbnRpdGllc1Jlc3BvbnNlEkIKD3ByaW5jaXBhbF90eXBlcxgBIAMoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRW50aXR5VHlwZUluZm8SPwoMYWN0aW9uX3R5cGVzGAIgAygLMikucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5FbnRpdHlUeXBlSW5mbxJBCg5yZXNvdXJjZV90eXBlcxgDIAMoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRW50aXR5VHlwZUluZm8SQgoPc2FtcGxlX2VudGl0aWVzGAQgAygLMikucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5FbnRpdHlJbnN0YW5jZSJzCg5FbnRpdHlUeXBlSW5mbxIMCgR0eXBlGAEgASgJEhMKC2Rlc2NyaXB0aW9uGAIgASgJEj4KCmF0dHJpYnV0ZXMYAyADKAsyKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkVudGl0eUF0dHJpYnV0ZSJCCg9FbnRpdHlBdHRyaWJ1dGUSDAoEbmFtZRgBIAEoCRIMCgR0eXBlGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJIkAKDkVudGl0eUluc3RhbmNlEgwKBHR5cGUYASABKAkSCgoCaWQYAiABKAkSFAoMZGlzcGxheV9uYW1lGAMgASgJKlsKClBvbGljeVR5cGUSGwoXUE9MSUNZX1RZUEVfVU5TUEVDSUZJRUQQABIWChJQT0xJQ1lfVFlQRV9TVEFUSUMQARIYChRQT0xJQ1lfVFlQRV9URU1QTEFURRACKmEKDFBvbGljeUVmZmVjdBIdChlQT0xJQ1lfRUZGRUNUX1VOU1BFQ0lGSUVEEAASGAoUUE9MSUNZX0VGRkVDVF9QRVJNSVQQARIYChRQT0xJQ1lfRUZGRUNUX0ZPUkJJRBACKmUKCERlY2lzaW9uEhgKFERFQ0lTSU9OX1VOU1BFQ0lGSUVEEAASEgoOREVDSVNJT05fQUxMT1cQARIRCg1ERUNJU0lPTl9ERU5ZEAISGAoUREVDSVNJT05fTk9fREVDSVNJT04QAzLfDAoUQWNjZXNzQ29udHJvbFNlcnZpY2USqgEKDENyZWF0ZVBvbGljeRIuLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlUG9saWN5UmVxdWVzdBovLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlUG9saWN5UmVzcG9uc2UiOYLT5JMCMzoGcG9saWN5IikvdjEve3BhcmVudD13b3Jrc3BhY2VzLyp9L2FjY2Vzcy1wb2xpY2llcxKZAQoJR2V0UG9saWN5EisucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRQb2xpY3lSZXF1ZXN0GiwucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRQb2xpY3lSZXNwb25zZSIxgtPkkwIrEikvdjEve25hbWU9d29ya3NwYWNlcy8qL2FjY2Vzcy1wb2xpY2llcy8qfRKiAQoMTGlzdFBvbGljaWVzEi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0UG9saWNpZXNSZXF1ZXN0Gi8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0UG9saWNpZXNSZXNwb25zZSIxgtPkkwIrEikvdjEve3BhcmVudD13b3Jrc3BhY2VzLyp9L2FjY2Vzcy1wb2xpY2llcxKxAQoMVXBkYXRlUG9saWN5Ei4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVQb2xpY3lSZXF1ZXN0Gi8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVQb2xpY3lSZXNwb25zZSJAgtPkkwI6OgZwb2xpY3kyMC92MS97cG9saWN5Lm5hbWU9d29ya3NwYWNlcy8qL2FjY2Vzcy1wb2xpY2llcy8qfRKiAQoMRGVsZXRlUG9saWN5Ei4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVQb2xpY3lSZXF1ZXN0Gi8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVQb2xpY3lSZXNwb25zZSIxgtPkkwIrKikvdjEve25hbWU9d29ya3NwYWNlcy8qL2FjY2Vzcy1wb2xpY2llcy8qfRK0AQoOVmFsaWRhdGVQb2xpY3kSMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlZhbGlkYXRlUG9saWN5UmVxdWVzdBoxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVmFsaWRhdGVQb2xpY3lSZXNwb25zZSI9gtPkkwI3OgEqIjIvdjEve3BhcmVudD13b3Jrc3BhY2VzLyp9L2FjY2Vzcy1wb2xpY2llczp2YWxpZGF0ZRKuAQoORXZhbHVhdGVBY2Nlc3MSMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkV2YWx1YXRlQWNjZXNzUmVxdWVzdBoxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRXZhbHVhdGVBY2Nlc3NSZXNwb25zZSI3gtPkkwIxOgEqIiwvdjEve3dvcmtzcGFjZT13b3Jrc3BhY2VzLyp9L2FjY2VzczpldmFsdWF0ZRK/AQoSTGlzdFBvbGljeVZlcnNpb25zEjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0UG9saWN5VmVyc2lvbnNSZXF1ZXN0GjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0UG9saWN5VmVyc2lvbnNSZXNwb25zZSI8gtPkkwI2EjQvdjEve3BhcmVudD13b3Jrc3BhY2VzLyovYWNjZXNzLXBvbGljaWVzLyp9L3ZlcnNpb25zEroBChFHZXRQb2xpY3lFbnRpdGllcxIzLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0UG9saWN5RW50aXRpZXNSZXF1ZXN0GjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRQb2xpY3lFbnRpdGllc1Jlc3BvbnNlIjqC0+STAjQSMi92MS97cGFyZW50PXdvcmtzcGFjZXMvKn0vYWNjZXNzLXBvbGljaWVzOmVudGl0aWVzGhnKQRZhaWdhdGV3YXkucmVkcGFuZGEuY29tQocCCh1jb20ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MUISQWNjZXNzQ29udHJvbFByb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * AccessPolicy represents a Cedar authorization policy.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AccessPolicy
+ */
+export type AccessPolicy = Message<"redpanda.api.aigateway.v1.AccessPolicy"> & {
+  /**
+   * Resource name. Format: `workspaces/{workspace}/access-policies/{policy}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Required: The Cedar policy source code
+   *
+   * @generated from field: string policy_text = 4;
+   */
+  policyText: string;
+
+  /**
+   * Policy type: STATIC or TEMPLATE
+   *
+   * @generated from field: redpanda.api.aigateway.v1.PolicyType policy_type = 5;
+   */
+  policyType: PolicyType;
+
+  /**
+   * Output only. Effect: PERMIT or FORBID (extracted from policy)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.PolicyEffect effect = 6;
+   */
+  effect: PolicyEffect;
+
+  /**
+   * Output only. Types of principals this policy applies to
+   *
+   * @generated from field: repeated string principal_types = 7;
+   */
+  principalTypes: string[];
+
+  /**
+   * Output only. Types of resources this policy applies to
+   *
+   * @generated from field: repeated string resource_types = 8;
+   */
+  resourceTypes: string[];
+
+  /**
+   * Output only. Types of actions this policy applies to
+   *
+   * @generated from field: repeated string action_types = 9;
+   */
+  actionTypes: string[];
+
+  /**
+   * Whether this policy is active
+   *
+   * @generated from field: bool enabled = 10;
+   */
+  enabled: boolean;
+
+  /**
+   * Priority for policy ordering (lower = higher priority)
+   *
+   * @generated from field: int32 priority = 11;
+   */
+  priority: number;
+
+  /**
+   * Current version number
+   *
+   * @generated from field: int32 version = 12;
+   */
+  version: number;
+
+  /**
+   * Metadata for arbitrary key-value pairs
+   *
+   * @generated from field: map<string, string> metadata = 13;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only timestamps
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 14;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp update_time = 15;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * @generated from field: string creator = 16;
+   */
+  creator: string;
+
+  /**
+   * @generated from field: string updater = 17;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AccessPolicy.
+ * Use `create(AccessPolicySchema)` to create a new message.
+ */
+export const AccessPolicySchema: GenMessage<AccessPolicy> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 0);
+
+/**
+ * PolicyVersion represents a historical version of a policy.
+ *
+ * @generated from message redpanda.api.aigateway.v1.PolicyVersion
+ */
+export type PolicyVersion = Message<"redpanda.api.aigateway.v1.PolicyVersion"> & {
+  /**
+   * Version number
+   *
+   * @generated from field: int32 version = 1;
+   */
+  version: number;
+
+  /**
+   * The policy text at this version
+   *
+   * @generated from field: string policy_text = 2;
+   */
+  policyText: string;
+
+  /**
+   * Reason for this change
+   *
+   * @generated from field: string change_reason = 3;
+   */
+  changeReason: string;
+
+  /**
+   * When this version was created
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 4;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Who created this version
+   *
+   * @generated from field: string creator = 5;
+   */
+  creator: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.PolicyVersion.
+ * Use `create(PolicyVersionSchema)` to create a new message.
+ */
+export const PolicyVersionSchema: GenMessage<PolicyVersion> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 1);
+
+/**
+ * Request message for CreatePolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreatePolicyRequest
+ */
+export type CreatePolicyRequest = Message<"redpanda.api.aigateway.v1.CreatePolicyRequest"> & {
+  /**
+   * Required: Parent workspace.
+   * Format: `workspaces/{workspace}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Optional policy ID (auto-generated if empty)
+   *
+   * @generated from field: string policy_id = 2;
+   */
+  policyId: string;
+
+  /**
+   * Required: The policy to create
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AccessPolicy policy = 3;
+   */
+  policy?: AccessPolicy;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreatePolicyRequest.
+ * Use `create(CreatePolicyRequestSchema)` to create a new message.
+ */
+export const CreatePolicyRequestSchema: GenMessage<CreatePolicyRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 2);
+
+/**
+ * Response message for CreatePolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreatePolicyResponse
+ */
+export type CreatePolicyResponse = Message<"redpanda.api.aigateway.v1.CreatePolicyResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.AccessPolicy policy = 1;
+   */
+  policy?: AccessPolicy;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreatePolicyResponse.
+ * Use `create(CreatePolicyResponseSchema)` to create a new message.
+ */
+export const CreatePolicyResponseSchema: GenMessage<CreatePolicyResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 3);
+
+/**
+ * Request message for GetPolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetPolicyRequest
+ */
+export type GetPolicyRequest = Message<"redpanda.api.aigateway.v1.GetPolicyRequest"> & {
+  /**
+   * Resource name of the policy.
+   * Format: `workspaces/{workspace}/access-policies/{policy}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetPolicyRequest.
+ * Use `create(GetPolicyRequestSchema)` to create a new message.
+ */
+export const GetPolicyRequestSchema: GenMessage<GetPolicyRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 4);
+
+/**
+ * Response message for GetPolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetPolicyResponse
+ */
+export type GetPolicyResponse = Message<"redpanda.api.aigateway.v1.GetPolicyResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.AccessPolicy policy = 1;
+   */
+  policy?: AccessPolicy;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetPolicyResponse.
+ * Use `create(GetPolicyResponseSchema)` to create a new message.
+ */
+export const GetPolicyResponseSchema: GenMessage<GetPolicyResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 5);
+
+/**
+ * Request message for ListPolicies RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListPoliciesRequest
+ */
+export type ListPoliciesRequest = Message<"redpanda.api.aigateway.v1.ListPoliciesRequest"> & {
+  /**
+   * Required: Parent workspace.
+   * Format: `workspaces/{workspace}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of policies to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous ListPolicies call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter expression (CEL syntax)
+   *
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * Comma-separated list of fields to order by
+   *
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListPoliciesRequest.
+ * Use `create(ListPoliciesRequestSchema)` to create a new message.
+ */
+export const ListPoliciesRequestSchema: GenMessage<ListPoliciesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 6);
+
+/**
+ * Response message for ListPolicies RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListPoliciesResponse
+ */
+export type ListPoliciesResponse = Message<"redpanda.api.aigateway.v1.ListPoliciesResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.AccessPolicy policies = 1;
+   */
+  policies: AccessPolicy[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListPoliciesResponse.
+ * Use `create(ListPoliciesResponseSchema)` to create a new message.
+ */
+export const ListPoliciesResponseSchema: GenMessage<ListPoliciesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 7);
+
+/**
+ * Request message for UpdatePolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdatePolicyRequest
+ */
+export type UpdatePolicyRequest = Message<"redpanda.api.aigateway.v1.UpdatePolicyRequest"> & {
+  /**
+   * The policy resource to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AccessPolicy policy = 1;
+   */
+  policy?: AccessPolicy;
+
+  /**
+   * The fields to update.
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+
+  /**
+   * Optional reason for this update (stored in version history)
+   *
+   * @generated from field: string change_reason = 3;
+   */
+  changeReason: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdatePolicyRequest.
+ * Use `create(UpdatePolicyRequestSchema)` to create a new message.
+ */
+export const UpdatePolicyRequestSchema: GenMessage<UpdatePolicyRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 8);
+
+/**
+ * Response message for UpdatePolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdatePolicyResponse
+ */
+export type UpdatePolicyResponse = Message<"redpanda.api.aigateway.v1.UpdatePolicyResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.AccessPolicy policy = 1;
+   */
+  policy?: AccessPolicy;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdatePolicyResponse.
+ * Use `create(UpdatePolicyResponseSchema)` to create a new message.
+ */
+export const UpdatePolicyResponseSchema: GenMessage<UpdatePolicyResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 9);
+
+/**
+ * Request message for DeletePolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeletePolicyRequest
+ */
+export type DeletePolicyRequest = Message<"redpanda.api.aigateway.v1.DeletePolicyRequest"> & {
+  /**
+   * Resource name of the policy to delete.
+   * Format: `workspaces/{workspace}/access-policies/{policy}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeletePolicyRequest.
+ * Use `create(DeletePolicyRequestSchema)` to create a new message.
+ */
+export const DeletePolicyRequestSchema: GenMessage<DeletePolicyRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 10);
+
+/**
+ * Response message for DeletePolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeletePolicyResponse
+ */
+export type DeletePolicyResponse = Message<"redpanda.api.aigateway.v1.DeletePolicyResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeletePolicyResponse.
+ * Use `create(DeletePolicyResponseSchema)` to create a new message.
+ */
+export const DeletePolicyResponseSchema: GenMessage<DeletePolicyResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 11);
+
+/**
+ * Request message for ValidatePolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ValidatePolicyRequest
+ */
+export type ValidatePolicyRequest = Message<"redpanda.api.aigateway.v1.ValidatePolicyRequest"> & {
+  /**
+   * Required: Parent workspace (for context).
+   * Format: `workspaces/{workspace}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * The Cedar policy text to validate
+   *
+   * @generated from field: string policy_text = 2;
+   */
+  policyText: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ValidatePolicyRequest.
+ * Use `create(ValidatePolicyRequestSchema)` to create a new message.
+ */
+export const ValidatePolicyRequestSchema: GenMessage<ValidatePolicyRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 12);
+
+/**
+ * Response message for ValidatePolicy RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ValidatePolicyResponse
+ */
+export type ValidatePolicyResponse = Message<"redpanda.api.aigateway.v1.ValidatePolicyResponse"> & {
+  /**
+   * Whether the policy is valid
+   *
+   * @generated from field: bool valid = 1;
+   */
+  valid: boolean;
+
+  /**
+   * Validation errors (if any)
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.PolicyValidationError errors = 2;
+   */
+  errors: PolicyValidationError[];
+
+  /**
+   * Parsed policy information (if valid)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.PolicyEffect effect = 3;
+   */
+  effect: PolicyEffect;
+
+  /**
+   * @generated from field: repeated string principal_types = 4;
+   */
+  principalTypes: string[];
+
+  /**
+   * @generated from field: repeated string resource_types = 5;
+   */
+  resourceTypes: string[];
+
+  /**
+   * @generated from field: repeated string action_types = 6;
+   */
+  actionTypes: string[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ValidatePolicyResponse.
+ * Use `create(ValidatePolicyResponseSchema)` to create a new message.
+ */
+export const ValidatePolicyResponseSchema: GenMessage<ValidatePolicyResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 13);
+
+/**
+ * PolicyValidationError describes a syntax error in a Cedar policy.
+ *
+ * @generated from message redpanda.api.aigateway.v1.PolicyValidationError
+ */
+export type PolicyValidationError = Message<"redpanda.api.aigateway.v1.PolicyValidationError"> & {
+  /**
+   * Line number (1-indexed)
+   *
+   * @generated from field: int32 line = 1;
+   */
+  line: number;
+
+  /**
+   * Column number (1-indexed)
+   *
+   * @generated from field: int32 column = 2;
+   */
+  column: number;
+
+  /**
+   * Error message
+   *
+   * @generated from field: string message = 3;
+   */
+  message: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.PolicyValidationError.
+ * Use `create(PolicyValidationErrorSchema)` to create a new message.
+ */
+export const PolicyValidationErrorSchema: GenMessage<PolicyValidationError> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 14);
+
+/**
+ * Request message for EvaluateAccess RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.EvaluateAccessRequest
+ */
+export type EvaluateAccessRequest = Message<"redpanda.api.aigateway.v1.EvaluateAccessRequest"> & {
+  /**
+   * Required: Workspace containing the policies.
+   * Format: `workspaces/{workspace}`
+   *
+   * @generated from field: string workspace = 1;
+   */
+  workspace: string;
+
+  /**
+   * Principal making the request
+   *
+   * @generated from field: redpanda.api.aigateway.v1.CedarEntity principal = 2;
+   */
+  principal?: CedarEntity;
+
+  /**
+   * Action being performed
+   *
+   * @generated from field: redpanda.api.aigateway.v1.CedarEntity action = 3;
+   */
+  action?: CedarEntity;
+
+  /**
+   * Resource being accessed
+   *
+   * @generated from field: redpanda.api.aigateway.v1.CedarEntity resource = 4;
+   */
+  resource?: CedarEntity;
+
+  /**
+   * Optional context attributes
+   *
+   * @generated from field: map<string, string> context = 5;
+   */
+  context: { [key: string]: string };
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EvaluateAccessRequest.
+ * Use `create(EvaluateAccessRequestSchema)` to create a new message.
+ */
+export const EvaluateAccessRequestSchema: GenMessage<EvaluateAccessRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 15);
+
+/**
+ * Response message for EvaluateAccess RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.EvaluateAccessResponse
+ */
+export type EvaluateAccessResponse = Message<"redpanda.api.aigateway.v1.EvaluateAccessResponse"> & {
+  /**
+   * Whether access is allowed
+   *
+   * @generated from field: bool allowed = 1;
+   */
+  allowed: boolean;
+
+  /**
+   * The decision: ALLOW, DENY, or NO_DECISION
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Decision decision = 2;
+   */
+  decision: Decision;
+
+  /**
+   * IDs of policies that contributed to this decision
+   *
+   * @generated from field: repeated string determining_policies = 3;
+   */
+  determiningPolicies: string[];
+
+  /**
+   * Diagnostic information
+   *
+   * @generated from field: repeated string diagnostics = 4;
+   */
+  diagnostics: string[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EvaluateAccessResponse.
+ * Use `create(EvaluateAccessResponseSchema)` to create a new message.
+ */
+export const EvaluateAccessResponseSchema: GenMessage<EvaluateAccessResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 16);
+
+/**
+ * CedarEntity represents a Cedar principal, action, or resource.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CedarEntity
+ */
+export type CedarEntity = Message<"redpanda.api.aigateway.v1.CedarEntity"> & {
+  /**
+   * Entity type (e.g., "AIGateway::User")
+   *
+   * @generated from field: string type = 1;
+   */
+  type: string;
+
+  /**
+   * Entity ID
+   *
+   * @generated from field: string id = 2;
+   */
+  id: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CedarEntity.
+ * Use `create(CedarEntitySchema)` to create a new message.
+ */
+export const CedarEntitySchema: GenMessage<CedarEntity> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 17);
+
+/**
+ * Request message for ListPolicyVersions RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListPolicyVersionsRequest
+ */
+export type ListPolicyVersionsRequest = Message<"redpanda.api.aigateway.v1.ListPolicyVersionsRequest"> & {
+  /**
+   * Parent policy resource.
+   * Format: `workspaces/{workspace}/access-policies/{policy}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListPolicyVersionsRequest.
+ * Use `create(ListPolicyVersionsRequestSchema)` to create a new message.
+ */
+export const ListPolicyVersionsRequestSchema: GenMessage<ListPolicyVersionsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 18);
+
+/**
+ * Response message for ListPolicyVersions RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListPolicyVersionsResponse
+ */
+export type ListPolicyVersionsResponse = Message<"redpanda.api.aigateway.v1.ListPolicyVersionsResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.PolicyVersion versions = 1;
+   */
+  versions: PolicyVersion[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListPolicyVersionsResponse.
+ * Use `create(ListPolicyVersionsResponseSchema)` to create a new message.
+ */
+export const ListPolicyVersionsResponseSchema: GenMessage<ListPolicyVersionsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 19);
+
+/**
+ * Request message for GetPolicyEntities RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetPolicyEntitiesRequest
+ */
+export type GetPolicyEntitiesRequest = Message<"redpanda.api.aigateway.v1.GetPolicyEntitiesRequest"> & {
+  /**
+   * Parent workspace.
+   * Format: `workspaces/{workspace}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetPolicyEntitiesRequest.
+ * Use `create(GetPolicyEntitiesRequestSchema)` to create a new message.
+ */
+export const GetPolicyEntitiesRequestSchema: GenMessage<GetPolicyEntitiesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 20);
+
+/**
+ * Response message for GetPolicyEntities RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetPolicyEntitiesResponse
+ */
+export type GetPolicyEntitiesResponse = Message<"redpanda.api.aigateway.v1.GetPolicyEntitiesResponse"> & {
+  /**
+   * Available principal types with descriptions
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.EntityTypeInfo principal_types = 1;
+   */
+  principalTypes: EntityTypeInfo[];
+
+  /**
+   * Available action types
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.EntityTypeInfo action_types = 2;
+   */
+  actionTypes: EntityTypeInfo[];
+
+  /**
+   * Available resource types with descriptions
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.EntityTypeInfo resource_types = 3;
+   */
+  resourceTypes: EntityTypeInfo[];
+
+  /**
+   * Sample entities for autocomplete
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.EntityInstance sample_entities = 4;
+   */
+  sampleEntities: EntityInstance[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetPolicyEntitiesResponse.
+ * Use `create(GetPolicyEntitiesResponseSchema)` to create a new message.
+ */
+export const GetPolicyEntitiesResponseSchema: GenMessage<GetPolicyEntitiesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 21);
+
+/**
+ * EntityTypeInfo describes a Cedar entity type.
+ *
+ * @generated from message redpanda.api.aigateway.v1.EntityTypeInfo
+ */
+export type EntityTypeInfo = Message<"redpanda.api.aigateway.v1.EntityTypeInfo"> & {
+  /**
+   * Entity type name (e.g., "AIGateway::User")
+   *
+   * @generated from field: string type = 1;
+   */
+  type: string;
+
+  /**
+   * Human-readable description
+   *
+   * @generated from field: string description = 2;
+   */
+  description: string;
+
+  /**
+   * Available attributes on this entity type
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.EntityAttribute attributes = 3;
+   */
+  attributes: EntityAttribute[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EntityTypeInfo.
+ * Use `create(EntityTypeInfoSchema)` to create a new message.
+ */
+export const EntityTypeInfoSchema: GenMessage<EntityTypeInfo> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 22);
+
+/**
+ * EntityAttribute describes an attribute on a Cedar entity.
+ *
+ * @generated from message redpanda.api.aigateway.v1.EntityAttribute
+ */
+export type EntityAttribute = Message<"redpanda.api.aigateway.v1.EntityAttribute"> & {
+  /**
+   * Attribute name
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Attribute type ("String", "Long", "Boolean", "Set", "Record")
+   *
+   * @generated from field: string type = 2;
+   */
+  type: string;
+
+  /**
+   * Human-readable description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EntityAttribute.
+ * Use `create(EntityAttributeSchema)` to create a new message.
+ */
+export const EntityAttributeSchema: GenMessage<EntityAttribute> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 23);
+
+/**
+ * EntityInstance represents a concrete entity for autocomplete.
+ *
+ * @generated from message redpanda.api.aigateway.v1.EntityInstance
+ */
+export type EntityInstance = Message<"redpanda.api.aigateway.v1.EntityInstance"> & {
+  /**
+   * Entity type
+   *
+   * @generated from field: string type = 1;
+   */
+  type: string;
+
+  /**
+   * Entity ID
+   *
+   * @generated from field: string id = 2;
+   */
+  id: string;
+
+  /**
+   * Display name for UI
+   *
+   * @generated from field: string display_name = 3;
+   */
+  displayName: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EntityInstance.
+ * Use `create(EntityInstanceSchema)` to create a new message.
+ */
+export const EntityInstanceSchema: GenMessage<EntityInstance> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_access_control, 24);
+
+/**
+ * Policy type enumeration
+ *
+ * @generated from enum redpanda.api.aigateway.v1.PolicyType
+ */
+export enum PolicyType {
+  /**
+   * @generated from enum value: POLICY_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Standard Cedar policy
+   *
+   * @generated from enum value: POLICY_TYPE_STATIC = 1;
+   */
+  STATIC = 1,
+
+  /**
+   * Cedar policy template
+   *
+   * @generated from enum value: POLICY_TYPE_TEMPLATE = 2;
+   */
+  TEMPLATE = 2,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.PolicyType.
+ */
+export const PolicyTypeSchema: GenEnum<PolicyType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_access_control, 0);
+
+/**
+ * Policy effect enumeration
+ *
+ * @generated from enum redpanda.api.aigateway.v1.PolicyEffect
+ */
+export enum PolicyEffect {
+  /**
+   * @generated from enum value: POLICY_EFFECT_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: POLICY_EFFECT_PERMIT = 1;
+   */
+  PERMIT = 1,
+
+  /**
+   * @generated from enum value: POLICY_EFFECT_FORBID = 2;
+   */
+  FORBID = 2,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.PolicyEffect.
+ */
+export const PolicyEffectSchema: GenEnum<PolicyEffect> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_access_control, 1);
+
+/**
+ * Authorization decision enumeration.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.Decision
+ */
+export enum Decision {
+  /**
+   * @generated from enum value: DECISION_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: DECISION_ALLOW = 1;
+   */
+  ALLOW = 1,
+
+  /**
+   * @generated from enum value: DECISION_DENY = 2;
+   */
+  DENY = 2,
+
+  /**
+   * No applicable policies
+   *
+   * @generated from enum value: DECISION_NO_DECISION = 3;
+   */
+  NO_DECISION = 3,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.Decision.
+ */
+export const DecisionSchema: GenEnum<Decision> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_access_control, 2);
+
+/**
+ * AccessControlService manages Cedar access control policies.
+ * Policies define fine-grained authorization rules for AI Gateway resources.
+ * Resource name: workspaces/{workspace}/access-policies/{policy}
+ *
+ * @generated from service redpanda.api.aigateway.v1.AccessControlService
+ */
+export const AccessControlService: GenService<{
+  /**
+   * Creates a new Cedar policy.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.CreatePolicy
+   */
+  createPolicy: {
+    methodKind: "unary";
+    input: typeof CreatePolicyRequestSchema;
+    output: typeof CreatePolicyResponseSchema;
+  },
+  /**
+   * Gets a policy by name.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.GetPolicy
+   */
+  getPolicy: {
+    methodKind: "unary";
+    input: typeof GetPolicyRequestSchema;
+    output: typeof GetPolicyResponseSchema;
+  },
+  /**
+   * Lists policies within a workspace.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.ListPolicies
+   */
+  listPolicies: {
+    methodKind: "unary";
+    input: typeof ListPoliciesRequestSchema;
+    output: typeof ListPoliciesResponseSchema;
+  },
+  /**
+   * Updates a policy.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.UpdatePolicy
+   */
+  updatePolicy: {
+    methodKind: "unary";
+    input: typeof UpdatePolicyRequestSchema;
+    output: typeof UpdatePolicyResponseSchema;
+  },
+  /**
+   * Deletes a policy.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.DeletePolicy
+   */
+  deletePolicy: {
+    methodKind: "unary";
+    input: typeof DeletePolicyRequestSchema;
+    output: typeof DeletePolicyResponseSchema;
+  },
+  /**
+   * Validates a Cedar policy without saving it.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.ValidatePolicy
+   */
+  validatePolicy: {
+    methodKind: "unary";
+    input: typeof ValidatePolicyRequestSchema;
+    output: typeof ValidatePolicyResponseSchema;
+  },
+  /**
+   * Evaluates an authorization request against policies.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.EvaluateAccess
+   */
+  evaluateAccess: {
+    methodKind: "unary";
+    input: typeof EvaluateAccessRequestSchema;
+    output: typeof EvaluateAccessResponseSchema;
+  },
+  /**
+   * Lists policy versions (audit trail).
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.ListPolicyVersions
+   */
+  listPolicyVersions: {
+    methodKind: "unary";
+    input: typeof ListPolicyVersionsRequestSchema;
+    output: typeof ListPolicyVersionsResponseSchema;
+  },
+  /**
+   * Gets available entities for policy authoring (autocomplete).
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccessControlService.GetPolicyEntities
+   */
+  getPolicyEntities: {
+    methodKind: "unary";
+    input: typeof GetPolicyEntitiesRequestSchema;
+    output: typeof GetPolicyEntitiesResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_access_control, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/account-AccountService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/account-AccountService_connectquery.ts
new file mode 100644
index 0000000000..ff5ca38f82
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/account-AccountService_connectquery.ts
@@ -0,0 +1,57 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/account.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { AccountService } from "./account_pb";
+
+/**
+ * Creates a new account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccountService.CreateAccount
+ */
+export const createAccount = AccountService.method.createAccount;
+
+/**
+ * Gets an account by name.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccountService.GetAccount
+ */
+export const getAccount = AccountService.method.getAccount;
+
+/**
+ * Lists accounts.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccountService.ListAccounts
+ */
+export const listAccounts = AccountService.method.listAccounts;
+
+/**
+ * Updates an account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccountService.UpdateAccount
+ */
+export const updateAccount = AccountService.method.updateAccount;
+
+/**
+ * Deletes an account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccountService.DeleteAccount
+ */
+export const deleteAccount = AccountService.method.deleteAccount;
+
+/**
+ * Sets the license key for an account.
+ * The license key is a JWT token signed by Redpanda.
+ * This operation will validate the JWT and store it encrypted at rest.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccountService.SetAccountLicense
+ */
+export const setAccountLicense = AccountService.method.setAccountLicense;
+
+/**
+ * Gets the current license information for an account.
+ * Returns the decoded license info without the encrypted key.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AccountService.GetAccountLicense
+ */
+export const getAccountLicense = AccountService.method.getAccountLicense;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/account_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/account_pb.ts
new file mode 100644
index 0000000000..c1a0aeb25e
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/account_pb.ts
@@ -0,0 +1,671 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/account.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_struct, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { JsonObject, Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/account.proto.
+ */
+export const file_redpanda_api_aigateway_v1_account: GenFile = /*@__PURE__*/
+  fileDesc("CidyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2FjY291bnQucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEikgIKC0xpY2Vuc2VJbmZvEjkKBHR5cGUYASABKA4yJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpY2Vuc2VUeXBlQgPgQQMSMwoKZXhwaXJlc19hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIyCglpc3N1ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSLgoIZmVhdHVyZXMYBCABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0QgPgQQMSEgoFdmFsaWQYBSABKAhCA+BBAxIbCg5zdGF0dXNfbWVzc2FnZRgGIAEoCUID4EEDIt8ECgdBY2NvdW50EhEKBG5hbWUYASABKAlCA+BBCBIjCgxkaXNwbGF5X25hbWUYAiABKAlCDeBBArpIB3IFEAEY/wESGAoLZGVzY3JpcHRpb24YAyABKAlCA+BBARIPCgdlbmFibGVkGAQgASgIEiEKDWJpbGxpbmdfZW1haWwYBSABKAlCCuBBArpIBHICYAESNQoPYmlsbGluZ19hZGRyZXNzGAYgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEID4EEBEhMKBnRheF9pZBgHIAEoCUID4EEBEkIKCG1ldGFkYXRhGAggAygLMjAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY2NvdW50Lk1ldGFkYXRhRW50cnkSNAoLY3JlYXRlX3RpbWUYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSNAoLdXBkYXRlX3RpbWUYCiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSFAoHY3JlYXRvchgLIAEoCUID4EEDEhQKB3VwZGF0ZXIYDCABKAlCA+BBAxI8CgdsaWNlbnNlGA0gASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaWNlbnNlSW5mb0ID4EEDGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATo36kE0Ch5haWdhdGV3YXkucmVkcGFuZGEuY29tL0FjY291bnQSEmFjY291bnRzL3thY2NvdW50fSJiChRDcmVhdGVBY2NvdW50UmVxdWVzdBI4CgdhY2NvdW50GAIgASgLMiIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY2NvdW50QgPgQQJKBAgBEAJSCmFjY291bnRfaWQiTAoVQ3JlYXRlQWNjb3VudFJlc3BvbnNlEjMKB2FjY291bnQYASABKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkFjY291bnQiSQoRR2V0QWNjb3VudFJlcXVlc3QSNAoEbmFtZRgBIAEoCUIm4EEC+kEgCh5haWdhdGV3YXkucmVkcGFuZGEuY29tL0FjY291bnQiSQoSR2V0QWNjb3VudFJlc3BvbnNlEjMKB2FjY291bnQYASABKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkFjY291bnQifAoTTGlzdEFjY291bnRzUmVxdWVzdBIgCglwYWdlX3NpemUYASABKAVCDeBBAbpIBxoFGOgHKAASFwoKcGFnZV90b2tlbhgCIAEoCUID4EEBEhMKBmZpbHRlchgDIAEoCUID4EEBEhUKCG9yZGVyX2J5GAQgASgJQgPgQQEieQoUTGlzdEFjY291bnRzUmVzcG9uc2USNAoIYWNjb3VudHMYASADKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkFjY291bnQSFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJEhIKCnRvdGFsX3NpemUYAyABKAUihgEKFFVwZGF0ZUFjY291bnRSZXF1ZXN0EjgKB2FjY291bnQYASABKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkFjY291bnRCA+BBAhI0Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCA+BBASJMChVVcGRhdGVBY2NvdW50UmVzcG9uc2USMwoHYWNjb3VudBgBIAEoCzIiLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQWNjb3VudCJgChREZWxldGVBY2NvdW50UmVxdWVzdBI0CgRuYW1lGAEgASgJQibgQQL6QSAKHmFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vQWNjb3VudBISCgVmb3JjZRgCIAEoCEID4EEBIhcKFURlbGV0ZUFjY291bnRSZXNwb25zZSJxChhTZXRBY2NvdW50TGljZW5zZVJlcXVlc3QSNAoEbmFtZRgBIAEoCUIm4EEC+kEgCh5haWdhdGV3YXkucmVkcGFuZGEuY29tL0FjY291bnQSHwoLbGljZW5zZV9rZXkYAiABKAlCCuBBArpIBHICEAEiVAoZU2V0QWNjb3VudExpY2Vuc2VSZXNwb25zZRI3CgdsaWNlbnNlGAEgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaWNlbnNlSW5mbyJQChhHZXRBY2NvdW50TGljZW5zZVJlcXVlc3QSNAoEbmFtZRgBIAEoCUIm4EEC+kEgCh5haWdhdGV3YXkucmVkcGFuZGEuY29tL0FjY291bnQiVAoZR2V0QWNjb3VudExpY2Vuc2VSZXNwb25zZRI3CgdsaWNlbnNlGAEgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaWNlbnNlSW5mbyqbAQoLTGljZW5zZVR5cGUSHAoYTElDRU5TRV9UWVBFX1VOU1BFQ0lGSUVEEAASFgoSTElDRU5TRV9UWVBFX1RSSUFMEAESHQoZTElDRU5TRV9UWVBFX1BST0ZFU1NJT05BTBACEhsKF0xJQ0VOU0VfVFlQRV9FTlRFUlBSSVNFEAMSGgoWTElDRU5TRV9UWVBFX1VOTElNSVRFRBAEMuEICg5BY2NvdW50U2VydmljZRKRAQoNQ3JlYXRlQWNjb3VudBIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlQWNjb3VudFJlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNyZWF0ZUFjY291bnRSZXNwb25zZSIdgtPkkwIXOgdhY2NvdW50IgwvdjEvYWNjb3VudHMSiAEKCkdldEFjY291bnQSLC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldEFjY291bnRSZXF1ZXN0Gi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRBY2NvdW50UmVzcG9uc2UiHYLT5JMCFxIVL3YxL3tuYW1lPWFjY291bnRzLyp9EoUBCgxMaXN0QWNjb3VudHMSLi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RBY2NvdW50c1JlcXVlc3QaLy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RBY2NvdW50c1Jlc3BvbnNlIhSC0+STAg4SDC92MS9hY2NvdW50cxKiAQoNVXBkYXRlQWNjb3VudBIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlQWNjb3VudFJlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZUFjY291bnRSZXNwb25zZSIugtPkkwIoOgdhY2NvdW50Mh0vdjEve2FjY291bnQubmFtZT1hY2NvdW50cy8qfRKRAQoNRGVsZXRlQWNjb3VudBIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlQWNjb3VudFJlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZUFjY291bnRSZXNwb25zZSIdgtPkkwIXKhUvdjEve25hbWU9YWNjb3VudHMvKn0SqwEKEVNldEFjY291bnRMaWNlbnNlEjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5TZXRBY2NvdW50TGljZW5zZVJlcXVlc3QaNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNldEFjY291bnRMaWNlbnNlUmVzcG9uc2UiK4LT5JMCJToBKiIgL3YxL3tuYW1lPWFjY291bnRzLyp9OnNldExpY2Vuc2USpQEKEUdldEFjY291bnRMaWNlbnNlEjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRBY2NvdW50TGljZW5zZVJlcXVlc3QaNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldEFjY291bnRMaWNlbnNlUmVzcG9uc2UiJYLT5JMCHxIdL3YxL3tuYW1lPWFjY291bnRzLyp9L2xpY2Vuc2UaGcpBFmFpZ2F0ZXdheS5yZWRwYW5kYS5jb21CgQIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQgxBY2NvdW50UHJvdG9QAVpLZ28ucGFuZGEuZGV2L3JlZHBhbmRhLWFpZ3cvcHJvdG9zL2dlbi9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxO2FpZ2F0ZXdheXYxogIDUkFBqgIZUmVkcGFuZGEuQXBpLkFpZ2F0ZXdheS5WMcoCGVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjHiAiVSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYxXEdQQk1ldGFkYXRh6gIcUmVkcGFuZGE6OkFwaTo6QWlnYXRld2F5OjpWMWIGcHJvdG8z", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_struct, file_google_protobuf_timestamp]);
+
+/**
+ * License information for an account.
+ * License keys are JWT tokens signed by Redpanda and encrypted at rest.
+ *
+ * @generated from message redpanda.api.aigateway.v1.LicenseInfo
+ */
+export type LicenseInfo = Message<"redpanda.api.aigateway.v1.LicenseInfo"> & {
+  /**
+   * License type/tier
+   *
+   * @generated from field: redpanda.api.aigateway.v1.LicenseType type = 1;
+   */
+  type: LicenseType;
+
+  /**
+   * When the license expires (null for perpetual licenses)
+   *
+   * @generated from field: google.protobuf.Timestamp expires_at = 2;
+   */
+  expiresAt?: Timestamp;
+
+  /**
+   * When the license was issued
+   *
+   * @generated from field: google.protobuf.Timestamp issued_at = 3;
+   */
+  issuedAt?: Timestamp;
+
+  /**
+   * Licensed features and their limits
+   * Example: {"max_gateways": 10, "max_requests_per_day": 1000000, "sso_enabled": true}
+   *
+   * @generated from field: google.protobuf.Struct features = 4;
+   */
+  features?: JsonObject;
+
+  /**
+   * Whether the license is currently valid
+   *
+   * @generated from field: bool valid = 5;
+   */
+  valid: boolean;
+
+  /**
+   * Human-readable license status message
+   *
+   * @generated from field: string status_message = 6;
+   */
+  statusMessage: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.LicenseInfo.
+ * Use `create(LicenseInfoSchema)` to create a new message.
+ */
+export const LicenseInfoSchema: GenMessage<LicenseInfo> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 0);
+
+/**
+ * Account represents a top-level billing entity.
+ * Accounts contain organizations and serve as the billing boundary in multi-tenant SaaS.
+ * Each account has an associated license key from Redpanda.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Account
+ */
+export type Account = Message<"redpanda.api.aigateway.v1.Account"> & {
+  /**
+   * Resource name. Format: `accounts/{account_id}`
+   * Account ID is a globally unique, sortable identifier (XID).
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name (must be unique)
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Whether this account is active
+   *
+   * @generated from field: bool enabled = 4;
+   */
+  enabled: boolean;
+
+  /**
+   * Required: Billing email address
+   *
+   * @generated from field: string billing_email = 5;
+   */
+  billingEmail: string;
+
+  /**
+   * Optional: Billing address as structured JSON
+   *
+   * @generated from field: google.protobuf.Struct billing_address = 6;
+   */
+  billingAddress?: JsonObject;
+
+  /**
+   * Optional: Tax identification number
+   *
+   * @generated from field: string tax_id = 7;
+   */
+  taxId: string;
+
+  /**
+   * Metadata for arbitrary key-value pairs
+   *
+   * @generated from field: map<string, string> metadata = 8;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 9;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 10;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Creator (API key or OIDC subject)
+   *
+   * @generated from field: string creator = 11;
+   */
+  creator: string;
+
+  /**
+   * Output only. Last updater (API key or OIDC subject)
+   *
+   * @generated from field: string updater = 12;
+   */
+  updater: string;
+
+  /**
+   * Output only. License information for this account.
+   * License keys are JWT tokens signed by Redpanda, stored encrypted at rest.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.LicenseInfo license = 13;
+   */
+  license?: LicenseInfo;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Account.
+ * Use `create(AccountSchema)` to create a new message.
+ */
+export const AccountSchema: GenMessage<Account> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 1);
+
+/**
+ * Request message for CreateAccount RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateAccountRequest
+ */
+export type CreateAccountRequest = Message<"redpanda.api.aigateway.v1.CreateAccountRequest"> & {
+  /**
+   * Required: The account resource to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Account account = 2;
+   */
+  account?: Account;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateAccountRequest.
+ * Use `create(CreateAccountRequestSchema)` to create a new message.
+ */
+export const CreateAccountRequestSchema: GenMessage<CreateAccountRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 2);
+
+/**
+ * Response message for CreateAccount RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateAccountResponse
+ */
+export type CreateAccountResponse = Message<"redpanda.api.aigateway.v1.CreateAccountResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Account account = 1;
+   */
+  account?: Account;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateAccountResponse.
+ * Use `create(CreateAccountResponseSchema)` to create a new message.
+ */
+export const CreateAccountResponseSchema: GenMessage<CreateAccountResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 3);
+
+/**
+ * Request message for GetAccount RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetAccountRequest
+ */
+export type GetAccountRequest = Message<"redpanda.api.aigateway.v1.GetAccountRequest"> & {
+  /**
+   * Resource name of the account.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetAccountRequest.
+ * Use `create(GetAccountRequestSchema)` to create a new message.
+ */
+export const GetAccountRequestSchema: GenMessage<GetAccountRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 4);
+
+/**
+ * Response message for GetAccount RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetAccountResponse
+ */
+export type GetAccountResponse = Message<"redpanda.api.aigateway.v1.GetAccountResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Account account = 1;
+   */
+  account?: Account;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetAccountResponse.
+ * Use `create(GetAccountResponseSchema)` to create a new message.
+ */
+export const GetAccountResponseSchema: GenMessage<GetAccountResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 5);
+
+/**
+ * Request message for ListAccounts RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListAccountsRequest
+ */
+export type ListAccountsRequest = Message<"redpanda.api.aigateway.v1.ListAccountsRequest"> & {
+  /**
+   * Maximum number of accounts to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 1;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous ListAccounts call
+   *
+   * @generated from field: string page_token = 2;
+   */
+  pageToken: string;
+
+  /**
+   * Filter expression (CEL syntax)
+   * Examples:
+   *   enabled == true
+   *   display_name == "production"
+   *   billing_email.endsWith("@example.com")
+   *
+   * @generated from field: string filter = 3;
+   */
+  filter: string;
+
+  /**
+   * Comma-separated list of fields to order by
+   * Examples: "create_time desc", "display_name"
+   *
+   * @generated from field: string order_by = 4;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListAccountsRequest.
+ * Use `create(ListAccountsRequestSchema)` to create a new message.
+ */
+export const ListAccountsRequestSchema: GenMessage<ListAccountsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 6);
+
+/**
+ * Response message for ListAccounts RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListAccountsResponse
+ */
+export type ListAccountsResponse = Message<"redpanda.api.aigateway.v1.ListAccountsResponse"> & {
+  /**
+   * The list of accounts
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.Account accounts = 1;
+   */
+  accounts: Account[];
+
+  /**
+   * Token for next page (empty if no more pages)
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count of matching accounts
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListAccountsResponse.
+ * Use `create(ListAccountsResponseSchema)` to create a new message.
+ */
+export const ListAccountsResponseSchema: GenMessage<ListAccountsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 7);
+
+/**
+ * Request message for UpdateAccount RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateAccountRequest
+ */
+export type UpdateAccountRequest = Message<"redpanda.api.aigateway.v1.UpdateAccountRequest"> & {
+  /**
+   * Required: The account resource to update.
+   * The account's name field is used to identify the resource.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Account account = 1;
+   */
+  account?: Account;
+
+  /**
+   * The fields to update.
+   * If omitted, all mutable fields are updated.
+   * Allowed fields: display_name, description, enabled, billing_email, billing_address, tax_id, metadata
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateAccountRequest.
+ * Use `create(UpdateAccountRequestSchema)` to create a new message.
+ */
+export const UpdateAccountRequestSchema: GenMessage<UpdateAccountRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 8);
+
+/**
+ * Response message for UpdateAccount RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateAccountResponse
+ */
+export type UpdateAccountResponse = Message<"redpanda.api.aigateway.v1.UpdateAccountResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Account account = 1;
+   */
+  account?: Account;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateAccountResponse.
+ * Use `create(UpdateAccountResponseSchema)` to create a new message.
+ */
+export const UpdateAccountResponseSchema: GenMessage<UpdateAccountResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 9);
+
+/**
+ * Request message for DeleteAccount RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteAccountRequest
+ */
+export type DeleteAccountRequest = Message<"redpanda.api.aigateway.v1.DeleteAccountRequest"> & {
+  /**
+   * Resource name of the account to delete.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * If true, cascade delete all child resources (organizations, workspaces, etc.)
+   *
+   * @generated from field: bool force = 2;
+   */
+  force: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteAccountRequest.
+ * Use `create(DeleteAccountRequestSchema)` to create a new message.
+ */
+export const DeleteAccountRequestSchema: GenMessage<DeleteAccountRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 10);
+
+/**
+ * Response message for DeleteAccount RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteAccountResponse
+ */
+export type DeleteAccountResponse = Message<"redpanda.api.aigateway.v1.DeleteAccountResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteAccountResponse.
+ * Use `create(DeleteAccountResponseSchema)` to create a new message.
+ */
+export const DeleteAccountResponseSchema: GenMessage<DeleteAccountResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 11);
+
+/**
+ * Request message for SetAccountLicense RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.SetAccountLicenseRequest
+ */
+export type SetAccountLicenseRequest = Message<"redpanda.api.aigateway.v1.SetAccountLicenseRequest"> & {
+  /**
+   * Resource name of the account.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * The JWT license key signed by Redpanda.
+   * This will be validated and stored encrypted at rest.
+   *
+   * @generated from field: string license_key = 2;
+   */
+  licenseKey: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SetAccountLicenseRequest.
+ * Use `create(SetAccountLicenseRequestSchema)` to create a new message.
+ */
+export const SetAccountLicenseRequestSchema: GenMessage<SetAccountLicenseRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 12);
+
+/**
+ * Response message for SetAccountLicense RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.SetAccountLicenseResponse
+ */
+export type SetAccountLicenseResponse = Message<"redpanda.api.aigateway.v1.SetAccountLicenseResponse"> & {
+  /**
+   * The updated license information
+   *
+   * @generated from field: redpanda.api.aigateway.v1.LicenseInfo license = 1;
+   */
+  license?: LicenseInfo;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SetAccountLicenseResponse.
+ * Use `create(SetAccountLicenseResponseSchema)` to create a new message.
+ */
+export const SetAccountLicenseResponseSchema: GenMessage<SetAccountLicenseResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 13);
+
+/**
+ * Request message for GetAccountLicense RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetAccountLicenseRequest
+ */
+export type GetAccountLicenseRequest = Message<"redpanda.api.aigateway.v1.GetAccountLicenseRequest"> & {
+  /**
+   * Resource name of the account.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetAccountLicenseRequest.
+ * Use `create(GetAccountLicenseRequestSchema)` to create a new message.
+ */
+export const GetAccountLicenseRequestSchema: GenMessage<GetAccountLicenseRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 14);
+
+/**
+ * Response message for GetAccountLicense RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetAccountLicenseResponse
+ */
+export type GetAccountLicenseResponse = Message<"redpanda.api.aigateway.v1.GetAccountLicenseResponse"> & {
+  /**
+   * The license information for the account
+   *
+   * @generated from field: redpanda.api.aigateway.v1.LicenseInfo license = 1;
+   */
+  license?: LicenseInfo;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetAccountLicenseResponse.
+ * Use `create(GetAccountLicenseResponseSchema)` to create a new message.
+ */
+export const GetAccountLicenseResponseSchema: GenMessage<GetAccountLicenseResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_account, 15);
+
+/**
+ * LicenseType represents the license tier for an account.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.LicenseType
+ */
+export enum LicenseType {
+  /**
+   * Unspecified license type
+   *
+   * @generated from enum value: LICENSE_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Trial license - limited features, time-limited
+   *
+   * @generated from enum value: LICENSE_TYPE_TRIAL = 1;
+   */
+  TRIAL = 1,
+
+  /**
+   * Professional license - standard features
+   *
+   * @generated from enum value: LICENSE_TYPE_PROFESSIONAL = 2;
+   */
+  PROFESSIONAL = 2,
+
+  /**
+   * Enterprise license - full features, SLA support
+   *
+   * @generated from enum value: LICENSE_TYPE_ENTERPRISE = 3;
+   */
+  ENTERPRISE = 3,
+
+  /**
+   * Unlimited license - no restrictions
+   *
+   * @generated from enum value: LICENSE_TYPE_UNLIMITED = 4;
+   */
+  UNLIMITED = 4,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.LicenseType.
+ */
+export const LicenseTypeSchema: GenEnum<LicenseType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_account, 0);
+
+/**
+ * AccountService manages accounts - top-level billing entities.
+ * An account contains one or more organizations and serves as the billing boundary.
+ * Resource name: accounts/{account_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.AccountService
+ */
+export const AccountService: GenService<{
+  /**
+   * Creates a new account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccountService.CreateAccount
+   */
+  createAccount: {
+    methodKind: "unary";
+    input: typeof CreateAccountRequestSchema;
+    output: typeof CreateAccountResponseSchema;
+  },
+  /**
+   * Gets an account by name.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccountService.GetAccount
+   */
+  getAccount: {
+    methodKind: "unary";
+    input: typeof GetAccountRequestSchema;
+    output: typeof GetAccountResponseSchema;
+  },
+  /**
+   * Lists accounts.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccountService.ListAccounts
+   */
+  listAccounts: {
+    methodKind: "unary";
+    input: typeof ListAccountsRequestSchema;
+    output: typeof ListAccountsResponseSchema;
+  },
+  /**
+   * Updates an account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccountService.UpdateAccount
+   */
+  updateAccount: {
+    methodKind: "unary";
+    input: typeof UpdateAccountRequestSchema;
+    output: typeof UpdateAccountResponseSchema;
+  },
+  /**
+   * Deletes an account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccountService.DeleteAccount
+   */
+  deleteAccount: {
+    methodKind: "unary";
+    input: typeof DeleteAccountRequestSchema;
+    output: typeof DeleteAccountResponseSchema;
+  },
+  /**
+   * Sets the license key for an account.
+   * The license key is a JWT token signed by Redpanda.
+   * This operation will validate the JWT and store it encrypted at rest.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccountService.SetAccountLicense
+   */
+  setAccountLicense: {
+    methodKind: "unary";
+    input: typeof SetAccountLicenseRequestSchema;
+    output: typeof SetAccountLicenseResponseSchema;
+  },
+  /**
+   * Gets the current license information for an account.
+   * Returns the decoded license info without the encrypted key.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AccountService.GetAccountLicense
+   */
+  getAccountLicense: {
+    methodKind: "unary";
+    input: typeof GetAccountLicenseRequestSchema;
+    output: typeof GetAccountLicenseResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_account, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/analytics-AnalyticsService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/analytics-AnalyticsService_connectquery.ts
new file mode 100644
index 0000000000..36e1ee111f
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/analytics-AnalyticsService_connectquery.ts
@@ -0,0 +1,37 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/analytics.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { AnalyticsService } from "./analytics_pb";
+
+/**
+ * GetSpendingSummary returns high-level spending metrics for the dashboard.
+ * Includes total cost, requests, tokens, and trends compared to previous period.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AnalyticsService.GetSpendingSummary
+ */
+export const getSpendingSummary = AnalyticsService.method.getSpendingSummary;
+
+/**
+ * GetSpendingTimeSeries returns spending over time for line charts.
+ * Automatically selects granularity (hour/day/week) based on time range.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AnalyticsService.GetSpendingTimeSeries
+ */
+export const getSpendingTimeSeries = AnalyticsService.method.getSpendingTimeSeries;
+
+/**
+ * GetSpendingBreakdown returns spending grouped by a dimension (provider, model, etc).
+ * Used for pie charts and bar charts showing distribution.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AnalyticsService.GetSpendingBreakdown
+ */
+export const getSpendingBreakdown = AnalyticsService.method.getSpendingBreakdown;
+
+/**
+ * GetTopSpenders returns the highest spending entities for a given dimension.
+ * Used for tables showing top users, teams, organizations, etc.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AnalyticsService.GetTopSpenders
+ */
+export const getTopSpenders = AnalyticsService.method.getTopSpenders;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/analytics_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/analytics_pb.ts
new file mode 100644
index 0000000000..b163eaf09e
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/analytics_pb.ts
@@ -0,0 +1,947 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/analytics.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/analytics.proto.
+ */
+export const file_redpanda_api_aigateway_v1_analytics: GenFile = /*@__PURE__*/
+  fileDesc("CilyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2FuYWx5dGljcy5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSJ7Cg9TcGVuZGluZ0ZpbHRlcnMSEAoIZ2F0ZXdheXMYASADKAkSEQoJcHJvdmlkZXJzGAIgAygJEg4KBm1vZGVscxgDIAMoCRINCgV0ZWFtcxgEIAMoCRIVCg1vcmdhbml6YXRpb25zGAUgAygJEg0KBXVzZXJzGAYgAygJIo4CChlHZXRTcGVuZGluZ1N1bW1hcnlSZXF1ZXN0EkcKCnRpbWVfcmFuZ2UYASABKA4yJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRpbWVSYW5nZUIN4EECukgHggEEEAEgABIzCgpzdGFydF9kYXRlGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEBEjEKCGVuZF9kYXRlGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEBEkAKB2ZpbHRlcnMYBCABKAsyKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNwZW5kaW5nRmlsdGVyc0ID4EEBIpICChpHZXRTcGVuZGluZ1N1bW1hcnlSZXNwb25zZRJACgdjdXJyZW50GAEgASgLMioucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5TcGVuZGluZ1N1bW1hcnlCA+BBAxJBCghwcmV2aW91cxgCIAEoCzIqLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRpbmdTdW1tYXJ5QgPgQQMSPAoGdHJlbmRzGAMgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UcmVuZE1ldHJpY3NCA+BBAxIWCgl0b3BfbW9kZWwYBCABKAlCA+BBAxIZCgx0b3BfcHJvdmlkZXIYBSABKAlCA+BBAyK4AgoPU3BlbmRpbmdTdW1tYXJ5EhgKEHRvdGFsX2Nvc3RfY2VudHMYASABKAMSFgoOdG90YWxfcmVxdWVzdHMYAiABKAMSGgoSdG90YWxfaW5wdXRfdG9rZW5zGAMgASgDEhsKE3RvdGFsX291dHB1dF90b2tlbnMYBCABKAMSFAoMdG90YWxfdG9rZW5zGAUgASgDEiIKGmF2Z19jb3N0X3Blcl9yZXF1ZXN0X2NlbnRzGAYgASgDEh4KFmF2Z190b2tlbnNfcGVyX3JlcXVlc3QYByABKAMSMAoMcGVyaW9kX3N0YXJ0GAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpwZXJpb2RfZW5kGAkgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKMAQoMVHJlbmRNZXRyaWNzEhsKE2Nvc3RfY2hhbmdlX3BlcmNlbnQYASABKAESHwoXcmVxdWVzdHNfY2hhbmdlX3BlcmNlbnQYAiABKAESHQoVdG9rZW5zX2NoYW5nZV9wZXJjZW50GAMgASgBEh8KF2F2Z19jb3N0X2NoYW5nZV9wZXJjZW50GAQgASgBItMCChxHZXRTcGVuZGluZ1RpbWVTZXJpZXNSZXF1ZXN0EkcKCnRpbWVfcmFuZ2UYASABKA4yJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRpbWVSYW5nZUIN4EECukgHggEEEAEgABIzCgpzdGFydF9kYXRlGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEBEjEKCGVuZF9kYXRlGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEBEkAKB2ZpbHRlcnMYBCABKAsyKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNwZW5kaW5nRmlsdGVyc0ID4EEBEkAKC2dyYW51bGFyaXR5GAUgASgOMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HcmFudWxhcml0eUID4EEBIuwBCh1HZXRTcGVuZGluZ1RpbWVTZXJpZXNSZXNwb25zZRJICgtkYXRhX3BvaW50cxgBIAMoCzIuLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVGltZVNlcmllc0RhdGFQb2ludEID4EEDEkAKC2dyYW51bGFyaXR5GAIgASgOMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HcmFudWxhcml0eUID4EEDEj8KBnRvdGFscxgDIAEoCzIqLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRpbmdTdW1tYXJ5QgPgQQMipwEKE1RpbWVTZXJpZXNEYXRhUG9pbnQSLQoJdGltZXN0YW1wGAEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBISCgpjb3N0X2NlbnRzGAIgASgDEhAKCHJlcXVlc3RzGAMgASgDEg4KBnRva2VucxgEIAEoAxIUCgxpbnB1dF90b2tlbnMYBSABKAMSFQoNb3V0cHV0X3Rva2VucxgGIAEoAyL+AgobR2V0U3BlbmRpbmdCcmVha2Rvd25SZXF1ZXN0Ek8KCWRpbWVuc2lvbhgBIAEoDjItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQnJlYWtkb3duRGltZW5zaW9uQg3gQQK6SAeCAQQQASAAEkcKCnRpbWVfcmFuZ2UYAiABKA4yJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRpbWVSYW5nZUIN4EECukgHggEEEAEgABIzCgpzdGFydF9kYXRlGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEBEjEKCGVuZF9kYXRlGAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEBEkAKB2ZpbHRlcnMYBSABKAsyKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNwZW5kaW5nRmlsdGVyc0ID4EEBEhsKBWxpbWl0GAYgASgFQgzgQQG6SAYaBBhkKAEixQEKHEdldFNwZW5kaW5nQnJlYWtkb3duUmVzcG9uc2USPwoHZW50cmllcxgBIAMoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQnJlYWtkb3duRW50cnlCA+BBAxIdChB0b3RhbF9jb3N0X2NlbnRzGAIgASgDQgPgQQMSRQoJZGltZW5zaW9uGAMgASgOMi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5CcmVha2Rvd25EaW1lbnNpb25CA+BBAyKrAQoOQnJlYWtkb3duRW50cnkSDAoEbmFtZRgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkSEgoKY29zdF9jZW50cxgDIAEoAxIQCghyZXF1ZXN0cxgEIAEoAxIOCgZ0b2tlbnMYBSABKAMSFAoMaW5wdXRfdG9rZW5zGAYgASgDEhUKDW91dHB1dF90b2tlbnMYByABKAMSEgoKcGVyY2VudGFnZRgIIAEoASL4AgoVR2V0VG9wU3BlbmRlcnNSZXF1ZXN0Ek8KCWRpbWVuc2lvbhgBIAEoDjItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQnJlYWtkb3duRGltZW5zaW9uQg3gQQK6SAeCAQQQASAAEkcKCnRpbWVfcmFuZ2UYAiABKA4yJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRpbWVSYW5nZUIN4EECukgHggEEEAEgABIzCgpzdGFydF9kYXRlGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEBEjEKCGVuZF9kYXRlGAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEBEkAKB2ZpbHRlcnMYBSABKAsyKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNwZW5kaW5nRmlsdGVyc0ID4EEBEhsKBWxpbWl0GAYgASgFQgzgQQG6SAYaBBhkKAEioQEKFkdldFRvcFNwZW5kZXJzUmVzcG9uc2USQAoHZW50cmllcxgBIAMoCzIqLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVG9wU3BlbmRlckVudHJ5QgPgQQMSRQoJZGltZW5zaW9uGAIgASgOMi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5CcmVha2Rvd25EaW1lbnNpb25CA+BBAyLGAQoPVG9wU3BlbmRlckVudHJ5EgwKBHJhbmsYASABKAUSDAoEbmFtZRgCIAEoCRIUCgxkaXNwbGF5X25hbWUYAyABKAkSEgoKY29zdF9jZW50cxgEIAEoAxIQCghyZXF1ZXN0cxgFIAEoAxIOCgZ0b2tlbnMYBiABKAMSIgoaYXZnX2Nvc3RfcGVyX3JlcXVlc3RfY2VudHMYByABKAMSEQoJdG9wX21vZGVsGAggASgJEhQKDHRvcF9wcm92aWRlchgJIAEoCSqIAQoJVGltZVJhbmdlEhoKFlRJTUVfUkFOR0VfVU5TUEVDSUZJRUQQABIXChNUSU1FX1JBTkdFX0xBU1RfMjRIEAESFgoSVElNRV9SQU5HRV9MQVNUXzdEEAISFwoTVElNRV9SQU5HRV9MQVNUXzMwRBADEhUKEVRJTUVfUkFOR0VfQ1VTVE9NEAQq/QEKEkJyZWFrZG93bkRpbWVuc2lvbhIjCh9CUkVBS0RPV05fRElNRU5TSU9OX1VOU1BFQ0lGSUVEEAASIAocQlJFQUtET1dOX0RJTUVOU0lPTl9QUk9WSURFUhABEh0KGUJSRUFLRE9XTl9ESU1FTlNJT05fTU9ERUwQAhIfChtCUkVBS0RPV05fRElNRU5TSU9OX0dBVEVXQVkQAxIcChhCUkVBS0RPV05fRElNRU5TSU9OX1RFQU0QBBIkCiBCUkVBS0RPV05fRElNRU5TSU9OX09SR0FOSVpBVElPThAFEhwKGEJSRUFLRE9XTl9ESU1FTlNJT05fVVNFUhAGKmsKC0dyYW51bGFyaXR5EhsKF0dSQU5VTEFSSVRZX1VOU1BFQ0lGSUVEEAASFAoQR1JBTlVMQVJJVFlfSE9VUhABEhMKD0dSQU5VTEFSSVRZX0RBWRACEhQKEEdSQU5VTEFSSVRZX1dFRUsQAzLrBQoQQW5hbHl0aWNzU2VydmljZRKpAQoSR2V0U3BlbmRpbmdTdW1tYXJ5EjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRTcGVuZGluZ1N1bW1hcnlSZXF1ZXN0GjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRTcGVuZGluZ1N1bW1hcnlSZXNwb25zZSImgtPkkwIgEh4vdjEvYW5hbHl0aWNzL3NwZW5kaW5nL3N1bW1hcnkStgEKFUdldFNwZW5kaW5nVGltZVNlcmllcxI3LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0U3BlbmRpbmdUaW1lU2VyaWVzUmVxdWVzdBo4LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0U3BlbmRpbmdUaW1lU2VyaWVzUmVzcG9uc2UiKoLT5JMCJBIiL3YxL2FuYWx5dGljcy9zcGVuZGluZy90aW1lLXNlcmllcxKxAQoUR2V0U3BlbmRpbmdCcmVha2Rvd24SNi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldFNwZW5kaW5nQnJlYWtkb3duUmVxdWVzdBo3LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0U3BlbmRpbmdCcmVha2Rvd25SZXNwb25zZSIogtPkkwIiEiAvdjEvYW5hbHl0aWNzL3NwZW5kaW5nL2JyZWFrZG93bhKiAQoOR2V0VG9wU3BlbmRlcnMSMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldFRvcFNwZW5kZXJzUmVxdWVzdBoxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0VG9wU3BlbmRlcnNSZXNwb25zZSIrgtPkkwIlEiMvdjEvYW5hbHl0aWNzL3NwZW5kaW5nL3RvcC1zcGVuZGVycxoZykEWYWlnYXRld2F5LnJlZHBhbmRhLmNvbUKDAgodY29tLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjFCDkFuYWx5dGljc1Byb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_protobuf_timestamp]);
+
+/**
+ * SpendingFilters allows filtering analytics queries by multiple dimensions.
+ *
+ * @generated from message redpanda.api.aigateway.v1.SpendingFilters
+ */
+export type SpendingFilters = Message<"redpanda.api.aigateway.v1.SpendingFilters"> & {
+  /**
+   * Optional: Filter by specific gateways
+   *
+   * @generated from field: repeated string gateways = 1;
+   */
+  gateways: string[];
+
+  /**
+   * Optional: Filter by specific providers
+   *
+   * @generated from field: repeated string providers = 2;
+   */
+  providers: string[];
+
+  /**
+   * Optional: Filter by specific models
+   *
+   * @generated from field: repeated string models = 3;
+   */
+  models: string[];
+
+  /**
+   * Optional: Filter by specific teams (JSONB extraction)
+   *
+   * @generated from field: repeated string teams = 4;
+   */
+  teams: string[];
+
+  /**
+   * Optional: Filter by specific organizations (JSONB extraction)
+   *
+   * @generated from field: repeated string organizations = 5;
+   */
+  organizations: string[];
+
+  /**
+   * Optional: Filter by specific users (JSONB extraction)
+   *
+   * @generated from field: repeated string users = 6;
+   */
+  users: string[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SpendingFilters.
+ * Use `create(SpendingFiltersSchema)` to create a new message.
+ */
+export const SpendingFiltersSchema: GenMessage<SpendingFilters> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 0);
+
+/**
+ * Request message for GetSpendingSummary
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSpendingSummaryRequest
+ */
+export type GetSpendingSummaryRequest = Message<"redpanda.api.aigateway.v1.GetSpendingSummaryRequest"> & {
+  /**
+   * Required: Time range for the summary
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TimeRange time_range = 1;
+   */
+  timeRange: TimeRange;
+
+  /**
+   * Optional: Custom start date (required if time_range = CUSTOM)
+   *
+   * @generated from field: google.protobuf.Timestamp start_date = 2;
+   */
+  startDate?: Timestamp;
+
+  /**
+   * Optional: Custom end date (required if time_range = CUSTOM)
+   *
+   * @generated from field: google.protobuf.Timestamp end_date = 3;
+   */
+  endDate?: Timestamp;
+
+  /**
+   * Optional: Filters to apply
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SpendingFilters filters = 4;
+   */
+  filters?: SpendingFilters;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendingSummaryRequest.
+ * Use `create(GetSpendingSummaryRequestSchema)` to create a new message.
+ */
+export const GetSpendingSummaryRequestSchema: GenMessage<GetSpendingSummaryRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 1);
+
+/**
+ * Response message for GetSpendingSummary
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSpendingSummaryResponse
+ */
+export type GetSpendingSummaryResponse = Message<"redpanda.api.aigateway.v1.GetSpendingSummaryResponse"> & {
+  /**
+   * Current period metrics
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SpendingSummary current = 1;
+   */
+  current?: SpendingSummary;
+
+  /**
+   * Previous period metrics (for trend calculation)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SpendingSummary previous = 2;
+   */
+  previous?: SpendingSummary;
+
+  /**
+   * Percentage change from previous period
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TrendMetrics trends = 3;
+   */
+  trends?: TrendMetrics;
+
+  /**
+   * Top model by cost in current period
+   *
+   * @generated from field: string top_model = 4;
+   */
+  topModel: string;
+
+  /**
+   * Top provider by cost in current period
+   *
+   * @generated from field: string top_provider = 5;
+   */
+  topProvider: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendingSummaryResponse.
+ * Use `create(GetSpendingSummaryResponseSchema)` to create a new message.
+ */
+export const GetSpendingSummaryResponseSchema: GenMessage<GetSpendingSummaryResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 2);
+
+/**
+ * SpendingSummary contains aggregated metrics for a time period.
+ *
+ * @generated from message redpanda.api.aigateway.v1.SpendingSummary
+ */
+export type SpendingSummary = Message<"redpanda.api.aigateway.v1.SpendingSummary"> & {
+  /**
+   * Total cost in cents
+   *
+   * @generated from field: int64 total_cost_cents = 1;
+   */
+  totalCostCents: bigint;
+
+  /**
+   * Total number of requests
+   *
+   * @generated from field: int64 total_requests = 2;
+   */
+  totalRequests: bigint;
+
+  /**
+   * Total input tokens
+   *
+   * @generated from field: int64 total_input_tokens = 3;
+   */
+  totalInputTokens: bigint;
+
+  /**
+   * Total output tokens
+   *
+   * @generated from field: int64 total_output_tokens = 4;
+   */
+  totalOutputTokens: bigint;
+
+  /**
+   * Total tokens (input + output)
+   *
+   * @generated from field: int64 total_tokens = 5;
+   */
+  totalTokens: bigint;
+
+  /**
+   * Average cost per request in cents
+   *
+   * @generated from field: int64 avg_cost_per_request_cents = 6;
+   */
+  avgCostPerRequestCents: bigint;
+
+  /**
+   * Average tokens per request
+   *
+   * @generated from field: int64 avg_tokens_per_request = 7;
+   */
+  avgTokensPerRequest: bigint;
+
+  /**
+   * Period start time
+   *
+   * @generated from field: google.protobuf.Timestamp period_start = 8;
+   */
+  periodStart?: Timestamp;
+
+  /**
+   * Period end time
+   *
+   * @generated from field: google.protobuf.Timestamp period_end = 9;
+   */
+  periodEnd?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SpendingSummary.
+ * Use `create(SpendingSummarySchema)` to create a new message.
+ */
+export const SpendingSummarySchema: GenMessage<SpendingSummary> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 3);
+
+/**
+ * TrendMetrics contains percentage changes compared to previous period.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TrendMetrics
+ */
+export type TrendMetrics = Message<"redpanda.api.aigateway.v1.TrendMetrics"> & {
+  /**
+   * Cost change percentage (-100 to +infinity)
+   *
+   * @generated from field: double cost_change_percent = 1;
+   */
+  costChangePercent: number;
+
+  /**
+   * Requests change percentage
+   *
+   * @generated from field: double requests_change_percent = 2;
+   */
+  requestsChangePercent: number;
+
+  /**
+   * Tokens change percentage
+   *
+   * @generated from field: double tokens_change_percent = 3;
+   */
+  tokensChangePercent: number;
+
+  /**
+   * Average cost per request change percentage
+   *
+   * @generated from field: double avg_cost_change_percent = 4;
+   */
+  avgCostChangePercent: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TrendMetrics.
+ * Use `create(TrendMetricsSchema)` to create a new message.
+ */
+export const TrendMetricsSchema: GenMessage<TrendMetrics> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 4);
+
+/**
+ * Request message for GetSpendingTimeSeries
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSpendingTimeSeriesRequest
+ */
+export type GetSpendingTimeSeriesRequest = Message<"redpanda.api.aigateway.v1.GetSpendingTimeSeriesRequest"> & {
+  /**
+   * Required: Time range
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TimeRange time_range = 1;
+   */
+  timeRange: TimeRange;
+
+  /**
+   * Optional: Custom start date (required if time_range = CUSTOM)
+   *
+   * @generated from field: google.protobuf.Timestamp start_date = 2;
+   */
+  startDate?: Timestamp;
+
+  /**
+   * Optional: Custom end date (required if time_range = CUSTOM)
+   *
+   * @generated from field: google.protobuf.Timestamp end_date = 3;
+   */
+  endDate?: Timestamp;
+
+  /**
+   * Optional: Filters to apply
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SpendingFilters filters = 4;
+   */
+  filters?: SpendingFilters;
+
+  /**
+   * Optional: Granularity (auto-selected if not specified)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Granularity granularity = 5;
+   */
+  granularity: Granularity;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendingTimeSeriesRequest.
+ * Use `create(GetSpendingTimeSeriesRequestSchema)` to create a new message.
+ */
+export const GetSpendingTimeSeriesRequestSchema: GenMessage<GetSpendingTimeSeriesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 5);
+
+/**
+ * Response message for GetSpendingTimeSeries
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSpendingTimeSeriesResponse
+ */
+export type GetSpendingTimeSeriesResponse = Message<"redpanda.api.aigateway.v1.GetSpendingTimeSeriesResponse"> & {
+  /**
+   * Time series data points
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.TimeSeriesDataPoint data_points = 1;
+   */
+  dataPoints: TimeSeriesDataPoint[];
+
+  /**
+   * Granularity used for the time series
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Granularity granularity = 2;
+   */
+  granularity: Granularity;
+
+  /**
+   * Total metrics across all data points
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SpendingSummary totals = 3;
+   */
+  totals?: SpendingSummary;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendingTimeSeriesResponse.
+ * Use `create(GetSpendingTimeSeriesResponseSchema)` to create a new message.
+ */
+export const GetSpendingTimeSeriesResponseSchema: GenMessage<GetSpendingTimeSeriesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 6);
+
+/**
+ * TimeSeriesDataPoint represents metrics for a single time bucket.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TimeSeriesDataPoint
+ */
+export type TimeSeriesDataPoint = Message<"redpanda.api.aigateway.v1.TimeSeriesDataPoint"> & {
+  /**
+   * Timestamp for this bucket (start of period)
+   *
+   * @generated from field: google.protobuf.Timestamp timestamp = 1;
+   */
+  timestamp?: Timestamp;
+
+  /**
+   * Cost in cents for this period
+   *
+   * @generated from field: int64 cost_cents = 2;
+   */
+  costCents: bigint;
+
+  /**
+   * Number of requests in this period
+   *
+   * @generated from field: int64 requests = 3;
+   */
+  requests: bigint;
+
+  /**
+   * Total tokens in this period
+   *
+   * @generated from field: int64 tokens = 4;
+   */
+  tokens: bigint;
+
+  /**
+   * Input tokens in this period
+   *
+   * @generated from field: int64 input_tokens = 5;
+   */
+  inputTokens: bigint;
+
+  /**
+   * Output tokens in this period
+   *
+   * @generated from field: int64 output_tokens = 6;
+   */
+  outputTokens: bigint;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TimeSeriesDataPoint.
+ * Use `create(TimeSeriesDataPointSchema)` to create a new message.
+ */
+export const TimeSeriesDataPointSchema: GenMessage<TimeSeriesDataPoint> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 7);
+
+/**
+ * Request message for GetSpendingBreakdown
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSpendingBreakdownRequest
+ */
+export type GetSpendingBreakdownRequest = Message<"redpanda.api.aigateway.v1.GetSpendingBreakdownRequest"> & {
+  /**
+   * Required: Dimension to break down by
+   *
+   * @generated from field: redpanda.api.aigateway.v1.BreakdownDimension dimension = 1;
+   */
+  dimension: BreakdownDimension;
+
+  /**
+   * Required: Time range
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TimeRange time_range = 2;
+   */
+  timeRange: TimeRange;
+
+  /**
+   * Optional: Custom start date (required if time_range = CUSTOM)
+   *
+   * @generated from field: google.protobuf.Timestamp start_date = 3;
+   */
+  startDate?: Timestamp;
+
+  /**
+   * Optional: Custom end date (required if time_range = CUSTOM)
+   *
+   * @generated from field: google.protobuf.Timestamp end_date = 4;
+   */
+  endDate?: Timestamp;
+
+  /**
+   * Optional: Filters to apply
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SpendingFilters filters = 5;
+   */
+  filters?: SpendingFilters;
+
+  /**
+   * Optional: Maximum number of results (default: 20, max: 100)
+   *
+   * @generated from field: int32 limit = 6;
+   */
+  limit: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendingBreakdownRequest.
+ * Use `create(GetSpendingBreakdownRequestSchema)` to create a new message.
+ */
+export const GetSpendingBreakdownRequestSchema: GenMessage<GetSpendingBreakdownRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 8);
+
+/**
+ * Response message for GetSpendingBreakdown
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSpendingBreakdownResponse
+ */
+export type GetSpendingBreakdownResponse = Message<"redpanda.api.aigateway.v1.GetSpendingBreakdownResponse"> & {
+  /**
+   * Breakdown entries sorted by cost descending
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.BreakdownEntry entries = 1;
+   */
+  entries: BreakdownEntry[];
+
+  /**
+   * Total cost across all entries
+   *
+   * @generated from field: int64 total_cost_cents = 2;
+   */
+  totalCostCents: bigint;
+
+  /**
+   * Dimension used for breakdown
+   *
+   * @generated from field: redpanda.api.aigateway.v1.BreakdownDimension dimension = 3;
+   */
+  dimension: BreakdownDimension;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendingBreakdownResponse.
+ * Use `create(GetSpendingBreakdownResponseSchema)` to create a new message.
+ */
+export const GetSpendingBreakdownResponseSchema: GenMessage<GetSpendingBreakdownResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 9);
+
+/**
+ * BreakdownEntry represents spending for a single dimension value.
+ *
+ * @generated from message redpanda.api.aigateway.v1.BreakdownEntry
+ */
+export type BreakdownEntry = Message<"redpanda.api.aigateway.v1.BreakdownEntry"> & {
+  /**
+   * Dimension value (e.g., "openai", "gpt-4o", "gateway-1", "team-a")
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Display name (if different from name)
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Cost in cents
+   *
+   * @generated from field: int64 cost_cents = 3;
+   */
+  costCents: bigint;
+
+  /**
+   * Number of requests
+   *
+   * @generated from field: int64 requests = 4;
+   */
+  requests: bigint;
+
+  /**
+   * Total tokens
+   *
+   * @generated from field: int64 tokens = 5;
+   */
+  tokens: bigint;
+
+  /**
+   * Input tokens
+   *
+   * @generated from field: int64 input_tokens = 6;
+   */
+  inputTokens: bigint;
+
+  /**
+   * Output tokens
+   *
+   * @generated from field: int64 output_tokens = 7;
+   */
+  outputTokens: bigint;
+
+  /**
+   * Percentage of total cost
+   *
+   * @generated from field: double percentage = 8;
+   */
+  percentage: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.BreakdownEntry.
+ * Use `create(BreakdownEntrySchema)` to create a new message.
+ */
+export const BreakdownEntrySchema: GenMessage<BreakdownEntry> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 10);
+
+/**
+ * Request message for GetTopSpenders
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetTopSpendersRequest
+ */
+export type GetTopSpendersRequest = Message<"redpanda.api.aigateway.v1.GetTopSpendersRequest"> & {
+  /**
+   * Required: Dimension to rank by
+   *
+   * @generated from field: redpanda.api.aigateway.v1.BreakdownDimension dimension = 1;
+   */
+  dimension: BreakdownDimension;
+
+  /**
+   * Required: Time range
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TimeRange time_range = 2;
+   */
+  timeRange: TimeRange;
+
+  /**
+   * Optional: Custom start date (required if time_range = CUSTOM)
+   *
+   * @generated from field: google.protobuf.Timestamp start_date = 3;
+   */
+  startDate?: Timestamp;
+
+  /**
+   * Optional: Custom end date (required if time_range = CUSTOM)
+   *
+   * @generated from field: google.protobuf.Timestamp end_date = 4;
+   */
+  endDate?: Timestamp;
+
+  /**
+   * Optional: Filters to apply
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SpendingFilters filters = 5;
+   */
+  filters?: SpendingFilters;
+
+  /**
+   * Optional: Maximum number of results (default: 10, max: 100)
+   *
+   * @generated from field: int32 limit = 6;
+   */
+  limit: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetTopSpendersRequest.
+ * Use `create(GetTopSpendersRequestSchema)` to create a new message.
+ */
+export const GetTopSpendersRequestSchema: GenMessage<GetTopSpendersRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 11);
+
+/**
+ * Response message for GetTopSpenders
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetTopSpendersResponse
+ */
+export type GetTopSpendersResponse = Message<"redpanda.api.aigateway.v1.GetTopSpendersResponse"> & {
+  /**
+   * Top spenders sorted by cost descending
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.TopSpenderEntry entries = 1;
+   */
+  entries: TopSpenderEntry[];
+
+  /**
+   * Dimension used for ranking
+   *
+   * @generated from field: redpanda.api.aigateway.v1.BreakdownDimension dimension = 2;
+   */
+  dimension: BreakdownDimension;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetTopSpendersResponse.
+ * Use `create(GetTopSpendersResponseSchema)` to create a new message.
+ */
+export const GetTopSpendersResponseSchema: GenMessage<GetTopSpendersResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 12);
+
+/**
+ * TopSpenderEntry represents a single top spender.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TopSpenderEntry
+ */
+export type TopSpenderEntry = Message<"redpanda.api.aigateway.v1.TopSpenderEntry"> & {
+  /**
+   * Rank (1 = highest spender)
+   *
+   * @generated from field: int32 rank = 1;
+   */
+  rank: number;
+
+  /**
+   * Dimension value (e.g., user ID, team name)
+   *
+   * @generated from field: string name = 2;
+   */
+  name: string;
+
+  /**
+   * Display name (if different from name)
+   *
+   * @generated from field: string display_name = 3;
+   */
+  displayName: string;
+
+  /**
+   * Cost in cents
+   *
+   * @generated from field: int64 cost_cents = 4;
+   */
+  costCents: bigint;
+
+  /**
+   * Number of requests
+   *
+   * @generated from field: int64 requests = 5;
+   */
+  requests: bigint;
+
+  /**
+   * Total tokens
+   *
+   * @generated from field: int64 tokens = 6;
+   */
+  tokens: bigint;
+
+  /**
+   * Average cost per request in cents
+   *
+   * @generated from field: int64 avg_cost_per_request_cents = 7;
+   */
+  avgCostPerRequestCents: bigint;
+
+  /**
+   * Most used model
+   *
+   * @generated from field: string top_model = 8;
+   */
+  topModel: string;
+
+  /**
+   * Most used provider
+   *
+   * @generated from field: string top_provider = 9;
+   */
+  topProvider: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TopSpenderEntry.
+ * Use `create(TopSpenderEntrySchema)` to create a new message.
+ */
+export const TopSpenderEntrySchema: GenMessage<TopSpenderEntry> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_analytics, 13);
+
+/**
+ * TimeRange specifies predefined time windows for analytics queries.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.TimeRange
+ */
+export enum TimeRange {
+  /**
+   * @generated from enum value: TIME_RANGE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Last 24 hours
+   *
+   * @generated from enum value: TIME_RANGE_LAST_24H = 1;
+   */
+  LAST_24H = 1,
+
+  /**
+   * Last 7 days
+   *
+   * @generated from enum value: TIME_RANGE_LAST_7D = 2;
+   */
+  LAST_7D = 2,
+
+  /**
+   * Last 30 days
+   *
+   * @generated from enum value: TIME_RANGE_LAST_30D = 3;
+   */
+  LAST_30D = 3,
+
+  /**
+   * Custom start/end dates
+   *
+   * @generated from enum value: TIME_RANGE_CUSTOM = 4;
+   */
+  CUSTOM = 4,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.TimeRange.
+ */
+export const TimeRangeSchema: GenEnum<TimeRange> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_analytics, 0);
+
+/**
+ * BreakdownDimension specifies how to group spending data.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.BreakdownDimension
+ */
+export enum BreakdownDimension {
+  /**
+   * @generated from enum value: BREAKDOWN_DIMENSION_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Group by LLM provider (openai, anthropic)
+   *
+   * @generated from enum value: BREAKDOWN_DIMENSION_PROVIDER = 1;
+   */
+  PROVIDER = 1,
+
+  /**
+   * Group by model ID (gpt-4o, claude-3-5-sonnet)
+   *
+   * @generated from enum value: BREAKDOWN_DIMENSION_MODEL = 2;
+   */
+  MODEL = 2,
+
+  /**
+   * Group by gateway/frontend ID
+   *
+   * @generated from enum value: BREAKDOWN_DIMENSION_GATEWAY = 3;
+   */
+  GATEWAY = 3,
+
+  /**
+   * Group by team from OIDC claims
+   *
+   * @generated from enum value: BREAKDOWN_DIMENSION_TEAM = 4;
+   */
+  TEAM = 4,
+
+  /**
+   * Group by organization from OIDC claims
+   *
+   * @generated from enum value: BREAKDOWN_DIMENSION_ORGANIZATION = 5;
+   */
+  ORGANIZATION = 5,
+
+  /**
+   * Group by user from OIDC claims
+   *
+   * @generated from enum value: BREAKDOWN_DIMENSION_USER = 6;
+   */
+  USER = 6,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.BreakdownDimension.
+ */
+export const BreakdownDimensionSchema: GenEnum<BreakdownDimension> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_analytics, 1);
+
+/**
+ * Granularity specifies the time bucket size for time series data.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.Granularity
+ */
+export enum Granularity {
+  /**
+   * @generated from enum value: GRANULARITY_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Hourly buckets
+   *
+   * @generated from enum value: GRANULARITY_HOUR = 1;
+   */
+  HOUR = 1,
+
+  /**
+   * Daily buckets
+   *
+   * @generated from enum value: GRANULARITY_DAY = 2;
+   */
+  DAY = 2,
+
+  /**
+   * Weekly buckets
+   *
+   * @generated from enum value: GRANULARITY_WEEK = 3;
+   */
+  WEEK = 3,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.Granularity.
+ */
+export const GranularitySchema: GenEnum<Granularity> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_analytics, 2);
+
+/**
+ * AnalyticsService provides spending analytics and insights across all gateways.
+ * It aggregates token usage and cost data from the token tracker database.
+ *
+ * @generated from service redpanda.api.aigateway.v1.AnalyticsService
+ */
+export const AnalyticsService: GenService<{
+  /**
+   * GetSpendingSummary returns high-level spending metrics for the dashboard.
+   * Includes total cost, requests, tokens, and trends compared to previous period.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AnalyticsService.GetSpendingSummary
+   */
+  getSpendingSummary: {
+    methodKind: "unary";
+    input: typeof GetSpendingSummaryRequestSchema;
+    output: typeof GetSpendingSummaryResponseSchema;
+  },
+  /**
+   * GetSpendingTimeSeries returns spending over time for line charts.
+   * Automatically selects granularity (hour/day/week) based on time range.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AnalyticsService.GetSpendingTimeSeries
+   */
+  getSpendingTimeSeries: {
+    methodKind: "unary";
+    input: typeof GetSpendingTimeSeriesRequestSchema;
+    output: typeof GetSpendingTimeSeriesResponseSchema;
+  },
+  /**
+   * GetSpendingBreakdown returns spending grouped by a dimension (provider, model, etc).
+   * Used for pie charts and bar charts showing distribution.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AnalyticsService.GetSpendingBreakdown
+   */
+  getSpendingBreakdown: {
+    methodKind: "unary";
+    input: typeof GetSpendingBreakdownRequestSchema;
+    output: typeof GetSpendingBreakdownResponseSchema;
+  },
+  /**
+   * GetTopSpenders returns the highest spending entities for a given dimension.
+   * Used for tables showing top users, teams, organizations, etc.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AnalyticsService.GetTopSpenders
+   */
+  getTopSpenders: {
+    methodKind: "unary";
+    input: typeof GetTopSpendersRequestSchema;
+    output: typeof GetTopSpendersResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_analytics, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/audit-AuditService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/audit-AuditService_connectquery.ts
new file mode 100644
index 0000000000..5a7e1b3fbb
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/audit-AuditService_connectquery.ts
@@ -0,0 +1,19 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/audit.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { AuditService } from "./audit_pb";
+
+/**
+ * ListAuditLogs returns audit log entries for a gateway.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuditService.ListAuditLogs
+ */
+export const listAuditLogs = AuditService.method.listAuditLogs;
+
+/**
+ * GetAuditLog returns a single audit log entry.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuditService.GetAuditLog
+ */
+export const getAuditLog = AuditService.method.getAuditLog;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/audit_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/audit_pb.ts
new file mode 100644
index 0000000000..87ef2ccad9
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/audit_pb.ts
@@ -0,0 +1,651 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/audit.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import type { Timestamp, Value } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_struct, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { JsonObject, Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/audit.proto.
+ */
+export const file_redpanda_api_aigateway_v1_audit: GenFile = /*@__PURE__*/
+  fileDesc("CiVyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2F1ZGl0LnByb3RvEhlyZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxIv4FCghBdWRpdExvZxIKCgJpZBgBIAEoCRIRCgljbGFzc191aWQYAiABKAUSFAoMY2F0ZWdvcnlfdWlkGAMgASgFEkEKC2FjdGl2aXR5X2lkGAQgASgOMiwucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BdWRpdEFjdGl2aXR5VHlwZRIQCgh0eXBlX3VpZBgFIAEoAxIQCghhY3Rpdml0eRgGIAEoCRIoCgR0aW1lGAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpzdGFydF90aW1lGAsgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIsCghlbmRfdGltZRgMIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPQoLc2V2ZXJpdHlfaWQYFCABKA4yKC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkF1ZGl0U2V2ZXJpdHkSEAoIc2V2ZXJpdHkYFSABKAkSOQoJc3RhdHVzX2lkGBYgASgOMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BdWRpdFN0YXR1cxIOCgZzdGF0dXMYFyABKAkSFQoNc3RhdHVzX2RldGFpbBgYIAEoCRI0CgVhY3RvchgeIAEoCzIlLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXVkaXRBY3RvchI2CgZlbnRpdHkYKCABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkF1ZGl0RW50aXR5Ej0KDWVudGl0eV9yZXN1bHQYKSABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkF1ZGl0RW50aXR5EjgKCHVubWFwcGVkGDIgAygLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5GaWVsZENoYW5nZRIPCgdtZXNzYWdlGDwgASgJEg8KB2NvbW1lbnQYPSABKAkSEgoKZ2F0ZXdheV9pZBg+IAEoCSKMAQoKQXVkaXRBY3RvchIyCgR1c2VyGAEgASgLMiQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BdWRpdFVzZXISOAoHc2Vzc2lvbhgCIAEoCzInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXVkaXRTZXNzaW9uEhAKCGFwcF9uYW1lGAMgASgJIjUKCUF1ZGl0VXNlchILCgN1aWQYASABKAkSDQoFZW1haWwYAiABKAkSDAoEbmFtZRgDIAEoCSIbCgxBdWRpdFNlc3Npb24SCwoDdWlkGAEgASgJIl0KC0F1ZGl0RW50aXR5EgsKA3VpZBgBIAEoCRIMCgRuYW1lGAIgASgJEgwKBHR5cGUYAyABKAkSJQoEZGF0YRgEIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QicgoLRmllbGRDaGFuZ2USDQoFZmllbGQYASABKAkSKQoJb2xkX3ZhbHVlGAIgASgLMhYuZ29vZ2xlLnByb3RvYnVmLlZhbHVlEikKCW5ld192YWx1ZRgDIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi5WYWx1ZSL3AQoUTGlzdEF1ZGl0TG9nc1JlcXVlc3QSFwoGcGFyZW50GAEgASgJQge6SARyAhABEhMKC2VudGl0eV90eXBlGAIgASgJEkEKC2FjdGl2aXR5X2lkGAMgASgOMiwucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BdWRpdEFjdGl2aXR5VHlwZRIQCghhY3Rvcl9pZBgEIAEoCRIpCgVzaW5jZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASHQoJcGFnZV9zaXplGAYgASgFQgq6SAcaBRjIASgAEhIKCnBhZ2VfdG9rZW4YByABKAkifgoVTGlzdEF1ZGl0TG9nc1Jlc3BvbnNlEjcKCmF1ZGl0X2xvZ3MYASADKAsyIy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkF1ZGl0TG9nEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRITCgt0b3RhbF9jb3VudBgDIAEoBSIrChJHZXRBdWRpdExvZ1JlcXVlc3QSFQoEbmFtZRgBIAEoCUIHukgEcgIQASJNChNHZXRBdWRpdExvZ1Jlc3BvbnNlEjYKCWF1ZGl0X2xvZxgBIAEoCzIjLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXVkaXRMb2cq9wEKEUF1ZGl0QWN0aXZpdHlUeXBlEiMKH0FVRElUX0FDVElWSVRZX1RZUEVfVU5TUEVDSUZJRUQQABIeChpBVURJVF9BQ1RJVklUWV9UWVBFX0NSRUFURRABEhwKGEFVRElUX0FDVElWSVRZX1RZUEVfUkVBRBACEh4KGkFVRElUX0FDVElWSVRZX1RZUEVfVVBEQVRFEAMSHgoaQVVESVRfQUNUSVZJVFlfVFlQRV9ERUxFVEUQBBIeChpBVURJVF9BQ1RJVklUWV9UWVBFX0VOQUJMRRAIEh8KG0FVRElUX0FDVElWSVRZX1RZUEVfRElTQUJMRRAJKtQBCg1BdWRpdFNldmVyaXR5Eh4KGkFVRElUX1NFVkVSSVRZX1VOU1BFQ0lGSUVEEAASIAocQVVESVRfU0VWRVJJVFlfSU5GT1JNQVRJT05BTBABEhYKEkFVRElUX1NFVkVSSVRZX0xPVxACEhkKFUFVRElUX1NFVkVSSVRZX01FRElVTRADEhcKE0FVRElUX1NFVkVSSVRZX0hJR0gQBBIbChdBVURJVF9TRVZFUklUWV9DUklUSUNBTBAFEhgKFEFVRElUX1NFVkVSSVRZX0ZBVEFMEAYqXwoLQXVkaXRTdGF0dXMSHAoYQVVESVRfU1RBVFVTX1VOU1BFQ0lGSUVEEAASGAoUQVVESVRfU1RBVFVTX1NVQ0NFU1MQARIYChRBVURJVF9TVEFUVVNfRkFJTFVSRRACMvABCgxBdWRpdFNlcnZpY2UScgoNTGlzdEF1ZGl0TG9ncxIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdEF1ZGl0TG9nc1JlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RBdWRpdExvZ3NSZXNwb25zZRJsCgtHZXRBdWRpdExvZxItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0QXVkaXRMb2dSZXF1ZXN0Gi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRBdWRpdExvZ1Jlc3BvbnNlQv8BCh1jb20ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MUIKQXVkaXRQcm90b1ABWktnby5wYW5kYS5kZXYvcmVkcGFuZGEtYWlndy9wcm90b3MvZ2VuL3JlZHBhbmRhL2FwaS9haWdhdGV3YXkvdjE7YWlnYXRld2F5djGiAgNSQUGqAhlSZWRwYW5kYS5BcGkuQWlnYXRld2F5LlYxygIZUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMeICJVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjFcR1BCTWV0YWRhdGHqAhxSZWRwYW5kYTo6QXBpOjpBaWdhdGV3YXk6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_timestamp, file_google_protobuf_struct]);
+
+/**
+ * AuditLog represents an OCSF Entity Management event (class 3004).
+ * https://schema.ocsf.io/1.0.0/classes/entity_management
+ *
+ * @generated from message redpanda.api.aigateway.v1.AuditLog
+ */
+export type AuditLog = Message<"redpanda.api.aigateway.v1.AuditLog"> & {
+  /**
+   * Unique identifier for this audit log entry.
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * OCSF Base Event fields
+   *
+   * 3004 = Entity Management
+   *
+   * @generated from field: int32 class_uid = 2;
+   */
+  classUid: number;
+
+  /**
+   * 3 = Identity & Access Management
+   *
+   * @generated from field: int32 category_uid = 3;
+   */
+  categoryUid: number;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.AuditActivityType activity_id = 4;
+   */
+  activityId: AuditActivityType;
+
+  /**
+   * class_uid * 100 + activity_id
+   *
+   * @generated from field: int64 type_uid = 5;
+   */
+  typeUid: bigint;
+
+  /**
+   * Human-readable: "Create", "Update", "Delete"
+   *
+   * @generated from field: string activity = 6;
+   */
+  activity: string;
+
+  /**
+   * Temporal
+   *
+   * @generated from field: google.protobuf.Timestamp time = 10;
+   */
+  time?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp start_time = 11;
+   */
+  startTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp end_time = 12;
+   */
+  endTime?: Timestamp;
+
+  /**
+   * Severity & Status
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuditSeverity severity_id = 20;
+   */
+  severityId: AuditSeverity;
+
+  /**
+   * "Informational", "Low", etc.
+   *
+   * @generated from field: string severity = 21;
+   */
+  severity: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.AuditStatus status_id = 22;
+   */
+  statusId: AuditStatus;
+
+  /**
+   * "Success", "Failure"
+   *
+   * @generated from field: string status = 23;
+   */
+  status: string;
+
+  /**
+   * Error message if failed
+   *
+   * @generated from field: string status_detail = 24;
+   */
+  statusDetail: string;
+
+  /**
+   * Actor (who performed the action)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuditActor actor = 30;
+   */
+  actor?: AuditActor;
+
+  /**
+   * Entity (resource being managed)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuditEntity entity = 40;
+   */
+  entity?: AuditEntity;
+
+  /**
+   * State after change
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuditEntity entity_result = 41;
+   */
+  entityResult?: AuditEntity;
+
+  /**
+   * Field-level changes (stored in OCSF unmapped field)
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.FieldChange unmapped = 50;
+   */
+  unmapped: FieldChange[];
+
+  /**
+   * Context
+   *
+   * Human-readable event description
+   *
+   * @generated from field: string message = 60;
+   */
+  message: string;
+
+  /**
+   * User-provided rationale
+   *
+   * @generated from field: string comment = 61;
+   */
+  comment: string;
+
+  /**
+   * Parent gateway ID for scoping
+   *
+   * @generated from field: string gateway_id = 62;
+   */
+  gatewayId: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AuditLog.
+ * Use `create(AuditLogSchema)` to create a new message.
+ */
+export const AuditLogSchema: GenMessage<AuditLog> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 0);
+
+/**
+ * AuditActor represents who performed the action (OCSF Actor object).
+ *
+ * @generated from message redpanda.api.aigateway.v1.AuditActor
+ */
+export type AuditActor = Message<"redpanda.api.aigateway.v1.AuditActor"> & {
+  /**
+   * The user who performed the action
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuditUser user = 1;
+   */
+  user?: AuditUser;
+
+  /**
+   * Session information
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuditSession session = 2;
+   */
+  session?: AuditSession;
+
+  /**
+   * Application name (e.g., "webui", "api", "cli")
+   *
+   * @generated from field: string app_name = 3;
+   */
+  appName: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AuditActor.
+ * Use `create(AuditActorSchema)` to create a new message.
+ */
+export const AuditActorSchema: GenMessage<AuditActor> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 1);
+
+/**
+ * AuditUser represents the authenticated user info in audit context.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AuditUser
+ */
+export type AuditUser = Message<"redpanda.api.aigateway.v1.AuditUser"> & {
+  /**
+   * User unique identifier
+   *
+   * @generated from field: string uid = 1;
+   */
+  uid: string;
+
+  /**
+   * User email address
+   *
+   * @generated from field: string email = 2;
+   */
+  email: string;
+
+  /**
+   * User display name
+   *
+   * @generated from field: string name = 3;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AuditUser.
+ * Use `create(AuditUserSchema)` to create a new message.
+ */
+export const AuditUserSchema: GenMessage<AuditUser> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 2);
+
+/**
+ * AuditSession represents the session context (OCSF Session object).
+ *
+ * @generated from message redpanda.api.aigateway.v1.AuditSession
+ */
+export type AuditSession = Message<"redpanda.api.aigateway.v1.AuditSession"> & {
+  /**
+   * Session unique identifier
+   *
+   * @generated from field: string uid = 1;
+   */
+  uid: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AuditSession.
+ * Use `create(AuditSessionSchema)` to create a new message.
+ */
+export const AuditSessionSchema: GenMessage<AuditSession> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 3);
+
+/**
+ * AuditEntity represents the managed resource (OCSF Managed Entity object).
+ *
+ * @generated from message redpanda.api.aigateway.v1.AuditEntity
+ */
+export type AuditEntity = Message<"redpanda.api.aigateway.v1.AuditEntity"> & {
+  /**
+   * Resource unique identifier
+   *
+   * @generated from field: string uid = 1;
+   */
+  uid: string;
+
+  /**
+   * Full resource name path (e.g., "gateways/xxx/backendPools/yyy")
+   *
+   * @generated from field: string name = 2;
+   */
+  name: string;
+
+  /**
+   * Resource type (e.g., "gateway", "backend_pool", "routing_rule")
+   *
+   * @generated from field: string type = 3;
+   */
+  type: string;
+
+  /**
+   * Resource data/state as a JSON structure
+   *
+   * @generated from field: google.protobuf.Struct data = 4;
+   */
+  data?: JsonObject;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AuditEntity.
+ * Use `create(AuditEntitySchema)` to create a new message.
+ */
+export const AuditEntitySchema: GenMessage<AuditEntity> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 4);
+
+/**
+ * FieldChange represents a single field that was changed.
+ *
+ * @generated from message redpanda.api.aigateway.v1.FieldChange
+ */
+export type FieldChange = Message<"redpanda.api.aigateway.v1.FieldChange"> & {
+  /**
+   * The name of the field that changed.
+   *
+   * @generated from field: string field = 1;
+   */
+  field: string;
+
+  /**
+   * The old value (before the change).
+   *
+   * @generated from field: google.protobuf.Value old_value = 2;
+   */
+  oldValue?: Value;
+
+  /**
+   * The new value (after the change).
+   *
+   * @generated from field: google.protobuf.Value new_value = 3;
+   */
+  newValue?: Value;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.FieldChange.
+ * Use `create(FieldChangeSchema)` to create a new message.
+ */
+export const FieldChangeSchema: GenMessage<FieldChange> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 5);
+
+/**
+ * ListAuditLogsRequest is the request for ListAuditLogs.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListAuditLogsRequest
+ */
+export type ListAuditLogsRequest = Message<"redpanda.api.aigateway.v1.ListAuditLogsRequest"> & {
+  /**
+   * Required. The gateway to list audit logs for.
+   * Format: gateways/{gateway_id}
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Optional. Filter by entity type (e.g., "backend_pool", "routing_rule").
+   *
+   * @generated from field: string entity_type = 2;
+   */
+  entityType: string;
+
+  /**
+   * Optional. Filter by activity type.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuditActivityType activity_id = 3;
+   */
+  activityId: AuditActivityType;
+
+  /**
+   * Optional. Filter by actor (user ID).
+   *
+   * @generated from field: string actor_id = 4;
+   */
+  actorId: string;
+
+  /**
+   * Optional. Only return logs since this timestamp.
+   *
+   * @generated from field: google.protobuf.Timestamp since = 5;
+   */
+  since?: Timestamp;
+
+  /**
+   * Maximum number of results to return. Default: 50, Max: 200.
+   *
+   * @generated from field: int32 page_size = 6;
+   */
+  pageSize: number;
+
+  /**
+   * Page token for pagination.
+   *
+   * @generated from field: string page_token = 7;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListAuditLogsRequest.
+ * Use `create(ListAuditLogsRequestSchema)` to create a new message.
+ */
+export const ListAuditLogsRequestSchema: GenMessage<ListAuditLogsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 6);
+
+/**
+ * ListAuditLogsResponse is the response for ListAuditLogs.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListAuditLogsResponse
+ */
+export type ListAuditLogsResponse = Message<"redpanda.api.aigateway.v1.ListAuditLogsResponse"> & {
+  /**
+   * The audit log entries.
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.AuditLog audit_logs = 1;
+   */
+  auditLogs: AuditLog[];
+
+  /**
+   * Token to retrieve the next page.
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total number of audit logs matching the filter.
+   *
+   * @generated from field: int32 total_count = 3;
+   */
+  totalCount: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListAuditLogsResponse.
+ * Use `create(ListAuditLogsResponseSchema)` to create a new message.
+ */
+export const ListAuditLogsResponseSchema: GenMessage<ListAuditLogsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 7);
+
+/**
+ * GetAuditLogRequest is the request for GetAuditLog.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetAuditLogRequest
+ */
+export type GetAuditLogRequest = Message<"redpanda.api.aigateway.v1.GetAuditLogRequest"> & {
+  /**
+   * Required. The audit log entry to retrieve.
+   * Format: auditLogs/{audit_log_id}
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetAuditLogRequest.
+ * Use `create(GetAuditLogRequestSchema)` to create a new message.
+ */
+export const GetAuditLogRequestSchema: GenMessage<GetAuditLogRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 8);
+
+/**
+ * GetAuditLogResponse is the response for GetAuditLog.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetAuditLogResponse
+ */
+export type GetAuditLogResponse = Message<"redpanda.api.aigateway.v1.GetAuditLogResponse"> & {
+  /**
+   * The audit log entry.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuditLog audit_log = 1;
+   */
+  auditLog?: AuditLog;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetAuditLogResponse.
+ * Use `create(GetAuditLogResponseSchema)` to create a new message.
+ */
+export const GetAuditLogResponseSchema: GenMessage<GetAuditLogResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_audit, 9);
+
+/**
+ * OCSF Activity types for Entity Management (class 3004)
+ *
+ * @generated from enum redpanda.api.aigateway.v1.AuditActivityType
+ */
+export enum AuditActivityType {
+  /**
+   * @generated from enum value: AUDIT_ACTIVITY_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Resource was created
+   *
+   * @generated from enum value: AUDIT_ACTIVITY_TYPE_CREATE = 1;
+   */
+  CREATE = 1,
+
+  /**
+   * Resource was read/accessed
+   *
+   * @generated from enum value: AUDIT_ACTIVITY_TYPE_READ = 2;
+   */
+  READ = 2,
+
+  /**
+   * Resource was modified
+   *
+   * @generated from enum value: AUDIT_ACTIVITY_TYPE_UPDATE = 3;
+   */
+  UPDATE = 3,
+
+  /**
+   * Resource was deleted
+   *
+   * @generated from enum value: AUDIT_ACTIVITY_TYPE_DELETE = 4;
+   */
+  DELETE = 4,
+
+  /**
+   * Resource was enabled
+   *
+   * @generated from enum value: AUDIT_ACTIVITY_TYPE_ENABLE = 8;
+   */
+  ENABLE = 8,
+
+  /**
+   * Resource was disabled
+   *
+   * @generated from enum value: AUDIT_ACTIVITY_TYPE_DISABLE = 9;
+   */
+  DISABLE = 9,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.AuditActivityType.
+ */
+export const AuditActivityTypeSchema: GenEnum<AuditActivityType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_audit, 0);
+
+/**
+ * OCSF Severity levels
+ *
+ * @generated from enum redpanda.api.aigateway.v1.AuditSeverity
+ */
+export enum AuditSeverity {
+  /**
+   * @generated from enum value: AUDIT_SEVERITY_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: AUDIT_SEVERITY_INFORMATIONAL = 1;
+   */
+  INFORMATIONAL = 1,
+
+  /**
+   * @generated from enum value: AUDIT_SEVERITY_LOW = 2;
+   */
+  LOW = 2,
+
+  /**
+   * @generated from enum value: AUDIT_SEVERITY_MEDIUM = 3;
+   */
+  MEDIUM = 3,
+
+  /**
+   * @generated from enum value: AUDIT_SEVERITY_HIGH = 4;
+   */
+  HIGH = 4,
+
+  /**
+   * @generated from enum value: AUDIT_SEVERITY_CRITICAL = 5;
+   */
+  CRITICAL = 5,
+
+  /**
+   * @generated from enum value: AUDIT_SEVERITY_FATAL = 6;
+   */
+  FATAL = 6,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.AuditSeverity.
+ */
+export const AuditSeveritySchema: GenEnum<AuditSeverity> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_audit, 1);
+
+/**
+ * OCSF Status values
+ *
+ * @generated from enum redpanda.api.aigateway.v1.AuditStatus
+ */
+export enum AuditStatus {
+  /**
+   * @generated from enum value: AUDIT_STATUS_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: AUDIT_STATUS_SUCCESS = 1;
+   */
+  SUCCESS = 1,
+
+  /**
+   * @generated from enum value: AUDIT_STATUS_FAILURE = 2;
+   */
+  FAILURE = 2,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.AuditStatus.
+ */
+export const AuditStatusSchema: GenEnum<AuditStatus> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_audit, 2);
+
+/**
+ * AuditService provides access to the OCSF-compliant audit log for tracking resource changes.
+ * Implements the Entity Management event class (3004) from the Open Cybersecurity Schema Framework.
+ *
+ * @generated from service redpanda.api.aigateway.v1.AuditService
+ */
+export const AuditService: GenService<{
+  /**
+   * ListAuditLogs returns audit log entries for a gateway.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuditService.ListAuditLogs
+   */
+  listAuditLogs: {
+    methodKind: "unary";
+    input: typeof ListAuditLogsRequestSchema;
+    output: typeof ListAuditLogsResponseSchema;
+  },
+  /**
+   * GetAuditLog returns a single audit log entry.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuditService.GetAuditLog
+   */
+  getAuditLog: {
+    methodKind: "unary";
+    input: typeof GetAuditLogRequestSchema;
+    output: typeof GetAuditLogResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_audit, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/auth-AuthService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/auth-AuthService_connectquery.ts
new file mode 100644
index 0000000000..fb4b376acc
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/auth-AuthService_connectquery.ts
@@ -0,0 +1,101 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/auth.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { AuthService } from "./auth_pb";
+
+/**
+ * Registers a new user with email and password.
+ * Creates a personal organization for the user.
+ * Sends email verification link.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.Register
+ */
+export const register = AuthService.method.register;
+
+/**
+ * Authenticates a user with email and password.
+ * Returns session cookie and access token.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.Login
+ */
+export const login = AuthService.method.login;
+
+/**
+ * Logs out the current user by invalidating their session.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.Logout
+ */
+export const logout = AuthService.method.logout;
+
+/**
+ * Refreshes the access token using the session cookie.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.RefreshToken
+ */
+export const refreshToken = AuthService.method.refreshToken;
+
+/**
+ * Requests a password reset email.
+ * Always returns success to prevent email enumeration.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.RequestPasswordReset
+ */
+export const requestPasswordReset = AuthService.method.requestPasswordReset;
+
+/**
+ * Resets password using a reset token.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.ResetPassword
+ */
+export const resetPassword = AuthService.method.resetPassword;
+
+/**
+ * Changes password for authenticated user.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.ChangePassword
+ */
+export const changePassword = AuthService.method.changePassword;
+
+/**
+ * Verifies email using verification token.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.VerifyEmail
+ */
+export const verifyEmail = AuthService.method.verifyEmail;
+
+/**
+ * Invites a user to join an organization.
+ * Requires admin permissions in the organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.InviteUser
+ */
+export const inviteUser = AuthService.method.inviteUser;
+
+/**
+ * Accepts an invitation and creates user account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.AcceptInvite
+ */
+export const acceptInvite = AuthService.method.acceptInvite;
+
+/**
+ * Gets the current authenticated user's info.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.GetCurrentUser
+ */
+export const getCurrentUser = AuthService.method.getCurrentUser;
+
+/**
+ * Lists pending invitations for an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.ListInvites
+ */
+export const listInvites = AuthService.method.listInvites;
+
+/**
+ * Revokes a pending invitation.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.AuthService.RevokeInvite
+ */
+export const revokeInvite = AuthService.method.revokeInvite;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/auth_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/auth_pb.ts
new file mode 100644
index 0000000000..7a17763b2d
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/auth_pb.ts
@@ -0,0 +1,1027 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/auth.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/auth.proto.
+ */
+export const file_redpanda_api_aigateway_v1_auth: GenFile = /*@__PURE__*/
+  fileDesc("CiRyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2F1dGgucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEikgEKD1JlZ2lzdGVyUmVxdWVzdBIZCgVlbWFpbBgBIAEoCUIK4EECukgEcgJgARIfCghwYXNzd29yZBgCIAEoCUIN4EECukgHcgUQCBiAARIjCgxkaXNwbGF5X25hbWUYAyABKAlCDeBBArpIB3IFEAEY/wESHgoRb3JnYW5pemF0aW9uX25hbWUYBCABKAlCA+BBASJNChBSZWdpc3RlclJlc3BvbnNlEg8KB3VzZXJfaWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg8KB21lc3NhZ2UYAyABKAkiRwoMTG9naW5SZXF1ZXN0EhkKBWVtYWlsGAEgASgJQgrgQQK6SARyAmABEhwKCHBhc3N3b3JkGAIgASgJQgrgQQK6SARyAhABIp8BCg1Mb2dpblJlc3BvbnNlEhQKDGFjY2Vzc190b2tlbhgBIAEoCRISCgp0b2tlbl90eXBlGAIgASgJEhIKCmV4cGlyZXNfaW4YAyABKAMSMQoEdXNlchgEIAEoCzIjLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXV0aFVzZXISHQoVZm9yY2VfcGFzc3dvcmRfY2hhbmdlGAUgASgIIg8KDUxvZ291dFJlcXVlc3QiEAoOTG9nb3V0UmVzcG9uc2UiFQoTUmVmcmVzaFRva2VuUmVxdWVzdCJUChRSZWZyZXNoVG9rZW5SZXNwb25zZRIUCgxhY2Nlc3NfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRISCgpleHBpcmVzX2luGAMgASgDIjgKG1JlcXVlc3RQYXNzd29yZFJlc2V0UmVxdWVzdBIZCgVlbWFpbBgBIAEoCUIK4EECukgEcgJgASIvChxSZXF1ZXN0UGFzc3dvcmRSZXNldFJlc3BvbnNlEg8KB21lc3NhZ2UYASABKAkiVgoUUmVzZXRQYXNzd29yZFJlcXVlc3QSGQoFdG9rZW4YASABKAlCCuBBArpIBHICEAESIwoMbmV3X3Bhc3N3b3JkGAIgASgJQg3gQQK6SAdyBRAIGIABIigKFVJlc2V0UGFzc3dvcmRSZXNwb25zZRIPCgdtZXNzYWdlGAEgASgJImIKFUNoYW5nZVBhc3N3b3JkUmVxdWVzdBIkChBjdXJyZW50X3Bhc3N3b3JkGAEgASgJQgrgQQK6SARyAhABEiMKDG5ld19wYXNzd29yZBgCIAEoCUIN4EECukgHcgUQCBiAASIpChZDaGFuZ2VQYXNzd29yZFJlc3BvbnNlEg8KB21lc3NhZ2UYASABKAkiLwoSVmVyaWZ5RW1haWxSZXF1ZXN0EhkKBXRva2VuGAEgASgJQgrgQQK6SARyAhABIiYKE1ZlcmlmeUVtYWlsUmVzcG9uc2USDwoHbWVzc2FnZRgBIAEoCSKVAQoRSW52aXRlVXNlclJlcXVlc3QSIAoMb3JnYW5pemF0aW9uGAEgASgJQgrgQQK6SARyAhABEhkKBWVtYWlsGAIgASgJQgrgQQK6SARyAmABEkMKEHRlYW1fYXNzaWdubWVudHMYAyADKAsyKS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlYW1Bc3NpZ25tZW50IjkKDlRlYW1Bc3NpZ25tZW50EhQKB3RlYW1faWQYASABKAlCA+BBAhIRCgRyb2xlGAIgASgJQgPgQQEiRwoSSW52aXRlVXNlclJlc3BvbnNlEjEKBmludml0ZRgBIAEoCzIhLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuSW52aXRlInYKE0FjY2VwdEludml0ZVJlcXVlc3QSGQoFdG9rZW4YASABKAlCCuBBArpIBHICEAESIwoMZGlzcGxheV9uYW1lGAIgASgJQg3gQQK6SAdyBRABGP8BEh8KCHBhc3N3b3JkGAMgASgJQg3gQQK6SAdyBRAIGIABIlEKFEFjY2VwdEludml0ZVJlc3BvbnNlEg8KB3VzZXJfaWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg8KB21lc3NhZ2UYAyABKAkihgEKEkxpc3RJbnZpdGVzUmVxdWVzdBIaCgZwYXJlbnQYASABKAlCCuBBArpIBHICEAESHwoJcGFnZV9zaXplGAIgASgFQgzgQQG6SAYaBBhkKAASFwoKcGFnZV90b2tlbhgDIAEoCUID4EEBEhoKDXN0YXR1c19maWx0ZXIYBCABKAlCA+BBASJ2ChNMaXN0SW52aXRlc1Jlc3BvbnNlEjIKB2ludml0ZXMYASADKAsyIS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkludml0ZRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSIvChNSZXZva2VJbnZpdGVSZXF1ZXN0EhgKBG5hbWUYASABKAlCCuBBArpIBHICEAEiFgoUUmV2b2tlSW52aXRlUmVzcG9uc2UiFwoVR2V0Q3VycmVudFVzZXJSZXF1ZXN0IksKFkdldEN1cnJlbnRVc2VyUmVzcG9uc2USMQoEdXNlchgBIAEoCzIjLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXV0aFVzZXIiwQEKCEF1dGhVc2VyEgoKAmlkGAEgASgJEg0KBWVtYWlsGAIgASgJEhQKDGRpc3BsYXlfbmFtZRgDIAEoCRIXCg9vcmdhbml6YXRpb25faWQYBCABKAkSEgoKYWNjb3VudF9pZBgFIAEoCRINCgVyb2xlcxgGIAMoCRIWCg5lbWFpbF92ZXJpZmllZBgHIAEoCBISCgphdmF0YXJfdXJsGAggASgJEhwKFHNvY2lhbF9hdXRoX3Byb3ZpZGVyGAkgASgJIrsCCgZJbnZpdGUSDAoEbmFtZRgBIAEoCRINCgVlbWFpbBgCIAEoCRIZChFvcmdhbml6YXRpb25fbmFtZRgDIAEoCRISCgppbnZpdGVkX2J5GAQgASgJEg4KBnN0YXR1cxgFIAEoCRJDChB0ZWFtX2Fzc2lnbm1lbnRzGAYgAygLMikucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UZWFtQXNzaWdubWVudBIuCgpleHBpcmVzX2F0GAcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtjcmVhdGVfdGltZRgIIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLYWNjZXB0ZWRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wMqcPCgtBdXRoU2VydmljZRKBAQoIUmVnaXN0ZXISKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJlZ2lzdGVyUmVxdWVzdBorLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVnaXN0ZXJSZXNwb25zZSIcgtPkkwIWOgEqIhEvdjEvYXV0aC9yZWdpc3RlchJ1CgVMb2dpbhInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTG9naW5SZXF1ZXN0GigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Mb2dpblJlc3BvbnNlIhmC0+STAhM6ASoiDi92MS9hdXRoL2xvZ2luEnkKBkxvZ291dBIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTG9nb3V0UmVxdWVzdBopLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTG9nb3V0UmVzcG9uc2UiGoLT5JMCFDoBKiIPL3YxL2F1dGgvbG9nb3V0EowBCgxSZWZyZXNoVG9rZW4SLi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJlZnJlc2hUb2tlblJlcXVlc3QaLy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJlZnJlc2hUb2tlblJlc3BvbnNlIhuC0+STAhU6ASoiEC92MS9hdXRoL3JlZnJlc2gSswEKFFJlcXVlc3RQYXNzd29yZFJlc2V0EjYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SZXF1ZXN0UGFzc3dvcmRSZXNldFJlcXVlc3QaNy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJlcXVlc3RQYXNzd29yZFJlc2V0UmVzcG9uc2UiKoLT5JMCJDoBKiIfL3YxL2F1dGgvcGFzc3dvcmQvcmVzZXQtcmVxdWVzdBKWAQoNUmVzZXRQYXNzd29yZBIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVzZXRQYXNzd29yZFJlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJlc2V0UGFzc3dvcmRSZXNwb25zZSIigtPkkwIcOgEqIhcvdjEvYXV0aC9wYXNzd29yZC9yZXNldBKaAQoOQ2hhbmdlUGFzc3dvcmQSMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNoYW5nZVBhc3N3b3JkUmVxdWVzdBoxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ2hhbmdlUGFzc3dvcmRSZXNwb25zZSIjgtPkkwIdOgEqIhgvdjEvYXV0aC9wYXNzd29yZC9jaGFuZ2USjgEKC1ZlcmlmeUVtYWlsEi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5WZXJpZnlFbWFpbFJlcXVlc3QaLi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlZlcmlmeUVtYWlsUmVzcG9uc2UiIILT5JMCGjoBKiIVL3YxL2F1dGgvdmVyaWZ5LWVtYWlsEoUBCgpJbnZpdGVVc2VyEiwucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5JbnZpdGVVc2VyUmVxdWVzdBotLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuSW52aXRlVXNlclJlc3BvbnNlIhqC0+STAhQ6ASoiDy92MS9hdXRoL2ludml0ZRKSAQoMQWNjZXB0SW52aXRlEi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY2NlcHRJbnZpdGVSZXF1ZXN0Gi8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY2NlcHRJbnZpdGVSZXNwb25zZSIhgtPkkwIbOgEqIhYvdjEvYXV0aC9pbnZpdGUvYWNjZXB0EooBCg5HZXRDdXJyZW50VXNlchIwLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0Q3VycmVudFVzZXJSZXF1ZXN0GjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRDdXJyZW50VXNlclJlc3BvbnNlIhOC0+STAg0SCy92MS9hdXRoL21lEqUBCgtMaXN0SW52aXRlcxItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdEludml0ZXNSZXF1ZXN0Gi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0SW52aXRlc1Jlc3BvbnNlIjeC0+STAjESLy92MS97cGFyZW50PWFjY291bnRzLyovb3JnYW5pemF0aW9ucy8qfS9pbnZpdGVzEqgBCgxSZXZva2VJbnZpdGUSLi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJldm9rZUludml0ZVJlcXVlc3QaLy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJldm9rZUludml0ZVJlc3BvbnNlIjeC0+STAjEqLy92MS97bmFtZT1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKi9pbnZpdGVzLyp9GhnKQRZhaWdhdGV3YXkucmVkcGFuZGEuY29tQv4BCh1jb20ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MUIJQXV0aFByb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_protobuf_timestamp]);
+
+/**
+ * Request message for Register RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RegisterRequest
+ */
+export type RegisterRequest = Message<"redpanda.api.aigateway.v1.RegisterRequest"> & {
+  /**
+   * Required: Email address (must be unique).
+   *
+   * @generated from field: string email = 1;
+   */
+  email: string;
+
+  /**
+   * Required: Password (min 8 characters).
+   *
+   * @generated from field: string password = 2;
+   */
+  password: string;
+
+  /**
+   * Required: Display name.
+   *
+   * @generated from field: string display_name = 3;
+   */
+  displayName: string;
+
+  /**
+   * Optional: Organization name for the personal org.
+   * If empty, uses "{display_name}'s Organization".
+   *
+   * @generated from field: string organization_name = 4;
+   */
+  organizationName: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RegisterRequest.
+ * Use `create(RegisterRequestSchema)` to create a new message.
+ */
+export const RegisterRequestSchema: GenMessage<RegisterRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 0);
+
+/**
+ * Response message for Register RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RegisterResponse
+ */
+export type RegisterResponse = Message<"redpanda.api.aigateway.v1.RegisterResponse"> & {
+  /**
+   * The created user's ID.
+   *
+   * @generated from field: string user_id = 1;
+   */
+  userId: string;
+
+  /**
+   * The created organization's ID.
+   *
+   * @generated from field: string organization_id = 2;
+   */
+  organizationId: string;
+
+  /**
+   * Message about email verification.
+   *
+   * @generated from field: string message = 3;
+   */
+  message: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RegisterResponse.
+ * Use `create(RegisterResponseSchema)` to create a new message.
+ */
+export const RegisterResponseSchema: GenMessage<RegisterResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 1);
+
+/**
+ * Request message for Login RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.LoginRequest
+ */
+export type LoginRequest = Message<"redpanda.api.aigateway.v1.LoginRequest"> & {
+  /**
+   * Required: Email address.
+   *
+   * @generated from field: string email = 1;
+   */
+  email: string;
+
+  /**
+   * Required: Password.
+   *
+   * @generated from field: string password = 2;
+   */
+  password: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.LoginRequest.
+ * Use `create(LoginRequestSchema)` to create a new message.
+ */
+export const LoginRequestSchema: GenMessage<LoginRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 2);
+
+/**
+ * Response message for Login RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.LoginResponse
+ */
+export type LoginResponse = Message<"redpanda.api.aigateway.v1.LoginResponse"> & {
+  /**
+   * JWT access token (also set as cookie).
+   *
+   * @generated from field: string access_token = 1;
+   */
+  accessToken: string;
+
+  /**
+   * Token type (always "Bearer").
+   *
+   * @generated from field: string token_type = 2;
+   */
+  tokenType: string;
+
+  /**
+   * Seconds until access token expires.
+   *
+   * @generated from field: int64 expires_in = 3;
+   */
+  expiresIn: bigint;
+
+  /**
+   * User information.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuthUser user = 4;
+   */
+  user?: AuthUser;
+
+  /**
+   * If true, user must change password before continuing.
+   *
+   * @generated from field: bool force_password_change = 5;
+   */
+  forcePasswordChange: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.LoginResponse.
+ * Use `create(LoginResponseSchema)` to create a new message.
+ */
+export const LoginResponseSchema: GenMessage<LoginResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 3);
+
+/**
+ * Request message for Logout RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.LogoutRequest
+ */
+export type LogoutRequest = Message<"redpanda.api.aigateway.v1.LogoutRequest"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.LogoutRequest.
+ * Use `create(LogoutRequestSchema)` to create a new message.
+ */
+export const LogoutRequestSchema: GenMessage<LogoutRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 4);
+
+/**
+ * Response message for Logout RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.LogoutResponse
+ */
+export type LogoutResponse = Message<"redpanda.api.aigateway.v1.LogoutResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.LogoutResponse.
+ * Use `create(LogoutResponseSchema)` to create a new message.
+ */
+export const LogoutResponseSchema: GenMessage<LogoutResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 5);
+
+/**
+ * Request message for RefreshToken RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RefreshTokenRequest
+ */
+export type RefreshTokenRequest = Message<"redpanda.api.aigateway.v1.RefreshTokenRequest"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RefreshTokenRequest.
+ * Use `create(RefreshTokenRequestSchema)` to create a new message.
+ */
+export const RefreshTokenRequestSchema: GenMessage<RefreshTokenRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 6);
+
+/**
+ * Response message for RefreshToken RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RefreshTokenResponse
+ */
+export type RefreshTokenResponse = Message<"redpanda.api.aigateway.v1.RefreshTokenResponse"> & {
+  /**
+   * New JWT access token.
+   *
+   * @generated from field: string access_token = 1;
+   */
+  accessToken: string;
+
+  /**
+   * Token type (always "Bearer").
+   *
+   * @generated from field: string token_type = 2;
+   */
+  tokenType: string;
+
+  /**
+   * Seconds until access token expires.
+   *
+   * @generated from field: int64 expires_in = 3;
+   */
+  expiresIn: bigint;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RefreshTokenResponse.
+ * Use `create(RefreshTokenResponseSchema)` to create a new message.
+ */
+export const RefreshTokenResponseSchema: GenMessage<RefreshTokenResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 7);
+
+/**
+ * Request message for RequestPasswordReset RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RequestPasswordResetRequest
+ */
+export type RequestPasswordResetRequest = Message<"redpanda.api.aigateway.v1.RequestPasswordResetRequest"> & {
+  /**
+   * Required: Email address to send reset link to.
+   *
+   * @generated from field: string email = 1;
+   */
+  email: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RequestPasswordResetRequest.
+ * Use `create(RequestPasswordResetRequestSchema)` to create a new message.
+ */
+export const RequestPasswordResetRequestSchema: GenMessage<RequestPasswordResetRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 8);
+
+/**
+ * Response message for RequestPasswordReset RPC.
+ * Always returns success to prevent email enumeration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RequestPasswordResetResponse
+ */
+export type RequestPasswordResetResponse = Message<"redpanda.api.aigateway.v1.RequestPasswordResetResponse"> & {
+  /**
+   * @generated from field: string message = 1;
+   */
+  message: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RequestPasswordResetResponse.
+ * Use `create(RequestPasswordResetResponseSchema)` to create a new message.
+ */
+export const RequestPasswordResetResponseSchema: GenMessage<RequestPasswordResetResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 9);
+
+/**
+ * Request message for ResetPassword RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ResetPasswordRequest
+ */
+export type ResetPasswordRequest = Message<"redpanda.api.aigateway.v1.ResetPasswordRequest"> & {
+  /**
+   * Required: Password reset token from email link.
+   *
+   * @generated from field: string token = 1;
+   */
+  token: string;
+
+  /**
+   * Required: New password (min 8 characters).
+   *
+   * @generated from field: string new_password = 2;
+   */
+  newPassword: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ResetPasswordRequest.
+ * Use `create(ResetPasswordRequestSchema)` to create a new message.
+ */
+export const ResetPasswordRequestSchema: GenMessage<ResetPasswordRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 10);
+
+/**
+ * Response message for ResetPassword RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ResetPasswordResponse
+ */
+export type ResetPasswordResponse = Message<"redpanda.api.aigateway.v1.ResetPasswordResponse"> & {
+  /**
+   * @generated from field: string message = 1;
+   */
+  message: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ResetPasswordResponse.
+ * Use `create(ResetPasswordResponseSchema)` to create a new message.
+ */
+export const ResetPasswordResponseSchema: GenMessage<ResetPasswordResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 11);
+
+/**
+ * Request message for ChangePassword RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ChangePasswordRequest
+ */
+export type ChangePasswordRequest = Message<"redpanda.api.aigateway.v1.ChangePasswordRequest"> & {
+  /**
+   * Required: Current password for verification.
+   *
+   * @generated from field: string current_password = 1;
+   */
+  currentPassword: string;
+
+  /**
+   * Required: New password (min 8 characters).
+   *
+   * @generated from field: string new_password = 2;
+   */
+  newPassword: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ChangePasswordRequest.
+ * Use `create(ChangePasswordRequestSchema)` to create a new message.
+ */
+export const ChangePasswordRequestSchema: GenMessage<ChangePasswordRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 12);
+
+/**
+ * Response message for ChangePassword RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ChangePasswordResponse
+ */
+export type ChangePasswordResponse = Message<"redpanda.api.aigateway.v1.ChangePasswordResponse"> & {
+  /**
+   * @generated from field: string message = 1;
+   */
+  message: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ChangePasswordResponse.
+ * Use `create(ChangePasswordResponseSchema)` to create a new message.
+ */
+export const ChangePasswordResponseSchema: GenMessage<ChangePasswordResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 13);
+
+/**
+ * Request message for VerifyEmail RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.VerifyEmailRequest
+ */
+export type VerifyEmailRequest = Message<"redpanda.api.aigateway.v1.VerifyEmailRequest"> & {
+  /**
+   * Required: Email verification token from email link.
+   *
+   * @generated from field: string token = 1;
+   */
+  token: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.VerifyEmailRequest.
+ * Use `create(VerifyEmailRequestSchema)` to create a new message.
+ */
+export const VerifyEmailRequestSchema: GenMessage<VerifyEmailRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 14);
+
+/**
+ * Response message for VerifyEmail RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.VerifyEmailResponse
+ */
+export type VerifyEmailResponse = Message<"redpanda.api.aigateway.v1.VerifyEmailResponse"> & {
+  /**
+   * @generated from field: string message = 1;
+   */
+  message: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.VerifyEmailResponse.
+ * Use `create(VerifyEmailResponseSchema)` to create a new message.
+ */
+export const VerifyEmailResponseSchema: GenMessage<VerifyEmailResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 15);
+
+/**
+ * Request message for InviteUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.InviteUserRequest
+ */
+export type InviteUserRequest = Message<"redpanda.api.aigateway.v1.InviteUserRequest"> & {
+  /**
+   * Required: Organization to invite user to.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string organization = 1;
+   */
+  organization: string;
+
+  /**
+   * Required: Email address to invite.
+   *
+   * @generated from field: string email = 2;
+   */
+  email: string;
+
+  /**
+   * Optional: Team assignments for the invited user.
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.TeamAssignment team_assignments = 3;
+   */
+  teamAssignments: TeamAssignment[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.InviteUserRequest.
+ * Use `create(InviteUserRequestSchema)` to create a new message.
+ */
+export const InviteUserRequestSchema: GenMessage<InviteUserRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 16);
+
+/**
+ * Team assignment for invited user.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TeamAssignment
+ */
+export type TeamAssignment = Message<"redpanda.api.aigateway.v1.TeamAssignment"> & {
+  /**
+   * Team ID to add user to.
+   *
+   * @generated from field: string team_id = 1;
+   */
+  teamId: string;
+
+  /**
+   * Role in the team (e.g., "member", "admin").
+   *
+   * @generated from field: string role = 2;
+   */
+  role: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TeamAssignment.
+ * Use `create(TeamAssignmentSchema)` to create a new message.
+ */
+export const TeamAssignmentSchema: GenMessage<TeamAssignment> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 17);
+
+/**
+ * Response message for InviteUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.InviteUserResponse
+ */
+export type InviteUserResponse = Message<"redpanda.api.aigateway.v1.InviteUserResponse"> & {
+  /**
+   * The created invite.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Invite invite = 1;
+   */
+  invite?: Invite;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.InviteUserResponse.
+ * Use `create(InviteUserResponseSchema)` to create a new message.
+ */
+export const InviteUserResponseSchema: GenMessage<InviteUserResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 18);
+
+/**
+ * Request message for AcceptInvite RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AcceptInviteRequest
+ */
+export type AcceptInviteRequest = Message<"redpanda.api.aigateway.v1.AcceptInviteRequest"> & {
+  /**
+   * Required: Invite token from email link.
+   *
+   * @generated from field: string token = 1;
+   */
+  token: string;
+
+  /**
+   * Required: Display name for the new user.
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Required: Password for the new account.
+   *
+   * @generated from field: string password = 3;
+   */
+  password: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AcceptInviteRequest.
+ * Use `create(AcceptInviteRequestSchema)` to create a new message.
+ */
+export const AcceptInviteRequestSchema: GenMessage<AcceptInviteRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 19);
+
+/**
+ * Response message for AcceptInvite RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AcceptInviteResponse
+ */
+export type AcceptInviteResponse = Message<"redpanda.api.aigateway.v1.AcceptInviteResponse"> & {
+  /**
+   * The created user's ID.
+   *
+   * @generated from field: string user_id = 1;
+   */
+  userId: string;
+
+  /**
+   * The organization the user joined.
+   *
+   * @generated from field: string organization_id = 2;
+   */
+  organizationId: string;
+
+  /**
+   * @generated from field: string message = 3;
+   */
+  message: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AcceptInviteResponse.
+ * Use `create(AcceptInviteResponseSchema)` to create a new message.
+ */
+export const AcceptInviteResponseSchema: GenMessage<AcceptInviteResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 20);
+
+/**
+ * Request message for ListInvites RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListInvitesRequest
+ */
+export type ListInvitesRequest = Message<"redpanda.api.aigateway.v1.ListInvitesRequest"> & {
+  /**
+   * Required: Parent organization.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number to return (max 100).
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from previous call.
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter by status: pending, accepted, expired, revoked.
+   *
+   * @generated from field: string status_filter = 4;
+   */
+  statusFilter: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListInvitesRequest.
+ * Use `create(ListInvitesRequestSchema)` to create a new message.
+ */
+export const ListInvitesRequestSchema: GenMessage<ListInvitesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 21);
+
+/**
+ * Response message for ListInvites RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListInvitesResponse
+ */
+export type ListInvitesResponse = Message<"redpanda.api.aigateway.v1.ListInvitesResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.Invite invites = 1;
+   */
+  invites: Invite[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListInvitesResponse.
+ * Use `create(ListInvitesResponseSchema)` to create a new message.
+ */
+export const ListInvitesResponseSchema: GenMessage<ListInvitesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 22);
+
+/**
+ * Request message for RevokeInvite RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RevokeInviteRequest
+ */
+export type RevokeInviteRequest = Message<"redpanda.api.aigateway.v1.RevokeInviteRequest"> & {
+  /**
+   * Resource name of the invite.
+   * Format: `accounts/{account}/organizations/{organization}/invites/{invite}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RevokeInviteRequest.
+ * Use `create(RevokeInviteRequestSchema)` to create a new message.
+ */
+export const RevokeInviteRequestSchema: GenMessage<RevokeInviteRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 23);
+
+/**
+ * Response message for RevokeInvite RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RevokeInviteResponse
+ */
+export type RevokeInviteResponse = Message<"redpanda.api.aigateway.v1.RevokeInviteResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RevokeInviteResponse.
+ * Use `create(RevokeInviteResponseSchema)` to create a new message.
+ */
+export const RevokeInviteResponseSchema: GenMessage<RevokeInviteResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 24);
+
+/**
+ * Request message for GetCurrentUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetCurrentUserRequest
+ */
+export type GetCurrentUserRequest = Message<"redpanda.api.aigateway.v1.GetCurrentUserRequest"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetCurrentUserRequest.
+ * Use `create(GetCurrentUserRequestSchema)` to create a new message.
+ */
+export const GetCurrentUserRequestSchema: GenMessage<GetCurrentUserRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 25);
+
+/**
+ * Response message for GetCurrentUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetCurrentUserResponse
+ */
+export type GetCurrentUserResponse = Message<"redpanda.api.aigateway.v1.GetCurrentUserResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.AuthUser user = 1;
+   */
+  user?: AuthUser;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetCurrentUserResponse.
+ * Use `create(GetCurrentUserResponseSchema)` to create a new message.
+ */
+export const GetCurrentUserResponseSchema: GenMessage<GetCurrentUserResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 26);
+
+/**
+ * AuthUser represents authenticated user information.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AuthUser
+ */
+export type AuthUser = Message<"redpanda.api.aigateway.v1.AuthUser"> & {
+  /**
+   * User ID.
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * User's email address.
+   *
+   * @generated from field: string email = 2;
+   */
+  email: string;
+
+  /**
+   * User's display name.
+   *
+   * @generated from field: string display_name = 3;
+   */
+  displayName: string;
+
+  /**
+   * Organization ID the user belongs to.
+   *
+   * @generated from field: string organization_id = 4;
+   */
+  organizationId: string;
+
+  /**
+   * Account ID the organization belongs to.
+   *
+   * @generated from field: string account_id = 5;
+   */
+  accountId: string;
+
+  /**
+   * User's roles (e.g., ["admin", "member"]).
+   *
+   * @generated from field: repeated string roles = 6;
+   */
+  roles: string[];
+
+  /**
+   * Whether email is verified.
+   *
+   * @generated from field: bool email_verified = 7;
+   */
+  emailVerified: boolean;
+
+  /**
+   * Profile picture URL (if available).
+   *
+   * @generated from field: string avatar_url = 8;
+   */
+  avatarUrl: string;
+
+  /**
+   * OAuth provider if logged in via social auth.
+   *
+   * @generated from field: string social_auth_provider = 9;
+   */
+  socialAuthProvider: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AuthUser.
+ * Use `create(AuthUserSchema)` to create a new message.
+ */
+export const AuthUserSchema: GenMessage<AuthUser> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 27);
+
+/**
+ * Invite represents a user invitation.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Invite
+ */
+export type Invite = Message<"redpanda.api.aigateway.v1.Invite"> & {
+  /**
+   * Resource name.
+   * Format: `accounts/{account}/organizations/{organization}/invites/{invite}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Email address invited.
+   *
+   * @generated from field: string email = 2;
+   */
+  email: string;
+
+  /**
+   * Organization display name.
+   *
+   * @generated from field: string organization_name = 3;
+   */
+  organizationName: string;
+
+  /**
+   * User ID who sent the invite.
+   *
+   * @generated from field: string invited_by = 4;
+   */
+  invitedBy: string;
+
+  /**
+   * Invite status: pending, accepted, expired, revoked.
+   *
+   * @generated from field: string status = 5;
+   */
+  status: string;
+
+  /**
+   * Team assignments.
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.TeamAssignment team_assignments = 6;
+   */
+  teamAssignments: TeamAssignment[];
+
+  /**
+   * When the invite expires.
+   *
+   * @generated from field: google.protobuf.Timestamp expires_at = 7;
+   */
+  expiresAt?: Timestamp;
+
+  /**
+   * When the invite was created.
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 8;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * When the invite was accepted (if applicable).
+   *
+   * @generated from field: google.protobuf.Timestamp accepted_at = 9;
+   */
+  acceptedAt?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Invite.
+ * Use `create(InviteSchema)` to create a new message.
+ */
+export const InviteSchema: GenMessage<Invite> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_auth, 28);
+
+/**
+ * AuthService provides authentication and session management.
+ * Handles email/password login, registration, password reset, and invitations.
+ * Social OAuth (Google, GitHub) uses HTTP redirects and is handled separately.
+ *
+ * @generated from service redpanda.api.aigateway.v1.AuthService
+ */
+export const AuthService: GenService<{
+  /**
+   * Registers a new user with email and password.
+   * Creates a personal organization for the user.
+   * Sends email verification link.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.Register
+   */
+  register: {
+    methodKind: "unary";
+    input: typeof RegisterRequestSchema;
+    output: typeof RegisterResponseSchema;
+  },
+  /**
+   * Authenticates a user with email and password.
+   * Returns session cookie and access token.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.Login
+   */
+  login: {
+    methodKind: "unary";
+    input: typeof LoginRequestSchema;
+    output: typeof LoginResponseSchema;
+  },
+  /**
+   * Logs out the current user by invalidating their session.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.Logout
+   */
+  logout: {
+    methodKind: "unary";
+    input: typeof LogoutRequestSchema;
+    output: typeof LogoutResponseSchema;
+  },
+  /**
+   * Refreshes the access token using the session cookie.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.RefreshToken
+   */
+  refreshToken: {
+    methodKind: "unary";
+    input: typeof RefreshTokenRequestSchema;
+    output: typeof RefreshTokenResponseSchema;
+  },
+  /**
+   * Requests a password reset email.
+   * Always returns success to prevent email enumeration.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.RequestPasswordReset
+   */
+  requestPasswordReset: {
+    methodKind: "unary";
+    input: typeof RequestPasswordResetRequestSchema;
+    output: typeof RequestPasswordResetResponseSchema;
+  },
+  /**
+   * Resets password using a reset token.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.ResetPassword
+   */
+  resetPassword: {
+    methodKind: "unary";
+    input: typeof ResetPasswordRequestSchema;
+    output: typeof ResetPasswordResponseSchema;
+  },
+  /**
+   * Changes password for authenticated user.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.ChangePassword
+   */
+  changePassword: {
+    methodKind: "unary";
+    input: typeof ChangePasswordRequestSchema;
+    output: typeof ChangePasswordResponseSchema;
+  },
+  /**
+   * Verifies email using verification token.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.VerifyEmail
+   */
+  verifyEmail: {
+    methodKind: "unary";
+    input: typeof VerifyEmailRequestSchema;
+    output: typeof VerifyEmailResponseSchema;
+  },
+  /**
+   * Invites a user to join an organization.
+   * Requires admin permissions in the organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.InviteUser
+   */
+  inviteUser: {
+    methodKind: "unary";
+    input: typeof InviteUserRequestSchema;
+    output: typeof InviteUserResponseSchema;
+  },
+  /**
+   * Accepts an invitation and creates user account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.AcceptInvite
+   */
+  acceptInvite: {
+    methodKind: "unary";
+    input: typeof AcceptInviteRequestSchema;
+    output: typeof AcceptInviteResponseSchema;
+  },
+  /**
+   * Gets the current authenticated user's info.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.GetCurrentUser
+   */
+  getCurrentUser: {
+    methodKind: "unary";
+    input: typeof GetCurrentUserRequestSchema;
+    output: typeof GetCurrentUserResponseSchema;
+  },
+  /**
+   * Lists pending invitations for an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.ListInvites
+   */
+  listInvites: {
+    methodKind: "unary";
+    input: typeof ListInvitesRequestSchema;
+    output: typeof ListInvitesResponseSchema;
+  },
+  /**
+   * Revokes a pending invitation.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.AuthService.RevokeInvite
+   */
+  revokeInvite: {
+    methodKind: "unary";
+    input: typeof RevokeInviteRequestSchema;
+    output: typeof RevokeInviteResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_auth, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/backend_pool-BackendPoolService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/backend_pool-BackendPoolService_connectquery.ts
new file mode 100644
index 0000000000..928cc09fb1
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/backend_pool-BackendPoolService_connectquery.ts
@@ -0,0 +1,40 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/backend_pool.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { BackendPoolService } from "./backend_pool_pb";
+
+/**
+ * Creates a new backend pool.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.CreateBackendPool
+ */
+export const createBackendPool = BackendPoolService.method.createBackendPool;
+
+/**
+ * Gets a backend pool.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.GetBackendPool
+ */
+export const getBackendPool = BackendPoolService.method.getBackendPool;
+
+/**
+ * Lists backend pools.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.ListBackendPools
+ */
+export const listBackendPools = BackendPoolService.method.listBackendPools;
+
+/**
+ * Updates a backend pool.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.UpdateBackendPool
+ */
+export const updateBackendPool = BackendPoolService.method.updateBackendPool;
+
+/**
+ * Deletes a backend pool.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.DeleteBackendPool
+ */
+export const deleteBackendPool = BackendPoolService.method.deleteBackendPool;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/backend_pool_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/backend_pool_pb.ts
new file mode 100644
index 0000000000..04993e48a7
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/backend_pool_pb.ts
@@ -0,0 +1,1134 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/backend_pool.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/backend_pool.proto.
+ */
+export const file_redpanda_api_aigateway_v1_backend_pool: GenFile = /*@__PURE__*/
+  fileDesc("CixyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2JhY2tlbmRfcG9vbC5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSJZChlDcmVhdGVCYWNrZW5kUG9vbFJlc3BvbnNlEjwKDGJhY2tlbmRfcG9vbBgBIAEoCzImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQmFja2VuZFBvb2wiVgoWR2V0QmFja2VuZFBvb2xSZXNwb25zZRI8CgxiYWNrZW5kX3Bvb2wYASABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkJhY2tlbmRQb29sIlkKGVVwZGF0ZUJhY2tlbmRQb29sUmVzcG9uc2USPAoMYmFja2VuZF9wb29sGAEgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5CYWNrZW5kUG9vbCIbChlEZWxldGVCYWNrZW5kUG9vbFJlc3BvbnNlItsICgtCYWNrZW5kUG9vbBIRCgRuYW1lGAEgASgJQgPgQQgSGQoMZGlzcGxheV9uYW1lGAIgASgJQgPgQQISEwoLZGVzY3JpcHRpb24YAyABKAkSOwoIYmFsYW5jZXIYBCABKAsyKS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkJhbGFuY2VyQ29uZmlnEjIKB3NlcnZlcnMYBSADKAsyIS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNlcnZlchIaChJyZXF1ZXN0X3RyYW5zZm9ybXMYBiADKAkSGwoTcmVzcG9uc2VfdHJhbnNmb3JtcxgHIAMoCRI5CgdyZXdyaXRlGAggASgLMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SZXdyaXRlQ29uZmlnEkIKDGhlYWx0aF9jaGVjaxgJIAEoCzIsLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuSGVhbHRoQ2hlY2tDb25maWcSQAoLaHR0cF9jbGllbnQYCiABKAsyKy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkhUVFBDbGllbnRDb25maWcSDwoHZW5hYmxlZBgLIAEoCBJGCghtZXRhZGF0YRgMIAMoCzI0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQmFja2VuZFBvb2wuTWV0YWRhdGFFbnRyeRI0CgtjcmVhdGVfdGltZRgNIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxI0Cgt1cGRhdGVfdGltZRgOIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxJGCgxiYWNrZW5kX3R5cGUYDyABKA4yJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkJhY2tlbmRUeXBlQgi6SAWCAQIQARIVCg1kZWZlcl9sb2FkaW5nGBAgASgIEhQKDGxvYWRfdXBmcm9udBgRIAMoCRIrChp0b29sX2luZGV4X3JlZnJlc2hfc2Vjb25kcxgSIAEoBUIHukgEGgIoABIkCg9zZXNzaW9uX3RpbWVvdXQYEyABKAVCC7pICBoGGICjBSgAEkwKD3Nlc3Npb25fbWFuYWdlchgUIAEoCzIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU2Vzc2lvbk1hbmFnZXJDb25maWdCAhgBEhoKEmZvcndhcmRfb2lkY190b2tlbhgVIAEoCBovCg1NZXRhZGF0YUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAE6dupBcwoiYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9CYWNrZW5kUG9vbBIvZ2F0ZXdheXMve2dhdGV3YXl9L2JhY2tlbmQtcG9vbHMve2JhY2tlbmRfcG9vbH0SHGJhY2tlbmQtcG9vbHMve2JhY2tlbmRfcG9vbH0ixwQKBlNlcnZlchIPCgJpZBgBIAEoCUID4EECEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIWCgl0cmFuc3BvcnQYAyABKAlCA+BBAhIPCgdhZGRyZXNzGAQgASgJEg8KB2NvbW1hbmQYBSABKAkSDAoEYXJncxgGIAMoCRI3CgNlbnYYByADKAsyKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNlcnZlci5FbnZFbnRyeRI5CgdyZXdyaXRlGAggASgLMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SZXdyaXRlQ29uZmlnEhcKD3RpbWVvdXRfc2Vjb25kcxgJIAEoBRITCgttYXhfcmV0cmllcxgKIAEoBRIOCgZ3ZWlnaHQYCyABKAUSPAoKdGxzX3ZlcmlmeRgMIAEoDjIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVExTVmVyaWZ5TW9kZRIzCgRhdXRoGA0gASgLMiUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BdXRoQ29uZmlnEg8KB2VuYWJsZWQYDiABKAgSGgoSZm9yd2FyZF9vaWRjX3Rva2VuGA8gASgIEiMKFmRlZmVyX2xvYWRpbmdfb3ZlcnJpZGUYECABKAhIAIgBARIQCghwcm92aWRlchgRIAEoCRoqCghFbnZFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBQhkKF19kZWZlcl9sb2FkaW5nX292ZXJyaWRlIngKDkJhbGFuY2VyQ29uZmlnEkIKCHN0cmF0ZWd5GAEgASgOMjAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Mb2FkQmFsYW5jaW5nU3RyYXRlZ3kSIgoVc3RyYXRlZ3lfZGlzcGxheV9uYW1lGAIgASgJQgPgQQMixQEKCkF1dGhDb25maWcSMQoEdHlwZRgBIAEoDjIjLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXV0aFR5cGUSDwoHYXBpX2tleRgCIAEoCRJDCgdoZWFkZXJzGAMgAygLMjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BdXRoQ29uZmlnLkhlYWRlcnNFbnRyeRouCgxIZWFkZXJzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKAAQoNUmV3cml0ZUNvbmZpZxI0CgRwYXRoGAEgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5QYXRoUmV3cml0ZRI5CgdoZWFkZXJzGAIgASgLMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5IZWFkZXJSZXdyaXRlIi8KC1BhdGhSZXdyaXRlEg8KB3BhdHRlcm4YASABKAkSDwoHcmVwbGFjZRgCIAEoCSL3AQoNSGVhZGVyUmV3cml0ZRI+CgNzZXQYASADKAsyMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkhlYWRlclJld3JpdGUuU2V0RW50cnkSPgoDYWRkGAIgAygLMjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5IZWFkZXJSZXdyaXRlLkFkZEVudHJ5Eg4KBnJlbW92ZRgDIAMoCRoqCghTZXRFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGioKCEFkZEVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEipAEKEUhlYWx0aENoZWNrQ29uZmlnEhsKE3VuaGVhbHRoeV90aHJlc2hvbGQYASABKAUSGQoRaGVhbHRoeV90aHJlc2hvbGQYAiABKAUSGQoRcmVjb3ZlcnlfaW50ZXJ2YWwYAyABKAkSPAoGYWN0aXZlGAQgASgLMiwucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BY3RpdmVIZWFsdGhDaGVjayKPAQoRQWN0aXZlSGVhbHRoQ2hlY2sSDwoHZW5hYmxlZBgBIAEoCBIMCgR0eXBlGAIgASgJEhAKCGludGVydmFsGAMgASgJEg8KB3RpbWVvdXQYBCABKAkSOAoEaHR0cBgFIAEoCzIqLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuSFRUUEhlYWx0aENoZWNrIkgKD0hUVFBIZWFsdGhDaGVjaxIOCgZtZXRob2QYASABKAkSDAoEcGF0aBgCIAEoCRIXCg9leHBlY3RlZF9zdGF0dXMYAyABKAUizwIKEEhUVFBDbGllbnRDb25maWcSFgoObWF4X2lkbGVfY29ubnMYASABKAUSIQoZbWF4X2lkbGVfY29ubnNfcGVyX3NlcnZlchgCIAEoBRIcChRtYXhfY29ubnNfcGVyX3NlcnZlchgDIAEoBRIZChFpZGxlX2Nvbm5fdGltZW91dBgEIAEoBRIXCg9jb25uZWN0X3RpbWVvdXQYBSABKAUSHQoVdGxzX2hhbmRzaGFrZV90aW1lb3V0GAYgASgFEh8KF3Jlc3BvbnNlX2hlYWRlcl90aW1lb3V0GAcgASgFEh8KF2V4cGVjdF9jb250aW51ZV90aW1lb3V0GAggASgFEhsKE2Rpc2FibGVfY29tcHJlc3Npb24YCSABKAgSGwoTZGlzYWJsZV9rZWVwX2FsaXZlcxgKIAEoCBITCgtmb3JjZV9odHRwMhgLIAEoCCJ3ChRTZXNzaW9uTWFuYWdlckNvbmZpZxITCgdlbmFibGVkGAEgASgIQgIYARIpChhlbmZvcmNlX2lkZW50aXR5X2JpbmRpbmcYAyABKAhCAhgBSACIAQE6AhgBQhsKGV9lbmZvcmNlX2lkZW50aXR5X2JpbmRpbmcihAEKGENyZWF0ZUJhY2tlbmRQb29sUmVxdWVzdBIOCgZwYXJlbnQYASABKAkSQQoMYmFja2VuZF9wb29sGAMgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5CYWNrZW5kUG9vbEID4EECSgQIAhADUg9iYWNrZW5kX3Bvb2xfaWQiUQoVR2V0QmFja2VuZFBvb2xSZXF1ZXN0EjgKBG5hbWUYASABKAlCKuBBAvpBJAoiYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9CYWNrZW5kUG9vbCJyChdMaXN0QmFja2VuZFBvb2xzUmVxdWVzdBIOCgZwYXJlbnQYASABKAkSEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkSDgoGZmlsdGVyGAQgASgJEhAKCG9yZGVyX2J5GAUgASgJIoYBChhMaXN0QmFja2VuZFBvb2xzUmVzcG9uc2USPQoNYmFja2VuZF9wb29scxgBIAMoCzImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQmFja2VuZFBvb2wSFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJEhIKCnRvdGFsX3NpemUYAyABKAUijgEKGFVwZGF0ZUJhY2tlbmRQb29sUmVxdWVzdBJBCgxiYWNrZW5kX3Bvb2wYASABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkJhY2tlbmRQb29sQgPgQQISLwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrIlQKGERlbGV0ZUJhY2tlbmRQb29sUmVxdWVzdBI4CgRuYW1lGAEgASgJQirgQQL6QSQKImFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vQmFja2VuZFBvb2wqlAIKFUxvYWRCYWxhbmNpbmdTdHJhdGVneRInCiNMT0FEX0JBTEFOQ0lOR19TVFJBVEVHWV9VTlNQRUNJRklFRBAAEicKI0xPQURfQkFMQU5DSU5HX1NUUkFURUdZX1JPVU5EX1JPQklOEAESMAosTE9BRF9CQUxBTkNJTkdfU1RSQVRFR1lfV0VJR0hURURfUk9VTkRfUk9CSU4QAhItCilMT0FEX0JBTEFOQ0lOR19TVFJBVEVHWV9MRUFTVF9DT05ORUNUSU9OUxADEiIKHkxPQURfQkFMQU5DSU5HX1NUUkFURUdZX1JBTkRPTRAEEiQKIExPQURfQkFMQU5DSU5HX1NUUkFURUdZX0ZBSUxPVkVSEAUqZAoNVExTVmVyaWZ5TW9kZRIfChtUTFNfVkVSSUZZX01PREVfVU5TUEVDSUZJRUQQABIYChRUTFNfVkVSSUZZX01PREVfRlVMTBABEhgKFFRMU19WRVJJRllfTU9ERV9TS0lQEAIqaAoIQXV0aFR5cGUSGQoVQVVUSF9UWVBFX1VOU1BFQ0lGSUVEEAASFAoQQVVUSF9UWVBFX0JFQVJFUhABEhUKEUFVVEhfVFlQRV9BUElfS0VZEAISFAoQQVVUSF9UWVBFX0NVU1RPTRADKlgKC0JhY2tlbmRUeXBlEhwKGEJBQ0tFTkRfVFlQRV9VTlNQRUNJRklFRBAAEhUKEUJBQ0tFTkRfVFlQRV9IVFRQEAESFAoQQkFDS0VORF9UWVBFX01DUBACMuoIChJCYWNrZW5kUG9vbFNlcnZpY2US3gEKEUNyZWF0ZUJhY2tlbmRQb29sEjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVCYWNrZW5kUG9vbFJlcXVlc3QaNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNyZWF0ZUJhY2tlbmRQb29sUmVzcG9uc2UiXoLT5JMCWDoMYmFja2VuZF9wb29sWiE6DGJhY2tlbmRfcG9vbCIRL3YxL2JhY2tlbmQtcG9vbHMiJS92MS97cGFyZW50PWdhdGV3YXlzLyp9L2JhY2tlbmQtcG9vbHMSwgEKDkdldEJhY2tlbmRQb29sEjAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRCYWNrZW5kUG9vbFJlcXVlc3QaMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldEJhY2tlbmRQb29sUmVzcG9uc2UiS4LT5JMCRVocEhovdjEve25hbWU9YmFja2VuZC1wb29scy8qfRIlL3YxL3tuYW1lPWdhdGV3YXlzLyovYmFja2VuZC1wb29scy8qfRK/AQoQTGlzdEJhY2tlbmRQb29scxIyLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdEJhY2tlbmRQb29sc1JlcXVlc3QaMy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RCYWNrZW5kUG9vbHNSZXNwb25zZSJCgtPkkwI8WhMSES92MS9iYWNrZW5kLXBvb2xzEiUvdjEve3BhcmVudD1nYXRld2F5cy8qfS9iYWNrZW5kLXBvb2xzEoICChFVcGRhdGVCYWNrZW5kUG9vbBIzLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlQmFja2VuZFBvb2xSZXF1ZXN0GjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVCYWNrZW5kUG9vbFJlc3BvbnNlIoEBgtPkkwJ7OgxiYWNrZW5kX3Bvb2xaNzoMYmFja2VuZF9wb29sMicvdjEve2JhY2tlbmRfcG9vbC5uYW1lPWJhY2tlbmQtcG9vbHMvKn0yMi92MS97YmFja2VuZF9wb29sLm5hbWU9Z2F0ZXdheXMvKi9iYWNrZW5kLXBvb2xzLyp9EssBChFEZWxldGVCYWNrZW5kUG9vbBIzLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlQmFja2VuZFBvb2xSZXF1ZXN0GjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVCYWNrZW5kUG9vbFJlc3BvbnNlIkuC0+STAkVaHCoaL3YxL3tuYW1lPWJhY2tlbmQtcG9vbHMvKn0qJS92MS97bmFtZT1nYXRld2F5cy8qL2JhY2tlbmQtcG9vbHMvKn0aGcpBFmFpZ2F0ZXdheS5yZWRwYW5kYS5jb21ChQIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQhBCYWNrZW5kUG9vbFByb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Response message for CreateBackendPool RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateBackendPoolResponse
+ */
+export type CreateBackendPoolResponse = Message<"redpanda.api.aigateway.v1.CreateBackendPoolResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.BackendPool backend_pool = 1;
+   */
+  backendPool?: BackendPool;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateBackendPoolResponse.
+ * Use `create(CreateBackendPoolResponseSchema)` to create a new message.
+ */
+export const CreateBackendPoolResponseSchema: GenMessage<CreateBackendPoolResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 0);
+
+/**
+ * Response message for GetBackendPool RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetBackendPoolResponse
+ */
+export type GetBackendPoolResponse = Message<"redpanda.api.aigateway.v1.GetBackendPoolResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.BackendPool backend_pool = 1;
+   */
+  backendPool?: BackendPool;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetBackendPoolResponse.
+ * Use `create(GetBackendPoolResponseSchema)` to create a new message.
+ */
+export const GetBackendPoolResponseSchema: GenMessage<GetBackendPoolResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 1);
+
+/**
+ * Response message for UpdateBackendPool RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateBackendPoolResponse
+ */
+export type UpdateBackendPoolResponse = Message<"redpanda.api.aigateway.v1.UpdateBackendPoolResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.BackendPool backend_pool = 1;
+   */
+  backendPool?: BackendPool;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateBackendPoolResponse.
+ * Use `create(UpdateBackendPoolResponseSchema)` to create a new message.
+ */
+export const UpdateBackendPoolResponseSchema: GenMessage<UpdateBackendPoolResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 2);
+
+/**
+ * Response message for DeleteBackendPool RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteBackendPoolResponse
+ */
+export type DeleteBackendPoolResponse = Message<"redpanda.api.aigateway.v1.DeleteBackendPoolResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteBackendPoolResponse.
+ * Use `create(DeleteBackendPoolResponseSchema)` to create a new message.
+ */
+export const DeleteBackendPoolResponseSchema: GenMessage<DeleteBackendPoolResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 3);
+
+/**
+ * BackendPool represents a group of LLM provider servers.
+ *
+ * @generated from message redpanda.api.aigateway.v1.BackendPool
+ */
+export type BackendPool = Message<"redpanda.api.aigateway.v1.BackendPool"> & {
+  /**
+   * Resource name.
+   * Format: `gateways/{gateway}/backend-pools/{backend_pool}` or `backend-pools/{backend_pool}` (global)
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Optional: Load balancing configuration
+   *
+   * @generated from field: redpanda.api.aigateway.v1.BalancerConfig balancer = 4;
+   */
+  balancer?: BalancerConfig;
+
+  /**
+   * Servers in this pool
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.Server servers = 5;
+   */
+  servers: Server[];
+
+  /**
+   * Request body transformations (applied before forwarding to backend)
+   * Examples: "strip_model_prefix", "openai_to_anthropic"
+   *
+   * @generated from field: repeated string request_transforms = 6;
+   */
+  requestTransforms: string[];
+
+  /**
+   * Response body transformations (applied before returning to client)
+   * Examples: "anthropic_to_openai"
+   *
+   * @generated from field: repeated string response_transforms = 7;
+   */
+  responseTransforms: string[];
+
+  /**
+   * Optional: HTTP request/response rewriting for all servers in this pool
+   *
+   * @generated from field: redpanda.api.aigateway.v1.RewriteConfig rewrite = 8;
+   */
+  rewrite?: RewriteConfig;
+
+  /**
+   * Optional: Health checking configuration (passive and active)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.HealthCheckConfig health_check = 9;
+   */
+  healthCheck?: HealthCheckConfig;
+
+  /**
+   * Optional: HTTP client configuration for backend connections
+   *
+   * @generated from field: redpanda.api.aigateway.v1.HTTPClientConfig http_client = 10;
+   */
+  httpClient?: HTTPClientConfig;
+
+  /**
+   * Whether this backend pool is active
+   *
+   * @generated from field: bool enabled = 11;
+   */
+  enabled: boolean;
+
+  /**
+   * Metadata
+   *
+   * @generated from field: map<string, string> metadata = 12;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 13;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 14;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Backend protocol type (default: HTTP for LLM APIs, MCP for tool servers)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.BackendType backend_type = 15;
+   */
+  backendType: BackendType;
+
+  /**
+   * Enable deferred tool loading (MCP backends only)
+   * When enabled, tools are loaded lazily via tool_search instead of all upfront
+   * Reduces token usage by ~85% for large tool catalogs (1000+ tools)
+   *
+   * @generated from field: bool defer_loading = 16;
+   */
+  deferLoading: boolean;
+
+  /**
+   * Glob patterns for tools to load immediately (allowlist for critical tools)
+   * Used with defer_loading to specify essential tools
+   * Supports wildcards: * (any chars), ? (single char)
+   * Examples: ["filesystem:*", "orchestrator:execute", "*:read_*"]
+   *
+   * @generated from field: repeated string load_upfront = 17;
+   */
+  loadUpfront: string[];
+
+  /**
+   * Tool index refresh interval in seconds (MCP backends with defer_loading only)
+   * How often to refresh the tool index in the background (default: 300 = 5 minutes)
+   * 0 means use server default
+   *
+   * @generated from field: int32 tool_index_refresh_seconds = 18;
+   */
+  toolIndexRefreshSeconds: number;
+
+  /**
+   * Session idle timeout in seconds (for stateful backends like MCP)
+   * Default: 3600 (1 hour), max: 86400 (24 hours)
+   *
+   * @generated from field: int32 session_timeout = 19;
+   */
+  sessionTimeout: number;
+
+  /**
+   * DEPRECATED: Per-backend session_manager is no longer supported.
+   * Session management for MCP backends is now configured globally via the
+   * mcp_gateway.session_manager section in config.yaml. This field is retained
+   * for backward compatibility but is ignored by the gateway.
+   * See: https://docs.redpanda.com/aigateway/mcp-gateway-configuration
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SessionManagerConfig session_manager = 20 [deprecated = true];
+   * @deprecated
+   */
+  sessionManager?: SessionManagerConfig;
+
+  /**
+   * Forward OIDC token to all servers in this backend pool
+   * Can be overridden at the individual server level
+   *
+   * @generated from field: bool forward_oidc_token = 21;
+   */
+  forwardOidcToken: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.BackendPool.
+ * Use `create(BackendPoolSchema)` to create a new message.
+ */
+export const BackendPoolSchema: GenMessage<BackendPool> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 4);
+
+/**
+ * Server represents an individual LLM provider endpoint.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Server
+ */
+export type Server = Message<"redpanda.api.aigateway.v1.Server"> & {
+  /**
+   * Required: Unique server identifier within the backend pool
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * Optional: Human-readable display name
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Transport protocol: "http" (default) or "stdio" (for MCP tools)
+   *
+   * @generated from field: string transport = 3;
+   */
+  transport: string;
+
+  /**
+   * Server address (required for http transport)
+   * Supports http://, https://, and builtin:// schemes
+   *
+   * @generated from field: string address = 4;
+   */
+  address: string;
+
+  /**
+   * Command to execute (required for stdio transport, e.g., "npx")
+   *
+   * @generated from field: string command = 5;
+   */
+  command: string;
+
+  /**
+   * Command arguments (for stdio transport, e.g., ["@modelcontextprotocol/server-memory"])
+   *
+   * @generated from field: repeated string args = 6;
+   */
+  args: string[];
+
+  /**
+   * Environment variables for the process (for stdio transport)
+   *
+   * @generated from field: map<string, string> env = 7;
+   */
+  env: { [key: string]: string };
+
+  /**
+   * Optional: Per-server HTTP rewrite configuration (overrides backend-level)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.RewriteConfig rewrite = 8;
+   */
+  rewrite?: RewriteConfig;
+
+  /**
+   * Optional: Request timeout in seconds (default: 30s, max: 3600s)
+   *
+   * @generated from field: int32 timeout_seconds = 9;
+   */
+  timeoutSeconds: number;
+
+  /**
+   * Optional: Maximum retry attempts on failure (default: 0, max: 10)
+   *
+   * @generated from field: int32 max_retries = 10;
+   */
+  maxRetries: number;
+
+  /**
+   * Optional: Load balancer weight (default: 100, max: 1000)
+   *
+   * @generated from field: int32 weight = 11;
+   */
+  weight: number;
+
+  /**
+   * Optional: TLS verification mode
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TLSVerifyMode tls_verify = 12;
+   */
+  tlsVerify: TLSVerifyMode;
+
+  /**
+   * Optional: Authentication configuration
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuthConfig auth = 13;
+   */
+  auth?: AuthConfig;
+
+  /**
+   * Whether this server is enabled
+   *
+   * @generated from field: bool enabled = 14;
+   */
+  enabled: boolean;
+
+  /**
+   * Optional: Forward OIDC token to this specific server
+   *
+   * @generated from field: bool forward_oidc_token = 15;
+   */
+  forwardOidcToken: boolean;
+
+  /**
+   * Optional: Override backend-level defer_loading for this server (MCP servers only)
+   * When null, inherits from BackendPool.defer_loading
+   * When explicitly set, overrides backend setting for this specific server
+   *
+   * @generated from field: optional bool defer_loading_override = 16;
+   */
+  deferLoadingOverride?: boolean;
+
+  /**
+   * Optional: Provider identifier (e.g., "openai", "anthropic", "google", "mistral")
+   * Used for UI display and filtering. When not specified, provider is auto-detected
+   * from the server address URL. Use this field for custom endpoints or proxies
+   * where URL-based detection doesn't work.
+   *
+   * @generated from field: string provider = 17;
+   */
+  provider: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Server.
+ * Use `create(ServerSchema)` to create a new message.
+ */
+export const ServerSchema: GenMessage<Server> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 5);
+
+/**
+ * BalancerConfig configures load balancing across servers
+ *
+ * @generated from message redpanda.api.aigateway.v1.BalancerConfig
+ */
+export type BalancerConfig = Message<"redpanda.api.aigateway.v1.BalancerConfig"> & {
+  /**
+   * Load balancing strategy
+   *
+   * @generated from field: redpanda.api.aigateway.v1.LoadBalancingStrategy strategy = 1;
+   */
+  strategy: LoadBalancingStrategy;
+
+  /**
+   * Output only. Human-readable strategy name (e.g., "Round Robin", "Weighted")
+   *
+   * @generated from field: string strategy_display_name = 2;
+   */
+  strategyDisplayName: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.BalancerConfig.
+ * Use `create(BalancerConfigSchema)` to create a new message.
+ */
+export const BalancerConfigSchema: GenMessage<BalancerConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 6);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.AuthConfig
+ */
+export type AuthConfig = Message<"redpanda.api.aigateway.v1.AuthConfig"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.AuthType type = 1;
+   */
+  type: AuthType;
+
+  /**
+   * @generated from field: string api_key = 2;
+   */
+  apiKey: string;
+
+  /**
+   * @generated from field: map<string, string> headers = 3;
+   */
+  headers: { [key: string]: string };
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AuthConfig.
+ * Use `create(AuthConfigSchema)` to create a new message.
+ */
+export const AuthConfigSchema: GenMessage<AuthConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 7);
+
+/**
+ * RewriteConfig defines HTTP request rewriting rules.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RewriteConfig
+ */
+export type RewriteConfig = Message<"redpanda.api.aigateway.v1.RewriteConfig"> & {
+  /**
+   * Optional: Path rewriting configuration
+   *
+   * @generated from field: redpanda.api.aigateway.v1.PathRewrite path = 1;
+   */
+  path?: PathRewrite;
+
+  /**
+   * Optional: Header manipulation configuration
+   *
+   * @generated from field: redpanda.api.aigateway.v1.HeaderRewrite headers = 2;
+   */
+  headers?: HeaderRewrite;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RewriteConfig.
+ * Use `create(RewriteConfigSchema)` to create a new message.
+ */
+export const RewriteConfigSchema: GenMessage<RewriteConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 8);
+
+/**
+ * PathRewrite defines path rewriting rules.
+ *
+ * @generated from message redpanda.api.aigateway.v1.PathRewrite
+ */
+export type PathRewrite = Message<"redpanda.api.aigateway.v1.PathRewrite"> & {
+  /**
+   * Regex pattern to match against the request path
+   *
+   * @generated from field: string pattern = 1;
+   */
+  pattern: string;
+
+  /**
+   * Replacement string (can use $1, $2 for regex capture groups)
+   *
+   * @generated from field: string replace = 2;
+   */
+  replace: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.PathRewrite.
+ * Use `create(PathRewriteSchema)` to create a new message.
+ */
+export const PathRewriteSchema: GenMessage<PathRewrite> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 9);
+
+/**
+ * HeaderRewrite defines header manipulation rules.
+ *
+ * @generated from message redpanda.api.aigateway.v1.HeaderRewrite
+ */
+export type HeaderRewrite = Message<"redpanda.api.aigateway.v1.HeaderRewrite"> & {
+  /**
+   * Headers to set (overwrite if present)
+   *
+   * @generated from field: map<string, string> set = 1;
+   */
+  set: { [key: string]: string };
+
+  /**
+   * Headers to add (only if not already present)
+   *
+   * @generated from field: map<string, string> add = 2;
+   */
+  add: { [key: string]: string };
+
+  /**
+   * Headers to remove
+   *
+   * @generated from field: repeated string remove = 3;
+   */
+  remove: string[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.HeaderRewrite.
+ * Use `create(HeaderRewriteSchema)` to create a new message.
+ */
+export const HeaderRewriteSchema: GenMessage<HeaderRewrite> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 10);
+
+/**
+ * HealthCheckConfig configures passive and active health checking.
+ *
+ * @generated from message redpanda.api.aigateway.v1.HealthCheckConfig
+ */
+export type HealthCheckConfig = Message<"redpanda.api.aigateway.v1.HealthCheckConfig"> & {
+  /**
+   * Number of consecutive failures before marking server unhealthy (default: 3)
+   *
+   * @generated from field: int32 unhealthy_threshold = 1;
+   */
+  unhealthyThreshold: number;
+
+  /**
+   * Number of consecutive successes before marking server healthy (default: 2)
+   *
+   * @generated from field: int32 healthy_threshold = 2;
+   */
+  healthyThreshold: number;
+
+  /**
+   * Time before retrying an unhealthy server (e.g., "30s", "5m")
+   *
+   * @generated from field: string recovery_interval = 3;
+   */
+  recoveryInterval: string;
+
+  /**
+   * Optional: Active health checking (periodic probing)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ActiveHealthCheck active = 4;
+   */
+  active?: ActiveHealthCheck;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.HealthCheckConfig.
+ * Use `create(HealthCheckConfigSchema)` to create a new message.
+ */
+export const HealthCheckConfigSchema: GenMessage<HealthCheckConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 11);
+
+/**
+ * ActiveHealthCheck configures periodic probing of backend servers.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ActiveHealthCheck
+ */
+export type ActiveHealthCheck = Message<"redpanda.api.aigateway.v1.ActiveHealthCheck"> & {
+  /**
+   * Enable active health checking
+   *
+   * @generated from field: bool enabled = 1;
+   */
+  enabled: boolean;
+
+  /**
+   * Health check protocol type (e.g., "http")
+   *
+   * @generated from field: string type = 2;
+   */
+  type: string;
+
+  /**
+   * Probe interval (e.g., "10s")
+   *
+   * @generated from field: string interval = 3;
+   */
+  interval: string;
+
+  /**
+   * Probe timeout (e.g., "5s")
+   *
+   * @generated from field: string timeout = 4;
+   */
+  timeout: string;
+
+  /**
+   * HTTP-specific health check configuration
+   *
+   * @generated from field: redpanda.api.aigateway.v1.HTTPHealthCheck http = 5;
+   */
+  http?: HTTPHealthCheck;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ActiveHealthCheck.
+ * Use `create(ActiveHealthCheckSchema)` to create a new message.
+ */
+export const ActiveHealthCheckSchema: GenMessage<ActiveHealthCheck> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 12);
+
+/**
+ * HTTPHealthCheck configures HTTP-based active health checks.
+ *
+ * @generated from message redpanda.api.aigateway.v1.HTTPHealthCheck
+ */
+export type HTTPHealthCheck = Message<"redpanda.api.aigateway.v1.HTTPHealthCheck"> & {
+  /**
+   * HTTP method for health check request (default: "GET")
+   *
+   * @generated from field: string method = 1;
+   */
+  method: string;
+
+  /**
+   * Health check endpoint path (default: "/health")
+   *
+   * @generated from field: string path = 2;
+   */
+  path: string;
+
+  /**
+   * Expected HTTP status code indicating health (default: 200)
+   *
+   * @generated from field: int32 expected_status = 3;
+   */
+  expectedStatus: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.HTTPHealthCheck.
+ * Use `create(HTTPHealthCheckSchema)` to create a new message.
+ */
+export const HTTPHealthCheckSchema: GenMessage<HTTPHealthCheck> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 13);
+
+/**
+ * HTTPClientConfig configures the HTTP client for backend requests.
+ *
+ * @generated from message redpanda.api.aigateway.v1.HTTPClientConfig
+ */
+export type HTTPClientConfig = Message<"redpanda.api.aigateway.v1.HTTPClientConfig"> & {
+  /**
+   * Connection pool settings
+   *
+   * @generated from field: int32 max_idle_conns = 1;
+   */
+  maxIdleConns: number;
+
+  /**
+   * @generated from field: int32 max_idle_conns_per_server = 2;
+   */
+  maxIdleConnsPerServer: number;
+
+  /**
+   * @generated from field: int32 max_conns_per_server = 3;
+   */
+  maxConnsPerServer: number;
+
+  /**
+   * seconds
+   *
+   * @generated from field: int32 idle_conn_timeout = 4;
+   */
+  idleConnTimeout: number;
+
+  /**
+   * Timeout settings (all in seconds, 0 = use default)
+   *
+   * @generated from field: int32 connect_timeout = 5;
+   */
+  connectTimeout: number;
+
+  /**
+   * @generated from field: int32 tls_handshake_timeout = 6;
+   */
+  tlsHandshakeTimeout: number;
+
+  /**
+   * @generated from field: int32 response_header_timeout = 7;
+   */
+  responseHeaderTimeout: number;
+
+  /**
+   * @generated from field: int32 expect_continue_timeout = 8;
+   */
+  expectContinueTimeout: number;
+
+  /**
+   * Feature flags
+   *
+   * @generated from field: bool disable_compression = 9;
+   */
+  disableCompression: boolean;
+
+  /**
+   * @generated from field: bool disable_keep_alives = 10;
+   */
+  disableKeepAlives: boolean;
+
+  /**
+   * @generated from field: bool force_http2 = 11;
+   */
+  forceHttp2: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.HTTPClientConfig.
+ * Use `create(HTTPClientConfigSchema)` to create a new message.
+ */
+export const HTTPClientConfigSchema: GenMessage<HTTPClientConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 14);
+
+/**
+ * DEPRECATED: SessionManagerConfig is deprecated.
+ * Session management for MCP backends is now configured globally via the
+ * mcp_gateway.session_manager section in config.yaml.
+ *
+ * Storage auto-detection:
+ *   1. If mcp_gateway.session_manager.storage_id is set → Uses that Redis instance
+ *   2. If storage.redis[] is configured → Auto-detects first Redis instance
+ *   3. Otherwise → Falls back to in-memory storage
+ *
+ * This message is retained for backward compatibility but is ignored by the gateway.
+ * All MCP backends share the same session storage configuration from mcp_gateway.
+ *
+ * @generated from message redpanda.api.aigateway.v1.SessionManagerConfig
+ * @deprecated
+ */
+export type SessionManagerConfig = Message<"redpanda.api.aigateway.v1.SessionManagerConfig"> & {
+  /**
+   * DEPRECATED: Session management is always enabled for MCP backends
+   *
+   * @generated from field: bool enabled = 1 [deprecated = true];
+   * @deprecated
+   */
+  enabled: boolean;
+
+  /**
+   * DEPRECATED: Use mcp_gateway.session_manager.enforce_identity_binding instead
+   * Bind MCP sessions to OIDC subject claim (secure by default)
+   * When enabled, each OIDC user gets their own isolated session
+   *
+   * @generated from field: optional bool enforce_identity_binding = 3 [deprecated = true];
+   * @deprecated
+   */
+  enforceIdentityBinding?: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SessionManagerConfig.
+ * Use `create(SessionManagerConfigSchema)` to create a new message.
+ * @deprecated
+ */
+export const SessionManagerConfigSchema: GenMessage<SessionManagerConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 15);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateBackendPoolRequest
+ */
+export type CreateBackendPoolRequest = Message<"redpanda.api.aigateway.v1.CreateBackendPoolRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.BackendPool backend_pool = 3;
+   */
+  backendPool?: BackendPool;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateBackendPoolRequest.
+ * Use `create(CreateBackendPoolRequestSchema)` to create a new message.
+ */
+export const CreateBackendPoolRequestSchema: GenMessage<CreateBackendPoolRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 16);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetBackendPoolRequest
+ */
+export type GetBackendPoolRequest = Message<"redpanda.api.aigateway.v1.GetBackendPoolRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetBackendPoolRequest.
+ * Use `create(GetBackendPoolRequestSchema)` to create a new message.
+ */
+export const GetBackendPoolRequestSchema: GenMessage<GetBackendPoolRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 17);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListBackendPoolsRequest
+ */
+export type ListBackendPoolsRequest = Message<"redpanda.api.aigateway.v1.ListBackendPoolsRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListBackendPoolsRequest.
+ * Use `create(ListBackendPoolsRequestSchema)` to create a new message.
+ */
+export const ListBackendPoolsRequestSchema: GenMessage<ListBackendPoolsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 18);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListBackendPoolsResponse
+ */
+export type ListBackendPoolsResponse = Message<"redpanda.api.aigateway.v1.ListBackendPoolsResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.BackendPool backend_pools = 1;
+   */
+  backendPools: BackendPool[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListBackendPoolsResponse.
+ * Use `create(ListBackendPoolsResponseSchema)` to create a new message.
+ */
+export const ListBackendPoolsResponseSchema: GenMessage<ListBackendPoolsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 19);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateBackendPoolRequest
+ */
+export type UpdateBackendPoolRequest = Message<"redpanda.api.aigateway.v1.UpdateBackendPoolRequest"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.BackendPool backend_pool = 1;
+   */
+  backendPool?: BackendPool;
+
+  /**
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateBackendPoolRequest.
+ * Use `create(UpdateBackendPoolRequestSchema)` to create a new message.
+ */
+export const UpdateBackendPoolRequestSchema: GenMessage<UpdateBackendPoolRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 20);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteBackendPoolRequest
+ */
+export type DeleteBackendPoolRequest = Message<"redpanda.api.aigateway.v1.DeleteBackendPoolRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteBackendPoolRequest.
+ * Use `create(DeleteBackendPoolRequestSchema)` to create a new message.
+ */
+export const DeleteBackendPoolRequestSchema: GenMessage<DeleteBackendPoolRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_backend_pool, 21);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.LoadBalancingStrategy
+ */
+export enum LoadBalancingStrategy {
+  /**
+   * @generated from enum value: LOAD_BALANCING_STRATEGY_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: LOAD_BALANCING_STRATEGY_ROUND_ROBIN = 1;
+   */
+  ROUND_ROBIN = 1,
+
+  /**
+   * @generated from enum value: LOAD_BALANCING_STRATEGY_WEIGHTED_ROUND_ROBIN = 2;
+   */
+  WEIGHTED_ROUND_ROBIN = 2,
+
+  /**
+   * @generated from enum value: LOAD_BALANCING_STRATEGY_LEAST_CONNECTIONS = 3;
+   */
+  LEAST_CONNECTIONS = 3,
+
+  /**
+   * @generated from enum value: LOAD_BALANCING_STRATEGY_RANDOM = 4;
+   */
+  RANDOM = 4,
+
+  /**
+   * @generated from enum value: LOAD_BALANCING_STRATEGY_FAILOVER = 5;
+   */
+  FAILOVER = 5,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.LoadBalancingStrategy.
+ */
+export const LoadBalancingStrategySchema: GenEnum<LoadBalancingStrategy> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_backend_pool, 0);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.TLSVerifyMode
+ */
+export enum TLSVerifyMode {
+  /**
+   * @generated from enum value: TLS_VERIFY_MODE_UNSPECIFIED = 0;
+   */
+  TLS_VERIFY_MODE_UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: TLS_VERIFY_MODE_FULL = 1;
+   */
+  TLS_VERIFY_MODE_FULL = 1,
+
+  /**
+   * @generated from enum value: TLS_VERIFY_MODE_SKIP = 2;
+   */
+  TLS_VERIFY_MODE_SKIP = 2,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.TLSVerifyMode.
+ */
+export const TLSVerifyModeSchema: GenEnum<TLSVerifyMode> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_backend_pool, 1);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.AuthType
+ */
+export enum AuthType {
+  /**
+   * @generated from enum value: AUTH_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: AUTH_TYPE_BEARER = 1;
+   */
+  BEARER = 1,
+
+  /**
+   * @generated from enum value: AUTH_TYPE_API_KEY = 2;
+   */
+  API_KEY = 2,
+
+  /**
+   * @generated from enum value: AUTH_TYPE_CUSTOM = 3;
+   */
+  CUSTOM = 3,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.AuthType.
+ */
+export const AuthTypeSchema: GenEnum<AuthType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_backend_pool, 2);
+
+/**
+ * BackendType specifies the backend protocol/implementation.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.BackendType
+ */
+export enum BackendType {
+  /**
+   * Default/unspecified (defaults to HTTP)
+   *
+   * @generated from enum value: BACKEND_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * HTTP/HTTPS backends (LLM REST APIs like OpenAI, Anthropic)
+   *
+   * @generated from enum value: BACKEND_TYPE_HTTP = 1;
+   */
+  HTTP = 1,
+
+  /**
+   * Model Context Protocol backends (MCP tool servers)
+   *
+   * @generated from enum value: BACKEND_TYPE_MCP = 2;
+   */
+  MCP = 2,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.BackendType.
+ */
+export const BackendTypeSchema: GenEnum<BackendType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_backend_pool, 3);
+
+/**
+ * @generated from service redpanda.api.aigateway.v1.BackendPoolService
+ */
+export const BackendPoolService: GenService<{
+  /**
+   * Creates a new backend pool.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.CreateBackendPool
+   */
+  createBackendPool: {
+    methodKind: "unary";
+    input: typeof CreateBackendPoolRequestSchema;
+    output: typeof CreateBackendPoolResponseSchema;
+  },
+  /**
+   * Gets a backend pool.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.GetBackendPool
+   */
+  getBackendPool: {
+    methodKind: "unary";
+    input: typeof GetBackendPoolRequestSchema;
+    output: typeof GetBackendPoolResponseSchema;
+  },
+  /**
+   * Lists backend pools.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.ListBackendPools
+   */
+  listBackendPools: {
+    methodKind: "unary";
+    input: typeof ListBackendPoolsRequestSchema;
+    output: typeof ListBackendPoolsResponseSchema;
+  },
+  /**
+   * Updates a backend pool.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.UpdateBackendPool
+   */
+  updateBackendPool: {
+    methodKind: "unary";
+    input: typeof UpdateBackendPoolRequestSchema;
+    output: typeof UpdateBackendPoolResponseSchema;
+  },
+  /**
+   * Deletes a backend pool.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.BackendPoolService.DeleteBackendPool
+   */
+  deleteBackendPool: {
+    methodKind: "unary";
+    input: typeof DeleteBackendPoolRequestSchema;
+    output: typeof DeleteBackendPoolResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_backend_pool, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/config-ConfigService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/config-ConfigService_connectquery.ts
new file mode 100644
index 0000000000..a3a335d5fa
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/config-ConfigService_connectquery.ts
@@ -0,0 +1,61 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/config.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { ConfigService } from "./config_pb";
+
+/**
+ * Stages a configuration (assembles entities, validates, stores immutably)
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ConfigService.StageConfiguration
+ */
+export const stageConfiguration = ConfigService.method.stageConfiguration;
+
+/**
+ * Publishes a staged configuration (packages and distributes)
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ConfigService.PublishConfiguration
+ */
+export const publishConfiguration = ConfigService.method.publishConfiguration;
+
+/**
+ * Deploys a published configuration (places near gateway instances)
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ConfigService.DeployConfiguration
+ */
+export const deployConfiguration = ConfigService.method.deployConfiguration;
+
+/**
+ * Releases a deployed configuration (activates it)
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ConfigService.ReleaseConfiguration
+ */
+export const releaseConfiguration = ConfigService.method.releaseConfiguration;
+
+/**
+ * Rolls back to a previous configuration
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ConfigService.RollbackConfiguration
+ */
+export const rollbackConfiguration = ConfigService.method.rollbackConfiguration;
+
+/**
+ * Gets a configuration
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ConfigService.GetConfiguration
+ */
+export const getConfiguration = ConfigService.method.getConfiguration;
+
+/**
+ * Lists configurations
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ConfigService.ListConfigurations
+ */
+export const listConfigurations = ConfigService.method.listConfigurations;
+
+/**
+ * Gets the currently active configuration
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ConfigService.GetActiveConfiguration
+ */
+export const getActiveConfiguration = ConfigService.method.getActiveConfiguration;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/config_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/config_pb.ts
new file mode 100644
index 0000000000..38f9537cbd
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/config_pb.ts
@@ -0,0 +1,780 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/config.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/config.proto.
+ */
+export const file_redpanda_api_aigateway_v1_config: GenFile = /*@__PURE__*/
+  fileDesc("CiZyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2NvbmZpZy5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSJdChpTdGFnZUNvbmZpZ3VyYXRpb25SZXNwb25zZRI/Cg1jb25maWd1cmF0aW9uGAEgASgLMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Db25maWd1cmF0aW9uIl8KHFB1Ymxpc2hDb25maWd1cmF0aW9uUmVzcG9uc2USPwoNY29uZmlndXJhdGlvbhgBIAEoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ29uZmlndXJhdGlvbiJeChtEZXBsb3lDb25maWd1cmF0aW9uUmVzcG9uc2USPwoNY29uZmlndXJhdGlvbhgBIAEoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ29uZmlndXJhdGlvbiJfChxSZWxlYXNlQ29uZmlndXJhdGlvblJlc3BvbnNlEj8KDWNvbmZpZ3VyYXRpb24YASABKAsyKC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNvbmZpZ3VyYXRpb24iYAodUm9sbGJhY2tDb25maWd1cmF0aW9uUmVzcG9uc2USPwoNY29uZmlndXJhdGlvbhgBIAEoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ29uZmlndXJhdGlvbiJbChhHZXRDb25maWd1cmF0aW9uUmVzcG9uc2USPwoNY29uZmlndXJhdGlvbhgBIAEoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ29uZmlndXJhdGlvbiJhCh5HZXRBY3RpdmVDb25maWd1cmF0aW9uUmVzcG9uc2USPwoNY29uZmlndXJhdGlvbhgBIAEoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ29uZmlndXJhdGlvbiKiCAoNQ29uZmlndXJhdGlvbhIRCgRuYW1lGAEgASgJQgPgQQgSGAoLdmVyc2lvbl90YWcYAiABKAlCA+BBAhIYCgtjb25maWdfeWFtbBgDIAEoCUID4EEDEhgKC2NvbmZpZ19oYXNoGAQgASgJQgPgQQMSGwoOc2NoZW1hX3ZlcnNpb24YBSABKAlCA+BBAxI5CgZwYXJlbnQYBiABKAlCKfpBJgokYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Db25maWd1cmF0aW9uEkMKBnN0YXR1cxgHIAEoDjIuLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ29uZmlndXJhdGlvblN0YXR1c0ID4EEDEhYKCWlzX2FjdGl2ZRgIIAEoCEID4EEDEhMKC2Rlc2NyaXB0aW9uGAkgASgJEl4KEWVudGl0aWVzX3NuYXBzaG90GAogAygLMj4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Db25maWd1cmF0aW9uLkVudGl0aWVzU25hcHNob3RFbnRyeUID4EEDEkgKCG1ldGFkYXRhGAsgAygLMjYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Db25maWd1cmF0aW9uLk1ldGFkYXRhRW50cnkSNAoLY3JlYXRlX3RpbWUYDCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSFAoHY3JlYXRvchgNIAEoCUID4EEDEjQKC3N0YWdlZF90aW1lGA4gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEjcKDnB1Ymxpc2hlZF90aW1lGA8gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEjYKDWRlcGxveWVkX3RpbWUYECABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSNgoNcmVsZWFzZWRfdGltZRgRIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxpiChVFbnRpdGllc1NuYXBzaG90RW50cnkSCwoDa2V5GAEgASgJEjgKBXZhbHVlGAIgASgLMikucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5FbnRpdHlTbmFwc2hvdDoCOAEaLwoNTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBOnzqQXkKJGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vQ29uZmlndXJhdGlvbhIxZ2F0ZXdheXMve2dhdGV3YXl9L2NvbmZpZ3VyYXRpb25zL3tjb25maWd1cmF0aW9ufRIeY29uZmlndXJhdGlvbnMve2NvbmZpZ3VyYXRpb259IjsKDkVudGl0eVNuYXBzaG90EhMKC2VudGl0eV90eXBlGAEgASgJEhQKDGVudGl0eV9uYW1lcxgCIAMoCSJeChBWYWxpZGF0aW9uUmVzdWx0EhAKCGlzX3ZhbGlkGAEgASgIEg4KBmVycm9ycxgCIAMoCRIQCgh3YXJuaW5ncxgDIAMoCRIWCg5zY2hlbWFfdmVyc2lvbhgEIAEoCSJEChJEaXN0cmlidXRpb25SZXN1bHQSDgoGdGFyZ2V0GAEgASgJEg8KB3N1Y2Nlc3MYAiABKAgSDQoFZXJyb3IYAyABKAkiTAoQRGVwbG95bWVudFJlc3VsdBIYChBnYXRld2F5X2luc3RhbmNlGAEgASgJEg8KB3N1Y2Nlc3MYAiABKAgSDQoFZXJyb3IYAyABKAkiZAoNUmVsZWFzZVJlc3VsdBIYChBnYXRld2F5X2luc3RhbmNlGAEgASgJEg8KB3N1Y2Nlc3MYAiABKAgSDQoFZXJyb3IYAyABKAkSGQoRc2NoZW1hX2NvbXBhdGlibGUYBCABKAgi4QEKGVN0YWdlQ29uZmlndXJhdGlvblJlcXVlc3QSDgoGcGFyZW50GAEgASgJEhgKC3ZlcnNpb25fdGFnGAIgASgJQgPgQQISEwoLZGVzY3JpcHRpb24YAyABKAkSVAoIbWV0YWRhdGEYBCADKAsyQi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlN0YWdlQ29uZmlndXJhdGlvblJlcXVlc3QuTWV0YWRhdGFFbnRyeRovCg1NZXRhZGF0YUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEidwobUHVibGlzaENvbmZpZ3VyYXRpb25SZXF1ZXN0EjoKBG5hbWUYASABKAlCLOBBAvpBJgokYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Db25maWd1cmF0aW9uEhwKFGRpc3RyaWJ1dGlvbl90YXJnZXRzGAIgAygJInEKGkRlcGxveUNvbmZpZ3VyYXRpb25SZXF1ZXN0EjoKBG5hbWUYASABKAlCLOBBAvpBJgokYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Db25maWd1cmF0aW9uEhcKD3RhcmdldF9nYXRld2F5cxgCIAMoCSKLAQobUmVsZWFzZUNvbmZpZ3VyYXRpb25SZXF1ZXN0EjoKBG5hbWUYASABKAlCLOBBAvpBJgokYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Db25maWd1cmF0aW9uEhcKD3RhcmdldF9nYXRld2F5cxgCIAMoCRIXCg9ncmFjZWZ1bF9yZWxvYWQYAyABKAgiuwEKHFJvbGxiYWNrQ29uZmlndXJhdGlvblJlcXVlc3QSOgoEbmFtZRgBIAEoCUIs4EEC+kEmCiRhaWdhdGV3YXkucmVkcGFuZGEuY29tL0NvbmZpZ3VyYXRpb24SSgoUdGFyZ2V0X2NvbmZpZ3VyYXRpb24YAiABKAlCLOBBAvpBJgokYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Db25maWd1cmF0aW9uEhMKC2Rlc2NyaXB0aW9uGAMgASgJIlUKF0dldENvbmZpZ3VyYXRpb25SZXF1ZXN0EjoKBG5hbWUYASABKAlCLOBBAvpBJgokYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Db25maWd1cmF0aW9uInQKGUxpc3RDb25maWd1cmF0aW9uc1JlcXVlc3QSDgoGcGFyZW50GAEgASgJEhEKCXBhZ2Vfc2l6ZRgCIAEoBRISCgpwYWdlX3Rva2VuGAMgASgJEg4KBmZpbHRlchgEIAEoCRIQCghvcmRlcl9ieRgFIAEoCSKLAQoaTGlzdENvbmZpZ3VyYXRpb25zUmVzcG9uc2USQAoOY29uZmlndXJhdGlvbnMYASADKAsyKC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNvbmZpZ3VyYXRpb24SFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJEhIKCnRvdGFsX3NpemUYAyABKAUiNAodR2V0QWN0aXZlQ29uZmlndXJhdGlvblJlcXVlc3QSEwoGcGFyZW50GAEgASgJQgPgQQIqiwIKE0NvbmZpZ3VyYXRpb25TdGF0dXMSJAogQ09ORklHVVJBVElPTl9TVEFUVVNfVU5TUEVDSUZJRUQQABIeChpDT05GSUdVUkFUSU9OX1NUQVRVU19EUkFGVBABEh8KG0NPTkZJR1VSQVRJT05fU1RBVFVTX1NUQUdFRBACEiIKHkNPTkZJR1VSQVRJT05fU1RBVFVTX1BVQkxJU0hFRBADEiEKHUNPTkZJR1VSQVRJT05fU1RBVFVTX0RFUExPWUVEEAQSIQodQ09ORklHVVJBVElPTl9TVEFUVVNfUkVMRUFTRUQQBRIjCh9DT05GSUdVUkFUSU9OX1NUQVRVU19TVVBFUlNFREVEEAYyqA4KDUNvbmZpZ1NlcnZpY2US2QEKElN0YWdlQ29uZmlndXJhdGlvbhI0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3RhZ2VDb25maWd1cmF0aW9uUmVxdWVzdBo1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3RhZ2VDb25maWd1cmF0aW9uUmVzcG9uc2UiVoLT5JMCUDoBKlodOgEqIhgvdjEvY29uZmlndXJhdGlvbnM6c3RhZ2UiLC92MS97cGFyZW50PWdhdGV3YXlzLyp9L2NvbmZpZ3VyYXRpb25zOnN0YWdlEuwBChRQdWJsaXNoQ29uZmlndXJhdGlvbhI2LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUHVibGlzaENvbmZpZ3VyYXRpb25SZXF1ZXN0GjcucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5QdWJsaXNoQ29uZmlndXJhdGlvblJlc3BvbnNlImOC0+STAl06ASpaKDoBKiIjL3YxL3tuYW1lPWNvbmZpZ3VyYXRpb25zLyp9OnB1Ymxpc2giLi92MS97bmFtZT1nYXRld2F5cy8qL2NvbmZpZ3VyYXRpb25zLyp9OnB1Ymxpc2gS5wEKE0RlcGxveUNvbmZpZ3VyYXRpb24SNS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlcGxveUNvbmZpZ3VyYXRpb25SZXF1ZXN0GjYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZXBsb3lDb25maWd1cmF0aW9uUmVzcG9uc2UiYYLT5JMCWzoBKlonOgEqIiIvdjEve25hbWU9Y29uZmlndXJhdGlvbnMvKn06ZGVwbG95Ii0vdjEve25hbWU9Z2F0ZXdheXMvKi9jb25maWd1cmF0aW9ucy8qfTpkZXBsb3kS7AEKFFJlbGVhc2VDb25maWd1cmF0aW9uEjYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SZWxlYXNlQ29uZmlndXJhdGlvblJlcXVlc3QaNy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJlbGVhc2VDb25maWd1cmF0aW9uUmVzcG9uc2UiY4LT5JMCXToBKlooOgEqIiMvdjEve25hbWU9Y29uZmlndXJhdGlvbnMvKn06cmVsZWFzZSIuL3YxL3tuYW1lPWdhdGV3YXlzLyovY29uZmlndXJhdGlvbnMvKn06cmVsZWFzZRLxAQoVUm9sbGJhY2tDb25maWd1cmF0aW9uEjcucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Sb2xsYmFja0NvbmZpZ3VyYXRpb25SZXF1ZXN0GjgucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Sb2xsYmFja0NvbmZpZ3VyYXRpb25SZXNwb25zZSJlgtPkkwJfOgEqWik6ASoiJC92MS97bmFtZT1jb25maWd1cmF0aW9ucy8qfTpyb2xsYmFjayIvL3YxL3tuYW1lPWdhdGV3YXlzLyovY29uZmlndXJhdGlvbnMvKn06cm9sbGJhY2sSygEKEEdldENvbmZpZ3VyYXRpb24SMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldENvbmZpZ3VyYXRpb25SZXF1ZXN0GjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRDb25maWd1cmF0aW9uUmVzcG9uc2UiTYLT5JMCR1odEhsvdjEve25hbWU9Y29uZmlndXJhdGlvbnMvKn0SJi92MS97bmFtZT1nYXRld2F5cy8qL2NvbmZpZ3VyYXRpb25zLyp9EscBChJMaXN0Q29uZmlndXJhdGlvbnMSNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RDb25maWd1cmF0aW9uc1JlcXVlc3QaNS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RDb25maWd1cmF0aW9uc1Jlc3BvbnNlIkSC0+STAj5aFBISL3YxL2NvbmZpZ3VyYXRpb25zEiYvdjEve3BhcmVudD1nYXRld2F5cy8qfS9jb25maWd1cmF0aW9ucxLnAQoWR2V0QWN0aXZlQ29uZmlndXJhdGlvbhI4LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0QWN0aXZlQ29uZmlndXJhdGlvblJlcXVlc3QaOS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldEFjdGl2ZUNvbmZpZ3VyYXRpb25SZXNwb25zZSJYgtPkkwJSWh4SHC92MS9jb25maWd1cmF0aW9uczpnZXRBY3RpdmUSMC92MS97cGFyZW50PWdhdGV3YXlzLyp9L2NvbmZpZ3VyYXRpb25zOmdldEFjdGl2ZUKAAgodY29tLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjFCC0NvbmZpZ1Byb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_google_api_annotations, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_timestamp]);
+
+/**
+ * Response message for StageConfiguration RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.StageConfigurationResponse
+ */
+export type StageConfigurationResponse = Message<"redpanda.api.aigateway.v1.StageConfigurationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Configuration configuration = 1;
+   */
+  configuration?: Configuration;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.StageConfigurationResponse.
+ * Use `create(StageConfigurationResponseSchema)` to create a new message.
+ */
+export const StageConfigurationResponseSchema: GenMessage<StageConfigurationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 0);
+
+/**
+ * Response message for PublishConfiguration RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.PublishConfigurationResponse
+ */
+export type PublishConfigurationResponse = Message<"redpanda.api.aigateway.v1.PublishConfigurationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Configuration configuration = 1;
+   */
+  configuration?: Configuration;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.PublishConfigurationResponse.
+ * Use `create(PublishConfigurationResponseSchema)` to create a new message.
+ */
+export const PublishConfigurationResponseSchema: GenMessage<PublishConfigurationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 1);
+
+/**
+ * Response message for DeployConfiguration RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeployConfigurationResponse
+ */
+export type DeployConfigurationResponse = Message<"redpanda.api.aigateway.v1.DeployConfigurationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Configuration configuration = 1;
+   */
+  configuration?: Configuration;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeployConfigurationResponse.
+ * Use `create(DeployConfigurationResponseSchema)` to create a new message.
+ */
+export const DeployConfigurationResponseSchema: GenMessage<DeployConfigurationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 2);
+
+/**
+ * Response message for ReleaseConfiguration RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ReleaseConfigurationResponse
+ */
+export type ReleaseConfigurationResponse = Message<"redpanda.api.aigateway.v1.ReleaseConfigurationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Configuration configuration = 1;
+   */
+  configuration?: Configuration;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ReleaseConfigurationResponse.
+ * Use `create(ReleaseConfigurationResponseSchema)` to create a new message.
+ */
+export const ReleaseConfigurationResponseSchema: GenMessage<ReleaseConfigurationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 3);
+
+/**
+ * Response message for RollbackConfiguration RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RollbackConfigurationResponse
+ */
+export type RollbackConfigurationResponse = Message<"redpanda.api.aigateway.v1.RollbackConfigurationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Configuration configuration = 1;
+   */
+  configuration?: Configuration;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RollbackConfigurationResponse.
+ * Use `create(RollbackConfigurationResponseSchema)` to create a new message.
+ */
+export const RollbackConfigurationResponseSchema: GenMessage<RollbackConfigurationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 4);
+
+/**
+ * Response message for GetConfiguration RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetConfigurationResponse
+ */
+export type GetConfigurationResponse = Message<"redpanda.api.aigateway.v1.GetConfigurationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Configuration configuration = 1;
+   */
+  configuration?: Configuration;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetConfigurationResponse.
+ * Use `create(GetConfigurationResponseSchema)` to create a new message.
+ */
+export const GetConfigurationResponseSchema: GenMessage<GetConfigurationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 5);
+
+/**
+ * Response message for GetActiveConfiguration RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetActiveConfigurationResponse
+ */
+export type GetActiveConfigurationResponse = Message<"redpanda.api.aigateway.v1.GetActiveConfigurationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Configuration configuration = 1;
+   */
+  configuration?: Configuration;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetActiveConfigurationResponse.
+ * Use `create(GetActiveConfigurationResponseSchema)` to create a new message.
+ */
+export const GetActiveConfigurationResponseSchema: GenMessage<GetActiveConfigurationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 6);
+
+/**
+ * Configuration represents an immutable configuration version.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Configuration
+ */
+export type Configuration = Message<"redpanda.api.aigateway.v1.Configuration"> & {
+  /**
+   * Resource name. Format: `gateways/{gateway}/configurations/{configuration}` or `configurations/{configuration}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Semantic version tag (e.g., "v1.0.0")
+   *
+   * @generated from field: string version_tag = 2;
+   */
+  versionTag: string;
+
+  /**
+   * Output only. Assembled YAML configuration
+   *
+   * @generated from field: string config_yaml = 3;
+   */
+  configYaml: string;
+
+  /**
+   * Output only. SHA-256 hash of config_yaml
+   *
+   * @generated from field: string config_hash = 4;
+   */
+  configHash: string;
+
+  /**
+   * Output only. CUE schema version used for validation
+   *
+   * @generated from field: string schema_version = 5;
+   */
+  schemaVersion: string;
+
+  /**
+   * Parent configuration (for lineage tracking)
+   *
+   * @generated from field: string parent = 6;
+   */
+  parent: string;
+
+  /**
+   * Current status
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ConfigurationStatus status = 7;
+   */
+  status: ConfigurationStatus;
+
+  /**
+   * Whether this is the active configuration
+   *
+   * @generated from field: bool is_active = 8;
+   */
+  isActive: boolean;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 9;
+   */
+  description: string;
+
+  /**
+   * Output only. Snapshot of entity names included
+   *
+   * @generated from field: map<string, redpanda.api.aigateway.v1.EntitySnapshot> entities_snapshot = 10;
+   */
+  entitiesSnapshot: { [key: string]: EntitySnapshot };
+
+  /**
+   * Metadata
+   *
+   * @generated from field: map<string, string> metadata = 11;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 12;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Creator's OIDC subject
+   *
+   * @generated from field: string creator = 13;
+   */
+  creator: string;
+
+  /**
+   * Output only. Lifecycle timestamps
+   *
+   * @generated from field: google.protobuf.Timestamp staged_time = 14;
+   */
+  stagedTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp published_time = 15;
+   */
+  publishedTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp deployed_time = 16;
+   */
+  deployedTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp released_time = 17;
+   */
+  releasedTime?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Configuration.
+ * Use `create(ConfigurationSchema)` to create a new message.
+ */
+export const ConfigurationSchema: GenMessage<Configuration> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 7);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.EntitySnapshot
+ */
+export type EntitySnapshot = Message<"redpanda.api.aigateway.v1.EntitySnapshot"> & {
+  /**
+   * @generated from field: string entity_type = 1;
+   */
+  entityType: string;
+
+  /**
+   * @generated from field: repeated string entity_names = 2;
+   */
+  entityNames: string[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EntitySnapshot.
+ * Use `create(EntitySnapshotSchema)` to create a new message.
+ */
+export const EntitySnapshotSchema: GenMessage<EntitySnapshot> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 8);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ValidationResult
+ */
+export type ValidationResult = Message<"redpanda.api.aigateway.v1.ValidationResult"> & {
+  /**
+   * @generated from field: bool is_valid = 1;
+   */
+  isValid: boolean;
+
+  /**
+   * @generated from field: repeated string errors = 2;
+   */
+  errors: string[];
+
+  /**
+   * @generated from field: repeated string warnings = 3;
+   */
+  warnings: string[];
+
+  /**
+   * @generated from field: string schema_version = 4;
+   */
+  schemaVersion: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ValidationResult.
+ * Use `create(ValidationResultSchema)` to create a new message.
+ */
+export const ValidationResultSchema: GenMessage<ValidationResult> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 9);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DistributionResult
+ */
+export type DistributionResult = Message<"redpanda.api.aigateway.v1.DistributionResult"> & {
+  /**
+   * @generated from field: string target = 1;
+   */
+  target: string;
+
+  /**
+   * @generated from field: bool success = 2;
+   */
+  success: boolean;
+
+  /**
+   * @generated from field: string error = 3;
+   */
+  error: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DistributionResult.
+ * Use `create(DistributionResultSchema)` to create a new message.
+ */
+export const DistributionResultSchema: GenMessage<DistributionResult> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 10);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeploymentResult
+ */
+export type DeploymentResult = Message<"redpanda.api.aigateway.v1.DeploymentResult"> & {
+  /**
+   * @generated from field: string gateway_instance = 1;
+   */
+  gatewayInstance: string;
+
+  /**
+   * @generated from field: bool success = 2;
+   */
+  success: boolean;
+
+  /**
+   * @generated from field: string error = 3;
+   */
+  error: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeploymentResult.
+ * Use `create(DeploymentResultSchema)` to create a new message.
+ */
+export const DeploymentResultSchema: GenMessage<DeploymentResult> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 11);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ReleaseResult
+ */
+export type ReleaseResult = Message<"redpanda.api.aigateway.v1.ReleaseResult"> & {
+  /**
+   * @generated from field: string gateway_instance = 1;
+   */
+  gatewayInstance: string;
+
+  /**
+   * @generated from field: bool success = 2;
+   */
+  success: boolean;
+
+  /**
+   * @generated from field: string error = 3;
+   */
+  error: string;
+
+  /**
+   * @generated from field: bool schema_compatible = 4;
+   */
+  schemaCompatible: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ReleaseResult.
+ * Use `create(ReleaseResultSchema)` to create a new message.
+ */
+export const ReleaseResultSchema: GenMessage<ReleaseResult> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 12);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.StageConfigurationRequest
+ */
+export type StageConfigurationRequest = Message<"redpanda.api.aigateway.v1.StageConfigurationRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: string version_tag = 2;
+   */
+  versionTag: string;
+
+  /**
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * @generated from field: map<string, string> metadata = 4;
+   */
+  metadata: { [key: string]: string };
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.StageConfigurationRequest.
+ * Use `create(StageConfigurationRequestSchema)` to create a new message.
+ */
+export const StageConfigurationRequestSchema: GenMessage<StageConfigurationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 13);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.PublishConfigurationRequest
+ */
+export type PublishConfigurationRequest = Message<"redpanda.api.aigateway.v1.PublishConfigurationRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: repeated string distribution_targets = 2;
+   */
+  distributionTargets: string[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.PublishConfigurationRequest.
+ * Use `create(PublishConfigurationRequestSchema)` to create a new message.
+ */
+export const PublishConfigurationRequestSchema: GenMessage<PublishConfigurationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 14);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeployConfigurationRequest
+ */
+export type DeployConfigurationRequest = Message<"redpanda.api.aigateway.v1.DeployConfigurationRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: repeated string target_gateways = 2;
+   */
+  targetGateways: string[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeployConfigurationRequest.
+ * Use `create(DeployConfigurationRequestSchema)` to create a new message.
+ */
+export const DeployConfigurationRequestSchema: GenMessage<DeployConfigurationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 15);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ReleaseConfigurationRequest
+ */
+export type ReleaseConfigurationRequest = Message<"redpanda.api.aigateway.v1.ReleaseConfigurationRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: repeated string target_gateways = 2;
+   */
+  targetGateways: string[];
+
+  /**
+   * @generated from field: bool graceful_reload = 3;
+   */
+  gracefulReload: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ReleaseConfigurationRequest.
+ * Use `create(ReleaseConfigurationRequestSchema)` to create a new message.
+ */
+export const ReleaseConfigurationRequestSchema: GenMessage<ReleaseConfigurationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 16);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.RollbackConfigurationRequest
+ */
+export type RollbackConfigurationRequest = Message<"redpanda.api.aigateway.v1.RollbackConfigurationRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: string target_configuration = 2;
+   */
+  targetConfiguration: string;
+
+  /**
+   * @generated from field: string description = 3;
+   */
+  description: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RollbackConfigurationRequest.
+ * Use `create(RollbackConfigurationRequestSchema)` to create a new message.
+ */
+export const RollbackConfigurationRequestSchema: GenMessage<RollbackConfigurationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 17);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetConfigurationRequest
+ */
+export type GetConfigurationRequest = Message<"redpanda.api.aigateway.v1.GetConfigurationRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetConfigurationRequest.
+ * Use `create(GetConfigurationRequestSchema)` to create a new message.
+ */
+export const GetConfigurationRequestSchema: GenMessage<GetConfigurationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 18);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListConfigurationsRequest
+ */
+export type ListConfigurationsRequest = Message<"redpanda.api.aigateway.v1.ListConfigurationsRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListConfigurationsRequest.
+ * Use `create(ListConfigurationsRequestSchema)` to create a new message.
+ */
+export const ListConfigurationsRequestSchema: GenMessage<ListConfigurationsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 19);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListConfigurationsResponse
+ */
+export type ListConfigurationsResponse = Message<"redpanda.api.aigateway.v1.ListConfigurationsResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.Configuration configurations = 1;
+   */
+  configurations: Configuration[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListConfigurationsResponse.
+ * Use `create(ListConfigurationsResponseSchema)` to create a new message.
+ */
+export const ListConfigurationsResponseSchema: GenMessage<ListConfigurationsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 20);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetActiveConfigurationRequest
+ */
+export type GetActiveConfigurationRequest = Message<"redpanda.api.aigateway.v1.GetActiveConfigurationRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetActiveConfigurationRequest.
+ * Use `create(GetActiveConfigurationRequestSchema)` to create a new message.
+ */
+export const GetActiveConfigurationRequestSchema: GenMessage<GetActiveConfigurationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_config, 21);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.ConfigurationStatus
+ */
+export enum ConfigurationStatus {
+  /**
+   * @generated from enum value: CONFIGURATION_STATUS_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: CONFIGURATION_STATUS_DRAFT = 1;
+   */
+  DRAFT = 1,
+
+  /**
+   * @generated from enum value: CONFIGURATION_STATUS_STAGED = 2;
+   */
+  STAGED = 2,
+
+  /**
+   * @generated from enum value: CONFIGURATION_STATUS_PUBLISHED = 3;
+   */
+  PUBLISHED = 3,
+
+  /**
+   * @generated from enum value: CONFIGURATION_STATUS_DEPLOYED = 4;
+   */
+  DEPLOYED = 4,
+
+  /**
+   * @generated from enum value: CONFIGURATION_STATUS_RELEASED = 5;
+   */
+  RELEASED = 5,
+
+  /**
+   * @generated from enum value: CONFIGURATION_STATUS_SUPERSEDED = 6;
+   */
+  SUPERSEDED = 6,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.ConfigurationStatus.
+ */
+export const ConfigurationStatusSchema: GenEnum<ConfigurationStatus> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_config, 0);
+
+/**
+ * @generated from service redpanda.api.aigateway.v1.ConfigService
+ */
+export const ConfigService: GenService<{
+  /**
+   * Stages a configuration (assembles entities, validates, stores immutably)
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ConfigService.StageConfiguration
+   */
+  stageConfiguration: {
+    methodKind: "unary";
+    input: typeof StageConfigurationRequestSchema;
+    output: typeof StageConfigurationResponseSchema;
+  },
+  /**
+   * Publishes a staged configuration (packages and distributes)
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ConfigService.PublishConfiguration
+   */
+  publishConfiguration: {
+    methodKind: "unary";
+    input: typeof PublishConfigurationRequestSchema;
+    output: typeof PublishConfigurationResponseSchema;
+  },
+  /**
+   * Deploys a published configuration (places near gateway instances)
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ConfigService.DeployConfiguration
+   */
+  deployConfiguration: {
+    methodKind: "unary";
+    input: typeof DeployConfigurationRequestSchema;
+    output: typeof DeployConfigurationResponseSchema;
+  },
+  /**
+   * Releases a deployed configuration (activates it)
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ConfigService.ReleaseConfiguration
+   */
+  releaseConfiguration: {
+    methodKind: "unary";
+    input: typeof ReleaseConfigurationRequestSchema;
+    output: typeof ReleaseConfigurationResponseSchema;
+  },
+  /**
+   * Rolls back to a previous configuration
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ConfigService.RollbackConfiguration
+   */
+  rollbackConfiguration: {
+    methodKind: "unary";
+    input: typeof RollbackConfigurationRequestSchema;
+    output: typeof RollbackConfigurationResponseSchema;
+  },
+  /**
+   * Gets a configuration
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ConfigService.GetConfiguration
+   */
+  getConfiguration: {
+    methodKind: "unary";
+    input: typeof GetConfigurationRequestSchema;
+    output: typeof GetConfigurationResponseSchema;
+  },
+  /**
+   * Lists configurations
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ConfigService.ListConfigurations
+   */
+  listConfigurations: {
+    methodKind: "unary";
+    input: typeof ListConfigurationsRequestSchema;
+    output: typeof ListConfigurationsResponseSchema;
+  },
+  /**
+   * Gets the currently active configuration
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ConfigService.GetActiveConfiguration
+   */
+  getActiveConfiguration: {
+    methodKind: "unary";
+    input: typeof GetActiveConfigurationRequestSchema;
+    output: typeof GetActiveConfigurationResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_config, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/gateway-GatewayService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/gateway-GatewayService_connectquery.ts
new file mode 100644
index 0000000000..d5dc965635
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/gateway-GatewayService_connectquery.ts
@@ -0,0 +1,40 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/gateway.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { GatewayService } from "./gateway_pb";
+
+/**
+ * Creates a new gateway.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.GatewayService.CreateGateway
+ */
+export const createGateway = GatewayService.method.createGateway;
+
+/**
+ * Gets a gateway by name.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.GatewayService.GetGateway
+ */
+export const getGateway = GatewayService.method.getGateway;
+
+/**
+ * Lists gateways.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.GatewayService.ListGateways
+ */
+export const listGateways = GatewayService.method.listGateways;
+
+/**
+ * Updates a gateway.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.GatewayService.UpdateGateway
+ */
+export const updateGateway = GatewayService.method.updateGateway;
+
+/**
+ * Deletes a gateway.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.GatewayService.DeleteGateway
+ */
+export const deleteGateway = GatewayService.method.deleteGateway;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/gateway_config-GatewayConfigService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/gateway_config-GatewayConfigService_connectquery.ts
new file mode 100644
index 0000000000..93c3546f1a
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/gateway_config-GatewayConfigService_connectquery.ts
@@ -0,0 +1,14 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/gateway_config.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { GatewayConfigService } from "./gateway_config_pb";
+
+/**
+ * FetchConfig retrieves the current configuration snapshot.
+ * Use this for simple polling-based updates or initial bootstrap.
+ * For real-time updates, prefer StreamConfig.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.GatewayConfigService.FetchConfig
+ */
+export const fetchConfig = GatewayConfigService.method.fetchConfig;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/gateway_config_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/gateway_config_pb.ts
new file mode 100644
index 0000000000..30079d0e98
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/gateway_config_pb.ts
@@ -0,0 +1,593 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/gateway_config.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { BackendPool } from "./backend_pool_pb";
+import { file_redpanda_api_aigateway_v1_backend_pool } from "./backend_pool_pb";
+import type { RateLimit } from "./ratelimit_pb";
+import { file_redpanda_api_aigateway_v1_ratelimit } from "./ratelimit_pb";
+import type { RoutingRule } from "./routing_pb";
+import { file_redpanda_api_aigateway_v1_routing } from "./routing_pb";
+import type { SpendLimit } from "./spend_limit_pb";
+import { file_redpanda_api_aigateway_v1_spend_limit } from "./spend_limit_pb";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/gateway_config.proto.
+ */
+export const file_redpanda_api_aigateway_v1_gateway_config: GenFile = /*@__PURE__*/
+  fileDesc("Ci5yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2dhdGV3YXlfY29uZmlnLnByb3RvEhlyZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxIu8BChNTdHJlYW1Db25maWdSZXF1ZXN0Ei0KBG5vZGUYASABKAsyHy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk5vZGUSFAoMbGFzdF92ZXJzaW9uGAIgASgJEhYKDnJlc3BvbnNlX25vbmNlGAMgASgJEjoKBWVycm9yGAQgASgLMisucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Db25maWdBcHBseUVycm9yEj8KDnJlc291cmNlX3R5cGVzGAUgAygOMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SZXNvdXJjZVR5cGUigwIKFFN0cmVhbUNvbmZpZ1Jlc3BvbnNlEhQKB3ZlcnNpb24YASABKAlCA+BBAhISCgVub25jZRgCIAEoCUID4EECEj0KBHR5cGUYAyABKA4yJS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZVR5cGVCCLpIBYIBAhABEjsKCXJlc291cmNlcxgEIAMoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVzb3VyY2VEZWx0YRI0CgtzZXJ2ZXJfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIPCgdnYXRld2F5GAYgASgJIsADCg1SZXNvdXJjZURlbHRhEkgKCW9wZXJhdGlvbhgBIAEoDjIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsdGFPcGVyYXRpb25CCrpIB4IBBBABIAASPgoMYmFja2VuZF9wb29sGAIgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5CYWNrZW5kUG9vbEgAEj4KDHJvdXRpbmdfcnVsZRgDIAEoCzImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm91dGluZ1J1bGVIABI6CgpyYXRlX2xpbWl0GAQgASgLMiQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SYXRlTGltaXRIABI8CgtzcGVuZF9saW1pdBgFIAEoCzIlLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRMaW1pdEgAEhUKDXJlc291cmNlX25hbWUYBiABKAkSSAoNcmVzb3VyY2VfdHlwZRgHIAEoDjInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVzb3VyY2VUeXBlQgi6SAWCAQIQAUIKCghyZXNvdXJjZSK4AQoETm9kZRIWCgJpZBgBIAEoCUIK4EECukgEcgIQARIPCgdjbHVzdGVyGAIgASgJEhUKDWJ1aWxkX3ZlcnNpb24YAyABKAkSPwoIbWV0YWRhdGEYBCADKAsyLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk5vZGUuTWV0YWRhdGFFbnRyeRovCg1NZXRhZGF0YUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiwwEKEENvbmZpZ0FwcGx5RXJyb3ISRwoEY29kZRgBIAEoDjIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ29uZmlnQXBwbHlFcnJvckNvZGVCCLpIBYIBAhABEg8KB21lc3NhZ2UYAiABKAkSFQoNcmVzb3VyY2VfbmFtZRgDIAEoCRI+Cg1yZXNvdXJjZV90eXBlGAQgASgOMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SZXNvdXJjZVR5cGUioAEKEkZldGNoQ29uZmlnUmVxdWVzdBIyCgRub2RlGAEgASgLMh8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Ob2RlQgPgQQISFQoNc2luY2VfdmVyc2lvbhgCIAEoCRI/Cg5yZXNvdXJjZV90eXBlcxgDIAMoDjInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVzb3VyY2VUeXBlIt0BChNGZXRjaENvbmZpZ1Jlc3BvbnNlEhQKB3ZlcnNpb24YASABKAlCA+BBAhI9CgR0eXBlGAIgASgOMiUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVUeXBlQgi6SAWCAQIQARI7CglyZXNvdXJjZXMYAyADKAsyKC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJlc291cmNlRGVsdGESNAoLc2VydmVyX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMqWgoKVXBkYXRlVHlwZRIbChdVUERBVEVfVFlQRV9VTlNQRUNJRklFRBAAEhgKFFVQREFURV9UWVBFX1NOQVBTSE9UEAESFQoRVVBEQVRFX1RZUEVfREVMVEEQAiqCAQoORGVsdGFPcGVyYXRpb24SHwobREVMVEFfT1BFUkFUSU9OX1VOU1BFQ0lGSUVEEAASFwoTREVMVEFfT1BFUkFUSU9OX0FERBABEhoKFkRFTFRBX09QRVJBVElPTl9VUERBVEUQAhIaChZERUxUQV9PUEVSQVRJT05fUkVNT1ZFEAMqqgEKDFJlc291cmNlVHlwZRIdChlSRVNPVVJDRV9UWVBFX1VOU1BFQ0lGSUVEEAASHgoaUkVTT1VSQ0VfVFlQRV9CQUNLRU5EX1BPT0wQARIeChpSRVNPVVJDRV9UWVBFX1JPVVRJTkdfUlVMRRACEhwKGFJFU09VUkNFX1RZUEVfUkFURV9MSU1JVBADEh0KGVJFU09VUkNFX1RZUEVfU1BFTkRfTElNSVQQBCrbAQoUQ29uZmlnQXBwbHlFcnJvckNvZGUSJwojQ09ORklHX0FQUExZX0VSUk9SX0NPREVfVU5TUEVDSUZJRUQQABImCiJDT05GSUdfQVBQTFlfRVJST1JfQ09ERV9WQUxJREFUSU9OEAESJgoiQ09ORklHX0FQUExZX0VSUk9SX0NPREVfREVQRU5ERU5DWRACEiQKIENPTkZJR19BUFBMWV9FUlJPUl9DT0RFX0NPTkZMSUNUEAMSJAogQ09ORklHX0FQUExZX0VSUk9SX0NPREVfSU5URVJOQUwQBDKfAgoUR2F0ZXdheUNvbmZpZ1NlcnZpY2UScwoMU3RyZWFtQ29uZmlnEi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5TdHJlYW1Db25maWdSZXF1ZXN0Gi8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5TdHJlYW1Db25maWdSZXNwb25zZSgBMAESkQEKC0ZldGNoQ29uZmlnEi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5GZXRjaENvbmZpZ1JlcXVlc3QaLi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkZldGNoQ29uZmlnUmVzcG9uc2UiI4LT5JMCHToBKiIYL3YxL2dhdGV3YXktY29uZmlnOmZldGNoQocCCh1jb20ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MUISR2F0ZXdheUNvbmZpZ1Byb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_field_behavior, file_google_protobuf_timestamp, file_redpanda_api_aigateway_v1_backend_pool, file_redpanda_api_aigateway_v1_ratelimit, file_redpanda_api_aigateway_v1_routing, file_redpanda_api_aigateway_v1_spend_limit]);
+
+/**
+ * StreamConfigRequest is sent by gateways to subscribe and acknowledge updates.
+ *
+ * @generated from message redpanda.api.aigateway.v1.StreamConfigRequest
+ */
+export type StreamConfigRequest = Message<"redpanda.api.aigateway.v1.StreamConfigRequest"> & {
+  /**
+   * Node information identifying this gateway instance.
+   * Required on first message, optional on subsequent ACKs.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Node node = 1;
+   */
+  node?: Node;
+
+  /**
+   * Last successfully applied version.
+   * Empty on initial connection (requests full snapshot).
+   * Set on reconnection to resume from last known state.
+   *
+   * @generated from field: string last_version = 2;
+   */
+  lastVersion: string;
+
+  /**
+   * Response nonce being acknowledged.
+   * Matches the nonce in the corresponding StreamConfigResponse.
+   * Empty on initial request.
+   *
+   * @generated from field: string response_nonce = 3;
+   */
+  responseNonce: string;
+
+  /**
+   * Optional error if the gateway failed to apply the previous update.
+   * Control plane may resend the update or take corrective action.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ConfigApplyError error = 4;
+   */
+  error?: ConfigApplyError;
+
+  /**
+   * Optional: Filter by resource types.
+   * If empty, subscribes to all resource types.
+   * Only used on initial request.
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.ResourceType resource_types = 5;
+   */
+  resourceTypes: ResourceType[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.StreamConfigRequest.
+ * Use `create(StreamConfigRequestSchema)` to create a new message.
+ */
+export const StreamConfigRequestSchema: GenMessage<StreamConfigRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway_config, 0);
+
+/**
+ * StreamConfigResponse contains configuration updates streamed from control plane.
+ *
+ * @generated from message redpanda.api.aigateway.v1.StreamConfigResponse
+ */
+export type StreamConfigResponse = Message<"redpanda.api.aigateway.v1.StreamConfigResponse"> & {
+  /**
+   * Monotonically increasing version identifier.
+   * Format: "{timestamp_unix_nanos}_{sequence}"
+   * Gateways should persist this to resume on reconnection.
+   *
+   * @generated from field: string version = 1;
+   */
+  version: string;
+
+  /**
+   * Unique identifier for this response.
+   * Gateway must echo this in the next StreamConfigRequest.response_nonce.
+   *
+   * @generated from field: string nonce = 2;
+   */
+  nonce: string;
+
+  /**
+   * Type of update being sent.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.UpdateType type = 3;
+   */
+  type: UpdateType;
+
+  /**
+   * Resource deltas (changes since last version or full snapshot).
+   * For SNAPSHOT type: contains all current resources.
+   * For DELTA type: contains only changed resources.
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.ResourceDelta resources = 4;
+   */
+  resources: ResourceDelta[];
+
+  /**
+   * Server timestamp when this update was generated.
+   *
+   * @generated from field: google.protobuf.Timestamp server_time = 5;
+   */
+  serverTime?: Timestamp;
+
+  /**
+   * Gateway resource name this config applies to.
+   * Format: "gateways/{gateway_id}"
+   *
+   * @generated from field: string gateway = 6;
+   */
+  gateway: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.StreamConfigResponse.
+ * Use `create(StreamConfigResponseSchema)` to create a new message.
+ */
+export const StreamConfigResponseSchema: GenMessage<StreamConfigResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway_config, 1);
+
+/**
+ * ResourceDelta represents a single resource change.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ResourceDelta
+ */
+export type ResourceDelta = Message<"redpanda.api.aigateway.v1.ResourceDelta"> & {
+  /**
+   * Type of operation for this resource.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.DeltaOperation operation = 1;
+   */
+  operation: DeltaOperation;
+
+  /**
+   * The resource being changed.
+   * Exactly one of the resource fields must be set based on resource_type.
+   *
+   * @generated from oneof redpanda.api.aigateway.v1.ResourceDelta.resource
+   */
+  resource: {
+    /**
+     * @generated from field: redpanda.api.aigateway.v1.BackendPool backend_pool = 2;
+     */
+    value: BackendPool;
+    case: "backendPool";
+  } | {
+    /**
+     * @generated from field: redpanda.api.aigateway.v1.RoutingRule routing_rule = 3;
+     */
+    value: RoutingRule;
+    case: "routingRule";
+  } | {
+    /**
+     * @generated from field: redpanda.api.aigateway.v1.RateLimit rate_limit = 4;
+     */
+    value: RateLimit;
+    case: "rateLimit";
+  } | {
+    /**
+     * @generated from field: redpanda.api.aigateway.v1.SpendLimit spend_limit = 5;
+     */
+    value: SpendLimit;
+    case: "spendLimit";
+  } | { case: undefined; value?: undefined };
+
+  /**
+   * For REMOVE operations, the resource name to remove.
+   * Only used when the resource oneof is not set.
+   *
+   * @generated from field: string resource_name = 6;
+   */
+  resourceName: string;
+
+  /**
+   * Resource type hint (useful for REMOVE operations).
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ResourceType resource_type = 7;
+   */
+  resourceType: ResourceType;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ResourceDelta.
+ * Use `create(ResourceDeltaSchema)` to create a new message.
+ */
+export const ResourceDeltaSchema: GenMessage<ResourceDelta> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway_config, 2);
+
+/**
+ * Node contains information about the subscribing gateway instance.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Node
+ */
+export type Node = Message<"redpanda.api.aigateway.v1.Node"> & {
+  /**
+   * Unique identifier for this gateway instance.
+   * Format: "gateways/{gateway_id}"
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * Human-readable cluster/deployment name for debugging.
+   *
+   * @generated from field: string cluster = 2;
+   */
+  cluster: string;
+
+  /**
+   * Build version of the gateway binary.
+   *
+   * @generated from field: string build_version = 3;
+   */
+  buildVersion: string;
+
+  /**
+   * Arbitrary metadata (e.g., region, availability_zone).
+   *
+   * @generated from field: map<string, string> metadata = 4;
+   */
+  metadata: { [key: string]: string };
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Node.
+ * Use `create(NodeSchema)` to create a new message.
+ */
+export const NodeSchema: GenMessage<Node> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway_config, 3);
+
+/**
+ * ConfigApplyError reports errors when applying configuration updates.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ConfigApplyError
+ */
+export type ConfigApplyError = Message<"redpanda.api.aigateway.v1.ConfigApplyError"> & {
+  /**
+   * Error code categorizing the failure.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ConfigApplyErrorCode code = 1;
+   */
+  code: ConfigApplyErrorCode;
+
+  /**
+   * Human-readable error message.
+   *
+   * @generated from field: string message = 2;
+   */
+  message: string;
+
+  /**
+   * Resource name that caused the error (if applicable).
+   *
+   * @generated from field: string resource_name = 3;
+   */
+  resourceName: string;
+
+  /**
+   * Resource type that caused the error (if applicable).
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ResourceType resource_type = 4;
+   */
+  resourceType: ResourceType;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ConfigApplyError.
+ * Use `create(ConfigApplyErrorSchema)` to create a new message.
+ */
+export const ConfigApplyErrorSchema: GenMessage<ConfigApplyError> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway_config, 4);
+
+/**
+ * FetchConfigRequest is used for single-shot configuration retrieval.
+ *
+ * @generated from message redpanda.api.aigateway.v1.FetchConfigRequest
+ */
+export type FetchConfigRequest = Message<"redpanda.api.aigateway.v1.FetchConfigRequest"> & {
+  /**
+   * Node information identifying this gateway instance.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Node node = 1;
+   */
+  node?: Node;
+
+  /**
+   * Optional: Only return resources changed since this version.
+   * If empty, returns full snapshot.
+   *
+   * @generated from field: string since_version = 2;
+   */
+  sinceVersion: string;
+
+  /**
+   * Optional: Filter by resource types.
+   * If empty, returns all resource types.
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.ResourceType resource_types = 3;
+   */
+  resourceTypes: ResourceType[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.FetchConfigRequest.
+ * Use `create(FetchConfigRequestSchema)` to create a new message.
+ */
+export const FetchConfigRequestSchema: GenMessage<FetchConfigRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway_config, 5);
+
+/**
+ * FetchConfigResponse contains the requested configuration snapshot.
+ *
+ * @generated from message redpanda.api.aigateway.v1.FetchConfigResponse
+ */
+export type FetchConfigResponse = Message<"redpanda.api.aigateway.v1.FetchConfigResponse"> & {
+  /**
+   * Current version of the configuration.
+   *
+   * @generated from field: string version = 1;
+   */
+  version: string;
+
+  /**
+   * Type of response (SNAPSHOT or DELTA based on since_version).
+   *
+   * @generated from field: redpanda.api.aigateway.v1.UpdateType type = 2;
+   */
+  type: UpdateType;
+
+  /**
+   * The configuration resources.
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.ResourceDelta resources = 3;
+   */
+  resources: ResourceDelta[];
+
+  /**
+   * Server timestamp when this snapshot was generated.
+   *
+   * @generated from field: google.protobuf.Timestamp server_time = 4;
+   */
+  serverTime?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.FetchConfigResponse.
+ * Use `create(FetchConfigResponseSchema)` to create a new message.
+ */
+export const FetchConfigResponseSchema: GenMessage<FetchConfigResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway_config, 6);
+
+/**
+ * UpdateType specifies whether this is a full snapshot or incremental delta.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.UpdateType
+ */
+export enum UpdateType {
+  /**
+   * @generated from enum value: UPDATE_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Full configuration snapshot.
+   * Replaces all existing resources of each type included.
+   *
+   * @generated from enum value: UPDATE_TYPE_SNAPSHOT = 1;
+   */
+  SNAPSHOT = 1,
+
+  /**
+   * Incremental delta update.
+   * Only contains resources that changed since last version.
+   *
+   * @generated from enum value: UPDATE_TYPE_DELTA = 2;
+   */
+  DELTA = 2,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.UpdateType.
+ */
+export const UpdateTypeSchema: GenEnum<UpdateType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_gateway_config, 0);
+
+/**
+ * DeltaOperation specifies what change to apply to a resource.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.DeltaOperation
+ */
+export enum DeltaOperation {
+  /**
+   * @generated from enum value: DELTA_OPERATION_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Add a new resource or update if it exists.
+   * Idempotent: applying the same ADD twice results in the same state.
+   *
+   * @generated from enum value: DELTA_OPERATION_ADD = 1;
+   */
+  ADD = 1,
+
+  /**
+   * Update an existing resource.
+   * Same as ADD semantically; explicit for logging/metrics.
+   *
+   * @generated from enum value: DELTA_OPERATION_UPDATE = 2;
+   */
+  UPDATE = 2,
+
+  /**
+   * Remove a resource by name.
+   * Idempotent: removing a non-existent resource is a no-op.
+   *
+   * @generated from enum value: DELTA_OPERATION_REMOVE = 3;
+   */
+  REMOVE = 3,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.DeltaOperation.
+ */
+export const DeltaOperationSchema: GenEnum<DeltaOperation> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_gateway_config, 1);
+
+/**
+ * ResourceType identifies the type of configuration resource.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.ResourceType
+ */
+export enum ResourceType {
+  /**
+   * @generated from enum value: RESOURCE_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: RESOURCE_TYPE_BACKEND_POOL = 1;
+   */
+  BACKEND_POOL = 1,
+
+  /**
+   * @generated from enum value: RESOURCE_TYPE_ROUTING_RULE = 2;
+   */
+  ROUTING_RULE = 2,
+
+  /**
+   * @generated from enum value: RESOURCE_TYPE_RATE_LIMIT = 3;
+   */
+  RATE_LIMIT = 3,
+
+  /**
+   * @generated from enum value: RESOURCE_TYPE_SPEND_LIMIT = 4;
+   */
+  SPEND_LIMIT = 4,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.ResourceType.
+ */
+export const ResourceTypeSchema: GenEnum<ResourceType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_gateway_config, 2);
+
+/**
+ * ConfigApplyErrorCode categorizes configuration application failures.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.ConfigApplyErrorCode
+ */
+export enum ConfigApplyErrorCode {
+  /**
+   * @generated from enum value: CONFIG_APPLY_ERROR_CODE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Resource validation failed (e.g., invalid CEL expression).
+   *
+   * @generated from enum value: CONFIG_APPLY_ERROR_CODE_VALIDATION = 1;
+   */
+  VALIDATION = 1,
+
+  /**
+   * Resource dependency not found (e.g., backend_pool for routing rule).
+   *
+   * @generated from enum value: CONFIG_APPLY_ERROR_CODE_DEPENDENCY = 2;
+   */
+  DEPENDENCY = 2,
+
+  /**
+   * Resource conflict (e.g., duplicate ID).
+   *
+   * @generated from enum value: CONFIG_APPLY_ERROR_CODE_CONFLICT = 3;
+   */
+  CONFLICT = 3,
+
+  /**
+   * Internal error applying the configuration.
+   *
+   * @generated from enum value: CONFIG_APPLY_ERROR_CODE_INTERNAL = 4;
+   */
+  INTERNAL = 4,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.ConfigApplyErrorCode.
+ */
+export const ConfigApplyErrorCodeSchema: GenEnum<ConfigApplyErrorCode> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_gateway_config, 3);
+
+/**
+ * GatewayConfigService provides streaming configuration updates to data plane gateways.
+ *
+ * This is an xDS-inspired protocol for incremental configuration distribution:
+ * - Gateways connect and subscribe to configuration updates
+ * - Control plane streams delta updates (add/update/remove resources)
+ * - Each update includes a version for consistency tracking
+ * - Gateways acknowledge received updates to enable flow control
+ *
+ * The service supports both full snapshots (initial sync) and delta updates
+ * (ongoing changes), minimizing bandwidth and processing overhead.
+ *
+ * Note: This service uses bidirectional streaming for efficient ACK/NACK flow.
+ * It is intended for internal gateway-to-control-plane communication (Go services),
+ * not for web clients. Web clients should use the REST CRUD APIs.
+ *
+ * @generated from service redpanda.api.aigateway.v1.GatewayConfigService
+ */
+export const GatewayConfigService: GenService<{
+  /**
+   * StreamConfig establishes a bidirectional stream for configuration updates.
+   *
+   * Flow:
+   * 1. Gateway sends StreamConfigRequest with node info and optional last_version
+   * 2. Control plane sends initial StreamConfigResponse with full snapshot (if no version)
+   *    or delta updates since last_version
+   * 3. Gateway sends ACK with received version
+   * 4. Control plane streams delta updates as resources change
+   * 5. Gateway ACKs each update
+   *
+   * On reconnection, gateway sends last successfully applied version to resume
+   * from where it left off.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.GatewayConfigService.StreamConfig
+   */
+  streamConfig: {
+    methodKind: "bidi_streaming";
+    input: typeof StreamConfigRequestSchema;
+    output: typeof StreamConfigResponseSchema;
+  },
+  /**
+   * FetchConfig retrieves the current configuration snapshot.
+   * Use this for simple polling-based updates or initial bootstrap.
+   * For real-time updates, prefer StreamConfig.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.GatewayConfigService.FetchConfig
+   */
+  fetchConfig: {
+    methodKind: "unary";
+    input: typeof FetchConfigRequestSchema;
+    output: typeof FetchConfigResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_gateway_config, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/gateway_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/gateway_pb.ts
new file mode 100644
index 0000000000..0f04b1e249
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/gateway_pb.ts
@@ -0,0 +1,425 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/gateway.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/gateway.proto.
+ */
+export const file_redpanda_api_aigateway_v1_gateway: GenFile = /*@__PURE__*/
+  fileDesc("CidyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2dhdGV3YXkucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEiTAoVQ3JlYXRlR2F0ZXdheVJlc3BvbnNlEjMKB2dhdGV3YXkYASABKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdhdGV3YXkiSQoSR2V0R2F0ZXdheVJlc3BvbnNlEjMKB2dhdGV3YXkYASABKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdhdGV3YXkiTAoVVXBkYXRlR2F0ZXdheVJlc3BvbnNlEjMKB2dhdGV3YXkYASABKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdhdGV3YXkiFwoVRGVsZXRlR2F0ZXdheVJlc3BvbnNlIsADCgdHYXRld2F5EhEKBG5hbWUYASABKAlCA+BBCBIZCgxkaXNwbGF5X25hbWUYAiABKAlCA+BBAhIYCgtkZXNjcmlwdGlvbhgDIAEoCUID4EEBEg8KB2VuYWJsZWQYBCABKAgSQgoIbWV0YWRhdGEYBSADKAsyMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdhdGV3YXkuTWV0YWRhdGFFbnRyeRI0CgtjcmVhdGVfdGltZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxI0Cgt1cGRhdGVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIUCgdjcmVhdG9yGAggASgJQgPgQQMSFAoHdXBkYXRlchgJIAEoCUID4EEDEhYKCXdvcmtzcGFjZRgKIAEoCUID4EECGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATo36kE0Ch5haWdhdGV3YXkucmVkcGFuZGEuY29tL0dhdGV3YXkSEmdhdGV3YXlzL3tnYXRld2F5fSJ3ChRDcmVhdGVHYXRld2F5UmVxdWVzdBITCgZwYXJlbnQYASABKAlCA+BBAhI4CgdnYXRld2F5GAMgASgLMiIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HYXRld2F5QgPgQQJKBAgCEANSCmdhdGV3YXlfaWQiSQoRR2V0R2F0ZXdheVJlcXVlc3QSNAoEbmFtZRgBIAEoCUIm4EEC+kEgCh5haWdhdGV3YXkucmVkcGFuZGEuY29tL0dhdGV3YXkihwEKE0xpc3RHYXRld2F5c1JlcXVlc3QSEwoGcGFyZW50GAEgASgJQgPgQQESFgoJcGFnZV9zaXplGAIgASgFQgPgQQESFwoKcGFnZV90b2tlbhgDIAEoCUID4EEBEhMKBmZpbHRlchgEIAEoCUID4EEBEhUKCG9yZGVyX2J5GAUgASgJQgPgQQEieQoUTGlzdEdhdGV3YXlzUmVzcG9uc2USNAoIZ2F0ZXdheXMYASADKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdhdGV3YXkSFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJEhIKCnRvdGFsX3NpemUYAyABKAUihgEKFFVwZGF0ZUdhdGV3YXlSZXF1ZXN0EjgKB2dhdGV3YXkYASABKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdhdGV3YXlCA+BBAhI0Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCA+BBASJgChREZWxldGVHYXRld2F5UmVxdWVzdBI0CgRuYW1lGAEgASgJQibgQQL6QSAKHmFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vR2F0ZXdheRISCgVmb3JjZRgCIAEoCEID4EEBMosGCg5HYXRld2F5U2VydmljZRKRAQoNQ3JlYXRlR2F0ZXdheRIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlR2F0ZXdheVJlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNyZWF0ZUdhdGV3YXlSZXNwb25zZSIdgtPkkwIXOgdnYXRld2F5IgwvdjEvZ2F0ZXdheXMSiAEKCkdldEdhdGV3YXkSLC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldEdhdGV3YXlSZXF1ZXN0Gi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRHYXRld2F5UmVzcG9uc2UiHYLT5JMCFxIVL3YxL3tuYW1lPWdhdGV3YXlzLyp9EoUBCgxMaXN0R2F0ZXdheXMSLi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RHYXRld2F5c1JlcXVlc3QaLy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RHYXRld2F5c1Jlc3BvbnNlIhSC0+STAg4SDC92MS9nYXRld2F5cxKiAQoNVXBkYXRlR2F0ZXdheRIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlR2F0ZXdheVJlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZUdhdGV3YXlSZXNwb25zZSIugtPkkwIoOgdnYXRld2F5Mh0vdjEve2dhdGV3YXkubmFtZT1nYXRld2F5cy8qfRKRAQoNRGVsZXRlR2F0ZXdheRIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlR2F0ZXdheVJlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZUdhdGV3YXlSZXNwb25zZSIdgtPkkwIXKhUvdjEve25hbWU9Z2F0ZXdheXMvKn0aGcpBFmFpZ2F0ZXdheS5yZWRwYW5kYS5jb21CgQIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQgxHYXRld2F5UHJvdG9QAVpLZ28ucGFuZGEuZGV2L3JlZHBhbmRhLWFpZ3cvcHJvdG9zL2dlbi9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxO2FpZ2F0ZXdheXYxogIDUkFBqgIZUmVkcGFuZGEuQXBpLkFpZ2F0ZXdheS5WMcoCGVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjHiAiVSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYxXEdQQk1ldGFkYXRh6gIcUmVkcGFuZGE6OkFwaTo6QWlnYXRld2F5OjpWMWIGcHJvdG8z", [file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Response message for CreateGateway RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateGatewayResponse
+ */
+export type CreateGatewayResponse = Message<"redpanda.api.aigateway.v1.CreateGatewayResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Gateway gateway = 1;
+   */
+  gateway?: Gateway;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateGatewayResponse.
+ * Use `create(CreateGatewayResponseSchema)` to create a new message.
+ */
+export const CreateGatewayResponseSchema: GenMessage<CreateGatewayResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 0);
+
+/**
+ * Response message for GetGateway RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetGatewayResponse
+ */
+export type GetGatewayResponse = Message<"redpanda.api.aigateway.v1.GetGatewayResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Gateway gateway = 1;
+   */
+  gateway?: Gateway;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetGatewayResponse.
+ * Use `create(GetGatewayResponseSchema)` to create a new message.
+ */
+export const GetGatewayResponseSchema: GenMessage<GetGatewayResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 1);
+
+/**
+ * Response message for UpdateGateway RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateGatewayResponse
+ */
+export type UpdateGatewayResponse = Message<"redpanda.api.aigateway.v1.UpdateGatewayResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Gateway gateway = 1;
+   */
+  gateway?: Gateway;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateGatewayResponse.
+ * Use `create(UpdateGatewayResponseSchema)` to create a new message.
+ */
+export const UpdateGatewayResponseSchema: GenMessage<UpdateGatewayResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 2);
+
+/**
+ * Response message for DeleteGateway RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteGatewayResponse
+ */
+export type DeleteGatewayResponse = Message<"redpanda.api.aigateway.v1.DeleteGatewayResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteGatewayResponse.
+ * Use `create(DeleteGatewayResponseSchema)` to create a new message.
+ */
+export const DeleteGatewayResponseSchema: GenMessage<DeleteGatewayResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 3);
+
+/**
+ * Gateway represents a virtual gateway with isolated configuration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Gateway
+ */
+export type Gateway = Message<"redpanda.api.aigateway.v1.Gateway"> & {
+  /**
+   * Resource name. Format: `gateways/{gateway_id}`
+   * Gateway ID is a globally unique, sortable identifier (XID).
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Whether this gateway is active
+   *
+   * @generated from field: bool enabled = 4;
+   */
+  enabled: boolean;
+
+  /**
+   * Metadata for arbitrary key-value pairs
+   *
+   * @generated from field: map<string, string> metadata = 5;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 6;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 7;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Creator's OIDC subject (if available)
+   *
+   * @generated from field: string creator = 8;
+   */
+  creator: string;
+
+  /**
+   * Output only. Last updater's OIDC subject (if available)
+   *
+   * @generated from field: string updater = 9;
+   */
+  updater: string;
+
+  /**
+   * Required: Parent workspace for this gateway.
+   * Format: `accounts/{account}/organizations/{organization}/workspaces/{workspace}`
+   *
+   * @generated from field: string workspace = 10;
+   */
+  workspace: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Gateway.
+ * Use `create(GatewaySchema)` to create a new message.
+ */
+export const GatewaySchema: GenMessage<Gateway> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 4);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateGatewayRequest
+ */
+export type CreateGatewayRequest = Message<"redpanda.api.aigateway.v1.CreateGatewayRequest"> & {
+  /**
+   * Required: The parent workspace where this gateway will be created.
+   * Format: `accounts/{account}/organizations/{organization}/workspaces/{workspace}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * The gateway resource to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Gateway gateway = 3;
+   */
+  gateway?: Gateway;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateGatewayRequest.
+ * Use `create(CreateGatewayRequestSchema)` to create a new message.
+ */
+export const CreateGatewayRequestSchema: GenMessage<CreateGatewayRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 5);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetGatewayRequest
+ */
+export type GetGatewayRequest = Message<"redpanda.api.aigateway.v1.GetGatewayRequest"> & {
+  /**
+   * Resource name of the gateway.
+   * Format: `gateways/{gateway}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetGatewayRequest.
+ * Use `create(GetGatewayRequestSchema)` to create a new message.
+ */
+export const GetGatewayRequestSchema: GenMessage<GetGatewayRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 6);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListGatewaysRequest
+ */
+export type ListGatewaysRequest = Message<"redpanda.api.aigateway.v1.ListGatewaysRequest"> & {
+  /**
+   * Optional: Filter by workspace.
+   * Format: `accounts/{account}/organizations/{organization}/workspaces/{workspace}`
+   * If empty, lists all gateways the caller has access to.
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of gateways to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous ListGateways call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter expression (CEL syntax)
+   * Examples:
+   *   enabled = true
+   *   display_name = "production-gateway"
+   *   create_time > timestamp("2024-01-01T00:00:00Z")
+   *
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * Comma-separated list of fields to order by
+   * Examples: "create_time desc", "display_name"
+   *
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListGatewaysRequest.
+ * Use `create(ListGatewaysRequestSchema)` to create a new message.
+ */
+export const ListGatewaysRequestSchema: GenMessage<ListGatewaysRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 7);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListGatewaysResponse
+ */
+export type ListGatewaysResponse = Message<"redpanda.api.aigateway.v1.ListGatewaysResponse"> & {
+  /**
+   * The list of gateways
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.Gateway gateways = 1;
+   */
+  gateways: Gateway[];
+
+  /**
+   * Token for next page (empty if no more pages)
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count (if requested via filter)
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListGatewaysResponse.
+ * Use `create(ListGatewaysResponseSchema)` to create a new message.
+ */
+export const ListGatewaysResponseSchema: GenMessage<ListGatewaysResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 8);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateGatewayRequest
+ */
+export type UpdateGatewayRequest = Message<"redpanda.api.aigateway.v1.UpdateGatewayRequest"> & {
+  /**
+   * The gateway resource to update.
+   * The gateway's name field is used to identify the resource.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Gateway gateway = 1;
+   */
+  gateway?: Gateway;
+
+  /**
+   * The fields to update.
+   * If omitted, all mutable fields are updated.
+   * Allowed fields: display_name, description, enabled, metadata
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateGatewayRequest.
+ * Use `create(UpdateGatewayRequestSchema)` to create a new message.
+ */
+export const UpdateGatewayRequestSchema: GenMessage<UpdateGatewayRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 9);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteGatewayRequest
+ */
+export type DeleteGatewayRequest = Message<"redpanda.api.aigateway.v1.DeleteGatewayRequest"> & {
+  /**
+   * Resource name of the gateway to delete.
+   * Format: `gateways/{gateway}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * If true, cascade delete all child resources (backend pools, routing rules, etc.)
+   *
+   * @generated from field: bool force = 2;
+   */
+  force: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteGatewayRequest.
+ * Use `create(DeleteGatewayRequestSchema)` to create a new message.
+ */
+export const DeleteGatewayRequestSchema: GenMessage<DeleteGatewayRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_gateway, 10);
+
+/**
+ * @generated from service redpanda.api.aigateway.v1.GatewayService
+ */
+export const GatewayService: GenService<{
+  /**
+   * Creates a new gateway.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.GatewayService.CreateGateway
+   */
+  createGateway: {
+    methodKind: "unary";
+    input: typeof CreateGatewayRequestSchema;
+    output: typeof CreateGatewayResponseSchema;
+  },
+  /**
+   * Gets a gateway by name.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.GatewayService.GetGateway
+   */
+  getGateway: {
+    methodKind: "unary";
+    input: typeof GetGatewayRequestSchema;
+    output: typeof GetGatewayResponseSchema;
+  },
+  /**
+   * Lists gateways.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.GatewayService.ListGateways
+   */
+  listGateways: {
+    methodKind: "unary";
+    input: typeof ListGatewaysRequestSchema;
+    output: typeof ListGatewaysResponseSchema;
+  },
+  /**
+   * Updates a gateway.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.GatewayService.UpdateGateway
+   */
+  updateGateway: {
+    methodKind: "unary";
+    input: typeof UpdateGatewayRequestSchema;
+    output: typeof UpdateGatewayResponseSchema;
+  },
+  /**
+   * Deletes a gateway.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.GatewayService.DeleteGateway
+   */
+  deleteGateway: {
+    methodKind: "unary";
+    input: typeof DeleteGatewayRequestSchema;
+    output: typeof DeleteGatewayResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_gateway, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/guardrail-GuardrailService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/guardrail-GuardrailService_connectquery.ts
new file mode 100644
index 0000000000..cce0607eb7
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/guardrail-GuardrailService_connectquery.ts
@@ -0,0 +1,30 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/guardrail.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { GuardrailService } from "./guardrail_pb";
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.CreateGuardrail
+ */
+export const createGuardrail = GuardrailService.method.createGuardrail;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.GetGuardrail
+ */
+export const getGuardrail = GuardrailService.method.getGuardrail;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.ListGuardrails
+ */
+export const listGuardrails = GuardrailService.method.listGuardrails;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.UpdateGuardrail
+ */
+export const updateGuardrail = GuardrailService.method.updateGuardrail;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.DeleteGuardrail
+ */
+export const deleteGuardrail = GuardrailService.method.deleteGuardrail;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/guardrail_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/guardrail_pb.ts
new file mode 100644
index 0000000000..6d89b962a9
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/guardrail_pb.ts
@@ -0,0 +1,502 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/guardrail.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/guardrail.proto.
+ */
+export const file_redpanda_api_aigateway_v1_guardrail: GenFile = /*@__PURE__*/
+  fileDesc("CilyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2d1YXJkcmFpbC5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSJSChdDcmVhdGVHdWFyZHJhaWxSZXNwb25zZRI3CglndWFyZHJhaWwYASABKAsyJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkd1YXJkcmFpbCJPChRHZXRHdWFyZHJhaWxSZXNwb25zZRI3CglndWFyZHJhaWwYASABKAsyJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkd1YXJkcmFpbCJSChdVcGRhdGVHdWFyZHJhaWxSZXNwb25zZRI3CglndWFyZHJhaWwYASABKAsyJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkd1YXJkcmFpbCIZChdEZWxldGVHdWFyZHJhaWxSZXNwb25zZSKzBQoJR3VhcmRyYWlsEhEKBG5hbWUYASABKAlCA+BBCBIZCgxkaXNwbGF5X25hbWUYAiABKAlCA+BBAhITCgtkZXNjcmlwdGlvbhgDIAEoCRI7CgR0eXBlGAQgASgOMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HdWFyZHJhaWxUeXBlQgPgQQISHQoQbWF0Y2hfZXhwcmVzc2lvbhgFIAEoCUID4EECEjsKCHBhdHRlcm5zGAYgAygLMikucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Db250ZW50UGF0dGVybhI/CgZhY3Rpb24YByABKA4yKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkd1YXJkcmFpbEFjdGlvbkID4EECEhQKDHNjYW5fcmVxdWVzdBgIIAEoCBIVCg1zY2FuX3Jlc3BvbnNlGAkgASgIEg8KB2VuYWJsZWQYCiABKAgSRAoIbWV0YWRhdGEYCyADKAsyMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkd1YXJkcmFpbC5NZXRhZGF0YUVudHJ5EjQKC2NyZWF0ZV90aW1lGAwgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEjQKC3VwZGF0ZV90aW1lGA0gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATpo6kFlCiBhaWdhdGV3YXkucmVkcGFuZGEuY29tL0d1YXJkcmFpbBIpZ2F0ZXdheXMve2dhdGV3YXl9L2d1YXJkcmFpbHMve2d1YXJkcmFpbH0SFmd1YXJkcmFpbHMve2d1YXJkcmFpbH0ibQoOQ29udGVudFBhdHRlcm4SNAoEdHlwZRgBIAEoDjImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUGF0dGVyblR5cGUSDQoFdmFsdWUYAiABKAkSFgoOY2FzZV9zZW5zaXRpdmUYAyABKAgifAoWQ3JlYXRlR3VhcmRyYWlsUmVxdWVzdBIOCgZwYXJlbnQYASABKAkSFAoMZ3VhcmRyYWlsX2lkGAIgASgJEjwKCWd1YXJkcmFpbBgDIAEoCzIkLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR3VhcmRyYWlsQgPgQQIiTQoTR2V0R3VhcmRyYWlsUmVxdWVzdBI2CgRuYW1lGAEgASgJQijgQQL6QSIKIGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vR3VhcmRyYWlsInAKFUxpc3RHdWFyZHJhaWxzUmVxdWVzdBIOCgZwYXJlbnQYASABKAkSEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkSDgoGZmlsdGVyGAQgASgJEhAKCG9yZGVyX2J5GAUgASgJIn8KFkxpc3RHdWFyZHJhaWxzUmVzcG9uc2USOAoKZ3VhcmRyYWlscxgBIAMoCzIkLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR3VhcmRyYWlsEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFIocBChZVcGRhdGVHdWFyZHJhaWxSZXF1ZXN0EjwKCWd1YXJkcmFpbBgBIAEoCzIkLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR3VhcmRyYWlsQgPgQQISLwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrIlAKFkRlbGV0ZUd1YXJkcmFpbFJlcXVlc3QSNgoEbmFtZRgBIAEoCUIo4EEC+kEiCiBhaWdhdGV3YXkucmVkcGFuZGEuY29tL0d1YXJkcmFpbCqEAgoNR3VhcmRyYWlsVHlwZRIeChpHVUFSRFJBSUxfVFlQRV9VTlNQRUNJRklFRBAAEiAKHEdVQVJEUkFJTF9UWVBFX1BJSV9ERVRFQ1RJT04QARIgChxHVUFSRFJBSUxfVFlQRV9UT1hJQ19DT05URU5UEAISIwofR1VBUkRSQUlMX1RZUEVfUFJPTVBUX0lOSkVDVElPThADEiMKH0dVQVJEUkFJTF9UWVBFX1NFTlNJVElWRV9UT1BJQ1MQBBIfChtHVUFSRFJBSUxfVFlQRV9DVVNUT01fUkVHRVgQBRIkCiBHVUFSRFJBSUxfVFlQRV9LRVlXT1JEX0JMT0NLTElTVBAGKqIBCg9HdWFyZHJhaWxBY3Rpb24SIAocR1VBUkRSQUlMX0FDVElPTl9VTlNQRUNJRklFRBAAEhoKFkdVQVJEUkFJTF9BQ1RJT05fQkxPQ0sQARIbChdHVUFSRFJBSUxfQUNUSU9OX1JFREFDVBACEhgKFEdVQVJEUkFJTF9BQ1RJT05fTE9HEAMSGgoWR1VBUkRSQUlMX0FDVElPTl9BTEVSVBAEKngKC1BhdHRlcm5UeXBlEhwKGFBBVFRFUk5fVFlQRV9VTlNQRUNJRklFRBAAEhYKElBBVFRFUk5fVFlQRV9SRUdFWBABEhgKFFBBVFRFUk5fVFlQRV9LRVlXT1JEEAISGQoVUEFUVEVSTl9UWVBFX1dJTERDQVJEEAMy/gcKEEd1YXJkcmFpbFNlcnZpY2USzAEKD0NyZWF0ZUd1YXJkcmFpbBIxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlR3VhcmRyYWlsUmVxdWVzdBoyLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlR3VhcmRyYWlsUmVzcG9uc2UiUoLT5JMCTDoJZ3VhcmRyYWlsWhs6CWd1YXJkcmFpbCIOL3YxL2d1YXJkcmFpbHMiIi92MS97cGFyZW50PWdhdGV3YXlzLyp9L2d1YXJkcmFpbHMStgEKDEdldEd1YXJkcmFpbBIuLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0R3VhcmRyYWlsUmVxdWVzdBovLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0R3VhcmRyYWlsUmVzcG9uc2UiRYLT5JMCP1oZEhcvdjEve25hbWU9Z3VhcmRyYWlscy8qfRIiL3YxL3tuYW1lPWdhdGV3YXlzLyovZ3VhcmRyYWlscy8qfRKzAQoOTGlzdEd1YXJkcmFpbHMSMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RHdWFyZHJhaWxzUmVxdWVzdBoxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdEd1YXJkcmFpbHNSZXNwb25zZSI8gtPkkwI2WhASDi92MS9ndWFyZHJhaWxzEiIvdjEve3BhcmVudD1nYXRld2F5cy8qfS9ndWFyZHJhaWxzEukBCg9VcGRhdGVHdWFyZHJhaWwSMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZUd1YXJkcmFpbFJlcXVlc3QaMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZUd1YXJkcmFpbFJlc3BvbnNlIm+C0+STAmk6CWd1YXJkcmFpbFouOglndWFyZHJhaWwyIS92MS97Z3VhcmRyYWlsLm5hbWU9Z3VhcmRyYWlscy8qfTIsL3YxL3tndWFyZHJhaWwubmFtZT1nYXRld2F5cy8qL2d1YXJkcmFpbHMvKn0SvwEKD0RlbGV0ZUd1YXJkcmFpbBIxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlR3VhcmRyYWlsUmVxdWVzdBoyLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlR3VhcmRyYWlsUmVzcG9uc2UiRYLT5JMCP1oZKhcvdjEve25hbWU9Z3VhcmRyYWlscy8qfSoiL3YxL3tuYW1lPWdhdGV3YXlzLyovZ3VhcmRyYWlscy8qfUKDAgodY29tLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjFCDkd1YXJkcmFpbFByb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_google_api_annotations, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Response message for CreateGuardrail RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateGuardrailResponse
+ */
+export type CreateGuardrailResponse = Message<"redpanda.api.aigateway.v1.CreateGuardrailResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Guardrail guardrail = 1;
+   */
+  guardrail?: Guardrail;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateGuardrailResponse.
+ * Use `create(CreateGuardrailResponseSchema)` to create a new message.
+ */
+export const CreateGuardrailResponseSchema: GenMessage<CreateGuardrailResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 0);
+
+/**
+ * Response message for GetGuardrail RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetGuardrailResponse
+ */
+export type GetGuardrailResponse = Message<"redpanda.api.aigateway.v1.GetGuardrailResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Guardrail guardrail = 1;
+   */
+  guardrail?: Guardrail;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetGuardrailResponse.
+ * Use `create(GetGuardrailResponseSchema)` to create a new message.
+ */
+export const GetGuardrailResponseSchema: GenMessage<GetGuardrailResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 1);
+
+/**
+ * Response message for UpdateGuardrail RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateGuardrailResponse
+ */
+export type UpdateGuardrailResponse = Message<"redpanda.api.aigateway.v1.UpdateGuardrailResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Guardrail guardrail = 1;
+   */
+  guardrail?: Guardrail;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateGuardrailResponse.
+ * Use `create(UpdateGuardrailResponseSchema)` to create a new message.
+ */
+export const UpdateGuardrailResponseSchema: GenMessage<UpdateGuardrailResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 2);
+
+/**
+ * Response message for DeleteGuardrail RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteGuardrailResponse
+ */
+export type DeleteGuardrailResponse = Message<"redpanda.api.aigateway.v1.DeleteGuardrailResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteGuardrailResponse.
+ * Use `create(DeleteGuardrailResponseSchema)` to create a new message.
+ */
+export const DeleteGuardrailResponseSchema: GenMessage<DeleteGuardrailResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 3);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.Guardrail
+ */
+export type Guardrail = Message<"redpanda.api.aigateway.v1.Guardrail"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.GuardrailType type = 4;
+   */
+  type: GuardrailType;
+
+  /**
+   * @generated from field: string match_expression = 5;
+   */
+  matchExpression: string;
+
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.ContentPattern patterns = 6;
+   */
+  patterns: ContentPattern[];
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.GuardrailAction action = 7;
+   */
+  action: GuardrailAction;
+
+  /**
+   * @generated from field: bool scan_request = 8;
+   */
+  scanRequest: boolean;
+
+  /**
+   * @generated from field: bool scan_response = 9;
+   */
+  scanResponse: boolean;
+
+  /**
+   * @generated from field: bool enabled = 10;
+   */
+  enabled: boolean;
+
+  /**
+   * @generated from field: map<string, string> metadata = 11;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * @generated from field: google.protobuf.Timestamp create_time = 12;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp update_time = 13;
+   */
+  updateTime?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Guardrail.
+ * Use `create(GuardrailSchema)` to create a new message.
+ */
+export const GuardrailSchema: GenMessage<Guardrail> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 4);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ContentPattern
+ */
+export type ContentPattern = Message<"redpanda.api.aigateway.v1.ContentPattern"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.PatternType type = 1;
+   */
+  type: PatternType;
+
+  /**
+   * @generated from field: string value = 2;
+   */
+  value: string;
+
+  /**
+   * @generated from field: bool case_sensitive = 3;
+   */
+  caseSensitive: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ContentPattern.
+ * Use `create(ContentPatternSchema)` to create a new message.
+ */
+export const ContentPatternSchema: GenMessage<ContentPattern> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 5);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateGuardrailRequest
+ */
+export type CreateGuardrailRequest = Message<"redpanda.api.aigateway.v1.CreateGuardrailRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: string guardrail_id = 2;
+   */
+  guardrailId: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Guardrail guardrail = 3;
+   */
+  guardrail?: Guardrail;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateGuardrailRequest.
+ * Use `create(CreateGuardrailRequestSchema)` to create a new message.
+ */
+export const CreateGuardrailRequestSchema: GenMessage<CreateGuardrailRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 6);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetGuardrailRequest
+ */
+export type GetGuardrailRequest = Message<"redpanda.api.aigateway.v1.GetGuardrailRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetGuardrailRequest.
+ * Use `create(GetGuardrailRequestSchema)` to create a new message.
+ */
+export const GetGuardrailRequestSchema: GenMessage<GetGuardrailRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 7);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListGuardrailsRequest
+ */
+export type ListGuardrailsRequest = Message<"redpanda.api.aigateway.v1.ListGuardrailsRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListGuardrailsRequest.
+ * Use `create(ListGuardrailsRequestSchema)` to create a new message.
+ */
+export const ListGuardrailsRequestSchema: GenMessage<ListGuardrailsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 8);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListGuardrailsResponse
+ */
+export type ListGuardrailsResponse = Message<"redpanda.api.aigateway.v1.ListGuardrailsResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.Guardrail guardrails = 1;
+   */
+  guardrails: Guardrail[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListGuardrailsResponse.
+ * Use `create(ListGuardrailsResponseSchema)` to create a new message.
+ */
+export const ListGuardrailsResponseSchema: GenMessage<ListGuardrailsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 9);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateGuardrailRequest
+ */
+export type UpdateGuardrailRequest = Message<"redpanda.api.aigateway.v1.UpdateGuardrailRequest"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Guardrail guardrail = 1;
+   */
+  guardrail?: Guardrail;
+
+  /**
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateGuardrailRequest.
+ * Use `create(UpdateGuardrailRequestSchema)` to create a new message.
+ */
+export const UpdateGuardrailRequestSchema: GenMessage<UpdateGuardrailRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 10);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteGuardrailRequest
+ */
+export type DeleteGuardrailRequest = Message<"redpanda.api.aigateway.v1.DeleteGuardrailRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteGuardrailRequest.
+ * Use `create(DeleteGuardrailRequestSchema)` to create a new message.
+ */
+export const DeleteGuardrailRequestSchema: GenMessage<DeleteGuardrailRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_guardrail, 11);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.GuardrailType
+ */
+export enum GuardrailType {
+  /**
+   * @generated from enum value: GUARDRAIL_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: GUARDRAIL_TYPE_PII_DETECTION = 1;
+   */
+  PII_DETECTION = 1,
+
+  /**
+   * @generated from enum value: GUARDRAIL_TYPE_TOXIC_CONTENT = 2;
+   */
+  TOXIC_CONTENT = 2,
+
+  /**
+   * @generated from enum value: GUARDRAIL_TYPE_PROMPT_INJECTION = 3;
+   */
+  PROMPT_INJECTION = 3,
+
+  /**
+   * @generated from enum value: GUARDRAIL_TYPE_SENSITIVE_TOPICS = 4;
+   */
+  SENSITIVE_TOPICS = 4,
+
+  /**
+   * @generated from enum value: GUARDRAIL_TYPE_CUSTOM_REGEX = 5;
+   */
+  CUSTOM_REGEX = 5,
+
+  /**
+   * @generated from enum value: GUARDRAIL_TYPE_KEYWORD_BLOCKLIST = 6;
+   */
+  KEYWORD_BLOCKLIST = 6,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.GuardrailType.
+ */
+export const GuardrailTypeSchema: GenEnum<GuardrailType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_guardrail, 0);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.GuardrailAction
+ */
+export enum GuardrailAction {
+  /**
+   * @generated from enum value: GUARDRAIL_ACTION_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: GUARDRAIL_ACTION_BLOCK = 1;
+   */
+  BLOCK = 1,
+
+  /**
+   * @generated from enum value: GUARDRAIL_ACTION_REDACT = 2;
+   */
+  REDACT = 2,
+
+  /**
+   * @generated from enum value: GUARDRAIL_ACTION_LOG = 3;
+   */
+  LOG = 3,
+
+  /**
+   * @generated from enum value: GUARDRAIL_ACTION_ALERT = 4;
+   */
+  ALERT = 4,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.GuardrailAction.
+ */
+export const GuardrailActionSchema: GenEnum<GuardrailAction> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_guardrail, 1);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.PatternType
+ */
+export enum PatternType {
+  /**
+   * @generated from enum value: PATTERN_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: PATTERN_TYPE_REGEX = 1;
+   */
+  REGEX = 1,
+
+  /**
+   * @generated from enum value: PATTERN_TYPE_KEYWORD = 2;
+   */
+  KEYWORD = 2,
+
+  /**
+   * @generated from enum value: PATTERN_TYPE_WILDCARD = 3;
+   */
+  WILDCARD = 3,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.PatternType.
+ */
+export const PatternTypeSchema: GenEnum<PatternType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_guardrail, 2);
+
+/**
+ * @generated from service redpanda.api.aigateway.v1.GuardrailService
+ */
+export const GuardrailService: GenService<{
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.CreateGuardrail
+   */
+  createGuardrail: {
+    methodKind: "unary";
+    input: typeof CreateGuardrailRequestSchema;
+    output: typeof CreateGuardrailResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.GetGuardrail
+   */
+  getGuardrail: {
+    methodKind: "unary";
+    input: typeof GetGuardrailRequestSchema;
+    output: typeof GetGuardrailResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.ListGuardrails
+   */
+  listGuardrails: {
+    methodKind: "unary";
+    input: typeof ListGuardrailsRequestSchema;
+    output: typeof ListGuardrailsResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.UpdateGuardrail
+   */
+  updateGuardrail: {
+    methodKind: "unary";
+    input: typeof UpdateGuardrailRequestSchema;
+    output: typeof UpdateGuardrailResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.GuardrailService.DeleteGuardrail
+   */
+  deleteGuardrail: {
+    methodKind: "unary";
+    input: typeof DeleteGuardrailRequestSchema;
+    output: typeof DeleteGuardrailResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_guardrail, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/iam_settings-IAMSettingsService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/iam_settings-IAMSettingsService_connectquery.ts
new file mode 100644
index 0000000000..3a811f9e85
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/iam_settings-IAMSettingsService_connectquery.ts
@@ -0,0 +1,40 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/iam_settings.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { IAMSettingsService } from "./iam_settings_pb";
+
+/**
+ * Gets a specific IAM setting by key.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.GetIAMSetting
+ */
+export const getIAMSetting = IAMSettingsService.method.getIAMSetting;
+
+/**
+ * Lists IAM settings, optionally filtered by category.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.ListIAMSettings
+ */
+export const listIAMSettings = IAMSettingsService.method.listIAMSettings;
+
+/**
+ * Updates an IAM setting.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.UpdateIAMSetting
+ */
+export const updateIAMSetting = IAMSettingsService.method.updateIAMSetting;
+
+/**
+ * Batch updates multiple IAM settings.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.BatchUpdateIAMSettings
+ */
+export const batchUpdateIAMSettings = IAMSettingsService.method.batchUpdateIAMSettings;
+
+/**
+ * Deletes an IAM setting (resets to default).
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.DeleteIAMSetting
+ */
+export const deleteIAMSetting = IAMSettingsService.method.deleteIAMSetting;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/iam_settings_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/iam_settings_pb.ts
new file mode 100644
index 0000000000..513262a765
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/iam_settings_pb.ts
@@ -0,0 +1,474 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/iam_settings.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import type { Timestamp, Value } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_struct, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/iam_settings.proto.
+ */
+export const file_redpanda_api_aigateway_v1_iam_settings: GenFile = /*@__PURE__*/
+  fileDesc("CixyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL2lhbV9zZXR0aW5ncy5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSKJAgoKSUFNU2V0dGluZxIQCgNrZXkYASABKAlCA+BBCBIqCgV2YWx1ZRgCIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi5WYWx1ZUID4EECEhgKC2Rlc2NyaXB0aW9uGAMgASgJQgPgQQESRAoIY2F0ZWdvcnkYBCABKA4yLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLklBTVNldHRpbmdDYXRlZ29yeUID4EECEhEKCXNlbnNpdGl2ZRgFIAEoCBI0Cgt1cGRhdGVfdGltZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIUCgd1cGRhdGVyGAcgASgJQgPgQQMiKAoUR2V0SUFNU2V0dGluZ1JlcXVlc3QSEAoDa2V5GAEgASgJQgPgQQIiTwoVR2V0SUFNU2V0dGluZ1Jlc3BvbnNlEjYKB3NldHRpbmcYASABKAsyJS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLklBTVNldHRpbmciuAEKFkxpc3RJQU1TZXR0aW5nc1JlcXVlc3QSRAoIY2F0ZWdvcnkYASABKA4yLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLklBTVNldHRpbmdDYXRlZ29yeUID4EEBEh4KEWluY2x1ZGVfc2Vuc2l0aXZlGAIgASgIQgPgQQESHwoJcGFnZV9zaXplGAMgASgFQgzgQQG6SAYaBBhkKAASFwoKcGFnZV90b2tlbhgEIAEoCUID4EEBIn8KF0xpc3RJQU1TZXR0aW5nc1Jlc3BvbnNlEjcKCHNldHRpbmdzGAEgAygLMiUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5JQU1TZXR0aW5nEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFIlcKF1VwZGF0ZUlBTVNldHRpbmdSZXF1ZXN0EhAKA2tleRgBIAEoCUID4EECEioKBXZhbHVlGAIgASgLMhYuZ29vZ2xlLnByb3RvYnVmLlZhbHVlQgPgQQIiUgoYVXBkYXRlSUFNU2V0dGluZ1Jlc3BvbnNlEjYKB3NldHRpbmcYASABKAsyJS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLklBTVNldHRpbmciYwodQmF0Y2hVcGRhdGVJQU1TZXR0aW5nc1JlcXVlc3QSQgoIc2V0dGluZ3MYASADKAsyKy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLklBTVNldHRpbmdVcGRhdGVCA+BBAiJQChBJQU1TZXR0aW5nVXBkYXRlEhAKA2tleRgBIAEoCUID4EECEioKBXZhbHVlGAIgASgLMhYuZ29vZ2xlLnByb3RvYnVmLlZhbHVlQgPgQQIiWQoeQmF0Y2hVcGRhdGVJQU1TZXR0aW5nc1Jlc3BvbnNlEjcKCHNldHRpbmdzGAEgAygLMiUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5JQU1TZXR0aW5nIisKF0RlbGV0ZUlBTVNldHRpbmdSZXF1ZXN0EhAKA2tleRgBIAEoCUID4EECIhoKGERlbGV0ZUlBTVNldHRpbmdSZXNwb25zZSqGAgoSSUFNU2V0dGluZ0NhdGVnb3J5EiQKIElBTV9TRVRUSU5HX0NBVEVHT1JZX1VOU1BFQ0lGSUVEEAASIQodSUFNX1NFVFRJTkdfQ0FURUdPUllfU0VDVVJJVFkQARIfChtJQU1fU0VUVElOR19DQVRFR09SWV9PQVVUSDIQAhIdChlJQU1fU0VUVElOR19DQVRFR09SWV9PSURDEAMSHQoZSUFNX1NFVFRJTkdfQ0FURUdPUllfSldLUxAEEicKI0lBTV9TRVRUSU5HX0NBVEVHT1JZX0FDQ0VTU19DT05UUk9MEAUSHwobSUFNX1NFVFRJTkdfQ0FURUdPUllfU1lTVEVNEAYy0QYKEklBTVNldHRpbmdzU2VydmljZRKSAQoNR2V0SUFNU2V0dGluZxIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0SUFNU2V0dGluZ1JlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldElBTVNldHRpbmdSZXNwb25zZSIegtPkkwIYEhYvdjEvaWFtL3NldHRpbmdzL3trZXl9EpIBCg9MaXN0SUFNU2V0dGluZ3MSMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RJQU1TZXR0aW5nc1JlcXVlc3QaMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RJQU1TZXR0aW5nc1Jlc3BvbnNlIhiC0+STAhISEC92MS9pYW0vc2V0dGluZ3MSngEKEFVwZGF0ZUlBTVNldHRpbmcSMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZUlBTVNldHRpbmdSZXF1ZXN0GjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVJQU1TZXR0aW5nUmVzcG9uc2UiIYLT5JMCGzoBKhoWL3YxL2lhbS9zZXR0aW5ncy97a2V5fRK2AQoWQmF0Y2hVcGRhdGVJQU1TZXR0aW5ncxI4LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQmF0Y2hVcGRhdGVJQU1TZXR0aW5nc1JlcXVlc3QaOS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkJhdGNoVXBkYXRlSUFNU2V0dGluZ3NSZXNwb25zZSIngtPkkwIhOgEqIhwvdjEvaWFtL3NldHRpbmdzOmJhdGNoVXBkYXRlEpsBChBEZWxldGVJQU1TZXR0aW5nEjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVJQU1TZXR0aW5nUmVxdWVzdBozLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlSUFNU2V0dGluZ1Jlc3BvbnNlIh6C0+STAhgqFi92MS9pYW0vc2V0dGluZ3Mve2tleX0aGcpBFmFpZ2F0ZXdheS5yZWRwYW5kYS5jb21ChQIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQhBJYW1TZXR0aW5nc1Byb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_protobuf_struct, file_google_protobuf_timestamp]);
+
+/**
+ * IAMSetting represents a single IAM configuration setting.
+ *
+ * @generated from message redpanda.api.aigateway.v1.IAMSetting
+ */
+export type IAMSetting = Message<"redpanda.api.aigateway.v1.IAMSetting"> & {
+  /**
+   * Setting key (e.g., "security.default_hash_algorithm")
+   *
+   * @generated from field: string key = 1;
+   */
+  key: string;
+
+  /**
+   * Setting value as JSON
+   *
+   * @generated from field: google.protobuf.Value value = 2;
+   */
+  value?: Value;
+
+  /**
+   * Human-readable description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Setting category
+   *
+   * @generated from field: redpanda.api.aigateway.v1.IAMSettingCategory category = 4;
+   */
+  category: IAMSettingCategory;
+
+  /**
+   * Whether this setting contains sensitive data (masked in UI)
+   *
+   * @generated from field: bool sensitive = 5;
+   */
+  sensitive: boolean;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 6;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Last updater (API key or OIDC subject)
+   *
+   * @generated from field: string updater = 7;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.IAMSetting.
+ * Use `create(IAMSettingSchema)` to create a new message.
+ */
+export const IAMSettingSchema: GenMessage<IAMSetting> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 0);
+
+/**
+ * Request message for GetIAMSetting RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetIAMSettingRequest
+ */
+export type GetIAMSettingRequest = Message<"redpanda.api.aigateway.v1.GetIAMSettingRequest"> & {
+  /**
+   * Required: Setting key.
+   *
+   * @generated from field: string key = 1;
+   */
+  key: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetIAMSettingRequest.
+ * Use `create(GetIAMSettingRequestSchema)` to create a new message.
+ */
+export const GetIAMSettingRequestSchema: GenMessage<GetIAMSettingRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 1);
+
+/**
+ * Response message for GetIAMSetting RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetIAMSettingResponse
+ */
+export type GetIAMSettingResponse = Message<"redpanda.api.aigateway.v1.GetIAMSettingResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.IAMSetting setting = 1;
+   */
+  setting?: IAMSetting;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetIAMSettingResponse.
+ * Use `create(GetIAMSettingResponseSchema)` to create a new message.
+ */
+export const GetIAMSettingResponseSchema: GenMessage<GetIAMSettingResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 2);
+
+/**
+ * Request message for ListIAMSettings RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListIAMSettingsRequest
+ */
+export type ListIAMSettingsRequest = Message<"redpanda.api.aigateway.v1.ListIAMSettingsRequest"> & {
+  /**
+   * Filter by category (optional)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.IAMSettingCategory category = 1;
+   */
+  category: IAMSettingCategory;
+
+  /**
+   * Whether to include sensitive settings (values will be masked)
+   *
+   * @generated from field: bool include_sensitive = 2;
+   */
+  includeSensitive: boolean;
+
+  /**
+   * Maximum number of settings to return (max 100)
+   *
+   * @generated from field: int32 page_size = 3;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call
+   *
+   * @generated from field: string page_token = 4;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListIAMSettingsRequest.
+ * Use `create(ListIAMSettingsRequestSchema)` to create a new message.
+ */
+export const ListIAMSettingsRequestSchema: GenMessage<ListIAMSettingsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 3);
+
+/**
+ * Response message for ListIAMSettings RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListIAMSettingsResponse
+ */
+export type ListIAMSettingsResponse = Message<"redpanda.api.aigateway.v1.ListIAMSettingsResponse"> & {
+  /**
+   * The list of settings
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.IAMSetting settings = 1;
+   */
+  settings: IAMSetting[];
+
+  /**
+   * Token for next page
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListIAMSettingsResponse.
+ * Use `create(ListIAMSettingsResponseSchema)` to create a new message.
+ */
+export const ListIAMSettingsResponseSchema: GenMessage<ListIAMSettingsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 4);
+
+/**
+ * Request message for UpdateIAMSetting RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateIAMSettingRequest
+ */
+export type UpdateIAMSettingRequest = Message<"redpanda.api.aigateway.v1.UpdateIAMSettingRequest"> & {
+  /**
+   * Required: Setting key.
+   *
+   * @generated from field: string key = 1;
+   */
+  key: string;
+
+  /**
+   * Required: New value.
+   *
+   * @generated from field: google.protobuf.Value value = 2;
+   */
+  value?: Value;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateIAMSettingRequest.
+ * Use `create(UpdateIAMSettingRequestSchema)` to create a new message.
+ */
+export const UpdateIAMSettingRequestSchema: GenMessage<UpdateIAMSettingRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 5);
+
+/**
+ * Response message for UpdateIAMSetting RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateIAMSettingResponse
+ */
+export type UpdateIAMSettingResponse = Message<"redpanda.api.aigateway.v1.UpdateIAMSettingResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.IAMSetting setting = 1;
+   */
+  setting?: IAMSetting;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateIAMSettingResponse.
+ * Use `create(UpdateIAMSettingResponseSchema)` to create a new message.
+ */
+export const UpdateIAMSettingResponseSchema: GenMessage<UpdateIAMSettingResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 6);
+
+/**
+ * Request message for BatchUpdateIAMSettings RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.BatchUpdateIAMSettingsRequest
+ */
+export type BatchUpdateIAMSettingsRequest = Message<"redpanda.api.aigateway.v1.BatchUpdateIAMSettingsRequest"> & {
+  /**
+   * Settings to update
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.IAMSettingUpdate settings = 1;
+   */
+  settings: IAMSettingUpdate[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.BatchUpdateIAMSettingsRequest.
+ * Use `create(BatchUpdateIAMSettingsRequestSchema)` to create a new message.
+ */
+export const BatchUpdateIAMSettingsRequestSchema: GenMessage<BatchUpdateIAMSettingsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 7);
+
+/**
+ * IAMSettingUpdate represents a single setting update in a batch.
+ *
+ * @generated from message redpanda.api.aigateway.v1.IAMSettingUpdate
+ */
+export type IAMSettingUpdate = Message<"redpanda.api.aigateway.v1.IAMSettingUpdate"> & {
+  /**
+   * Required: Setting key.
+   *
+   * @generated from field: string key = 1;
+   */
+  key: string;
+
+  /**
+   * Required: New value.
+   *
+   * @generated from field: google.protobuf.Value value = 2;
+   */
+  value?: Value;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.IAMSettingUpdate.
+ * Use `create(IAMSettingUpdateSchema)` to create a new message.
+ */
+export const IAMSettingUpdateSchema: GenMessage<IAMSettingUpdate> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 8);
+
+/**
+ * Response message for BatchUpdateIAMSettings RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.BatchUpdateIAMSettingsResponse
+ */
+export type BatchUpdateIAMSettingsResponse = Message<"redpanda.api.aigateway.v1.BatchUpdateIAMSettingsResponse"> & {
+  /**
+   * Updated settings
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.IAMSetting settings = 1;
+   */
+  settings: IAMSetting[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.BatchUpdateIAMSettingsResponse.
+ * Use `create(BatchUpdateIAMSettingsResponseSchema)` to create a new message.
+ */
+export const BatchUpdateIAMSettingsResponseSchema: GenMessage<BatchUpdateIAMSettingsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 9);
+
+/**
+ * Request message for DeleteIAMSetting RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteIAMSettingRequest
+ */
+export type DeleteIAMSettingRequest = Message<"redpanda.api.aigateway.v1.DeleteIAMSettingRequest"> & {
+  /**
+   * Required: Setting key.
+   *
+   * @generated from field: string key = 1;
+   */
+  key: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteIAMSettingRequest.
+ * Use `create(DeleteIAMSettingRequestSchema)` to create a new message.
+ */
+export const DeleteIAMSettingRequestSchema: GenMessage<DeleteIAMSettingRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 10);
+
+/**
+ * Response message for DeleteIAMSetting RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteIAMSettingResponse
+ */
+export type DeleteIAMSettingResponse = Message<"redpanda.api.aigateway.v1.DeleteIAMSettingResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteIAMSettingResponse.
+ * Use `create(DeleteIAMSettingResponseSchema)` to create a new message.
+ */
+export const DeleteIAMSettingResponseSchema: GenMessage<DeleteIAMSettingResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_iam_settings, 11);
+
+/**
+ * IAMSettingCategory defines setting categories.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.IAMSettingCategory
+ */
+export enum IAMSettingCategory {
+  /**
+   * @generated from enum value: IAM_SETTING_CATEGORY_UNSPECIFIED = 0;
+   */
+  IAM_SETTING_CATEGORY_UNSPECIFIED = 0,
+
+  /**
+   * Security settings (hash algorithms, password policies)
+   *
+   * @generated from enum value: IAM_SETTING_CATEGORY_SECURITY = 1;
+   */
+  IAM_SETTING_CATEGORY_SECURITY = 1,
+
+  /**
+   * OAuth2 settings (issuer, token lifetimes)
+   *
+   * @generated from enum value: IAM_SETTING_CATEGORY_OAUTH2 = 2;
+   */
+  IAM_SETTING_CATEGORY_OAUTH2 = 2,
+
+  /**
+   * OIDC settings (auto-provisioning, claim mappings)
+   *
+   * @generated from enum value: IAM_SETTING_CATEGORY_OIDC = 3;
+   */
+  IAM_SETTING_CATEGORY_OIDC = 3,
+
+  /**
+   * JWKS settings (key rotation)
+   *
+   * @generated from enum value: IAM_SETTING_CATEGORY_JWKS = 4;
+   */
+  IAM_SETTING_CATEGORY_JWKS = 4,
+
+  /**
+   * Access control settings (default policies)
+   *
+   * @generated from enum value: IAM_SETTING_CATEGORY_ACCESS_CONTROL = 5;
+   */
+  IAM_SETTING_CATEGORY_ACCESS_CONTROL = 5,
+
+  /**
+   * System settings (general configuration)
+   *
+   * @generated from enum value: IAM_SETTING_CATEGORY_SYSTEM = 6;
+   */
+  IAM_SETTING_CATEGORY_SYSTEM = 6,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.IAMSettingCategory.
+ */
+export const IAMSettingCategorySchema: GenEnum<IAMSettingCategory> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_iam_settings, 0);
+
+/**
+ * IAMSettingsService manages IAM-related system settings.
+ * Settings are stored as key-value pairs organized by category.
+ * Categories: security, oauth2, oidc, jwks, access_control, system
+ *
+ * @generated from service redpanda.api.aigateway.v1.IAMSettingsService
+ */
+export const IAMSettingsService: GenService<{
+  /**
+   * Gets a specific IAM setting by key.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.GetIAMSetting
+   */
+  getIAMSetting: {
+    methodKind: "unary";
+    input: typeof GetIAMSettingRequestSchema;
+    output: typeof GetIAMSettingResponseSchema;
+  },
+  /**
+   * Lists IAM settings, optionally filtered by category.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.ListIAMSettings
+   */
+  listIAMSettings: {
+    methodKind: "unary";
+    input: typeof ListIAMSettingsRequestSchema;
+    output: typeof ListIAMSettingsResponseSchema;
+  },
+  /**
+   * Updates an IAM setting.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.UpdateIAMSetting
+   */
+  updateIAMSetting: {
+    methodKind: "unary";
+    input: typeof UpdateIAMSettingRequestSchema;
+    output: typeof UpdateIAMSettingResponseSchema;
+  },
+  /**
+   * Batch updates multiple IAM settings.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.BatchUpdateIAMSettings
+   */
+  batchUpdateIAMSettings: {
+    methodKind: "unary";
+    input: typeof BatchUpdateIAMSettingsRequestSchema;
+    output: typeof BatchUpdateIAMSettingsResponseSchema;
+  },
+  /**
+   * Deletes an IAM setting (resets to default).
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.IAMSettingsService.DeleteIAMSetting
+   */
+  deleteIAMSetting: {
+    methodKind: "unary";
+    input: typeof DeleteIAMSettingRequestSchema;
+    output: typeof DeleteIAMSettingResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_iam_settings, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/mcp_tools-MCPToolsService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/mcp_tools-MCPToolsService_connectquery.ts
new file mode 100644
index 0000000000..d65f94f2da
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/mcp_tools-MCPToolsService_connectquery.ts
@@ -0,0 +1,12 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/mcp_tools.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { MCPToolsService } from "./mcp_tools_pb";
+
+/**
+ * ListMCPTools returns the list of tools available in a gateway
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.MCPToolsService.ListMCPTools
+ */
+export const listMCPTools = MCPToolsService.method.listMCPTools;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/mcp_tools_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/mcp_tools_pb.ts
new file mode 100644
index 0000000000..bb32387bf5
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/mcp_tools_pb.ts
@@ -0,0 +1,139 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/mcp_tools.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/mcp_tools.proto.
+ */
+export const file_redpanda_api_aigateway_v1_mcp_tools: GenFile = /*@__PURE__*/
+  fileDesc("CilyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL21jcF90b29scy5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSLJAQoTTGlzdE1DUFRvb2xzUmVxdWVzdBJaCgxnYXRld2F5X25hbWUYASABKAlCROBBAvpBIAoeYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9HYXRld2F5ukgbchkQATIVXmdhdGV3YXlzL1thLXowLTktXSskEhgKBnNlYXJjaBgCIAEoCUIIukgFcgMYgAISPAoIY2F0ZWdvcnkYAyABKAlCKrpIJ3IlUgBSBGZpbGVSA3dlYlIEY29kZVIIZGF0YWJhc2VSBnN5c3RlbSJJChRMaXN0TUNQVG9vbHNSZXNwb25zZRIxCgV0b29scxgBIAMoCzIiLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTUNQVG9vbCKCAQoHTUNQVG9vbBIbCgRuYW1lGAEgASgJQg3gQQK6SAdyBRABGIACEh0KC2Rlc2NyaXB0aW9uGAIgASgJQgi6SAVyAxiACBIgCgxpbnB1dF9zY2hlbWEYAyABKAlCCuBBArpIBHICEAESGQoIY2F0ZWdvcnkYBCABKAlCB7pIBHICGEAytAEKD01DUFRvb2xzU2VydmljZRKgAQoMTGlzdE1DUFRvb2xzEi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0TUNQVG9vbHNSZXF1ZXN0Gi8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0TUNQVG9vbHNSZXNwb25zZSIvgtPkkwIpEicvdjEve2dhdGV3YXlfbmFtZT1nYXRld2F5cy8qfS9tY3AtdG9vbHNCggIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQg1NY3BUb29sc1Byb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_field_behavior, file_google_api_resource]);
+
+/**
+ * Request message for ListMCPTools
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListMCPToolsRequest
+ */
+export type ListMCPToolsRequest = Message<"redpanda.api.aigateway.v1.ListMCPToolsRequest"> & {
+  /**
+   * Gateway resource name (format: gateways/{gateway_id})
+   * The gateway must have MCP orchestration configured
+   *
+   * @generated from field: string gateway_name = 1;
+   */
+  gatewayName: string;
+
+  /**
+   * Optional search query to filter tools by name or description
+   *
+   * @generated from field: string search = 2;
+   */
+  search: string;
+
+  /**
+   * Optional category filter (e.g., "file", "web", "code", "database", "system")
+   *
+   * @generated from field: string category = 3;
+   */
+  category: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListMCPToolsRequest.
+ * Use `create(ListMCPToolsRequestSchema)` to create a new message.
+ */
+export const ListMCPToolsRequestSchema: GenMessage<ListMCPToolsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_mcp_tools, 0);
+
+/**
+ * Response message for ListMCPTools
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListMCPToolsResponse
+ */
+export type ListMCPToolsResponse = Message<"redpanda.api.aigateway.v1.ListMCPToolsResponse"> & {
+  /**
+   * List of MCP tools available in the gateway
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.MCPTool tools = 1;
+   */
+  tools: MCPTool[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListMCPToolsResponse.
+ * Use `create(ListMCPToolsResponseSchema)` to create a new message.
+ */
+export const ListMCPToolsResponseSchema: GenMessage<ListMCPToolsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_mcp_tools, 1);
+
+/**
+ * MCPTool represents a tool available via the Model Context Protocol
+ *
+ * @generated from message redpanda.api.aigateway.v1.MCPTool
+ */
+export type MCPTool = Message<"redpanda.api.aigateway.v1.MCPTool"> & {
+  /**
+   * Unique identifier for the tool (e.g., "read_file", "search_web")
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable description of what the tool does
+   *
+   * @generated from field: string description = 2;
+   */
+  description: string;
+
+  /**
+   * JSON Schema defining the tool's input parameters as a JSON string
+   * This is the inputSchema from the MCP specification
+   *
+   * @generated from field: string input_schema = 3;
+   */
+  inputSchema: string;
+
+  /**
+   * Optional category for filtering/grouping (e.g., "file", "web", "code")
+   *
+   * @generated from field: string category = 4;
+   */
+  category: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.MCPTool.
+ * Use `create(MCPToolSchema)` to create a new message.
+ */
+export const MCPToolSchema: GenMessage<MCPTool> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_mcp_tools, 2);
+
+/**
+ * MCPToolsService provides access to MCP (Model Context Protocol) tools
+ * available in a gateway. This service proxies the tools/list call to the
+ * MCP Gateway and returns the available tools with their schemas.
+ *
+ * @generated from service redpanda.api.aigateway.v1.MCPToolsService
+ */
+export const MCPToolsService: GenService<{
+  /**
+   * ListMCPTools returns the list of tools available in a gateway
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.MCPToolsService.ListMCPTools
+   */
+  listMCPTools: {
+    methodKind: "unary";
+    input: typeof ListMCPToolsRequestSchema;
+    output: typeof ListMCPToolsResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_mcp_tools, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/model_providers-ModelProvidersService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/model_providers-ModelProvidersService_connectquery.ts
new file mode 100644
index 0000000000..94215389c6
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/model_providers-ModelProvidersService_connectquery.ts
@@ -0,0 +1,34 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/model_providers.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { ModelProvidersService } from "./model_providers_pb";
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.GetModelProvider
+ */
+export const getModelProvider = ModelProvidersService.method.getModelProvider;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.ListModelProviders
+ */
+export const listModelProviders = ModelProvidersService.method.listModelProviders;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.UpdateModelProvider
+ */
+export const updateModelProvider = ModelProvidersService.method.updateModelProvider;
+
+/**
+ * Enable a provider for routing (does NOT auto-enable its models)
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.EnableModelProvider
+ */
+export const enableModelProvider = ModelProvidersService.method.enableModelProvider;
+
+/**
+ * Disable a provider (cascade-disables ALL its models)
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.DisableModelProvider
+ */
+export const disableModelProvider = ModelProvidersService.method.disableModelProvider;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/model_providers_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/model_providers_pb.ts
new file mode 100644
index 0000000000..8669de412a
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/model_providers_pb.ts
@@ -0,0 +1,488 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/model_providers.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { AuthType, PathRewrite } from "./backend_pool_pb";
+import { file_redpanda_api_aigateway_v1_backend_pool } from "./backend_pool_pb";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/model_providers.proto.
+ */
+export const file_redpanda_api_aigateway_v1_model_providers: GenFile = /*@__PURE__*/
+  fileDesc("Ci9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL21vZGVsX3Byb3ZpZGVycy5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSKIBQoNTW9kZWxQcm92aWRlchIRCgRuYW1lGAEgASgJQgPgQQgSGQoMZGlzcGxheV9uYW1lGAIgASgJQgPgQQISEwoLZGVzY3JpcHRpb24YAyABKAkSEwoLd2Vic2l0ZV91cmwYBCABKAkSEAoIbG9nb191cmwYBSABKAkSDwoHZW5hYmxlZBgGIAEoCBIUCgxoZWFkcXVhcnRlcnMYCyABKAkSEwoLZGF0YV9wb2xpY3kYDCABKAkSFgoOY2VydGlmaWNhdGlvbnMYDSADKAkSGwoTZGF0YV9yZXRlbnRpb25fZGF5cxgOIAEoBRITCgtkYXRhX3JlZ2lvbhgPIAMoCRIQCghiYXNlX3VybBgQIAEoCRI2CglhdXRoX3R5cGUYESABKA4yIy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkF1dGhUeXBlEhUKDW9wZW5haV9uYXRpdmUYFCABKAgSRAoNb3BlbmFpX2NvbXBhdBgVIAEoCzItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT3BlbkFJQ29tcGF0Q29uZmlnEjQKC2NyZWF0ZV90aW1lGAcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEjQKC3VwZGF0ZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEhQKB2NyZWF0b3IYCSABKAlCA+BBAxIUCgd1cGRhdGVyGAogASgJQgPgQQM6SOpBRQokYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Nb2RlbFByb3ZpZGVyEh1tb2RlbF9wcm92aWRlcnMve3Byb3ZpZGVyX2lkfSJVChdHZXRNb2RlbFByb3ZpZGVyUmVxdWVzdBI6CgRuYW1lGAEgASgJQizgQQL6QSYKJGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vTW9kZWxQcm92aWRlciJcChhHZXRNb2RlbFByb3ZpZGVyUmVzcG9uc2USQAoObW9kZWxfcHJvdmlkZXIYASABKAsyKC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk1vZGVsUHJvdmlkZXIiUgoZTGlzdE1vZGVsUHJvdmlkZXJzUmVxdWVzdBIRCglwYWdlX3NpemUYASABKAUSEgoKcGFnZV90b2tlbhgCIAEoCRIOCgZmaWx0ZXIYAyABKAkijAEKGkxpc3RNb2RlbFByb3ZpZGVyc1Jlc3BvbnNlEkEKD21vZGVsX3Byb3ZpZGVycxgBIAMoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTW9kZWxQcm92aWRlchIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSKUAQoaVXBkYXRlTW9kZWxQcm92aWRlclJlcXVlc3QSRQoObW9kZWxfcHJvdmlkZXIYASABKAsyKC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk1vZGVsUHJvdmlkZXJCA+BBAhIvCgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2siXwobVXBkYXRlTW9kZWxQcm92aWRlclJlc3BvbnNlEkAKDm1vZGVsX3Byb3ZpZGVyGAEgASgLMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Nb2RlbFByb3ZpZGVyIlgKGkVuYWJsZU1vZGVsUHJvdmlkZXJSZXF1ZXN0EjoKBG5hbWUYASABKAlCLOBBAvpBJgokYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Nb2RlbFByb3ZpZGVyIl8KG0VuYWJsZU1vZGVsUHJvdmlkZXJSZXNwb25zZRJACg5tb2RlbF9wcm92aWRlchgBIAEoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTW9kZWxQcm92aWRlciJZChtEaXNhYmxlTW9kZWxQcm92aWRlclJlcXVlc3QSOgoEbmFtZRgBIAEoCUIs4EEC+kEmCiRhaWdhdGV3YXkucmVkcGFuZGEuY29tL01vZGVsUHJvdmlkZXIifwocRGlzYWJsZU1vZGVsUHJvdmlkZXJSZXNwb25zZRJACg5tb2RlbF9wcm92aWRlchgBIAEoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTW9kZWxQcm92aWRlchIdChVkaXNhYmxlZF9tb2RlbHNfY291bnQYAiABKAUirQIKEk9wZW5BSUNvbXBhdENvbmZpZxIaChJyZXF1ZXN0X3RyYW5zZm9ybXMYASADKAkSGwoTcmVzcG9uc2VfdHJhbnNmb3JtcxgCIAMoCRI8CgxwYXRoX3Jld3JpdGUYAyABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlBhdGhSZXdyaXRlEhMKC2F1dGhfaGVhZGVyGAQgASgJElYKDWV4dHJhX2hlYWRlcnMYBSADKAsyPy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9wZW5BSUNvbXBhdENvbmZpZy5FeHRyYUhlYWRlcnNFbnRyeRozChFFeHRyYUhlYWRlcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBMpoHChVNb2RlbFByb3ZpZGVyc1NlcnZpY2USoQEKEEdldE1vZGVsUHJvdmlkZXISMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldE1vZGVsUHJvdmlkZXJSZXF1ZXN0GjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRNb2RlbFByb3ZpZGVyUmVzcG9uc2UiJILT5JMCHhIcL3YxL3tuYW1lPW1vZGVsX3Byb3ZpZGVycy8qfRKeAQoSTGlzdE1vZGVsUHJvdmlkZXJzEjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0TW9kZWxQcm92aWRlcnNSZXF1ZXN0GjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0TW9kZWxQcm92aWRlcnNSZXNwb25zZSIbgtPkkwIVEhMvdjEvbW9kZWxfcHJvdmlkZXJzEskBChNVcGRhdGVNb2RlbFByb3ZpZGVyEjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVNb2RlbFByb3ZpZGVyUmVxdWVzdBo2LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlTW9kZWxQcm92aWRlclJlc3BvbnNlIkOC0+STAj06Dm1vZGVsX3Byb3ZpZGVyMisvdjEve21vZGVsX3Byb3ZpZGVyLm5hbWU9bW9kZWxfcHJvdmlkZXJzLyp9ErQBChNFbmFibGVNb2RlbFByb3ZpZGVyEjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5FbmFibGVNb2RlbFByb3ZpZGVyUmVxdWVzdBo2LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRW5hYmxlTW9kZWxQcm92aWRlclJlc3BvbnNlIi6C0+STAig6ASoiIy92MS97bmFtZT1tb2RlbF9wcm92aWRlcnMvKn06ZW5hYmxlErgBChREaXNhYmxlTW9kZWxQcm92aWRlchI2LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGlzYWJsZU1vZGVsUHJvdmlkZXJSZXF1ZXN0GjcucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EaXNhYmxlTW9kZWxQcm92aWRlclJlc3BvbnNlIi+C0+STAik6ASoiJC92MS97bmFtZT1tb2RlbF9wcm92aWRlcnMvKn06ZGlzYWJsZUKIAgodY29tLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjFCE01vZGVsUHJvdmlkZXJzUHJvdG9QAVpLZ28ucGFuZGEuZGV2L3JlZHBhbmRhLWFpZ3cvcHJvdG9zL2dlbi9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxO2FpZ2F0ZXdheXYxogIDUkFBqgIZUmVkcGFuZGEuQXBpLkFpZ2F0ZXdheS5WMcoCGVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjHiAiVSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYxXEdQQk1ldGFkYXRh6gIcUmVkcGFuZGE6OkFwaTo6QWlnYXRld2F5OjpWMWIGcHJvdG8z", [file_google_api_annotations, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp, file_redpanda_api_aigateway_v1_backend_pool]);
+
+/**
+ * ModelProvider represents an LLM provider (e.g., OpenAI, Anthropic).
+ * Providers are seeded by migrations and cannot be created/deleted via API.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ModelProvider
+ */
+export type ModelProvider = Message<"redpanda.api.aigateway.v1.ModelProvider"> & {
+  /**
+   * Resource name: model_providers/{id}
+   * Example: model_providers/openai
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Display name for UI
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Provider description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Provider website URL
+   *
+   * @generated from field: string website_url = 4;
+   */
+  websiteUrl: string;
+
+  /**
+   * Provider logo URL
+   *
+   * @generated from field: string logo_url = 5;
+   */
+  logoUrl: string;
+
+  /**
+   * Enable/disable toggle for routing
+   * When false, all models from this provider are effectively disabled
+   *
+   * @generated from field: bool enabled = 6;
+   */
+  enabled: boolean;
+
+  /**
+   * Country code where provider is headquartered (e.g., "US", "FR", "CA")
+   *
+   * @generated from field: string headquarters = 11;
+   */
+  headquarters: string;
+
+  /**
+   * Data training policy:
+   * - "never": Provider never trains on customer data
+   * - "opt-out": Training can be disabled via provider settings
+   * - "always": Provider may use data for training
+   *
+   * @generated from field: string data_policy = 12;
+   */
+  dataPolicy: string;
+
+  /**
+   * Compliance certifications (e.g., "SOC2", "GDPR", "HIPAA", "ISO27001")
+   *
+   * @generated from field: repeated string certifications = 13;
+   */
+  certifications: string[];
+
+  /**
+   * Data retention period in days (0 = no retention, -1 = unknown)
+   *
+   * @generated from field: int32 data_retention_days = 14;
+   */
+  dataRetentionDays: number;
+
+  /**
+   * Data processing region(s) (e.g., "US", "EU", "APAC")
+   *
+   * @generated from field: repeated string data_region = 15;
+   */
+  dataRegion: string[];
+
+  /**
+   * Base URL for API requests (e.g., "https://api.openai.com")
+   *
+   * @generated from field: string base_url = 16;
+   */
+  baseUrl: string;
+
+  /**
+   * Authentication type used by this provider
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuthType auth_type = 17;
+   */
+  authType: AuthType;
+
+  /**
+   * True if provider natively uses OpenAI-compatible API format
+   * (e.g., OpenAI, Mistral, Groq, Together, Fireworks, DeepSeek, Cerebras)
+   *
+   * @generated from field: bool openai_native = 20;
+   */
+  openaiNative: boolean;
+
+  /**
+   * OpenAI compatibility configuration for non-native providers.
+   * Only populated for providers where transforms have been implemented.
+   * null/empty means transforms are not available for this provider.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OpenAICompatConfig openai_compat = 21;
+   */
+  openaiCompat?: OpenAICompatConfig;
+
+  /**
+   * Audit fields
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 7;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp update_time = 8;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * @generated from field: string creator = 9;
+   */
+  creator: string;
+
+  /**
+   * @generated from field: string updater = 10;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ModelProvider.
+ * Use `create(ModelProviderSchema)` to create a new message.
+ */
+export const ModelProviderSchema: GenMessage<ModelProvider> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 0);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetModelProviderRequest
+ */
+export type GetModelProviderRequest = Message<"redpanda.api.aigateway.v1.GetModelProviderRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetModelProviderRequest.
+ * Use `create(GetModelProviderRequestSchema)` to create a new message.
+ */
+export const GetModelProviderRequestSchema: GenMessage<GetModelProviderRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 1);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetModelProviderResponse
+ */
+export type GetModelProviderResponse = Message<"redpanda.api.aigateway.v1.GetModelProviderResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.ModelProvider model_provider = 1;
+   */
+  modelProvider?: ModelProvider;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetModelProviderResponse.
+ * Use `create(GetModelProviderResponseSchema)` to create a new message.
+ */
+export const GetModelProviderResponseSchema: GenMessage<GetModelProviderResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 2);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListModelProvidersRequest
+ */
+export type ListModelProvidersRequest = Message<"redpanda.api.aigateway.v1.ListModelProvidersRequest"> & {
+  /**
+   * @generated from field: int32 page_size = 1;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 2;
+   */
+  pageToken: string;
+
+  /**
+   * AIP-160 filter expression.
+   * Supported fields: provider_id, enabled, display_name
+   * Examples:
+   *   - enabled = "true"
+   *   - provider_id = "openai"
+   *   - display_name = "Anthropic"
+   *
+   * @generated from field: string filter = 3;
+   */
+  filter: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListModelProvidersRequest.
+ * Use `create(ListModelProvidersRequestSchema)` to create a new message.
+ */
+export const ListModelProvidersRequestSchema: GenMessage<ListModelProvidersRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 3);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListModelProvidersResponse
+ */
+export type ListModelProvidersResponse = Message<"redpanda.api.aigateway.v1.ListModelProvidersResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.ModelProvider model_providers = 1;
+   */
+  modelProviders: ModelProvider[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListModelProvidersResponse.
+ * Use `create(ListModelProvidersResponseSchema)` to create a new message.
+ */
+export const ListModelProvidersResponseSchema: GenMessage<ListModelProvidersResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 4);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateModelProviderRequest
+ */
+export type UpdateModelProviderRequest = Message<"redpanda.api.aigateway.v1.UpdateModelProviderRequest"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.ModelProvider model_provider = 1;
+   */
+  modelProvider?: ModelProvider;
+
+  /**
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateModelProviderRequest.
+ * Use `create(UpdateModelProviderRequestSchema)` to create a new message.
+ */
+export const UpdateModelProviderRequestSchema: GenMessage<UpdateModelProviderRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 5);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateModelProviderResponse
+ */
+export type UpdateModelProviderResponse = Message<"redpanda.api.aigateway.v1.UpdateModelProviderResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.ModelProvider model_provider = 1;
+   */
+  modelProvider?: ModelProvider;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateModelProviderResponse.
+ * Use `create(UpdateModelProviderResponseSchema)` to create a new message.
+ */
+export const UpdateModelProviderResponseSchema: GenMessage<UpdateModelProviderResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 6);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.EnableModelProviderRequest
+ */
+export type EnableModelProviderRequest = Message<"redpanda.api.aigateway.v1.EnableModelProviderRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EnableModelProviderRequest.
+ * Use `create(EnableModelProviderRequestSchema)` to create a new message.
+ */
+export const EnableModelProviderRequestSchema: GenMessage<EnableModelProviderRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 7);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.EnableModelProviderResponse
+ */
+export type EnableModelProviderResponse = Message<"redpanda.api.aigateway.v1.EnableModelProviderResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.ModelProvider model_provider = 1;
+   */
+  modelProvider?: ModelProvider;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EnableModelProviderResponse.
+ * Use `create(EnableModelProviderResponseSchema)` to create a new message.
+ */
+export const EnableModelProviderResponseSchema: GenMessage<EnableModelProviderResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 8);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DisableModelProviderRequest
+ */
+export type DisableModelProviderRequest = Message<"redpanda.api.aigateway.v1.DisableModelProviderRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DisableModelProviderRequest.
+ * Use `create(DisableModelProviderRequestSchema)` to create a new message.
+ */
+export const DisableModelProviderRequestSchema: GenMessage<DisableModelProviderRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 9);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DisableModelProviderResponse
+ */
+export type DisableModelProviderResponse = Message<"redpanda.api.aigateway.v1.DisableModelProviderResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.ModelProvider model_provider = 1;
+   */
+  modelProvider?: ModelProvider;
+
+  /**
+   * Number of models that were cascade-disabled
+   *
+   * @generated from field: int32 disabled_models_count = 2;
+   */
+  disabledModelsCount: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DisableModelProviderResponse.
+ * Use `create(DisableModelProviderResponseSchema)` to create a new message.
+ */
+export const DisableModelProviderResponseSchema: GenMessage<DisableModelProviderResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 10);
+
+/**
+ * OpenAI compatibility configuration for non-native providers.
+ * When a provider pool has this config applied, requests in OpenAI format
+ * are automatically transformed to the provider's native format.
+ *
+ * @generated from message redpanda.api.aigateway.v1.OpenAICompatConfig
+ */
+export type OpenAICompatConfig = Message<"redpanda.api.aigateway.v1.OpenAICompatConfig"> & {
+  /**
+   * Request transforms to apply (e.g., ["strip_model_prefix", "openai_to_anthropic"])
+   *
+   * @generated from field: repeated string request_transforms = 1;
+   */
+  requestTransforms: string[];
+
+  /**
+   * Response transforms to apply (e.g., ["anthropic_to_openai"])
+   *
+   * @generated from field: repeated string response_transforms = 2;
+   */
+  responseTransforms: string[];
+
+  /**
+   * Path rewrite configuration for providers that don't use /v1/chat/completions
+   *
+   * @generated from field: redpanda.api.aigateway.v1.PathRewrite path_rewrite = 3;
+   */
+  pathRewrite?: PathRewrite;
+
+  /**
+   * Auth header name override (e.g., "x-api-key" for Anthropic).
+   * If empty, uses default "Authorization" with "Bearer " prefix.
+   *
+   * @generated from field: string auth_header = 4;
+   */
+  authHeader: string;
+
+  /**
+   * Extra headers to include with every request (e.g., anthropic-version)
+   *
+   * @generated from field: map<string, string> extra_headers = 5;
+   */
+  extraHeaders: { [key: string]: string };
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.OpenAICompatConfig.
+ * Use `create(OpenAICompatConfigSchema)` to create a new message.
+ */
+export const OpenAICompatConfigSchema: GenMessage<OpenAICompatConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_model_providers, 11);
+
+/**
+ * ModelProvidersService manages LLM provider configurations.
+ * Providers are seeded by migrations; this service allows enabling/disabling
+ * and updating provider metadata. Disabling a provider will cascade-disable
+ * all its models.
+ *
+ * @generated from service redpanda.api.aigateway.v1.ModelProvidersService
+ */
+export const ModelProvidersService: GenService<{
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.GetModelProvider
+   */
+  getModelProvider: {
+    methodKind: "unary";
+    input: typeof GetModelProviderRequestSchema;
+    output: typeof GetModelProviderResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.ListModelProviders
+   */
+  listModelProviders: {
+    methodKind: "unary";
+    input: typeof ListModelProvidersRequestSchema;
+    output: typeof ListModelProvidersResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.UpdateModelProvider
+   */
+  updateModelProvider: {
+    methodKind: "unary";
+    input: typeof UpdateModelProviderRequestSchema;
+    output: typeof UpdateModelProviderResponseSchema;
+  },
+  /**
+   * Enable a provider for routing (does NOT auto-enable its models)
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.EnableModelProvider
+   */
+  enableModelProvider: {
+    methodKind: "unary";
+    input: typeof EnableModelProviderRequestSchema;
+    output: typeof EnableModelProviderResponseSchema;
+  },
+  /**
+   * Disable a provider (cascade-disables ALL its models)
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ModelProvidersService.DisableModelProvider
+   */
+  disableModelProvider: {
+    methodKind: "unary";
+    input: typeof DisableModelProviderRequestSchema;
+    output: typeof DisableModelProviderResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_model_providers, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/models-ModelsService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/models-ModelsService_connectquery.ts
new file mode 100644
index 0000000000..600887ba9a
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/models-ModelsService_connectquery.ts
@@ -0,0 +1,51 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/models.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { ModelsService } from "./models_pb";
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelsService.CreateModel
+ */
+export const createModel = ModelsService.method.createModel;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelsService.GetModel
+ */
+export const getModel = ModelsService.method.getModel;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelsService.ListModels
+ */
+export const listModels = ModelsService.method.listModels;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelsService.UpdateModel
+ */
+export const updateModel = ModelsService.method.updateModel;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelsService.DeleteModel
+ */
+export const deleteModel = ModelsService.method.deleteModel;
+
+/**
+ * Enable a model for routing
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ModelsService.EnableModel
+ */
+export const enableModel = ModelsService.method.enableModel;
+
+/**
+ * Disable a model (generates 0 req/s rate limit)
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ModelsService.DisableModel
+ */
+export const disableModel = ModelsService.method.disableModel;
+
+/**
+ * List all disabled models (for generating rate limit rules)
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ModelsService.ListDisabledModels
+ */
+export const listDisabledModels = ModelsService.method.listDisabledModels;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/models_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/models_pb.ts
new file mode 100644
index 0000000000..4e42fb5d5b
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/models_pb.ts
@@ -0,0 +1,549 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/models.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/models.proto.
+ */
+export const file_redpanda_api_aigateway_v1_models: GenFile = /*@__PURE__*/
+  fileDesc("CiZyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL21vZGVscy5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSK6BAoFTW9kZWwSEQoEbmFtZRgBIAEoCUID4EEIEhkKDGRpc3BsYXlfbmFtZRgCIAEoCUID4EECEhgKC21vZGVsX293bmVyGAMgASgJQgPgQQISFQoIbW9kZWxfaWQYBCABKAlCA+BBAhIVCghwcm92aWRlchgOIAEoCUID4EECEh4KEXByb3ZpZGVyX21vZGVsX2lkGA8gASgJQgPgQQISFwoKbW9kYWxpdGllcxgFIAMoCUID4EECEhYKDmNvbnRleHRfd2luZG93GAYgASgFEhMKC2Rlc2NyaXB0aW9uGAcgASgJEkAKCG1ldGFkYXRhGAggAygLMi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Nb2RlbC5NZXRhZGF0YUVudHJ5EhQKB2VuYWJsZWQYCSABKAhCA+BBAhI0CgtjcmVhdGVfdGltZRgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxI0Cgt1cGRhdGVfdGltZRgLIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIUCgdjcmVhdG9yGAwgASgJQgPgQQMSFAoHdXBkYXRlchgNIAEoCUID4EEDGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATo06kExChxhaWdhdGV3YXkucmVkcGFuZGEuY29tL01vZGVsEhFtb2RlbHMve21vZGVsX2lkfSJcChJDcmVhdGVNb2RlbFJlcXVlc3QSEAoIbW9kZWxfaWQYASABKAkSNAoFbW9kZWwYAiABKAsyIC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk1vZGVsQgPgQQIiRgoTQ3JlYXRlTW9kZWxSZXNwb25zZRIvCgVtb2RlbBgBIAEoCzIgLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTW9kZWwiRQoPR2V0TW9kZWxSZXF1ZXN0EjIKBG5hbWUYASABKAlCJOBBAvpBHgocYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Nb2RlbCJDChBHZXRNb2RlbFJlc3BvbnNlEi8KBW1vZGVsGAEgASgLMiAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Nb2RlbCJcChFMaXN0TW9kZWxzUmVxdWVzdBIRCglwYWdlX3NpemUYASABKAUSEgoKcGFnZV90b2tlbhgCIAEoCRIOCgZmaWx0ZXIYAyABKAkSEAoIb3JkZXJfYnkYBCABKAkicwoSTGlzdE1vZGVsc1Jlc3BvbnNlEjAKBm1vZGVscxgBIAMoCzIgLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTW9kZWwSFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJEhIKCnRvdGFsX3NpemUYAyABKAUiewoSVXBkYXRlTW9kZWxSZXF1ZXN0EjQKBW1vZGVsGAEgASgLMiAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Nb2RlbEID4EECEi8KC3VwZGF0ZV9tYXNrGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLkZpZWxkTWFzayJGChNVcGRhdGVNb2RlbFJlc3BvbnNlEi8KBW1vZGVsGAEgASgLMiAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Nb2RlbCJIChJEZWxldGVNb2RlbFJlcXVlc3QSMgoEbmFtZRgBIAEoCUIk4EEC+kEeChxhaWdhdGV3YXkucmVkcGFuZGEuY29tL01vZGVsIhUKE0RlbGV0ZU1vZGVsUmVzcG9uc2UiSAoSRW5hYmxlTW9kZWxSZXF1ZXN0EjIKBG5hbWUYASABKAlCJOBBAvpBHgocYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Nb2RlbCJGChNFbmFibGVNb2RlbFJlc3BvbnNlEi8KBW1vZGVsGAEgASgLMiAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Nb2RlbCJJChNEaXNhYmxlTW9kZWxSZXF1ZXN0EjIKBG5hbWUYASABKAlCJOBBAvpBHgocYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Nb2RlbCJHChREaXNhYmxlTW9kZWxSZXNwb25zZRIvCgVtb2RlbBgBIAEoCzIgLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTW9kZWwiQgoZTGlzdERpc2FibGVkTW9kZWxzUmVxdWVzdBIRCglwYWdlX3NpemUYASABKAUSEgoKcGFnZV90b2tlbhgCIAEoCSJ7ChpMaXN0RGlzYWJsZWRNb2RlbHNSZXNwb25zZRIwCgZtb2RlbHMYASADKAsyIC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk1vZGVsEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFMpUJCg1Nb2RlbHNTZXJ2aWNlEocBCgtDcmVhdGVNb2RlbBItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlTW9kZWxSZXF1ZXN0Gi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVNb2RlbFJlc3BvbnNlIhmC0+STAhM6BW1vZGVsIgovdjEvbW9kZWxzEoABCghHZXRNb2RlbBIqLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0TW9kZWxSZXF1ZXN0GisucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRNb2RlbFJlc3BvbnNlIhuC0+STAhUSEy92MS97bmFtZT1tb2RlbHMvKn0SfQoKTGlzdE1vZGVscxIsLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdE1vZGVsc1JlcXVlc3QaLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RNb2RlbHNSZXNwb25zZSISgtPkkwIMEgovdjEvbW9kZWxzEpYBCgtVcGRhdGVNb2RlbBItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlTW9kZWxSZXF1ZXN0Gi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVNb2RlbFJlc3BvbnNlIiiC0+STAiI6BW1vZGVsMhkvdjEve21vZGVsLm5hbWU9bW9kZWxzLyp9EokBCgtEZWxldGVNb2RlbBItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlTW9kZWxSZXF1ZXN0Gi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVNb2RlbFJlc3BvbnNlIhuC0+STAhUqEy92MS97bmFtZT1tb2RlbHMvKn0SkwEKC0VuYWJsZU1vZGVsEi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5FbmFibGVNb2RlbFJlcXVlc3QaLi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkVuYWJsZU1vZGVsUmVzcG9uc2UiJYLT5JMCHzoBKiIaL3YxL3tuYW1lPW1vZGVscy8qfTplbmFibGUSlwEKDERpc2FibGVNb2RlbBIuLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGlzYWJsZU1vZGVsUmVxdWVzdBovLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGlzYWJsZU1vZGVsUmVzcG9uc2UiJoLT5JMCIDoBKiIbL3YxL3tuYW1lPW1vZGVscy8qfTpkaXNhYmxlEqIBChJMaXN0RGlzYWJsZWRNb2RlbHMSNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3REaXNhYmxlZE1vZGVsc1JlcXVlc3QaNS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3REaXNhYmxlZE1vZGVsc1Jlc3BvbnNlIh+C0+STAhkSFy92MS9tb2RlbHM6bGlzdERpc2FibGVkQoACCh1jb20ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MUILTW9kZWxzUHJvdG9QAVpLZ28ucGFuZGEuZGV2L3JlZHBhbmRhLWFpZ3cvcHJvdG9zL2dlbi9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxO2FpZ2F0ZXdheXYxogIDUkFBqgIZUmVkcGFuZGEuQXBpLkFpZ2F0ZXdheS5WMcoCGVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjHiAiVSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYxXEdQQk1ldGFkYXRh6gIcUmVkcGFuZGE6OkFwaTo6QWlnYXRld2F5OjpWMWIGcHJvdG8z", [file_google_api_annotations, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Model represents an LLM model in the catalog.
+ * Models exist independently of pricing and can be enabled/disabled for routing.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Model
+ */
+export type Model = Message<"redpanda.api.aigateway.v1.Model"> & {
+  /**
+   * Resource name format:
+   * - Direct access: models/{model_owner}/{model_id} (e.g., models/anthropic/claude-3-5-sonnet)
+   * - Hosted provider: models/{model_owner}/{model_id}/{provider} (e.g., models/anthropic/claude-3-5-sonnet/aws-bedrock)
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Display name for UI
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Model identification
+   * model_owner: The company that created/owns the model (e.g., "openai", "anthropic", "google", "meta")
+   * This is distinct from hosting providers (Azure, AWS Bedrock) which are configured separately.
+   *
+   * @generated from field: string model_owner = 3;
+   */
+  modelOwner: string;
+
+  /**
+   * e.g., "gpt-4o", "claude-3-5-sonnet"
+   *
+   * @generated from field: string model_id = 4;
+   */
+  modelId: string;
+
+  /**
+   * Hosting provider - the service hosting this model
+   * Always populated. For direct API access, provider equals model_owner.
+   * Examples: "anthropic", "openai" (direct), "aws-bedrock", "azure", "google-vertex" (hosted)
+   *
+   * @generated from field: string provider = 14;
+   */
+  provider: string;
+
+  /**
+   * Provider-specific model identifier - the actual model ID to use when calling the provider's API.
+   * Always populated. For direct access, equals model_id. For hosted providers, this is the
+   * provider-specific ID (e.g., "anthropic.claude-3-5-sonnet-20241022-v2:0" for AWS Bedrock).
+   *
+   * @generated from field: string provider_model_id = 15;
+   */
+  providerModelId: string;
+
+  /**
+   * Modalities that this model supports - array for multimodal models
+   * Examples: ["chat"], ["chat", "vision"], ["chat", "vision", "audio"], ["embedding"]
+   *
+   * @generated from field: repeated string modalities = 5;
+   */
+  modalities: string[];
+
+  /**
+   * Model capabilities
+   *
+   * Maximum context window size
+   *
+   * @generated from field: int32 context_window = 6;
+   */
+  contextWindow: number;
+
+  /**
+   * Human-readable description
+   *
+   * @generated from field: string description = 7;
+   */
+  description: string;
+
+  /**
+   * Metadata for additional model properties
+   *
+   * @generated from field: map<string, string> metadata = 8;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Enable/disable toggle for routing
+   * When false, model appears in UI but generates 0 req/s rate limit in data plane
+   *
+   * @generated from field: bool enabled = 9;
+   */
+  enabled: boolean;
+
+  /**
+   * Audit fields
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 10;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp update_time = 11;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * @generated from field: string creator = 12;
+   */
+  creator: string;
+
+  /**
+   * @generated from field: string updater = 13;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Model.
+ * Use `create(ModelSchema)` to create a new message.
+ */
+export const ModelSchema: GenMessage<Model> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 0);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateModelRequest
+ */
+export type CreateModelRequest = Message<"redpanda.api.aigateway.v1.CreateModelRequest"> & {
+  /**
+   * @generated from field: string model_id = 1;
+   */
+  modelId: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Model model = 2;
+   */
+  model?: Model;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateModelRequest.
+ * Use `create(CreateModelRequestSchema)` to create a new message.
+ */
+export const CreateModelRequestSchema: GenMessage<CreateModelRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 1);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateModelResponse
+ */
+export type CreateModelResponse = Message<"redpanda.api.aigateway.v1.CreateModelResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Model model = 1;
+   */
+  model?: Model;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateModelResponse.
+ * Use `create(CreateModelResponseSchema)` to create a new message.
+ */
+export const CreateModelResponseSchema: GenMessage<CreateModelResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 2);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetModelRequest
+ */
+export type GetModelRequest = Message<"redpanda.api.aigateway.v1.GetModelRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetModelRequest.
+ * Use `create(GetModelRequestSchema)` to create a new message.
+ */
+export const GetModelRequestSchema: GenMessage<GetModelRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 3);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetModelResponse
+ */
+export type GetModelResponse = Message<"redpanda.api.aigateway.v1.GetModelResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Model model = 1;
+   */
+  model?: Model;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetModelResponse.
+ * Use `create(GetModelResponseSchema)` to create a new message.
+ */
+export const GetModelResponseSchema: GenMessage<GetModelResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 4);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListModelsRequest
+ */
+export type ListModelsRequest = Message<"redpanda.api.aigateway.v1.ListModelsRequest"> & {
+  /**
+   * @generated from field: int32 page_size = 1;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 2;
+   */
+  pageToken: string;
+
+  /**
+   * Filter by model_owner, provider, model_id, modality (checks if contained in modalities array), or enabled status
+   * Examples:
+   *   model_owner = "anthropic"       (the company that created the model)
+   *   provider = "aws-bedrock"        (the hosting provider)
+   *   model_id = "claude-3-5-sonnet"
+   *   modality = "chat"               (matches models with "chat" in their modalities array)
+   *   modality = "vision"             (matches multimodal models that support vision)
+   *   enabled = true
+   *
+   * @generated from field: string filter = 3;
+   */
+  filter: string;
+
+  /**
+   * @generated from field: string order_by = 4;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListModelsRequest.
+ * Use `create(ListModelsRequestSchema)` to create a new message.
+ */
+export const ListModelsRequestSchema: GenMessage<ListModelsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 5);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListModelsResponse
+ */
+export type ListModelsResponse = Message<"redpanda.api.aigateway.v1.ListModelsResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.Model models = 1;
+   */
+  models: Model[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListModelsResponse.
+ * Use `create(ListModelsResponseSchema)` to create a new message.
+ */
+export const ListModelsResponseSchema: GenMessage<ListModelsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 6);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateModelRequest
+ */
+export type UpdateModelRequest = Message<"redpanda.api.aigateway.v1.UpdateModelRequest"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Model model = 1;
+   */
+  model?: Model;
+
+  /**
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateModelRequest.
+ * Use `create(UpdateModelRequestSchema)` to create a new message.
+ */
+export const UpdateModelRequestSchema: GenMessage<UpdateModelRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 7);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateModelResponse
+ */
+export type UpdateModelResponse = Message<"redpanda.api.aigateway.v1.UpdateModelResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Model model = 1;
+   */
+  model?: Model;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateModelResponse.
+ * Use `create(UpdateModelResponseSchema)` to create a new message.
+ */
+export const UpdateModelResponseSchema: GenMessage<UpdateModelResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 8);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteModelRequest
+ */
+export type DeleteModelRequest = Message<"redpanda.api.aigateway.v1.DeleteModelRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteModelRequest.
+ * Use `create(DeleteModelRequestSchema)` to create a new message.
+ */
+export const DeleteModelRequestSchema: GenMessage<DeleteModelRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 9);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteModelResponse
+ */
+export type DeleteModelResponse = Message<"redpanda.api.aigateway.v1.DeleteModelResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteModelResponse.
+ * Use `create(DeleteModelResponseSchema)` to create a new message.
+ */
+export const DeleteModelResponseSchema: GenMessage<DeleteModelResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 10);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.EnableModelRequest
+ */
+export type EnableModelRequest = Message<"redpanda.api.aigateway.v1.EnableModelRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EnableModelRequest.
+ * Use `create(EnableModelRequestSchema)` to create a new message.
+ */
+export const EnableModelRequestSchema: GenMessage<EnableModelRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 11);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.EnableModelResponse
+ */
+export type EnableModelResponse = Message<"redpanda.api.aigateway.v1.EnableModelResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Model model = 1;
+   */
+  model?: Model;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EnableModelResponse.
+ * Use `create(EnableModelResponseSchema)` to create a new message.
+ */
+export const EnableModelResponseSchema: GenMessage<EnableModelResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 12);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DisableModelRequest
+ */
+export type DisableModelRequest = Message<"redpanda.api.aigateway.v1.DisableModelRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DisableModelRequest.
+ * Use `create(DisableModelRequestSchema)` to create a new message.
+ */
+export const DisableModelRequestSchema: GenMessage<DisableModelRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 13);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DisableModelResponse
+ */
+export type DisableModelResponse = Message<"redpanda.api.aigateway.v1.DisableModelResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Model model = 1;
+   */
+  model?: Model;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DisableModelResponse.
+ * Use `create(DisableModelResponseSchema)` to create a new message.
+ */
+export const DisableModelResponseSchema: GenMessage<DisableModelResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 14);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListDisabledModelsRequest
+ */
+export type ListDisabledModelsRequest = Message<"redpanda.api.aigateway.v1.ListDisabledModelsRequest"> & {
+  /**
+   * @generated from field: int32 page_size = 1;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 2;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListDisabledModelsRequest.
+ * Use `create(ListDisabledModelsRequestSchema)` to create a new message.
+ */
+export const ListDisabledModelsRequestSchema: GenMessage<ListDisabledModelsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 15);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListDisabledModelsResponse
+ */
+export type ListDisabledModelsResponse = Message<"redpanda.api.aigateway.v1.ListDisabledModelsResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.Model models = 1;
+   */
+  models: Model[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListDisabledModelsResponse.
+ * Use `create(ListDisabledModelsResponseSchema)` to create a new message.
+ */
+export const ListDisabledModelsResponseSchema: GenMessage<ListDisabledModelsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_models, 16);
+
+/**
+ * @generated from service redpanda.api.aigateway.v1.ModelsService
+ */
+export const ModelsService: GenService<{
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelsService.CreateModel
+   */
+  createModel: {
+    methodKind: "unary";
+    input: typeof CreateModelRequestSchema;
+    output: typeof CreateModelResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelsService.GetModel
+   */
+  getModel: {
+    methodKind: "unary";
+    input: typeof GetModelRequestSchema;
+    output: typeof GetModelResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelsService.ListModels
+   */
+  listModels: {
+    methodKind: "unary";
+    input: typeof ListModelsRequestSchema;
+    output: typeof ListModelsResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelsService.UpdateModel
+   */
+  updateModel: {
+    methodKind: "unary";
+    input: typeof UpdateModelRequestSchema;
+    output: typeof UpdateModelResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelsService.DeleteModel
+   */
+  deleteModel: {
+    methodKind: "unary";
+    input: typeof DeleteModelRequestSchema;
+    output: typeof DeleteModelResponseSchema;
+  },
+  /**
+   * Enable a model for routing
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ModelsService.EnableModel
+   */
+  enableModel: {
+    methodKind: "unary";
+    input: typeof EnableModelRequestSchema;
+    output: typeof EnableModelResponseSchema;
+  },
+  /**
+   * Disable a model (generates 0 req/s rate limit)
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ModelsService.DisableModel
+   */
+  disableModel: {
+    methodKind: "unary";
+    input: typeof DisableModelRequestSchema;
+    output: typeof DisableModelResponseSchema;
+  },
+  /**
+   * List all disabled models (for generating rate limit rules)
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ModelsService.ListDisabledModels
+   */
+  listDisabledModels: {
+    methodKind: "unary";
+    input: typeof ListDisabledModelsRequestSchema;
+    output: typeof ListDisabledModelsResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_models, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_client-OAuth2ClientService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_client-OAuth2ClientService_connectquery.ts
new file mode 100644
index 0000000000..b1c7469d5c
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_client-OAuth2ClientService_connectquery.ts
@@ -0,0 +1,65 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/oauth2_client.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { OAuth2ClientService } from "./oauth2_client_pb";
+
+/**
+ * Creates a new OAuth2 client.
+ * Returns the client with plaintext secret (only returned on creation).
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.CreateOAuth2Client
+ */
+export const createOAuth2Client = OAuth2ClientService.method.createOAuth2Client;
+
+/**
+ * Gets an OAuth2 client by name.
+ * Note: The client_secret is never returned after creation.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.GetOAuth2Client
+ */
+export const getOAuth2Client = OAuth2ClientService.method.getOAuth2Client;
+
+/**
+ * Lists OAuth2 clients.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.ListOAuth2Clients
+ */
+export const listOAuth2Clients = OAuth2ClientService.method.listOAuth2Clients;
+
+/**
+ * Updates an OAuth2 client.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.UpdateOAuth2Client
+ */
+export const updateOAuth2Client = OAuth2ClientService.method.updateOAuth2Client;
+
+/**
+ * Deletes an OAuth2 client.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.DeleteOAuth2Client
+ */
+export const deleteOAuth2Client = OAuth2ClientService.method.deleteOAuth2Client;
+
+/**
+ * Rotates an OAuth2 client's secret.
+ * Returns the new plaintext secret (only returned during rotation).
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.RotateOAuth2ClientSecret
+ */
+export const rotateOAuth2ClientSecret = OAuth2ClientService.method.rotateOAuth2ClientSecret;
+
+/**
+ * Disables an OAuth2 client (soft delete).
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.DisableOAuth2Client
+ */
+export const disableOAuth2Client = OAuth2ClientService.method.disableOAuth2Client;
+
+/**
+ * Validates OAuth2 client credentials.
+ * Used for authenticating client_credentials grant requests.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.ValidateClientCredentials
+ */
+export const validateClientCredentials = OAuth2ClientService.method.validateClientCredentials;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_client_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_client_pb.ts
new file mode 100644
index 0000000000..c087eb2cc5
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_client_pb.ts
@@ -0,0 +1,738 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/oauth2_client.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/oauth2_client.proto.
+ */
+export const file_redpanda_api_aigateway_v1_oauth2_client: GenFile = /*@__PURE__*/
+  fileDesc("Ci1yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL29hdXRoMl9jbGllbnQucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEiyAYKDE9BdXRoMkNsaWVudBIRCgRuYW1lGAEgASgJQgPgQQgSIwoMZGlzcGxheV9uYW1lGAIgASgJQg3gQQK6SAdyBRABGP8BEhgKC2Rlc2NyaXB0aW9uGAMgASgJQgPgQQESRQoLY2xpZW50X3R5cGUYBCABKA4yKy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMkNsaWVudFR5cGVCA+BBAhJACgxvcmdhbml6YXRpb24YBSABKAlCKPpBJQojYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Pcmdhbml6YXRpb25IABI6Cgl3b3Jrc3BhY2UYBiABKAlCJfpBIgogYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Xb3Jrc3BhY2VIABIwCgR0ZWFtGAcgASgJQiD6QR0KG2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vVGVhbUgAEjAKBHVzZXIYCCABKAlCIPpBHQobYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Vc2VySAASNgoHZ2F0ZXdheRgJIAEoCUIj+kEgCh5haWdhdGV3YXkucmVkcGFuZGEuY29tL0dhdGV3YXlIABIVCg1yZWRpcmVjdF91cmlzGAogAygJEg4KBnNjb3BlcxgLIAMoCRITCgtncmFudF90eXBlcxgMIAMoCRIPCgdlbmFibGVkGA0gASgIEjMKCmV4cGlyZXNfYXQYDiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQESNQoMbGFzdF91c2VkX2F0GA8gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEjQKC2NyZWF0ZV90aW1lGBAgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEjQKC3VwZGF0ZV90aW1lGBEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEhQKB2NyZWF0b3IYEiABKAlCA+BBAzpB6kE+CiNhaWdhdGV3YXkucmVkcGFuZGEuY29tL09BdXRoMkNsaWVudBIXb2F1dGgyL2NsaWVudHMve2NsaWVudH1CBwoFb3duZXIibQoWT0F1dGgyQ2xpZW50V2l0aFNlY3JldBI3CgZjbGllbnQYASABKAsyJy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMkNsaWVudBIaCg1jbGllbnRfc2VjcmV0GAIgASgJQgPgQQMiagoZQ3JlYXRlT0F1dGgyQ2xpZW50UmVxdWVzdBI8CgZjbGllbnQYAiABKAsyJy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMkNsaWVudEID4EECSgQIARACUgljbGllbnRfaWQiXwoaQ3JlYXRlT0F1dGgyQ2xpZW50UmVzcG9uc2USQQoGY2xpZW50GAEgASgLMjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5PQXV0aDJDbGllbnRXaXRoU2VjcmV0IlMKFkdldE9BdXRoMkNsaWVudFJlcXVlc3QSOQoEbmFtZRgBIAEoCUIr4EEC+kElCiNhaWdhdGV3YXkucmVkcGFuZGEuY29tL09BdXRoMkNsaWVudCJSChdHZXRPQXV0aDJDbGllbnRSZXNwb25zZRI3CgZjbGllbnQYASABKAsyJy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMkNsaWVudCLcAQoYTGlzdE9BdXRoMkNsaWVudHNSZXF1ZXN0EhIKBW93bmVyGAEgASgJQgPgQQESRQoLY2xpZW50X3R5cGUYAiABKA4yKy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMkNsaWVudFR5cGVCA+BBARIgCglwYWdlX3NpemUYAyABKAVCDeBBAbpIBxoFGOgHKAASFwoKcGFnZV90b2tlbhgEIAEoCUID4EEBEhMKBmZpbHRlchgFIAEoCUID4EEBEhUKCG9yZGVyX2J5GAYgASgJQgPgQQEiggEKGUxpc3RPQXV0aDJDbGllbnRzUmVzcG9uc2USOAoHY2xpZW50cxgBIAMoCzInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT0F1dGgyQ2xpZW50EhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFIo8BChlVcGRhdGVPQXV0aDJDbGllbnRSZXF1ZXN0EjwKBmNsaWVudBgBIAEoCzInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT0F1dGgyQ2xpZW50QgPgQQISNAoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQgPgQQEiVQoaVXBkYXRlT0F1dGgyQ2xpZW50UmVzcG9uc2USNwoGY2xpZW50GAEgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5PQXV0aDJDbGllbnQiVgoZRGVsZXRlT0F1dGgyQ2xpZW50UmVxdWVzdBI5CgRuYW1lGAEgASgJQivgQQL6QSUKI2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT0F1dGgyQ2xpZW50IhwKGkRlbGV0ZU9BdXRoMkNsaWVudFJlc3BvbnNlIlwKH1JvdGF0ZU9BdXRoMkNsaWVudFNlY3JldFJlcXVlc3QSOQoEbmFtZRgBIAEoCUIr4EEC+kElCiNhaWdhdGV3YXkucmVkcGFuZGEuY29tL09BdXRoMkNsaWVudCJlCiBSb3RhdGVPQXV0aDJDbGllbnRTZWNyZXRSZXNwb25zZRJBCgZjbGllbnQYASABKAsyMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMkNsaWVudFdpdGhTZWNyZXQiVwoaRGlzYWJsZU9BdXRoMkNsaWVudFJlcXVlc3QSOQoEbmFtZRgBIAEoCUIr4EEC+kElCiNhaWdhdGV3YXkucmVkcGFuZGEuY29tL09BdXRoMkNsaWVudCJWChtEaXNhYmxlT0F1dGgyQ2xpZW50UmVzcG9uc2USNwoGY2xpZW50GAEgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5PQXV0aDJDbGllbnQiVgogVmFsaWRhdGVDbGllbnRDcmVkZW50aWFsc1JlcXVlc3QSFgoJY2xpZW50X2lkGAEgASgJQgPgQQISGgoNY2xpZW50X3NlY3JldBgCIAEoCUID4EECIoIBCiFWYWxpZGF0ZUNsaWVudENyZWRlbnRpYWxzUmVzcG9uc2USDQoFdmFsaWQYASABKAgSNwoGY2xpZW50GAIgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5PQXV0aDJDbGllbnQSFQoNZXJyb3JfbWVzc2FnZRgDIAEoCSpzChBPQXV0aDJDbGllbnRUeXBlEiIKHk9BVVRIMl9DTElFTlRfVFlQRV9VTlNQRUNJRklFRBAAEhsKF09BVVRIMl9DTElFTlRfVFlQRV9VU0VSEAESHgoaT0FVVEgyX0NMSUVOVF9UWVBFX1NFUlZJQ0UQAjLECwoTT0F1dGgyQ2xpZW50U2VydmljZRKlAQoSQ3JlYXRlT0F1dGgyQ2xpZW50EjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVPQXV0aDJDbGllbnRSZXF1ZXN0GjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVPQXV0aDJDbGllbnRSZXNwb25zZSIigtPkkwIcOgZjbGllbnQiEi92MS9vYXV0aDIvY2xpZW50cxKdAQoPR2V0T0F1dGgyQ2xpZW50EjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRPQXV0aDJDbGllbnRSZXF1ZXN0GjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRPQXV0aDJDbGllbnRSZXNwb25zZSIjgtPkkwIdEhsvdjEve25hbWU9b2F1dGgyL2NsaWVudHMvKn0SmgEKEUxpc3RPQXV0aDJDbGllbnRzEjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0T0F1dGgyQ2xpZW50c1JlcXVlc3QaNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RPQXV0aDJDbGllbnRzUmVzcG9uc2UiGoLT5JMCFBISL3YxL29hdXRoMi9jbGllbnRzErUBChJVcGRhdGVPQXV0aDJDbGllbnQSNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZU9BdXRoMkNsaWVudFJlcXVlc3QaNS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZU9BdXRoMkNsaWVudFJlc3BvbnNlIjKC0+STAiw6BmNsaWVudDIiL3YxL3tjbGllbnQubmFtZT1vYXV0aDIvY2xpZW50cy8qfRKmAQoSRGVsZXRlT0F1dGgyQ2xpZW50EjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVPQXV0aDJDbGllbnRSZXF1ZXN0GjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVPQXV0aDJDbGllbnRSZXNwb25zZSIjgtPkkwIdKhsvdjEve25hbWU9b2F1dGgyL2NsaWVudHMvKn0SyAEKGFJvdGF0ZU9BdXRoMkNsaWVudFNlY3JldBI6LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm90YXRlT0F1dGgyQ2xpZW50U2VjcmV0UmVxdWVzdBo7LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm90YXRlT0F1dGgyQ2xpZW50U2VjcmV0UmVzcG9uc2UiM4LT5JMCLToBKiIoL3YxL3tuYW1lPW9hdXRoMi9jbGllbnRzLyp9OnJvdGF0ZVNlY3JldBK0AQoTRGlzYWJsZU9BdXRoMkNsaWVudBI1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGlzYWJsZU9BdXRoMkNsaWVudFJlcXVlc3QaNi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRpc2FibGVPQXV0aDJDbGllbnRSZXNwb25zZSIugtPkkwIoOgEqIiMvdjEve25hbWU9b2F1dGgyL2NsaWVudHMvKn06ZGlzYWJsZRLJAQoZVmFsaWRhdGVDbGllbnRDcmVkZW50aWFscxI7LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVmFsaWRhdGVDbGllbnRDcmVkZW50aWFsc1JlcXVlc3QaPC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlZhbGlkYXRlQ2xpZW50Q3JlZGVudGlhbHNSZXNwb25zZSIxgtPkkwIrOgEqIiYvdjEvb2F1dGgyL2NsaWVudHM6dmFsaWRhdGVDcmVkZW50aWFscxoZykEWYWlnYXRld2F5LnJlZHBhbmRhLmNvbUKGAgodY29tLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjFCEU9hdXRoMkNsaWVudFByb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * OAuth2Client represents an OAuth2 client for machine-to-machine authentication.
+ *
+ * @generated from message redpanda.api.aigateway.v1.OAuth2Client
+ */
+export type OAuth2Client = Message<"redpanda.api.aigateway.v1.OAuth2Client"> & {
+  /**
+   * Resource name. Format: `oauth2/clients/{client_id}`
+   * Client ID is a globally unique identifier (XID).
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Client type: 'user' (interactive) or 'service' (machine-to-machine)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2ClientType client_type = 4;
+   */
+  clientType: OAuth2ClientType;
+
+  /**
+   * Owner reference (exactly one must be set)
+   *
+   * @generated from oneof redpanda.api.aigateway.v1.OAuth2Client.owner
+   */
+  owner: {
+    /**
+     * Organization that owns this client
+     *
+     * @generated from field: string organization = 5;
+     */
+    value: string;
+    case: "organization";
+  } | {
+    /**
+     * Workspace that owns this client
+     *
+     * @generated from field: string workspace = 6;
+     */
+    value: string;
+    case: "workspace";
+  } | {
+    /**
+     * Team that owns this client
+     *
+     * @generated from field: string team = 7;
+     */
+    value: string;
+    case: "team";
+  } | {
+    /**
+     * User that owns this client
+     *
+     * @generated from field: string user = 8;
+     */
+    value: string;
+    case: "user";
+  } | {
+    /**
+     * Gateway that owns this client
+     *
+     * @generated from field: string gateway = 9;
+     */
+    value: string;
+    case: "gateway";
+  } | { case: undefined; value?: undefined };
+
+  /**
+   * OAuth2 redirect URIs (for authorization_code flow, future use)
+   *
+   * @generated from field: repeated string redirect_uris = 10;
+   */
+  redirectUris: string[];
+
+  /**
+   * Allowed OAuth2 scopes
+   *
+   * @generated from field: repeated string scopes = 11;
+   */
+  scopes: string[];
+
+  /**
+   * Supported grant types (default: client_credentials)
+   *
+   * @generated from field: repeated string grant_types = 12;
+   */
+  grantTypes: string[];
+
+  /**
+   * Whether this client is active
+   *
+   * @generated from field: bool enabled = 13;
+   */
+  enabled: boolean;
+
+  /**
+   * Optional: Expiration time for the client
+   *
+   * @generated from field: google.protobuf.Timestamp expires_at = 14;
+   */
+  expiresAt?: Timestamp;
+
+  /**
+   * Output only. Last time this client was used
+   *
+   * @generated from field: google.protobuf.Timestamp last_used_at = 15;
+   */
+  lastUsedAt?: Timestamp;
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 16;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 17;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Creator (API key or OIDC subject)
+   *
+   * @generated from field: string creator = 18;
+   */
+  creator: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.OAuth2Client.
+ * Use `create(OAuth2ClientSchema)` to create a new message.
+ */
+export const OAuth2ClientSchema: GenMessage<OAuth2Client> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 0);
+
+/**
+ * OAuth2ClientWithSecret is returned only on creation or secret rotation.
+ *
+ * @generated from message redpanda.api.aigateway.v1.OAuth2ClientWithSecret
+ */
+export type OAuth2ClientWithSecret = Message<"redpanda.api.aigateway.v1.OAuth2ClientWithSecret"> & {
+  /**
+   * The OAuth2 client
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Client client = 1;
+   */
+  client?: OAuth2Client;
+
+  /**
+   * Output only. The plaintext client secret.
+   * This is ONLY returned during creation or rotation.
+   * Store this securely - it cannot be retrieved again.
+   *
+   * @generated from field: string client_secret = 2;
+   */
+  clientSecret: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.OAuth2ClientWithSecret.
+ * Use `create(OAuth2ClientWithSecretSchema)` to create a new message.
+ */
+export const OAuth2ClientWithSecretSchema: GenMessage<OAuth2ClientWithSecret> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 1);
+
+/**
+ * Request message for CreateOAuth2Client RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateOAuth2ClientRequest
+ */
+export type CreateOAuth2ClientRequest = Message<"redpanda.api.aigateway.v1.CreateOAuth2ClientRequest"> & {
+  /**
+   * Required: The OAuth2 client to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Client client = 2;
+   */
+  client?: OAuth2Client;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateOAuth2ClientRequest.
+ * Use `create(CreateOAuth2ClientRequestSchema)` to create a new message.
+ */
+export const CreateOAuth2ClientRequestSchema: GenMessage<CreateOAuth2ClientRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 2);
+
+/**
+ * Response message for CreateOAuth2Client RPC.
+ * Includes the plaintext secret - store it securely!
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateOAuth2ClientResponse
+ */
+export type CreateOAuth2ClientResponse = Message<"redpanda.api.aigateway.v1.CreateOAuth2ClientResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2ClientWithSecret client = 1;
+   */
+  client?: OAuth2ClientWithSecret;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateOAuth2ClientResponse.
+ * Use `create(CreateOAuth2ClientResponseSchema)` to create a new message.
+ */
+export const CreateOAuth2ClientResponseSchema: GenMessage<CreateOAuth2ClientResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 3);
+
+/**
+ * Request message for GetOAuth2Client RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetOAuth2ClientRequest
+ */
+export type GetOAuth2ClientRequest = Message<"redpanda.api.aigateway.v1.GetOAuth2ClientRequest"> & {
+  /**
+   * Resource name of the client.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetOAuth2ClientRequest.
+ * Use `create(GetOAuth2ClientRequestSchema)` to create a new message.
+ */
+export const GetOAuth2ClientRequestSchema: GenMessage<GetOAuth2ClientRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 4);
+
+/**
+ * Response message for GetOAuth2Client RPC.
+ * Note: client_secret is never returned.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetOAuth2ClientResponse
+ */
+export type GetOAuth2ClientResponse = Message<"redpanda.api.aigateway.v1.GetOAuth2ClientResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Client client = 1;
+   */
+  client?: OAuth2Client;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetOAuth2ClientResponse.
+ * Use `create(GetOAuth2ClientResponseSchema)` to create a new message.
+ */
+export const GetOAuth2ClientResponseSchema: GenMessage<GetOAuth2ClientResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 5);
+
+/**
+ * Request message for ListOAuth2Clients RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListOAuth2ClientsRequest
+ */
+export type ListOAuth2ClientsRequest = Message<"redpanda.api.aigateway.v1.ListOAuth2ClientsRequest"> & {
+  /**
+   * Filter by owner type and ID (optional)
+   * Format examples:
+   *   organization=accounts/*\/organizations/*
+   *   workspace=accounts/*\/organizations/*\/workspaces/*
+   *   user=accounts/*\/organizations/*\/users/*
+   *   gateway=gateways/*
+   *
+   * @generated from field: string owner = 1;
+   */
+  owner: string;
+
+  /**
+   * Filter by client type
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2ClientType client_type = 2;
+   */
+  clientType: OAuth2ClientType;
+
+  /**
+   * Maximum number of clients to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 3;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call
+   *
+   * @generated from field: string page_token = 4;
+   */
+  pageToken: string;
+
+  /**
+   * Filter expression (CEL syntax)
+   *
+   * @generated from field: string filter = 5;
+   */
+  filter: string;
+
+  /**
+   * Comma-separated list of fields to order by
+   *
+   * @generated from field: string order_by = 6;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListOAuth2ClientsRequest.
+ * Use `create(ListOAuth2ClientsRequestSchema)` to create a new message.
+ */
+export const ListOAuth2ClientsRequestSchema: GenMessage<ListOAuth2ClientsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 6);
+
+/**
+ * Response message for ListOAuth2Clients RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListOAuth2ClientsResponse
+ */
+export type ListOAuth2ClientsResponse = Message<"redpanda.api.aigateway.v1.ListOAuth2ClientsResponse"> & {
+  /**
+   * The list of OAuth2 clients (without secrets)
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.OAuth2Client clients = 1;
+   */
+  clients: OAuth2Client[];
+
+  /**
+   * Token for next page
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListOAuth2ClientsResponse.
+ * Use `create(ListOAuth2ClientsResponseSchema)` to create a new message.
+ */
+export const ListOAuth2ClientsResponseSchema: GenMessage<ListOAuth2ClientsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 7);
+
+/**
+ * Request message for UpdateOAuth2Client RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateOAuth2ClientRequest
+ */
+export type UpdateOAuth2ClientRequest = Message<"redpanda.api.aigateway.v1.UpdateOAuth2ClientRequest"> & {
+  /**
+   * Required: The client to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Client client = 1;
+   */
+  client?: OAuth2Client;
+
+  /**
+   * The fields to update.
+   * Allowed fields: display_name, description, redirect_uris, scopes, grant_types, enabled, expires_at
+   * Note: Owner cannot be changed after creation.
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateOAuth2ClientRequest.
+ * Use `create(UpdateOAuth2ClientRequestSchema)` to create a new message.
+ */
+export const UpdateOAuth2ClientRequestSchema: GenMessage<UpdateOAuth2ClientRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 8);
+
+/**
+ * Response message for UpdateOAuth2Client RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateOAuth2ClientResponse
+ */
+export type UpdateOAuth2ClientResponse = Message<"redpanda.api.aigateway.v1.UpdateOAuth2ClientResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Client client = 1;
+   */
+  client?: OAuth2Client;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateOAuth2ClientResponse.
+ * Use `create(UpdateOAuth2ClientResponseSchema)` to create a new message.
+ */
+export const UpdateOAuth2ClientResponseSchema: GenMessage<UpdateOAuth2ClientResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 9);
+
+/**
+ * Request message for DeleteOAuth2Client RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteOAuth2ClientRequest
+ */
+export type DeleteOAuth2ClientRequest = Message<"redpanda.api.aigateway.v1.DeleteOAuth2ClientRequest"> & {
+  /**
+   * Resource name of the client to delete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteOAuth2ClientRequest.
+ * Use `create(DeleteOAuth2ClientRequestSchema)` to create a new message.
+ */
+export const DeleteOAuth2ClientRequestSchema: GenMessage<DeleteOAuth2ClientRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 10);
+
+/**
+ * Response message for DeleteOAuth2Client RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteOAuth2ClientResponse
+ */
+export type DeleteOAuth2ClientResponse = Message<"redpanda.api.aigateway.v1.DeleteOAuth2ClientResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteOAuth2ClientResponse.
+ * Use `create(DeleteOAuth2ClientResponseSchema)` to create a new message.
+ */
+export const DeleteOAuth2ClientResponseSchema: GenMessage<DeleteOAuth2ClientResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 11);
+
+/**
+ * Request message for RotateOAuth2ClientSecret RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RotateOAuth2ClientSecretRequest
+ */
+export type RotateOAuth2ClientSecretRequest = Message<"redpanda.api.aigateway.v1.RotateOAuth2ClientSecretRequest"> & {
+  /**
+   * Resource name of the client.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RotateOAuth2ClientSecretRequest.
+ * Use `create(RotateOAuth2ClientSecretRequestSchema)` to create a new message.
+ */
+export const RotateOAuth2ClientSecretRequestSchema: GenMessage<RotateOAuth2ClientSecretRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 12);
+
+/**
+ * Response message for RotateOAuth2ClientSecret RPC.
+ * Includes the new plaintext secret - store it securely!
+ *
+ * @generated from message redpanda.api.aigateway.v1.RotateOAuth2ClientSecretResponse
+ */
+export type RotateOAuth2ClientSecretResponse = Message<"redpanda.api.aigateway.v1.RotateOAuth2ClientSecretResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2ClientWithSecret client = 1;
+   */
+  client?: OAuth2ClientWithSecret;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RotateOAuth2ClientSecretResponse.
+ * Use `create(RotateOAuth2ClientSecretResponseSchema)` to create a new message.
+ */
+export const RotateOAuth2ClientSecretResponseSchema: GenMessage<RotateOAuth2ClientSecretResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 13);
+
+/**
+ * Request message for DisableOAuth2Client RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DisableOAuth2ClientRequest
+ */
+export type DisableOAuth2ClientRequest = Message<"redpanda.api.aigateway.v1.DisableOAuth2ClientRequest"> & {
+  /**
+   * Resource name of the client to disable.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DisableOAuth2ClientRequest.
+ * Use `create(DisableOAuth2ClientRequestSchema)` to create a new message.
+ */
+export const DisableOAuth2ClientRequestSchema: GenMessage<DisableOAuth2ClientRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 14);
+
+/**
+ * Response message for DisableOAuth2Client RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DisableOAuth2ClientResponse
+ */
+export type DisableOAuth2ClientResponse = Message<"redpanda.api.aigateway.v1.DisableOAuth2ClientResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Client client = 1;
+   */
+  client?: OAuth2Client;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DisableOAuth2ClientResponse.
+ * Use `create(DisableOAuth2ClientResponseSchema)` to create a new message.
+ */
+export const DisableOAuth2ClientResponseSchema: GenMessage<DisableOAuth2ClientResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 15);
+
+/**
+ * Request message for ValidateClientCredentials RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ValidateClientCredentialsRequest
+ */
+export type ValidateClientCredentialsRequest = Message<"redpanda.api.aigateway.v1.ValidateClientCredentialsRequest"> & {
+  /**
+   * Client ID (the resource name suffix, e.g., from "oauth2/clients/{id}")
+   *
+   * @generated from field: string client_id = 1;
+   */
+  clientId: string;
+
+  /**
+   * Client secret to validate
+   *
+   * @generated from field: string client_secret = 2;
+   */
+  clientSecret: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ValidateClientCredentialsRequest.
+ * Use `create(ValidateClientCredentialsRequestSchema)` to create a new message.
+ */
+export const ValidateClientCredentialsRequestSchema: GenMessage<ValidateClientCredentialsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 16);
+
+/**
+ * Response message for ValidateClientCredentials RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ValidateClientCredentialsResponse
+ */
+export type ValidateClientCredentialsResponse = Message<"redpanda.api.aigateway.v1.ValidateClientCredentialsResponse"> & {
+  /**
+   * Whether the credentials are valid
+   *
+   * @generated from field: bool valid = 1;
+   */
+  valid: boolean;
+
+  /**
+   * The authenticated client (only set if valid=true)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Client client = 2;
+   */
+  client?: OAuth2Client;
+
+  /**
+   * Error message if validation failed (for logging/debugging)
+   *
+   * @generated from field: string error_message = 3;
+   */
+  errorMessage: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ValidateClientCredentialsResponse.
+ * Use `create(ValidateClientCredentialsResponseSchema)` to create a new message.
+ */
+export const ValidateClientCredentialsResponseSchema: GenMessage<ValidateClientCredentialsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_client, 17);
+
+/**
+ * OAuth2ClientType defines the type of OAuth2 client.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.OAuth2ClientType
+ */
+export enum OAuth2ClientType {
+  /**
+   * @generated from enum value: OAUTH2_CLIENT_TYPE_UNSPECIFIED = 0;
+   */
+  OAUTH2_CLIENT_TYPE_UNSPECIFIED = 0,
+
+  /**
+   * Interactive user clients (future: authorization_code flow)
+   *
+   * @generated from enum value: OAUTH2_CLIENT_TYPE_USER = 1;
+   */
+  OAUTH2_CLIENT_TYPE_USER = 1,
+
+  /**
+   * Service/machine clients (client_credentials flow)
+   *
+   * @generated from enum value: OAUTH2_CLIENT_TYPE_SERVICE = 2;
+   */
+  OAUTH2_CLIENT_TYPE_SERVICE = 2,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.OAuth2ClientType.
+ */
+export const OAuth2ClientTypeSchema: GenEnum<OAuth2ClientType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_oauth2_client, 0);
+
+/**
+ * OAuth2ClientService manages OAuth2 client credentials.
+ * Clients can be owned by organizations, workspaces, teams, users, or gateways.
+ * Resource name: oauth2/clients/{client_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.OAuth2ClientService
+ */
+export const OAuth2ClientService: GenService<{
+  /**
+   * Creates a new OAuth2 client.
+   * Returns the client with plaintext secret (only returned on creation).
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.CreateOAuth2Client
+   */
+  createOAuth2Client: {
+    methodKind: "unary";
+    input: typeof CreateOAuth2ClientRequestSchema;
+    output: typeof CreateOAuth2ClientResponseSchema;
+  },
+  /**
+   * Gets an OAuth2 client by name.
+   * Note: The client_secret is never returned after creation.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.GetOAuth2Client
+   */
+  getOAuth2Client: {
+    methodKind: "unary";
+    input: typeof GetOAuth2ClientRequestSchema;
+    output: typeof GetOAuth2ClientResponseSchema;
+  },
+  /**
+   * Lists OAuth2 clients.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.ListOAuth2Clients
+   */
+  listOAuth2Clients: {
+    methodKind: "unary";
+    input: typeof ListOAuth2ClientsRequestSchema;
+    output: typeof ListOAuth2ClientsResponseSchema;
+  },
+  /**
+   * Updates an OAuth2 client.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.UpdateOAuth2Client
+   */
+  updateOAuth2Client: {
+    methodKind: "unary";
+    input: typeof UpdateOAuth2ClientRequestSchema;
+    output: typeof UpdateOAuth2ClientResponseSchema;
+  },
+  /**
+   * Deletes an OAuth2 client.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.DeleteOAuth2Client
+   */
+  deleteOAuth2Client: {
+    methodKind: "unary";
+    input: typeof DeleteOAuth2ClientRequestSchema;
+    output: typeof DeleteOAuth2ClientResponseSchema;
+  },
+  /**
+   * Rotates an OAuth2 client's secret.
+   * Returns the new plaintext secret (only returned during rotation).
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.RotateOAuth2ClientSecret
+   */
+  rotateOAuth2ClientSecret: {
+    methodKind: "unary";
+    input: typeof RotateOAuth2ClientSecretRequestSchema;
+    output: typeof RotateOAuth2ClientSecretResponseSchema;
+  },
+  /**
+   * Disables an OAuth2 client (soft delete).
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.DisableOAuth2Client
+   */
+  disableOAuth2Client: {
+    methodKind: "unary";
+    input: typeof DisableOAuth2ClientRequestSchema;
+    output: typeof DisableOAuth2ClientResponseSchema;
+  },
+  /**
+   * Validates OAuth2 client credentials.
+   * Used for authenticating client_credentials grant requests.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2ClientService.ValidateClientCredentials
+   */
+  validateClientCredentials: {
+    methodKind: "unary";
+    input: typeof ValidateClientCredentialsRequestSchema;
+    output: typeof ValidateClientCredentialsResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_oauth2_client, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_key-OAuth2KeyService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_key-OAuth2KeyService_connectquery.ts
new file mode 100644
index 0000000000..addd077cb0
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_key-OAuth2KeyService_connectquery.ts
@@ -0,0 +1,60 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/oauth2_key.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { OAuth2KeyService } from "./oauth2_key_pb";
+
+/**
+ * Creates a new signing key.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.CreateOAuth2Key
+ */
+export const createOAuth2Key = OAuth2KeyService.method.createOAuth2Key;
+
+/**
+ * Gets a signing key by name.
+ * Note: Private key material is never returned.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.GetOAuth2Key
+ */
+export const getOAuth2Key = OAuth2KeyService.method.getOAuth2Key;
+
+/**
+ * Lists signing keys.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.ListOAuth2Keys
+ */
+export const listOAuth2Keys = OAuth2KeyService.method.listOAuth2Keys;
+
+/**
+ * Deactivates a signing key.
+ * The key will no longer be used for signing new tokens.
+ * Existing tokens signed with this key remain valid until expiry.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.DeactivateOAuth2Key
+ */
+export const deactivateOAuth2Key = OAuth2KeyService.method.deactivateOAuth2Key;
+
+/**
+ * Deletes a signing key.
+ * WARNING: This will invalidate all tokens signed with this key.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.DeleteOAuth2Key
+ */
+export const deleteOAuth2Key = OAuth2KeyService.method.deleteOAuth2Key;
+
+/**
+ * Rotates signing keys.
+ * Creates a new active key and optionally deactivates old keys.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.RotateOAuth2Keys
+ */
+export const rotateOAuth2Keys = OAuth2KeyService.method.rotateOAuth2Keys;
+
+/**
+ * Gets the JWKS (JSON Web Key Set) for token verification.
+ * This endpoint is public and returns only public keys.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.GetJWKS
+ */
+export const getJWKS = OAuth2KeyService.method.getJWKS;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_key_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_key_pb.ts
new file mode 100644
index 0000000000..fdd7039b86
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/oauth2_key_pb.ts
@@ -0,0 +1,610 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/oauth2_key.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/oauth2_key.proto.
+ */
+export const file_redpanda_api_aigateway_v1_oauth2_key: GenFile = /*@__PURE__*/
+  fileDesc("CipyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL29hdXRoMl9rZXkucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEiyQIKCU9BdXRoMktleRIRCgRuYW1lGAEgASgJQgPgQQgSRQoJYWxnb3JpdGhtGAIgASgOMi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5PQXV0aDJLZXlBbGdvcml0aG1CA+BBAhIXCgpwdWJsaWNfa2V5GAMgASgJQgPgQQMSDgoGYWN0aXZlGAQgASgIEjMKCmV4cGlyZXNfYXQYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQESNAoLY3JlYXRlX3RpbWUYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSFAoHY3JlYXRvchgHIAEoCUID4EEDOjjqQTUKIGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT0F1dGgyS2V5EhFvYXV0aDIva2V5cy97a2V5fSKpAQoWQ3JlYXRlT0F1dGgyS2V5UmVxdWVzdBITCgZrZXlfaWQYASABKAlCA+BBARJFCglhbGdvcml0aG0YAiABKA4yLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMktleUFsZ29yaXRobUID4EEBEjMKCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQEiTAoXQ3JlYXRlT0F1dGgyS2V5UmVzcG9uc2USMQoDa2V5GAEgASgLMiQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5PQXV0aDJLZXkiTQoTR2V0T0F1dGgyS2V5UmVxdWVzdBI2CgRuYW1lGAEgASgJQijgQQL6QSIKIGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT0F1dGgyS2V5IkkKFEdldE9BdXRoMktleVJlc3BvbnNlEjEKA2tleRgBIAEoCzIkLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT0F1dGgyS2V5ImsKFUxpc3RPQXV0aDJLZXlzUmVxdWVzdBIYCgthY3RpdmVfb25seRgBIAEoCEID4EEBEh8KCXBhZ2Vfc2l6ZRgCIAEoBUIM4EEBukgGGgQYZCgAEhcKCnBhZ2VfdG9rZW4YAyABKAlCA+BBASJ5ChZMaXN0T0F1dGgyS2V5c1Jlc3BvbnNlEjIKBGtleXMYASADKAsyJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMktleRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSJUChpEZWFjdGl2YXRlT0F1dGgyS2V5UmVxdWVzdBI2CgRuYW1lGAEgASgJQijgQQL6QSIKIGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT0F1dGgyS2V5IlAKG0RlYWN0aXZhdGVPQXV0aDJLZXlSZXNwb25zZRIxCgNrZXkYASABKAsyJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMktleSJQChZEZWxldGVPQXV0aDJLZXlSZXF1ZXN0EjYKBG5hbWUYASABKAlCKOBBAvpBIgogYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9PQXV0aDJLZXkiGQoXRGVsZXRlT0F1dGgyS2V5UmVzcG9uc2UirQEKF1JvdGF0ZU9BdXRoMktleXNSZXF1ZXN0EkUKCWFsZ29yaXRobRgBIAEoDjItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT0F1dGgyS2V5QWxnb3JpdGhtQgPgQQESIAoTZGVhY3RpdmF0ZV9leGlzdGluZxgCIAEoCEID4EEBEikKEmdyYWNlX3BlcmlvZF9ob3VycxgDIAEoBUIN4EEBukgHGgUYqAEoACKRAQoYUm90YXRlT0F1dGgyS2V5c1Jlc3BvbnNlEjUKB25ld19rZXkYASABKAsyJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9BdXRoMktleRI+ChBkZWFjdGl2YXRlZF9rZXlzGAIgAygLMiQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5PQXV0aDJLZXkiEAoOR2V0SldLU1JlcXVlc3QiRgoPR2V0SldLU1Jlc3BvbnNlEjMKBGtleXMYASADKAsyJS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkpTT05XZWJLZXkiVgoKSlNPTldlYktleRILCgNrdHkYASABKAkSCwoDdXNlGAIgASgJEgsKA2tpZBgDIAEoCRILCgNhbGcYBCABKAkSCQoBbhgFIAEoCRIJCgFlGAYgASgJKpoBChJPQXV0aDJLZXlBbGdvcml0aG0SJAogT0FVVEgyX0tFWV9BTEdPUklUSE1fVU5TUEVDSUZJRUQQABIeChpPQVVUSDJfS0VZX0FMR09SSVRITV9SUzI1NhABEh4KGk9BVVRIMl9LRVlfQUxHT1JJVEhNX1JTMzg0EAISHgoaT0FVVEgyX0tFWV9BTEdPUklUSE1fUlM1MTIQAzL+CAoQT0F1dGgyS2V5U2VydmljZRKUAQoPQ3JlYXRlT0F1dGgyS2V5EjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVPQXV0aDJLZXlSZXF1ZXN0GjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVPQXV0aDJLZXlSZXNwb25zZSIagtPkkwIUOgEqIg8vdjEvb2F1dGgyL2tleXMSkQEKDEdldE9BdXRoMktleRIuLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0T0F1dGgyS2V5UmVxdWVzdBovLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0T0F1dGgyS2V5UmVzcG9uc2UiIILT5JMCGhIYL3YxL3tuYW1lPW9hdXRoMi9rZXlzLyp9Eo4BCg5MaXN0T0F1dGgyS2V5cxIwLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdE9BdXRoMktleXNSZXF1ZXN0GjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0T0F1dGgyS2V5c1Jlc3BvbnNlIheC0+STAhESDy92MS9vYXV0aDIva2V5cxK0AQoTRGVhY3RpdmF0ZU9BdXRoMktleRI1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVhY3RpdmF0ZU9BdXRoMktleVJlcXVlc3QaNi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlYWN0aXZhdGVPQXV0aDJLZXlSZXNwb25zZSIugtPkkwIoOgEqIiMvdjEve25hbWU9b2F1dGgyL2tleXMvKn06ZGVhY3RpdmF0ZRKaAQoPRGVsZXRlT0F1dGgyS2V5EjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVPQXV0aDJLZXlSZXF1ZXN0GjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVPQXV0aDJLZXlSZXNwb25zZSIggtPkkwIaKhgvdjEve25hbWU9b2F1dGgyL2tleXMvKn0SngEKEFJvdGF0ZU9BdXRoMktleXMSMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJvdGF0ZU9BdXRoMktleXNSZXF1ZXN0GjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Sb3RhdGVPQXV0aDJLZXlzUmVzcG9uc2UiIYLT5JMCGzoBKiIWL3YxL29hdXRoMi9rZXlzOnJvdGF0ZRKdAQoHR2V0SldLUxIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0SldLU1JlcXVlc3QaKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldEpXS1NSZXNwb25zZSI7gtPkkwI1WhgSFi8ud2VsbC1rbm93bi9qd2tzLmpzb24SGS92MS8ud2VsbC1rbm93bi9qd2tzLmpzb24aGcpBFmFpZ2F0ZXdheS5yZWRwYW5kYS5jb21CgwIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQg5PYXV0aDJLZXlQcm90b1ABWktnby5wYW5kYS5kZXYvcmVkcGFuZGEtYWlndy9wcm90b3MvZ2VuL3JlZHBhbmRhL2FwaS9haWdhdGV3YXkvdjE7YWlnYXRld2F5djGiAgNSQUGqAhlSZWRwYW5kYS5BcGkuQWlnYXRld2F5LlYxygIZUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMeICJVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjFcR1BCTWV0YWRhdGHqAhxSZWRwYW5kYTo6QXBpOjpBaWdhdGV3YXk6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_timestamp]);
+
+/**
+ * OAuth2Key represents a JWKS signing key for OAuth2 tokens.
+ *
+ * @generated from message redpanda.api.aigateway.v1.OAuth2Key
+ */
+export type OAuth2Key = Message<"redpanda.api.aigateway.v1.OAuth2Key"> & {
+  /**
+   * Resource name. Format: `oauth2/keys/{key_id}`
+   * Key ID (kid) is a globally unique identifier (XID).
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Signing algorithm: RS256, RS384, RS512
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2KeyAlgorithm algorithm = 2;
+   */
+  algorithm: OAuth2KeyAlgorithm;
+
+  /**
+   * Output only. PEM-encoded RSA public key
+   *
+   * @generated from field: string public_key = 3;
+   */
+  publicKey: string;
+
+  /**
+   * Whether this key is active for signing new tokens
+   *
+   * @generated from field: bool active = 4;
+   */
+  active: boolean;
+
+  /**
+   * Optional: When this key should stop being used for signing
+   *
+   * @generated from field: google.protobuf.Timestamp expires_at = 5;
+   */
+  expiresAt?: Timestamp;
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 6;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Creator (API key or OIDC subject)
+   *
+   * @generated from field: string creator = 7;
+   */
+  creator: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.OAuth2Key.
+ * Use `create(OAuth2KeySchema)` to create a new message.
+ */
+export const OAuth2KeySchema: GenMessage<OAuth2Key> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 0);
+
+/**
+ * Request message for CreateOAuth2Key RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateOAuth2KeyRequest
+ */
+export type CreateOAuth2KeyRequest = Message<"redpanda.api.aigateway.v1.CreateOAuth2KeyRequest"> & {
+  /**
+   * The key ID to use. If empty, server generates one.
+   *
+   * @generated from field: string key_id = 1;
+   */
+  keyId: string;
+
+  /**
+   * Signing algorithm (default: RS256)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2KeyAlgorithm algorithm = 2;
+   */
+  algorithm: OAuth2KeyAlgorithm;
+
+  /**
+   * Optional: Expiration time for the key
+   *
+   * @generated from field: google.protobuf.Timestamp expires_at = 3;
+   */
+  expiresAt?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateOAuth2KeyRequest.
+ * Use `create(CreateOAuth2KeyRequestSchema)` to create a new message.
+ */
+export const CreateOAuth2KeyRequestSchema: GenMessage<CreateOAuth2KeyRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 1);
+
+/**
+ * Response message for CreateOAuth2Key RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateOAuth2KeyResponse
+ */
+export type CreateOAuth2KeyResponse = Message<"redpanda.api.aigateway.v1.CreateOAuth2KeyResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Key key = 1;
+   */
+  key?: OAuth2Key;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateOAuth2KeyResponse.
+ * Use `create(CreateOAuth2KeyResponseSchema)` to create a new message.
+ */
+export const CreateOAuth2KeyResponseSchema: GenMessage<CreateOAuth2KeyResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 2);
+
+/**
+ * Request message for GetOAuth2Key RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetOAuth2KeyRequest
+ */
+export type GetOAuth2KeyRequest = Message<"redpanda.api.aigateway.v1.GetOAuth2KeyRequest"> & {
+  /**
+   * Resource name of the key.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetOAuth2KeyRequest.
+ * Use `create(GetOAuth2KeyRequestSchema)` to create a new message.
+ */
+export const GetOAuth2KeyRequestSchema: GenMessage<GetOAuth2KeyRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 3);
+
+/**
+ * Response message for GetOAuth2Key RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetOAuth2KeyResponse
+ */
+export type GetOAuth2KeyResponse = Message<"redpanda.api.aigateway.v1.GetOAuth2KeyResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Key key = 1;
+   */
+  key?: OAuth2Key;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetOAuth2KeyResponse.
+ * Use `create(GetOAuth2KeyResponseSchema)` to create a new message.
+ */
+export const GetOAuth2KeyResponseSchema: GenMessage<GetOAuth2KeyResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 4);
+
+/**
+ * Request message for ListOAuth2Keys RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListOAuth2KeysRequest
+ */
+export type ListOAuth2KeysRequest = Message<"redpanda.api.aigateway.v1.ListOAuth2KeysRequest"> & {
+  /**
+   * Filter to only active keys
+   *
+   * @generated from field: bool active_only = 1;
+   */
+  activeOnly: boolean;
+
+  /**
+   * Maximum number of keys to return (max 100)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListOAuth2KeysRequest.
+ * Use `create(ListOAuth2KeysRequestSchema)` to create a new message.
+ */
+export const ListOAuth2KeysRequestSchema: GenMessage<ListOAuth2KeysRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 5);
+
+/**
+ * Response message for ListOAuth2Keys RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListOAuth2KeysResponse
+ */
+export type ListOAuth2KeysResponse = Message<"redpanda.api.aigateway.v1.ListOAuth2KeysResponse"> & {
+  /**
+   * The list of keys
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.OAuth2Key keys = 1;
+   */
+  keys: OAuth2Key[];
+
+  /**
+   * Token for next page
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListOAuth2KeysResponse.
+ * Use `create(ListOAuth2KeysResponseSchema)` to create a new message.
+ */
+export const ListOAuth2KeysResponseSchema: GenMessage<ListOAuth2KeysResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 6);
+
+/**
+ * Request message for DeactivateOAuth2Key RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeactivateOAuth2KeyRequest
+ */
+export type DeactivateOAuth2KeyRequest = Message<"redpanda.api.aigateway.v1.DeactivateOAuth2KeyRequest"> & {
+  /**
+   * Resource name of the key to deactivate.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeactivateOAuth2KeyRequest.
+ * Use `create(DeactivateOAuth2KeyRequestSchema)` to create a new message.
+ */
+export const DeactivateOAuth2KeyRequestSchema: GenMessage<DeactivateOAuth2KeyRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 7);
+
+/**
+ * Response message for DeactivateOAuth2Key RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeactivateOAuth2KeyResponse
+ */
+export type DeactivateOAuth2KeyResponse = Message<"redpanda.api.aigateway.v1.DeactivateOAuth2KeyResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Key key = 1;
+   */
+  key?: OAuth2Key;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeactivateOAuth2KeyResponse.
+ * Use `create(DeactivateOAuth2KeyResponseSchema)` to create a new message.
+ */
+export const DeactivateOAuth2KeyResponseSchema: GenMessage<DeactivateOAuth2KeyResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 8);
+
+/**
+ * Request message for DeleteOAuth2Key RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteOAuth2KeyRequest
+ */
+export type DeleteOAuth2KeyRequest = Message<"redpanda.api.aigateway.v1.DeleteOAuth2KeyRequest"> & {
+  /**
+   * Resource name of the key to delete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteOAuth2KeyRequest.
+ * Use `create(DeleteOAuth2KeyRequestSchema)` to create a new message.
+ */
+export const DeleteOAuth2KeyRequestSchema: GenMessage<DeleteOAuth2KeyRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 9);
+
+/**
+ * Response message for DeleteOAuth2Key RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteOAuth2KeyResponse
+ */
+export type DeleteOAuth2KeyResponse = Message<"redpanda.api.aigateway.v1.DeleteOAuth2KeyResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteOAuth2KeyResponse.
+ * Use `create(DeleteOAuth2KeyResponseSchema)` to create a new message.
+ */
+export const DeleteOAuth2KeyResponseSchema: GenMessage<DeleteOAuth2KeyResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 10);
+
+/**
+ * Request message for RotateOAuth2Keys RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RotateOAuth2KeysRequest
+ */
+export type RotateOAuth2KeysRequest = Message<"redpanda.api.aigateway.v1.RotateOAuth2KeysRequest"> & {
+  /**
+   * Signing algorithm for the new key (default: RS256)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2KeyAlgorithm algorithm = 1;
+   */
+  algorithm: OAuth2KeyAlgorithm;
+
+  /**
+   * Deactivate all existing active keys
+   *
+   * @generated from field: bool deactivate_existing = 2;
+   */
+  deactivateExisting: boolean;
+
+  /**
+   * Grace period in hours before deactivating old keys (default: 24)
+   * Old keys will be marked to expire after this period
+   *
+   * @generated from field: int32 grace_period_hours = 3;
+   */
+  gracePeriodHours: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RotateOAuth2KeysRequest.
+ * Use `create(RotateOAuth2KeysRequestSchema)` to create a new message.
+ */
+export const RotateOAuth2KeysRequestSchema: GenMessage<RotateOAuth2KeysRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 11);
+
+/**
+ * Response message for RotateOAuth2Keys RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RotateOAuth2KeysResponse
+ */
+export type RotateOAuth2KeysResponse = Message<"redpanda.api.aigateway.v1.RotateOAuth2KeysResponse"> & {
+  /**
+   * The newly created active key
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OAuth2Key new_key = 1;
+   */
+  newKey?: OAuth2Key;
+
+  /**
+   * Keys that were deactivated
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.OAuth2Key deactivated_keys = 2;
+   */
+  deactivatedKeys: OAuth2Key[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RotateOAuth2KeysResponse.
+ * Use `create(RotateOAuth2KeysResponseSchema)` to create a new message.
+ */
+export const RotateOAuth2KeysResponseSchema: GenMessage<RotateOAuth2KeysResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 12);
+
+/**
+ * Request message for GetJWKS RPC.
+ *
+ * Empty - JWKS is public
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetJWKSRequest
+ */
+export type GetJWKSRequest = Message<"redpanda.api.aigateway.v1.GetJWKSRequest"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetJWKSRequest.
+ * Use `create(GetJWKSRequestSchema)` to create a new message.
+ */
+export const GetJWKSRequestSchema: GenMessage<GetJWKSRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 13);
+
+/**
+ * Response message for GetJWKS RPC.
+ * Returns RFC 7517 compliant JWKS.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetJWKSResponse
+ */
+export type GetJWKSResponse = Message<"redpanda.api.aigateway.v1.GetJWKSResponse"> & {
+  /**
+   * JSON Web Key Set
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.JSONWebKey keys = 1;
+   */
+  keys: JSONWebKey[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetJWKSResponse.
+ * Use `create(GetJWKSResponseSchema)` to create a new message.
+ */
+export const GetJWKSResponseSchema: GenMessage<GetJWKSResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 14);
+
+/**
+ * JSONWebKey represents a single key in JWKS format (RFC 7517).
+ *
+ * @generated from message redpanda.api.aigateway.v1.JSONWebKey
+ */
+export type JSONWebKey = Message<"redpanda.api.aigateway.v1.JSONWebKey"> & {
+  /**
+   * Key type (always "RSA" for our keys)
+   *
+   * @generated from field: string kty = 1;
+   */
+  kty: string;
+
+  /**
+   * Public key use ("sig" for signature)
+   *
+   * @generated from field: string use = 2;
+   */
+  use: string;
+
+  /**
+   * Key ID
+   *
+   * @generated from field: string kid = 3;
+   */
+  kid: string;
+
+  /**
+   * Algorithm (RS256, RS384, RS512)
+   *
+   * @generated from field: string alg = 4;
+   */
+  alg: string;
+
+  /**
+   * RSA modulus (Base64url encoded)
+   *
+   * @generated from field: string n = 5;
+   */
+  n: string;
+
+  /**
+   * RSA exponent (Base64url encoded)
+   *
+   * @generated from field: string e = 6;
+   */
+  e: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.JSONWebKey.
+ * Use `create(JSONWebKeySchema)` to create a new message.
+ */
+export const JSONWebKeySchema: GenMessage<JSONWebKey> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_oauth2_key, 15);
+
+/**
+ * OAuth2KeyAlgorithm defines supported signing algorithms.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.OAuth2KeyAlgorithm
+ */
+export enum OAuth2KeyAlgorithm {
+  /**
+   * @generated from enum value: OAUTH2_KEY_ALGORITHM_UNSPECIFIED = 0;
+   */
+  OAUTH2_KEY_ALGORITHM_UNSPECIFIED = 0,
+
+  /**
+   * RSA PKCS#1 v1.5 with SHA-256
+   *
+   * @generated from enum value: OAUTH2_KEY_ALGORITHM_RS256 = 1;
+   */
+  OAUTH2_KEY_ALGORITHM_RS256 = 1,
+
+  /**
+   * RSA PKCS#1 v1.5 with SHA-384
+   *
+   * @generated from enum value: OAUTH2_KEY_ALGORITHM_RS384 = 2;
+   */
+  OAUTH2_KEY_ALGORITHM_RS384 = 2,
+
+  /**
+   * RSA PKCS#1 v1.5 with SHA-512
+   *
+   * @generated from enum value: OAUTH2_KEY_ALGORITHM_RS512 = 3;
+   */
+  OAUTH2_KEY_ALGORITHM_RS512 = 3,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.OAuth2KeyAlgorithm.
+ */
+export const OAuth2KeyAlgorithmSchema: GenEnum<OAuth2KeyAlgorithm> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_oauth2_key, 0);
+
+/**
+ * OAuth2KeyService manages JWKS signing keys for OAuth2 tokens.
+ * Keys are used to sign and verify JWT access tokens.
+ * Resource name: oauth2/keys/{key_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.OAuth2KeyService
+ */
+export const OAuth2KeyService: GenService<{
+  /**
+   * Creates a new signing key.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.CreateOAuth2Key
+   */
+  createOAuth2Key: {
+    methodKind: "unary";
+    input: typeof CreateOAuth2KeyRequestSchema;
+    output: typeof CreateOAuth2KeyResponseSchema;
+  },
+  /**
+   * Gets a signing key by name.
+   * Note: Private key material is never returned.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.GetOAuth2Key
+   */
+  getOAuth2Key: {
+    methodKind: "unary";
+    input: typeof GetOAuth2KeyRequestSchema;
+    output: typeof GetOAuth2KeyResponseSchema;
+  },
+  /**
+   * Lists signing keys.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.ListOAuth2Keys
+   */
+  listOAuth2Keys: {
+    methodKind: "unary";
+    input: typeof ListOAuth2KeysRequestSchema;
+    output: typeof ListOAuth2KeysResponseSchema;
+  },
+  /**
+   * Deactivates a signing key.
+   * The key will no longer be used for signing new tokens.
+   * Existing tokens signed with this key remain valid until expiry.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.DeactivateOAuth2Key
+   */
+  deactivateOAuth2Key: {
+    methodKind: "unary";
+    input: typeof DeactivateOAuth2KeyRequestSchema;
+    output: typeof DeactivateOAuth2KeyResponseSchema;
+  },
+  /**
+   * Deletes a signing key.
+   * WARNING: This will invalidate all tokens signed with this key.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.DeleteOAuth2Key
+   */
+  deleteOAuth2Key: {
+    methodKind: "unary";
+    input: typeof DeleteOAuth2KeyRequestSchema;
+    output: typeof DeleteOAuth2KeyResponseSchema;
+  },
+  /**
+   * Rotates signing keys.
+   * Creates a new active key and optionally deactivates old keys.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.RotateOAuth2Keys
+   */
+  rotateOAuth2Keys: {
+    methodKind: "unary";
+    input: typeof RotateOAuth2KeysRequestSchema;
+    output: typeof RotateOAuth2KeysResponseSchema;
+  },
+  /**
+   * Gets the JWKS (JSON Web Key Set) for token verification.
+   * This endpoint is public and returns only public keys.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OAuth2KeyService.GetJWKS
+   */
+  getJWKS: {
+    methodKind: "unary";
+    input: typeof GetJWKSRequestSchema;
+    output: typeof GetJWKSResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_oauth2_key, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/organization-OrganizationService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/organization-OrganizationService_connectquery.ts
new file mode 100644
index 0000000000..b56336e34d
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/organization-OrganizationService_connectquery.ts
@@ -0,0 +1,40 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/organization.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { OrganizationService } from "./organization_pb";
+
+/**
+ * Creates a new organization within an account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.CreateOrganization
+ */
+export const createOrganization = OrganizationService.method.createOrganization;
+
+/**
+ * Gets an organization by name.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.GetOrganization
+ */
+export const getOrganization = OrganizationService.method.getOrganization;
+
+/**
+ * Lists organizations within an account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.ListOrganizations
+ */
+export const listOrganizations = OrganizationService.method.listOrganizations;
+
+/**
+ * Updates an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.UpdateOrganization
+ */
+export const updateOrganization = OrganizationService.method.updateOrganization;
+
+/**
+ * Deletes an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.DeleteOrganization
+ */
+export const deleteOrganization = OrganizationService.method.deleteOrganization;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/organization_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/organization_pb.ts
new file mode 100644
index 0000000000..e88f6f1721
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/organization_pb.ts
@@ -0,0 +1,427 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/organization.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/organization.proto.
+ */
+export const file_redpanda_api_aigateway_v1_organization: GenFile = /*@__PURE__*/
+  fileDesc("CixyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL29yZ2FuaXphdGlvbi5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSLeAwoMT3JnYW5pemF0aW9uEhEKBG5hbWUYASABKAlCA+BBCBIjCgxkaXNwbGF5X25hbWUYAiABKAlCDeBBArpIB3IFEAEY/wESGAoLZGVzY3JpcHRpb24YAyABKAlCA+BBARIPCgdlbmFibGVkGAQgASgIEkcKCG1ldGFkYXRhGAUgAygLMjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Pcmdhbml6YXRpb24uTWV0YWRhdGFFbnRyeRI0CgtjcmVhdGVfdGltZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxI0Cgt1cGRhdGVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIUCgdjcmVhdG9yGAggASgJQgPgQQMSFAoHdXBkYXRlchgJIAEoCUID4EEDGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATpZ6kFWCiNhaWdhdGV3YXkucmVkcGFuZGEuY29tL09yZ2FuaXphdGlvbhIvYWNjb3VudHMve2FjY291bnR9L29yZ2FuaXphdGlvbnMve29yZ2FuaXphdGlvbn0irgEKGUNyZWF0ZU9yZ2FuaXphdGlvblJlcXVlc3QSNgoGcGFyZW50GAEgASgJQibgQQL6QSAKHmFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vQWNjb3VudBJCCgxvcmdhbml6YXRpb24YAyABKAsyJy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9yZ2FuaXphdGlvbkID4EECSgQIAhADUg9vcmdhbml6YXRpb25faWQiWwoaQ3JlYXRlT3JnYW5pemF0aW9uUmVzcG9uc2USPQoMb3JnYW5pemF0aW9uGAEgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Pcmdhbml6YXRpb24iUwoWR2V0T3JnYW5pemF0aW9uUmVxdWVzdBI5CgRuYW1lGAEgASgJQivgQQL6QSUKI2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT3JnYW5pemF0aW9uIlgKF0dldE9yZ2FuaXphdGlvblJlc3BvbnNlEj0KDG9yZ2FuaXphdGlvbhgBIAEoCzInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT3JnYW5pemF0aW9uIrkBChhMaXN0T3JnYW5pemF0aW9uc1JlcXVlc3QSNgoGcGFyZW50GAEgASgJQibgQQL6QSAKHmFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vQWNjb3VudBIgCglwYWdlX3NpemUYAiABKAVCDeBBAbpIBxoFGOgHKAASFwoKcGFnZV90b2tlbhgDIAEoCUID4EEBEhMKBmZpbHRlchgEIAEoCUID4EEBEhUKCG9yZGVyX2J5GAUgASgJQgPgQQEiiAEKGUxpc3RPcmdhbml6YXRpb25zUmVzcG9uc2USPgoNb3JnYW5pemF0aW9ucxgBIAMoCzInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT3JnYW5pemF0aW9uEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFIpUBChlVcGRhdGVPcmdhbml6YXRpb25SZXF1ZXN0EkIKDG9yZ2FuaXphdGlvbhgBIAEoCzInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT3JnYW5pemF0aW9uQgPgQQISNAoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQgPgQQEiWwoaVXBkYXRlT3JnYW5pemF0aW9uUmVzcG9uc2USPQoMb3JnYW5pemF0aW9uGAEgASgLMicucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Pcmdhbml6YXRpb24iagoZRGVsZXRlT3JnYW5pemF0aW9uUmVxdWVzdBI5CgRuYW1lGAEgASgJQivgQQL6QSUKI2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT3JnYW5pemF0aW9uEhIKBWZvcmNlGAIgASgIQgPgQQEiHAoaRGVsZXRlT3JnYW5pemF0aW9uUmVzcG9uc2UyzAcKE09yZ2FuaXphdGlvblNlcnZpY2USvgEKEkNyZWF0ZU9yZ2FuaXphdGlvbhI0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlT3JnYW5pemF0aW9uUmVxdWVzdBo1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlT3JnYW5pemF0aW9uUmVzcG9uc2UiO4LT5JMCNToMb3JnYW5pemF0aW9uIiUvdjEve3BhcmVudD1hY2NvdW50cy8qfS9vcmdhbml6YXRpb25zEqcBCg9HZXRPcmdhbml6YXRpb24SMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldE9yZ2FuaXphdGlvblJlcXVlc3QaMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldE9yZ2FuaXphdGlvblJlc3BvbnNlIi2C0+STAicSJS92MS97bmFtZT1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKn0SrQEKEUxpc3RPcmdhbml6YXRpb25zEjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0T3JnYW5pemF0aW9uc1JlcXVlc3QaNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RPcmdhbml6YXRpb25zUmVzcG9uc2UiLYLT5JMCJxIlL3YxL3twYXJlbnQ9YWNjb3VudHMvKn0vb3JnYW5pemF0aW9ucxLLAQoSVXBkYXRlT3JnYW5pemF0aW9uEjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVPcmdhbml6YXRpb25SZXF1ZXN0GjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVPcmdhbml6YXRpb25SZXNwb25zZSJIgtPkkwJCOgxvcmdhbml6YXRpb24yMi92MS97b3JnYW5pemF0aW9uLm5hbWU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyp9ErABChJEZWxldGVPcmdhbml6YXRpb24SNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZU9yZ2FuaXphdGlvblJlcXVlc3QaNS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZU9yZ2FuaXphdGlvblJlc3BvbnNlIi2C0+STAicqJS92MS97bmFtZT1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKn0aGcpBFmFpZ2F0ZXdheS5yZWRwYW5kYS5jb21ChgIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQhFPcmdhbml6YXRpb25Qcm90b1ABWktnby5wYW5kYS5kZXYvcmVkcGFuZGEtYWlndy9wcm90b3MvZ2VuL3JlZHBhbmRhL2FwaS9haWdhdGV3YXkvdjE7YWlnYXRld2F5djGiAgNSQUGqAhlSZWRwYW5kYS5BcGkuQWlnYXRld2F5LlYxygIZUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMeICJVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjFcR1BCTWV0YWRhdGHqAhxSZWRwYW5kYTo6QXBpOjpBaWdhdGV3YXk6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Organization represents a tenant boundary within an account.
+ * Organizations contain workspaces, teams, and users.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Organization
+ */
+export type Organization = Message<"redpanda.api.aigateway.v1.Organization"> & {
+  /**
+   * Resource name. Format: `accounts/{account}/organizations/{organization}`
+   * Organization ID is a globally unique, sortable identifier (XID).
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name (must be unique within account)
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Whether this organization is active
+   *
+   * @generated from field: bool enabled = 4;
+   */
+  enabled: boolean;
+
+  /**
+   * Metadata for arbitrary key-value pairs
+   *
+   * @generated from field: map<string, string> metadata = 5;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 6;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 7;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Creator (API key or OIDC subject)
+   *
+   * @generated from field: string creator = 8;
+   */
+  creator: string;
+
+  /**
+   * Output only. Last updater (API key or OIDC subject)
+   *
+   * @generated from field: string updater = 9;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Organization.
+ * Use `create(OrganizationSchema)` to create a new message.
+ */
+export const OrganizationSchema: GenMessage<Organization> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 0);
+
+/**
+ * Request message for CreateOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateOrganizationRequest
+ */
+export type CreateOrganizationRequest = Message<"redpanda.api.aigateway.v1.CreateOrganizationRequest"> & {
+  /**
+   * Required: Parent account.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Required: The organization resource to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Organization organization = 3;
+   */
+  organization?: Organization;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateOrganizationRequest.
+ * Use `create(CreateOrganizationRequestSchema)` to create a new message.
+ */
+export const CreateOrganizationRequestSchema: GenMessage<CreateOrganizationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 1);
+
+/**
+ * Response message for CreateOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateOrganizationResponse
+ */
+export type CreateOrganizationResponse = Message<"redpanda.api.aigateway.v1.CreateOrganizationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Organization organization = 1;
+   */
+  organization?: Organization;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateOrganizationResponse.
+ * Use `create(CreateOrganizationResponseSchema)` to create a new message.
+ */
+export const CreateOrganizationResponseSchema: GenMessage<CreateOrganizationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 2);
+
+/**
+ * Request message for GetOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetOrganizationRequest
+ */
+export type GetOrganizationRequest = Message<"redpanda.api.aigateway.v1.GetOrganizationRequest"> & {
+  /**
+   * Resource name of the organization.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetOrganizationRequest.
+ * Use `create(GetOrganizationRequestSchema)` to create a new message.
+ */
+export const GetOrganizationRequestSchema: GenMessage<GetOrganizationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 3);
+
+/**
+ * Response message for GetOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetOrganizationResponse
+ */
+export type GetOrganizationResponse = Message<"redpanda.api.aigateway.v1.GetOrganizationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Organization organization = 1;
+   */
+  organization?: Organization;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetOrganizationResponse.
+ * Use `create(GetOrganizationResponseSchema)` to create a new message.
+ */
+export const GetOrganizationResponseSchema: GenMessage<GetOrganizationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 4);
+
+/**
+ * Request message for ListOrganizations RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListOrganizationsRequest
+ */
+export type ListOrganizationsRequest = Message<"redpanda.api.aigateway.v1.ListOrganizationsRequest"> & {
+  /**
+   * Required: Parent account.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of organizations to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous ListOrganizations call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter expression (CEL syntax)
+   *
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * Comma-separated list of fields to order by
+   *
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListOrganizationsRequest.
+ * Use `create(ListOrganizationsRequestSchema)` to create a new message.
+ */
+export const ListOrganizationsRequestSchema: GenMessage<ListOrganizationsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 5);
+
+/**
+ * Response message for ListOrganizations RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListOrganizationsResponse
+ */
+export type ListOrganizationsResponse = Message<"redpanda.api.aigateway.v1.ListOrganizationsResponse"> & {
+  /**
+   * The list of organizations
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.Organization organizations = 1;
+   */
+  organizations: Organization[];
+
+  /**
+   * Token for next page (empty if no more pages)
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count of matching organizations
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListOrganizationsResponse.
+ * Use `create(ListOrganizationsResponseSchema)` to create a new message.
+ */
+export const ListOrganizationsResponseSchema: GenMessage<ListOrganizationsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 6);
+
+/**
+ * Request message for UpdateOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateOrganizationRequest
+ */
+export type UpdateOrganizationRequest = Message<"redpanda.api.aigateway.v1.UpdateOrganizationRequest"> & {
+  /**
+   * Required: The organization resource to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Organization organization = 1;
+   */
+  organization?: Organization;
+
+  /**
+   * The fields to update.
+   * Allowed fields: display_name, description, enabled, metadata
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateOrganizationRequest.
+ * Use `create(UpdateOrganizationRequestSchema)` to create a new message.
+ */
+export const UpdateOrganizationRequestSchema: GenMessage<UpdateOrganizationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 7);
+
+/**
+ * Response message for UpdateOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateOrganizationResponse
+ */
+export type UpdateOrganizationResponse = Message<"redpanda.api.aigateway.v1.UpdateOrganizationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Organization organization = 1;
+   */
+  organization?: Organization;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateOrganizationResponse.
+ * Use `create(UpdateOrganizationResponseSchema)` to create a new message.
+ */
+export const UpdateOrganizationResponseSchema: GenMessage<UpdateOrganizationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 8);
+
+/**
+ * Request message for DeleteOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteOrganizationRequest
+ */
+export type DeleteOrganizationRequest = Message<"redpanda.api.aigateway.v1.DeleteOrganizationRequest"> & {
+  /**
+   * Resource name of the organization to delete.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * If true, cascade delete all child resources (workspaces, teams, users, etc.)
+   *
+   * @generated from field: bool force = 2;
+   */
+  force: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteOrganizationRequest.
+ * Use `create(DeleteOrganizationRequestSchema)` to create a new message.
+ */
+export const DeleteOrganizationRequestSchema: GenMessage<DeleteOrganizationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 9);
+
+/**
+ * Response message for DeleteOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteOrganizationResponse
+ */
+export type DeleteOrganizationResponse = Message<"redpanda.api.aigateway.v1.DeleteOrganizationResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteOrganizationResponse.
+ * Use `create(DeleteOrganizationResponseSchema)` to create a new message.
+ */
+export const DeleteOrganizationResponseSchema: GenMessage<DeleteOrganizationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_organization, 10);
+
+/**
+ * OrganizationService manages organizations within accounts.
+ * An organization represents a tenant boundary (department, division) within an account.
+ * Resource name: accounts/{account_id}/organizations/{organization_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.OrganizationService
+ */
+export const OrganizationService: GenService<{
+  /**
+   * Creates a new organization within an account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.CreateOrganization
+   */
+  createOrganization: {
+    methodKind: "unary";
+    input: typeof CreateOrganizationRequestSchema;
+    output: typeof CreateOrganizationResponseSchema;
+  },
+  /**
+   * Gets an organization by name.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.GetOrganization
+   */
+  getOrganization: {
+    methodKind: "unary";
+    input: typeof GetOrganizationRequestSchema;
+    output: typeof GetOrganizationResponseSchema;
+  },
+  /**
+   * Lists organizations within an account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.ListOrganizations
+   */
+  listOrganizations: {
+    methodKind: "unary";
+    input: typeof ListOrganizationsRequestSchema;
+    output: typeof ListOrganizationsResponseSchema;
+  },
+  /**
+   * Updates an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.UpdateOrganization
+   */
+  updateOrganization: {
+    methodKind: "unary";
+    input: typeof UpdateOrganizationRequestSchema;
+    output: typeof UpdateOrganizationResponseSchema;
+  },
+  /**
+   * Deletes an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.OrganizationService.DeleteOrganization
+   */
+  deleteOrganization: {
+    methodKind: "unary";
+    input: typeof DeleteOrganizationRequestSchema;
+    output: typeof DeleteOrganizationResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_organization, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/pricing-ModelPricingService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/pricing-ModelPricingService_connectquery.ts
new file mode 100644
index 0000000000..658b320c31
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/pricing-ModelPricingService_connectquery.ts
@@ -0,0 +1,65 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/pricing.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { ModelPricingService } from "./pricing_pb";
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.CreateStandardPrice
+ */
+export const createStandardPrice = ModelPricingService.method.createStandardPrice;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.GetStandardPrice
+ */
+export const getStandardPrice = ModelPricingService.method.getStandardPrice;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.ListStandardPrices
+ */
+export const listStandardPrices = ModelPricingService.method.listStandardPrices;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.UpdateStandardPrice
+ */
+export const updateStandardPrice = ModelPricingService.method.updateStandardPrice;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.DeleteStandardPrice
+ */
+export const deleteStandardPrice = ModelPricingService.method.deleteStandardPrice;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.CreateCustomPrice
+ */
+export const createCustomPrice = ModelPricingService.method.createCustomPrice;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.GetCustomPrice
+ */
+export const getCustomPrice = ModelPricingService.method.getCustomPrice;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.ListCustomPrices
+ */
+export const listCustomPrices = ModelPricingService.method.listCustomPrices;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.UpdateCustomPrice
+ */
+export const updateCustomPrice = ModelPricingService.method.updateCustomPrice;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.DeleteCustomPrice
+ */
+export const deleteCustomPrice = ModelPricingService.method.deleteCustomPrice;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.GetEffectivePrice
+ */
+export const getEffectivePrice = ModelPricingService.method.getEffectivePrice;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.ListPriceHistory
+ */
+export const listPriceHistory = ModelPricingService.method.listPriceHistory;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/pricing_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/pricing_pb.ts
new file mode 100644
index 0000000000..895c39adb9
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/pricing_pb.ts
@@ -0,0 +1,1083 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/pricing.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/pricing.proto.
+ */
+export const file_redpanda_api_aigateway_v1_pricing: GenFile = /*@__PURE__*/
+  fileDesc("CidyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3ByaWNpbmcucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEiXwobQ3JlYXRlU3RhbmRhcmRQcmljZVJlc3BvbnNlEkAKDnN0YW5kYXJkX3ByaWNlGAEgASgLMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5TdGFuZGFyZFByaWNlIlwKGEdldFN0YW5kYXJkUHJpY2VSZXNwb25zZRJACg5zdGFuZGFyZF9wcmljZRgBIAEoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3RhbmRhcmRQcmljZSJfChtVcGRhdGVTdGFuZGFyZFByaWNlUmVzcG9uc2USQAoOc3RhbmRhcmRfcHJpY2UYASABKAsyKC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlN0YW5kYXJkUHJpY2UiHQobRGVsZXRlU3RhbmRhcmRQcmljZVJlc3BvbnNlIlkKGUNyZWF0ZUN1c3RvbVByaWNlUmVzcG9uc2USPAoMY3VzdG9tX3ByaWNlGAEgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DdXN0b21QcmljZSJWChZHZXRDdXN0b21QcmljZVJlc3BvbnNlEjwKDGN1c3RvbV9wcmljZRgBIAEoCzImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3VzdG9tUHJpY2UiWQoZVXBkYXRlQ3VzdG9tUHJpY2VSZXNwb25zZRI8CgxjdXN0b21fcHJpY2UYASABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkN1c3RvbVByaWNlIhsKGURlbGV0ZUN1c3RvbVByaWNlUmVzcG9uc2UiXwoZR2V0RWZmZWN0aXZlUHJpY2VSZXNwb25zZRJCCg9lZmZlY3RpdmVfcHJpY2UYASABKAsyKS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkVmZmVjdGl2ZVByaWNlIu0GCg1TdGFuZGFyZFByaWNlEhEKBG5hbWUYASABKAlCA+BBCBIZCgxkaXNwbGF5X25hbWUYAiABKAlCA+BBAhIVCghwcm92aWRlchgDIAEoCUID4EECEhUKCG1vZGVsX2lkGAQgASgJQgPgQQISFQoIbW9kYWxpdHkYBSABKAlCA+BBAhIrCiNpbnB1dF90b2tlbl9wcmljZV9jZW50c19wZXJfbWlsbGlvbhgGIAEoAxIsCiRvdXRwdXRfdG9rZW5fcHJpY2VfY2VudHNfcGVyX21pbGxpb24YByABKAMSMQopY2FjaGVkX2lucHV0X3JlYWRfcHJpY2VfY2VudHNfcGVyX21pbGxpb24YCCABKAMSMgoqY2FjaGVkX2lucHV0X3dyaXRlX3ByaWNlX2NlbnRzX3Blcl9taWxsaW9uGAkgASgDEhEKCXVuaXRfdHlwZRgKIAEoCRIYChB1bml0X3ByaWNlX2NlbnRzGAsgASgDEhYKDmNvbnRleHRfd2luZG93GAwgASgFEhMKC2Rlc2NyaXB0aW9uGA0gASgJEjcKDmVmZmVjdGl2ZV9mcm9tGA4gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EECEjAKDGVmZmVjdGl2ZV90bxgPIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASSAoIbWV0YWRhdGEYECADKAsyNi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlN0YW5kYXJkUHJpY2UuTWV0YWRhdGFFbnRyeRI0CgtjcmVhdGVfdGltZRgRIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxI0Cgt1cGRhdGVfdGltZRgSIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIUCgdjcmVhdG9yGBMgASgJQgPgQQMSFAoHdXBkYXRlchgUIAEoCUID4EEDGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATpP6kFMCiRhaWdhdGV3YXkucmVkcGFuZGEuY29tL1N0YW5kYXJkUHJpY2USJHByaWNpbmcvc3RhbmRhcmQve3N0YW5kYXJkX3ByaWNlX2lkfSLsBgoLQ3VzdG9tUHJpY2USEQoEbmFtZRgBIAEoCUID4EEIEhkKDGRpc3BsYXlfbmFtZRgCIAEoCUID4EECEhgKC2N1c3RvbWVyX2lkGAMgASgJQgPgQQISFQoIcHJvdmlkZXIYBCABKAlCA+BBAhIVCghtb2RlbF9pZBgFIAEoCUID4EECEhUKCG1vZGFsaXR5GAYgASgJQgPgQQISKwojaW5wdXRfdG9rZW5fcHJpY2VfY2VudHNfcGVyX21pbGxpb24YByABKAMSLAokb3V0cHV0X3Rva2VuX3ByaWNlX2NlbnRzX3Blcl9taWxsaW9uGAggASgDEjEKKWNhY2hlZF9pbnB1dF9yZWFkX3ByaWNlX2NlbnRzX3Blcl9taWxsaW9uGAkgASgDEjIKKmNhY2hlZF9pbnB1dF93cml0ZV9wcmljZV9jZW50c19wZXJfbWlsbGlvbhgKIAEoAxIRCgl1bml0X3R5cGUYCyABKAkSGAoQdW5pdF9wcmljZV9jZW50cxgMIAEoAxI3Cg5lZmZlY3RpdmVfZnJvbRgNIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAhIwCgxlZmZlY3RpdmVfdG8YDiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhoKEmNvbnRyYWN0X3JlZmVyZW5jZRgPIAEoCRJGCghtZXRhZGF0YRgQIAMoCzI0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3VzdG9tUHJpY2UuTWV0YWRhdGFFbnRyeRI0CgtjcmVhdGVfdGltZRgRIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxI0Cgt1cGRhdGVfdGltZRgSIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIUCgdjcmVhdG9yGBMgASgJQgPgQQMSFAoHdXBkYXRlchgUIAEoCUID4EEDGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATpJ6kFGCiJhaWdhdGV3YXkucmVkcGFuZGEuY29tL0N1c3RvbVByaWNlEiBwcmljaW5nL2N1c3RvbS97Y3VzdG9tX3ByaWNlX2lkfSK6AwoORWZmZWN0aXZlUHJpY2USEAoIcHJvdmlkZXIYASABKAkSEAoIbW9kZWxfaWQYAiABKAkSEAoIbW9kYWxpdHkYAyABKAkSKwojaW5wdXRfdG9rZW5fcHJpY2VfY2VudHNfcGVyX21pbGxpb24YBCABKAMSLAokb3V0cHV0X3Rva2VuX3ByaWNlX2NlbnRzX3Blcl9taWxsaW9uGAUgASgDEjEKKWNhY2hlZF9pbnB1dF9yZWFkX3ByaWNlX2NlbnRzX3Blcl9taWxsaW9uGAYgASgDEjIKKmNhY2hlZF9pbnB1dF93cml0ZV9wcmljZV9jZW50c19wZXJfbWlsbGlvbhgHIAEoAxIRCgl1bml0X3R5cGUYCCABKAkSGAoQdW5pdF9wcmljZV9jZW50cxgJIAEoAxI2CgZzb3VyY2UYCiABKA4yJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlByaWNlU291cmNlEhkKEXByaWNlX3JlY29yZF9uYW1lGAsgASgJEjAKDGVmZmVjdGl2ZV9hdBgMIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAifgoaQ3JlYXRlU3RhbmRhcmRQcmljZVJlcXVlc3QSGQoRc3RhbmRhcmRfcHJpY2VfaWQYASABKAkSRQoOc3RhbmRhcmRfcHJpY2UYAiABKAsyKC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlN0YW5kYXJkUHJpY2VCA+BBAiJVChdHZXRTdGFuZGFyZFByaWNlUmVxdWVzdBI6CgRuYW1lGAEgASgJQizgQQL6QSYKJGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vU3RhbmRhcmRQcmljZSJkChlMaXN0U3RhbmRhcmRQcmljZXNSZXF1ZXN0EhEKCXBhZ2Vfc2l6ZRgBIAEoBRISCgpwYWdlX3Rva2VuGAIgASgJEg4KBmZpbHRlchgDIAEoCRIQCghvcmRlcl9ieRgEIAEoCSKMAQoaTGlzdFN0YW5kYXJkUHJpY2VzUmVzcG9uc2USQQoPc3RhbmRhcmRfcHJpY2VzGAEgAygLMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5TdGFuZGFyZFByaWNlEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFIpQBChpVcGRhdGVTdGFuZGFyZFByaWNlUmVxdWVzdBJFCg5zdGFuZGFyZF9wcmljZRgBIAEoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3RhbmRhcmRQcmljZUID4EECEi8KC3VwZGF0ZV9tYXNrGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLkZpZWxkTWFzayJYChpEZWxldGVTdGFuZGFyZFByaWNlUmVxdWVzdBI6CgRuYW1lGAEgASgJQizgQQL6QSYKJGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vU3RhbmRhcmRQcmljZSJ2ChhDcmVhdGVDdXN0b21QcmljZVJlcXVlc3QSFwoPY3VzdG9tX3ByaWNlX2lkGAEgASgJEkEKDGN1c3RvbV9wcmljZRgCIAEoCzImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3VzdG9tUHJpY2VCA+BBAiJRChVHZXRDdXN0b21QcmljZVJlcXVlc3QSOAoEbmFtZRgBIAEoCUIq4EEC+kEkCiJhaWdhdGV3YXkucmVkcGFuZGEuY29tL0N1c3RvbVByaWNlImIKF0xpc3RDdXN0b21QcmljZXNSZXF1ZXN0EhEKCXBhZ2Vfc2l6ZRgBIAEoBRISCgpwYWdlX3Rva2VuGAIgASgJEg4KBmZpbHRlchgDIAEoCRIQCghvcmRlcl9ieRgEIAEoCSKGAQoYTGlzdEN1c3RvbVByaWNlc1Jlc3BvbnNlEj0KDWN1c3RvbV9wcmljZXMYASADKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkN1c3RvbVByaWNlEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFIo4BChhVcGRhdGVDdXN0b21QcmljZVJlcXVlc3QSQQoMY3VzdG9tX3ByaWNlGAEgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DdXN0b21QcmljZUID4EECEi8KC3VwZGF0ZV9tYXNrGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLkZpZWxkTWFzayJUChhEZWxldGVDdXN0b21QcmljZVJlcXVlc3QSOAoEbmFtZRgBIAEoCUIq4EEC+kEkCiJhaWdhdGV3YXkucmVkcGFuZGEuY29tL0N1c3RvbVByaWNlIqYBChhHZXRFZmZlY3RpdmVQcmljZVJlcXVlc3QSFQoIcHJvdmlkZXIYASABKAlCA+BBAhIVCghtb2RlbF9pZBgCIAEoCUID4EECEhUKCG1vZGFsaXR5GAMgASgJQgPgQQISEwoLY3VzdG9tZXJfaWQYBCABKAkSMAoMZWZmZWN0aXZlX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCJnChdMaXN0UHJpY2VIaXN0b3J5UmVxdWVzdBITCgZwYXJlbnQYASABKAlCA+BBAhIRCglwYWdlX3NpemUYAiABKAUSEgoKcGFnZV90b2tlbhgDIAEoCRIQCghvcmRlcl9ieRgEIAEoCSLJAQoYTGlzdFByaWNlSGlzdG9yeVJlc3BvbnNlEkEKD3N0YW5kYXJkX3ByaWNlcxgBIAMoCzIoLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3RhbmRhcmRQcmljZRI9Cg1jdXN0b21fcHJpY2VzGAIgAygLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DdXN0b21QcmljZRIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAkSEgoKdG90YWxfc2l6ZRgEIAEoBSp5CgtQcmljZVNvdXJjZRIcChhQUklDRV9TT1VSQ0VfVU5TUEVDSUZJRUQQABIZChVQUklDRV9TT1VSQ0VfU1RBTkRBUkQQARIXChNQUklDRV9TT1VSQ0VfQ1VTVE9NEAISGAoUUFJJQ0VfU09VUkNFX0RFRkFVTFQQAzLTEAoTTW9kZWxQcmljaW5nU2VydmljZRKyAQoTQ3JlYXRlU3RhbmRhcmRQcmljZRI1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlU3RhbmRhcmRQcmljZVJlcXVlc3QaNi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNyZWF0ZVN0YW5kYXJkUHJpY2VSZXNwb25zZSIsgtPkkwImOg5zdGFuZGFyZF9wcmljZSIUL3YxL3ByaWNpbmcvc3RhbmRhcmQSogEKEEdldFN0YW5kYXJkUHJpY2USMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldFN0YW5kYXJkUHJpY2VSZXF1ZXN0GjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRTdGFuZGFyZFByaWNlUmVzcG9uc2UiJYLT5JMCHxIdL3YxL3tuYW1lPXByaWNpbmcvc3RhbmRhcmQvKn0SnwEKEkxpc3RTdGFuZGFyZFByaWNlcxI0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFN0YW5kYXJkUHJpY2VzUmVxdWVzdBo1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFN0YW5kYXJkUHJpY2VzUmVzcG9uc2UiHILT5JMCFhIUL3YxL3ByaWNpbmcvc3RhbmRhcmQSygEKE1VwZGF0ZVN0YW5kYXJkUHJpY2USNS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZVN0YW5kYXJkUHJpY2VSZXF1ZXN0GjYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVTdGFuZGFyZFByaWNlUmVzcG9uc2UiRILT5JMCPjoOc3RhbmRhcmRfcHJpY2UyLC92MS97c3RhbmRhcmRfcHJpY2UubmFtZT1wcmljaW5nL3N0YW5kYXJkLyp9EqsBChNEZWxldGVTdGFuZGFyZFByaWNlEjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVTdGFuZGFyZFByaWNlUmVxdWVzdBo2LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlU3RhbmRhcmRQcmljZVJlc3BvbnNlIiWC0+STAh8qHS92MS97bmFtZT1wcmljaW5nL3N0YW5kYXJkLyp9EqgBChFDcmVhdGVDdXN0b21QcmljZRIzLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlQ3VzdG9tUHJpY2VSZXF1ZXN0GjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVDdXN0b21QcmljZVJlc3BvbnNlIiiC0+STAiI6DGN1c3RvbV9wcmljZSISL3YxL3ByaWNpbmcvY3VzdG9tEpoBCg5HZXRDdXN0b21QcmljZRIwLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0Q3VzdG9tUHJpY2VSZXF1ZXN0GjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRDdXN0b21QcmljZVJlc3BvbnNlIiOC0+STAh0SGy92MS97bmFtZT1wcmljaW5nL2N1c3RvbS8qfRKXAQoQTGlzdEN1c3RvbVByaWNlcxIyLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdEN1c3RvbVByaWNlc1JlcXVlc3QaMy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RDdXN0b21QcmljZXNSZXNwb25zZSIagtPkkwIUEhIvdjEvcHJpY2luZy9jdXN0b20SvgEKEVVwZGF0ZUN1c3RvbVByaWNlEjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVDdXN0b21QcmljZVJlcXVlc3QaNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZUN1c3RvbVByaWNlUmVzcG9uc2UiPoLT5JMCODoMY3VzdG9tX3ByaWNlMigvdjEve2N1c3RvbV9wcmljZS5uYW1lPXByaWNpbmcvY3VzdG9tLyp9EqMBChFEZWxldGVDdXN0b21QcmljZRIzLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlQ3VzdG9tUHJpY2VSZXF1ZXN0GjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVDdXN0b21QcmljZVJlc3BvbnNlIiOC0+STAh0qGy92MS97bmFtZT1wcmljaW5nL2N1c3RvbS8qfRKjAQoRR2V0RWZmZWN0aXZlUHJpY2USMy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldEVmZmVjdGl2ZVByaWNlUmVxdWVzdBo0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0RWZmZWN0aXZlUHJpY2VSZXNwb25zZSIjgtPkkwIdOgEqIhgvdjEvcHJpY2luZzpnZXRFZmZlY3RpdmUS1QEKEExpc3RQcmljZUhpc3RvcnkSMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RQcmljZUhpc3RvcnlSZXF1ZXN0GjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0UHJpY2VIaXN0b3J5UmVzcG9uc2UiWILT5JMCUlonEiUvdjEve3BhcmVudD1wcmljaW5nL2N1c3RvbS8qfS9oaXN0b3J5EicvdjEve3BhcmVudD1wcmljaW5nL3N0YW5kYXJkLyp9L2hpc3RvcnlCgQIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQgxQcmljaW5nUHJvdG9QAVpLZ28ucGFuZGEuZGV2L3JlZHBhbmRhLWFpZ3cvcHJvdG9zL2dlbi9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxO2FpZ2F0ZXdheXYxogIDUkFBqgIZUmVkcGFuZGEuQXBpLkFpZ2F0ZXdheS5WMcoCGVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjHiAiVSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYxXEdQQk1ldGFkYXRh6gIcUmVkcGFuZGE6OkFwaTo6QWlnYXRld2F5OjpWMWIGcHJvdG8z", [file_google_api_annotations, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Response message for CreateStandardPrice RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateStandardPriceResponse
+ */
+export type CreateStandardPriceResponse = Message<"redpanda.api.aigateway.v1.CreateStandardPriceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.StandardPrice standard_price = 1;
+   */
+  standardPrice?: StandardPrice;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateStandardPriceResponse.
+ * Use `create(CreateStandardPriceResponseSchema)` to create a new message.
+ */
+export const CreateStandardPriceResponseSchema: GenMessage<CreateStandardPriceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 0);
+
+/**
+ * Response message for GetStandardPrice RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetStandardPriceResponse
+ */
+export type GetStandardPriceResponse = Message<"redpanda.api.aigateway.v1.GetStandardPriceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.StandardPrice standard_price = 1;
+   */
+  standardPrice?: StandardPrice;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetStandardPriceResponse.
+ * Use `create(GetStandardPriceResponseSchema)` to create a new message.
+ */
+export const GetStandardPriceResponseSchema: GenMessage<GetStandardPriceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 1);
+
+/**
+ * Response message for UpdateStandardPrice RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateStandardPriceResponse
+ */
+export type UpdateStandardPriceResponse = Message<"redpanda.api.aigateway.v1.UpdateStandardPriceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.StandardPrice standard_price = 1;
+   */
+  standardPrice?: StandardPrice;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateStandardPriceResponse.
+ * Use `create(UpdateStandardPriceResponseSchema)` to create a new message.
+ */
+export const UpdateStandardPriceResponseSchema: GenMessage<UpdateStandardPriceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 2);
+
+/**
+ * Response message for DeleteStandardPrice RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteStandardPriceResponse
+ */
+export type DeleteStandardPriceResponse = Message<"redpanda.api.aigateway.v1.DeleteStandardPriceResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteStandardPriceResponse.
+ * Use `create(DeleteStandardPriceResponseSchema)` to create a new message.
+ */
+export const DeleteStandardPriceResponseSchema: GenMessage<DeleteStandardPriceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 3);
+
+/**
+ * Response message for CreateCustomPrice RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateCustomPriceResponse
+ */
+export type CreateCustomPriceResponse = Message<"redpanda.api.aigateway.v1.CreateCustomPriceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.CustomPrice custom_price = 1;
+   */
+  customPrice?: CustomPrice;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateCustomPriceResponse.
+ * Use `create(CreateCustomPriceResponseSchema)` to create a new message.
+ */
+export const CreateCustomPriceResponseSchema: GenMessage<CreateCustomPriceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 4);
+
+/**
+ * Response message for GetCustomPrice RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetCustomPriceResponse
+ */
+export type GetCustomPriceResponse = Message<"redpanda.api.aigateway.v1.GetCustomPriceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.CustomPrice custom_price = 1;
+   */
+  customPrice?: CustomPrice;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetCustomPriceResponse.
+ * Use `create(GetCustomPriceResponseSchema)` to create a new message.
+ */
+export const GetCustomPriceResponseSchema: GenMessage<GetCustomPriceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 5);
+
+/**
+ * Response message for UpdateCustomPrice RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateCustomPriceResponse
+ */
+export type UpdateCustomPriceResponse = Message<"redpanda.api.aigateway.v1.UpdateCustomPriceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.CustomPrice custom_price = 1;
+   */
+  customPrice?: CustomPrice;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateCustomPriceResponse.
+ * Use `create(UpdateCustomPriceResponseSchema)` to create a new message.
+ */
+export const UpdateCustomPriceResponseSchema: GenMessage<UpdateCustomPriceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 6);
+
+/**
+ * Response message for DeleteCustomPrice RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteCustomPriceResponse
+ */
+export type DeleteCustomPriceResponse = Message<"redpanda.api.aigateway.v1.DeleteCustomPriceResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteCustomPriceResponse.
+ * Use `create(DeleteCustomPriceResponseSchema)` to create a new message.
+ */
+export const DeleteCustomPriceResponseSchema: GenMessage<DeleteCustomPriceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 7);
+
+/**
+ * Response message for GetEffectivePrice RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetEffectivePriceResponse
+ */
+export type GetEffectivePriceResponse = Message<"redpanda.api.aigateway.v1.GetEffectivePriceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.EffectivePrice effective_price = 1;
+   */
+  effectivePrice?: EffectivePrice;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetEffectivePriceResponse.
+ * Use `create(GetEffectivePriceResponseSchema)` to create a new message.
+ */
+export const GetEffectivePriceResponseSchema: GenMessage<GetEffectivePriceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 8);
+
+/**
+ * StandardPrice represents public/default pricing for a model.
+ * Supports multiple pricing dimensions: token-based (chat, embeddings) and unit-based (images, audio).
+ *
+ * @generated from message redpanda.api.aigateway.v1.StandardPrice
+ */
+export type StandardPrice = Message<"redpanda.api.aigateway.v1.StandardPrice"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Model identification
+   *
+   * e.g., "openai", "anthropic"
+   *
+   * @generated from field: string provider = 3;
+   */
+  provider: string;
+
+  /**
+   * e.g., "gpt-4o", "claude-3-5-haiku-20241022"
+   *
+   * @generated from field: string model_id = 4;
+   */
+  modelId: string;
+
+  /**
+   * API type - determines which pricing dimensions apply
+   *
+   * "chat", "batch", "embedding", "image", "audio"
+   *
+   * @generated from field: string modality = 5;
+   */
+  modality: string;
+
+  /**
+   * TOKEN-BASED PRICING (for chat, batch, embeddings)
+   * Standard tokens (always present for token-based APIs)
+   *
+   * @generated from field: int64 input_token_price_cents_per_million = 6;
+   */
+  inputTokenPriceCentsPerMillion: bigint;
+
+  /**
+   * @generated from field: int64 output_token_price_cents_per_million = 7;
+   */
+  outputTokenPriceCentsPerMillion: bigint;
+
+  /**
+   * Cached tokens (Anthropic prompt caching)
+   * - cached_input_read: 90% discount for cache hits
+   * - cached_input_write: 25% markup for cache creation
+   *
+   * @generated from field: int64 cached_input_read_price_cents_per_million = 8;
+   */
+  cachedInputReadPriceCentsPerMillion: bigint;
+
+  /**
+   * @generated from field: int64 cached_input_write_price_cents_per_million = 9;
+   */
+  cachedInputWritePriceCentsPerMillion: bigint;
+
+  /**
+   * UNIT-BASED PRICING (for images, audio, etc.)
+   * Used when pricing is not per-token (e.g., flat fee per image)
+   *
+   * "image", "audio_second", "character", null for tokens
+   *
+   * @generated from field: string unit_type = 10;
+   */
+  unitType: string;
+
+  /**
+   * Flat fee per unit
+   *
+   * @generated from field: int64 unit_price_cents = 11;
+   */
+  unitPriceCents: bigint;
+
+  /**
+   * Optional: Context window size for reference
+   *
+   * @generated from field: int32 context_window = 12;
+   */
+  contextWindow: number;
+
+  /**
+   * Optional: Model description
+   *
+   * @generated from field: string description = 13;
+   */
+  description: string;
+
+  /**
+   * Versioning: Effective date range
+   *
+   * @generated from field: google.protobuf.Timestamp effective_from = 14;
+   */
+  effectiveFrom?: Timestamp;
+
+  /**
+   * NULL = currently active
+   *
+   * @generated from field: google.protobuf.Timestamp effective_to = 15;
+   */
+  effectiveTo?: Timestamp;
+
+  /**
+   * Metadata
+   *
+   * @generated from field: map<string, string> metadata = 16;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Audit fields
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 17;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp update_time = 18;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * @generated from field: string creator = 19;
+   */
+  creator: string;
+
+  /**
+   * @generated from field: string updater = 20;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.StandardPrice.
+ * Use `create(StandardPriceSchema)` to create a new message.
+ */
+export const StandardPriceSchema: GenMessage<StandardPrice> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 9);
+
+/**
+ * CustomPrice represents customer-specific pricing overrides.
+ * Allows negotiated pricing per organization/tenant with same dimensions as StandardPrice.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CustomPrice
+ */
+export type CustomPrice = Message<"redpanda.api.aigateway.v1.CustomPrice"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Customer identifier (e.g., org_id, tenant_id from OIDC claims)
+   *
+   * @generated from field: string customer_id = 3;
+   */
+  customerId: string;
+
+  /**
+   * Model identification
+   *
+   * @generated from field: string provider = 4;
+   */
+  provider: string;
+
+  /**
+   * @generated from field: string model_id = 5;
+   */
+  modelId: string;
+
+  /**
+   * @generated from field: string modality = 6;
+   */
+  modality: string;
+
+  /**
+   * TOKEN-BASED PRICING
+   *
+   * @generated from field: int64 input_token_price_cents_per_million = 7;
+   */
+  inputTokenPriceCentsPerMillion: bigint;
+
+  /**
+   * @generated from field: int64 output_token_price_cents_per_million = 8;
+   */
+  outputTokenPriceCentsPerMillion: bigint;
+
+  /**
+   * @generated from field: int64 cached_input_read_price_cents_per_million = 9;
+   */
+  cachedInputReadPriceCentsPerMillion: bigint;
+
+  /**
+   * @generated from field: int64 cached_input_write_price_cents_per_million = 10;
+   */
+  cachedInputWritePriceCentsPerMillion: bigint;
+
+  /**
+   * UNIT-BASED PRICING
+   *
+   * @generated from field: string unit_type = 11;
+   */
+  unitType: string;
+
+  /**
+   * @generated from field: int64 unit_price_cents = 12;
+   */
+  unitPriceCents: bigint;
+
+  /**
+   * Versioning: Effective date range
+   *
+   * @generated from field: google.protobuf.Timestamp effective_from = 13;
+   */
+  effectiveFrom?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp effective_to = 14;
+   */
+  effectiveTo?: Timestamp;
+
+  /**
+   * Optional: Contract/agreement reference
+   *
+   * @generated from field: string contract_reference = 15;
+   */
+  contractReference: string;
+
+  /**
+   * Metadata
+   *
+   * @generated from field: map<string, string> metadata = 16;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Audit fields
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 17;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp update_time = 18;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * @generated from field: string creator = 19;
+   */
+  creator: string;
+
+  /**
+   * @generated from field: string updater = 20;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CustomPrice.
+ * Use `create(CustomPriceSchema)` to create a new message.
+ */
+export const CustomPriceSchema: GenMessage<CustomPrice> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 10);
+
+/**
+ * EffectivePrice is the resolved price for a specific request.
+ * Returns the applicable pricing based on priority: Custom > Standard > Default.
+ *
+ * @generated from message redpanda.api.aigateway.v1.EffectivePrice
+ */
+export type EffectivePrice = Message<"redpanda.api.aigateway.v1.EffectivePrice"> & {
+  /**
+   * @generated from field: string provider = 1;
+   */
+  provider: string;
+
+  /**
+   * @generated from field: string model_id = 2;
+   */
+  modelId: string;
+
+  /**
+   * @generated from field: string modality = 3;
+   */
+  modality: string;
+
+  /**
+   * TOKEN-BASED PRICING
+   *
+   * @generated from field: int64 input_token_price_cents_per_million = 4;
+   */
+  inputTokenPriceCentsPerMillion: bigint;
+
+  /**
+   * @generated from field: int64 output_token_price_cents_per_million = 5;
+   */
+  outputTokenPriceCentsPerMillion: bigint;
+
+  /**
+   * @generated from field: int64 cached_input_read_price_cents_per_million = 6;
+   */
+  cachedInputReadPriceCentsPerMillion: bigint;
+
+  /**
+   * @generated from field: int64 cached_input_write_price_cents_per_million = 7;
+   */
+  cachedInputWritePriceCentsPerMillion: bigint;
+
+  /**
+   * UNIT-BASED PRICING
+   *
+   * @generated from field: string unit_type = 8;
+   */
+  unitType: string;
+
+  /**
+   * @generated from field: int64 unit_price_cents = 9;
+   */
+  unitPriceCents: bigint;
+
+  /**
+   * Which price was used
+   *
+   * @generated from field: redpanda.api.aigateway.v1.PriceSource source = 10;
+   */
+  source: PriceSource;
+
+  /**
+   * Reference to the pricing record used
+   *
+   * @generated from field: string price_record_name = 11;
+   */
+  priceRecordName: string;
+
+  /**
+   * Timestamp used for price lookup
+   *
+   * @generated from field: google.protobuf.Timestamp effective_at = 12;
+   */
+  effectiveAt?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EffectivePrice.
+ * Use `create(EffectivePriceSchema)` to create a new message.
+ */
+export const EffectivePriceSchema: GenMessage<EffectivePrice> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 11);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateStandardPriceRequest
+ */
+export type CreateStandardPriceRequest = Message<"redpanda.api.aigateway.v1.CreateStandardPriceRequest"> & {
+  /**
+   * @generated from field: string standard_price_id = 1;
+   */
+  standardPriceId: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.StandardPrice standard_price = 2;
+   */
+  standardPrice?: StandardPrice;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateStandardPriceRequest.
+ * Use `create(CreateStandardPriceRequestSchema)` to create a new message.
+ */
+export const CreateStandardPriceRequestSchema: GenMessage<CreateStandardPriceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 12);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetStandardPriceRequest
+ */
+export type GetStandardPriceRequest = Message<"redpanda.api.aigateway.v1.GetStandardPriceRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetStandardPriceRequest.
+ * Use `create(GetStandardPriceRequestSchema)` to create a new message.
+ */
+export const GetStandardPriceRequestSchema: GenMessage<GetStandardPriceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 13);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListStandardPricesRequest
+ */
+export type ListStandardPricesRequest = Message<"redpanda.api.aigateway.v1.ListStandardPricesRequest"> & {
+  /**
+   * @generated from field: int32 page_size = 1;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 2;
+   */
+  pageToken: string;
+
+  /**
+   * Filter by provider, model_id, modality, or effective date
+   * Examples:
+   *   provider = "openai"
+   *   model_id = "gpt-4o"
+   *   modality = "chat"
+   *   effective_from <= timestamp("2025-01-15T00:00:00Z") AND (effective_to > timestamp("2025-01-15T00:00:00Z") OR effective_to = null)
+   *
+   * @generated from field: string filter = 3;
+   */
+  filter: string;
+
+  /**
+   * @generated from field: string order_by = 4;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListStandardPricesRequest.
+ * Use `create(ListStandardPricesRequestSchema)` to create a new message.
+ */
+export const ListStandardPricesRequestSchema: GenMessage<ListStandardPricesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 14);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListStandardPricesResponse
+ */
+export type ListStandardPricesResponse = Message<"redpanda.api.aigateway.v1.ListStandardPricesResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.StandardPrice standard_prices = 1;
+   */
+  standardPrices: StandardPrice[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListStandardPricesResponse.
+ * Use `create(ListStandardPricesResponseSchema)` to create a new message.
+ */
+export const ListStandardPricesResponseSchema: GenMessage<ListStandardPricesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 15);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateStandardPriceRequest
+ */
+export type UpdateStandardPriceRequest = Message<"redpanda.api.aigateway.v1.UpdateStandardPriceRequest"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.StandardPrice standard_price = 1;
+   */
+  standardPrice?: StandardPrice;
+
+  /**
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateStandardPriceRequest.
+ * Use `create(UpdateStandardPriceRequestSchema)` to create a new message.
+ */
+export const UpdateStandardPriceRequestSchema: GenMessage<UpdateStandardPriceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 16);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteStandardPriceRequest
+ */
+export type DeleteStandardPriceRequest = Message<"redpanda.api.aigateway.v1.DeleteStandardPriceRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteStandardPriceRequest.
+ * Use `create(DeleteStandardPriceRequestSchema)` to create a new message.
+ */
+export const DeleteStandardPriceRequestSchema: GenMessage<DeleteStandardPriceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 17);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateCustomPriceRequest
+ */
+export type CreateCustomPriceRequest = Message<"redpanda.api.aigateway.v1.CreateCustomPriceRequest"> & {
+  /**
+   * @generated from field: string custom_price_id = 1;
+   */
+  customPriceId: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.CustomPrice custom_price = 2;
+   */
+  customPrice?: CustomPrice;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateCustomPriceRequest.
+ * Use `create(CreateCustomPriceRequestSchema)` to create a new message.
+ */
+export const CreateCustomPriceRequestSchema: GenMessage<CreateCustomPriceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 18);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetCustomPriceRequest
+ */
+export type GetCustomPriceRequest = Message<"redpanda.api.aigateway.v1.GetCustomPriceRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetCustomPriceRequest.
+ * Use `create(GetCustomPriceRequestSchema)` to create a new message.
+ */
+export const GetCustomPriceRequestSchema: GenMessage<GetCustomPriceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 19);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListCustomPricesRequest
+ */
+export type ListCustomPricesRequest = Message<"redpanda.api.aigateway.v1.ListCustomPricesRequest"> & {
+  /**
+   * @generated from field: int32 page_size = 1;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 2;
+   */
+  pageToken: string;
+
+  /**
+   * Filter by customer_id, provider, model_id, modality, or effective date
+   *
+   * @generated from field: string filter = 3;
+   */
+  filter: string;
+
+  /**
+   * @generated from field: string order_by = 4;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListCustomPricesRequest.
+ * Use `create(ListCustomPricesRequestSchema)` to create a new message.
+ */
+export const ListCustomPricesRequestSchema: GenMessage<ListCustomPricesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 20);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListCustomPricesResponse
+ */
+export type ListCustomPricesResponse = Message<"redpanda.api.aigateway.v1.ListCustomPricesResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.CustomPrice custom_prices = 1;
+   */
+  customPrices: CustomPrice[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListCustomPricesResponse.
+ * Use `create(ListCustomPricesResponseSchema)` to create a new message.
+ */
+export const ListCustomPricesResponseSchema: GenMessage<ListCustomPricesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 21);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateCustomPriceRequest
+ */
+export type UpdateCustomPriceRequest = Message<"redpanda.api.aigateway.v1.UpdateCustomPriceRequest"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.CustomPrice custom_price = 1;
+   */
+  customPrice?: CustomPrice;
+
+  /**
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateCustomPriceRequest.
+ * Use `create(UpdateCustomPriceRequestSchema)` to create a new message.
+ */
+export const UpdateCustomPriceRequestSchema: GenMessage<UpdateCustomPriceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 22);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteCustomPriceRequest
+ */
+export type DeleteCustomPriceRequest = Message<"redpanda.api.aigateway.v1.DeleteCustomPriceRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteCustomPriceRequest.
+ * Use `create(DeleteCustomPriceRequestSchema)` to create a new message.
+ */
+export const DeleteCustomPriceRequestSchema: GenMessage<DeleteCustomPriceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 23);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetEffectivePriceRequest
+ */
+export type GetEffectivePriceRequest = Message<"redpanda.api.aigateway.v1.GetEffectivePriceRequest"> & {
+  /**
+   * @generated from field: string provider = 1;
+   */
+  provider: string;
+
+  /**
+   * @generated from field: string model_id = 2;
+   */
+  modelId: string;
+
+  /**
+   * "chat", "batch", "embedding", etc.
+   *
+   * @generated from field: string modality = 3;
+   */
+  modality: string;
+
+  /**
+   * Optional: Customer ID for custom pricing lookup
+   *
+   * @generated from field: string customer_id = 4;
+   */
+  customerId: string;
+
+  /**
+   * Optional: Timestamp for historical price lookup (defaults to NOW)
+   *
+   * @generated from field: google.protobuf.Timestamp effective_at = 5;
+   */
+  effectiveAt?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetEffectivePriceRequest.
+ * Use `create(GetEffectivePriceRequestSchema)` to create a new message.
+ */
+export const GetEffectivePriceRequestSchema: GenMessage<GetEffectivePriceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 24);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListPriceHistoryRequest
+ */
+export type ListPriceHistoryRequest = Message<"redpanda.api.aigateway.v1.ListPriceHistoryRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Default: "effective_from desc"
+   *
+   * @generated from field: string order_by = 4;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListPriceHistoryRequest.
+ * Use `create(ListPriceHistoryRequestSchema)` to create a new message.
+ */
+export const ListPriceHistoryRequestSchema: GenMessage<ListPriceHistoryRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 25);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListPriceHistoryResponse
+ */
+export type ListPriceHistoryResponse = Message<"redpanda.api.aigateway.v1.ListPriceHistoryResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.StandardPrice standard_prices = 1;
+   */
+  standardPrices: StandardPrice[];
+
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.CustomPrice custom_prices = 2;
+   */
+  customPrices: CustomPrice[];
+
+  /**
+   * @generated from field: string next_page_token = 3;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 4;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListPriceHistoryResponse.
+ * Use `create(ListPriceHistoryResponseSchema)` to create a new message.
+ */
+export const ListPriceHistoryResponseSchema: GenMessage<ListPriceHistoryResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_pricing, 26);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.PriceSource
+ */
+export enum PriceSource {
+  /**
+   * @generated from enum value: PRICE_SOURCE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Standard/public pricing
+   *
+   * @generated from enum value: PRICE_SOURCE_STANDARD = 1;
+   */
+  STANDARD = 1,
+
+  /**
+   * Customer-specific override
+   *
+   * @generated from enum value: PRICE_SOURCE_CUSTOM = 2;
+   */
+  CUSTOM = 2,
+
+  /**
+   * Fallback default when no price found
+   *
+   * @generated from enum value: PRICE_SOURCE_DEFAULT = 3;
+   */
+  DEFAULT = 3,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.PriceSource.
+ */
+export const PriceSourceSchema: GenEnum<PriceSource> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_pricing, 0);
+
+/**
+ * Standard Pricing Operations
+ *
+ * @generated from service redpanda.api.aigateway.v1.ModelPricingService
+ */
+export const ModelPricingService: GenService<{
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.CreateStandardPrice
+   */
+  createStandardPrice: {
+    methodKind: "unary";
+    input: typeof CreateStandardPriceRequestSchema;
+    output: typeof CreateStandardPriceResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.GetStandardPrice
+   */
+  getStandardPrice: {
+    methodKind: "unary";
+    input: typeof GetStandardPriceRequestSchema;
+    output: typeof GetStandardPriceResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.ListStandardPrices
+   */
+  listStandardPrices: {
+    methodKind: "unary";
+    input: typeof ListStandardPricesRequestSchema;
+    output: typeof ListStandardPricesResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.UpdateStandardPrice
+   */
+  updateStandardPrice: {
+    methodKind: "unary";
+    input: typeof UpdateStandardPriceRequestSchema;
+    output: typeof UpdateStandardPriceResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.DeleteStandardPrice
+   */
+  deleteStandardPrice: {
+    methodKind: "unary";
+    input: typeof DeleteStandardPriceRequestSchema;
+    output: typeof DeleteStandardPriceResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.CreateCustomPrice
+   */
+  createCustomPrice: {
+    methodKind: "unary";
+    input: typeof CreateCustomPriceRequestSchema;
+    output: typeof CreateCustomPriceResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.GetCustomPrice
+   */
+  getCustomPrice: {
+    methodKind: "unary";
+    input: typeof GetCustomPriceRequestSchema;
+    output: typeof GetCustomPriceResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.ListCustomPrices
+   */
+  listCustomPrices: {
+    methodKind: "unary";
+    input: typeof ListCustomPricesRequestSchema;
+    output: typeof ListCustomPricesResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.UpdateCustomPrice
+   */
+  updateCustomPrice: {
+    methodKind: "unary";
+    input: typeof UpdateCustomPriceRequestSchema;
+    output: typeof UpdateCustomPriceResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.DeleteCustomPrice
+   */
+  deleteCustomPrice: {
+    methodKind: "unary";
+    input: typeof DeleteCustomPriceRequestSchema;
+    output: typeof DeleteCustomPriceResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.GetEffectivePrice
+   */
+  getEffectivePrice: {
+    methodKind: "unary";
+    input: typeof GetEffectivePriceRequestSchema;
+    output: typeof GetEffectivePriceResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.ModelPricingService.ListPriceHistory
+   */
+  listPriceHistory: {
+    methodKind: "unary";
+    input: typeof ListPriceHistoryRequestSchema;
+    output: typeof ListPriceHistoryResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_pricing, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/provider_config-ProviderConfigService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/provider_config-ProviderConfigService_connectquery.ts
new file mode 100644
index 0000000000..3544994737
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/provider_config-ProviderConfigService_connectquery.ts
@@ -0,0 +1,49 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/provider_config.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { ProviderConfigService } from "./provider_config_pb";
+
+/**
+ * Creates a new provider configuration.
+ * The configuration is encrypted at rest using the control plane encryption key.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.CreateProviderConfig
+ */
+export const createProviderConfig = ProviderConfigService.method.createProviderConfig;
+
+/**
+ * Gets a provider configuration by name.
+ * Note: Sensitive fields are masked in the response.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.GetProviderConfig
+ */
+export const getProviderConfig = ProviderConfigService.method.getProviderConfig;
+
+/**
+ * Lists provider configurations.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.ListProviderConfigs
+ */
+export const listProviderConfigs = ProviderConfigService.method.listProviderConfigs;
+
+/**
+ * Updates a provider configuration.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.UpdateProviderConfig
+ */
+export const updateProviderConfig = ProviderConfigService.method.updateProviderConfig;
+
+/**
+ * Deletes a provider configuration.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.DeleteProviderConfig
+ */
+export const deleteProviderConfig = ProviderConfigService.method.deleteProviderConfig;
+
+/**
+ * Tests a provider configuration by attempting to authenticate with the provider.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.TestProviderConfig
+ */
+export const testProviderConfig = ProviderConfigService.method.testProviderConfig;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/provider_config_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/provider_config_pb.ts
new file mode 100644
index 0000000000..23b3f8c24b
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/provider_config_pb.ts
@@ -0,0 +1,785 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/provider_config.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/provider_config.proto.
+ */
+export const file_redpanda_api_aigateway_v1_provider_config: GenFile = /*@__PURE__*/
+  fileDesc("Ci9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3Byb3ZpZGVyX2NvbmZpZy5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSLuBgoOUHJvdmlkZXJDb25maWcSEQoEbmFtZRgBIAEoCUID4EEIEhwKBWxhYmVsGAIgASgJQg3gQQK6SAdyBRABGP8BEkcKC2NvbmZpZ190eXBlGAMgASgOMi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Qcm92aWRlckNvbmZpZ1R5cGVCA+BBAhJBCg5hcGlfa2V5X2NvbmZpZxgEIAEoCzInLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXBpS2V5Q29uZmlnSAASUQoWYXdzX2NyZWRlbnRpYWxzX2NvbmZpZxgFIAEoCzIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXdzQ3JlZGVudGlhbHNDb25maWdIABJKChNhd3NfaWFtX3JvbGVfY29uZmlnGAYgASgLMisucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Bd3NJYW1Sb2xlQ29uZmlnSAASWAoaZ2NwX3NlcnZpY2VfYWNjb3VudF9jb25maWcYByABKAsyMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdjcFNlcnZpY2VBY2NvdW50Q29uZmlnSAASVQoYYXp1cmVfY3JlZGVudGlhbHNfY29uZmlnGAggASgLMjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BenVyZUNyZWRlbnRpYWxzQ29uZmlnSAASDwoHZW5hYmxlZBgJIAEoCBIQCghwcmlvcml0eRgKIAEoBRI1CgxsYXN0X3VzZWRfYXQYCyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSFgoJdXNlX2NvdW50GAwgASgDQgPgQQMSNAoLY3JlYXRlX3RpbWUYDSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSNAoLdXBkYXRlX3RpbWUYDiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSFAoHY3JlYXRvchgPIAEoCUID4EEDOlHqQU4KJWFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vUHJvdmlkZXJDb25maWcSJXByb3ZpZGVycy97cHJvdmlkZXJ9L2NvbmZpZ3Mve2NvbmZpZ31CCAoGY29uZmlnIkEKDEFwaUtleUNvbmZpZxIUCgdhcGlfa2V5GAEgASgJQgPgQQQSGwoOYXBpX2tleV9tYXNrZWQYAiABKAlCA+BBAyKKAQoUQXdzQ3JlZGVudGlhbHNDb25maWcSGgoNYWNjZXNzX2tleV9pZBgBIAEoCUID4EEEEh4KEXNlY3JldF9hY2Nlc3Nfa2V5GAIgASgJQgPgQQQSEwoGcmVnaW9uGAMgASgJQgPgQQISIQoUYWNjZXNzX2tleV9pZF9tYXNrZWQYBCABKAlCA+BBAyJYChBBd3NJYW1Sb2xlQ29uZmlnEhUKCHJvbGVfYXJuGAEgASgJQgPgQQISEwoGcmVnaW9uGAIgASgJQgPgQQISGAoLZXh0ZXJuYWxfaWQYAyABKAlCA+BBASKOAQoXR2NwU2VydmljZUFjY291bnRDb25maWcSIQoUc2VydmljZV9hY2NvdW50X2pzb24YASABKAlCA+BBBBIXCgpwcm9qZWN0X2lkGAIgASgJQgPgQQISEwoGcmVnaW9uGAMgASgJQgPgQQISIgoVc2VydmljZV9hY2NvdW50X2VtYWlsGAQgASgJQgPgQQMinwEKFkF6dXJlQ3JlZGVudGlhbHNDb25maWcSFAoHYXBpX2tleRgBIAEoCUID4EEEEhoKDXJlc291cmNlX25hbWUYAiABKAlCA+BBAhIcCg9kZXBsb3ltZW50X25hbWUYAyABKAlCA+BBARIYCgthcGlfdmVyc2lvbhgEIAEoCUID4EEBEhsKDmFwaV9rZXlfbWFza2VkGAUgASgJQgPgQQMiswEKG0NyZWF0ZVByb3ZpZGVyQ29uZmlnUmVxdWVzdBI8CgZwYXJlbnQYASABKAlCLOBBAvpBJgokYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Nb2RlbFByb3ZpZGVyEj4KBmNvbmZpZxgCIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUHJvdmlkZXJDb25maWdCA+BBAhIWCgljb25maWdfaWQYAyABKAlCA+BBASJZChxDcmVhdGVQcm92aWRlckNvbmZpZ1Jlc3BvbnNlEjkKBmNvbmZpZxgBIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUHJvdmlkZXJDb25maWciVwoYR2V0UHJvdmlkZXJDb25maWdSZXF1ZXN0EjsKBG5hbWUYASABKAlCLeBBAvpBJwolYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Qcm92aWRlckNvbmZpZyJWChlHZXRQcm92aWRlckNvbmZpZ1Jlc3BvbnNlEjkKBmNvbmZpZxgBIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUHJvdmlkZXJDb25maWcisQEKGkxpc3RQcm92aWRlckNvbmZpZ3NSZXF1ZXN0EjwKBnBhcmVudBgBIAEoCUIs4EEC+kEmCiRhaWdhdGV3YXkucmVkcGFuZGEuY29tL01vZGVsUHJvdmlkZXISHwoJcGFnZV9zaXplGAIgASgFQgzgQQG6SAYaBBhkKAASFwoKcGFnZV90b2tlbhgDIAEoCUID4EEBEhsKDmZpbHRlcl9lbmFibGVkGAQgASgIQgPgQQEihgEKG0xpc3RQcm92aWRlckNvbmZpZ3NSZXNwb25zZRI6Cgdjb25maWdzGAEgAygLMikucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Qcm92aWRlckNvbmZpZxIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSKTAQobVXBkYXRlUHJvdmlkZXJDb25maWdSZXF1ZXN0Ej4KBmNvbmZpZxgBIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUHJvdmlkZXJDb25maWdCA+BBAhI0Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCA+BBASJZChxVcGRhdGVQcm92aWRlckNvbmZpZ1Jlc3BvbnNlEjkKBmNvbmZpZxgBIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUHJvdmlkZXJDb25maWciWgobRGVsZXRlUHJvdmlkZXJDb25maWdSZXF1ZXN0EjsKBG5hbWUYASABKAlCLeBBAvpBJwolYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Qcm92aWRlckNvbmZpZyIeChxEZWxldGVQcm92aWRlckNvbmZpZ1Jlc3BvbnNlIlgKGVRlc3RQcm92aWRlckNvbmZpZ1JlcXVlc3QSOwoEbmFtZRgBIAEoCUIt4EEC+kEnCiVhaWdhdGV3YXkucmVkcGFuZGEuY29tL1Byb3ZpZGVyQ29uZmlnIl4KGlRlc3RQcm92aWRlckNvbmZpZ1Jlc3BvbnNlEg8KB3N1Y2Nlc3MYASABKAgSFQoNZXJyb3JfbWVzc2FnZRgCIAEoCRIYChByZXNwb25zZV90aW1lX21zGAMgASgDKocCChJQcm92aWRlckNvbmZpZ1R5cGUSJAogUFJPVklERVJfQ09ORklHX1RZUEVfVU5TUEVDSUZJRUQQABIgChxQUk9WSURFUl9DT05GSUdfVFlQRV9BUElfS0VZEAESKAokUFJPVklERVJfQ09ORklHX1RZUEVfQVdTX0NSRURFTlRJQUxTEAISJQohUFJPVklERVJfQ09ORklHX1RZUEVfQVdTX0lBTV9ST0xFEAMSLAooUFJPVklERVJfQ09ORklHX1RZUEVfR0NQX1NFUlZJQ0VfQUNDT1VOVBAEEioKJlBST1ZJREVSX0NPTkZJR19UWVBFX0FaVVJFX0NSRURFTlRJQUxTEAUy9wgKFVByb3ZpZGVyQ29uZmlnU2VydmljZRK5AQoUQ3JlYXRlUHJvdmlkZXJDb25maWcSNi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNyZWF0ZVByb3ZpZGVyQ29uZmlnUmVxdWVzdBo3LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlUHJvdmlkZXJDb25maWdSZXNwb25zZSIwgtPkkwIqOgZjb25maWciIC92MS97cGFyZW50PXByb3ZpZGVycy8qfS9jb25maWdzEqgBChFHZXRQcm92aWRlckNvbmZpZxIzLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0UHJvdmlkZXJDb25maWdSZXF1ZXN0GjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRQcm92aWRlckNvbmZpZ1Jlc3BvbnNlIiiC0+STAiISIC92MS97bmFtZT1wcm92aWRlcnMvKi9jb25maWdzLyp9Eq4BChNMaXN0UHJvdmlkZXJDb25maWdzEjUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0UHJvdmlkZXJDb25maWdzUmVxdWVzdBo2LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFByb3ZpZGVyQ29uZmlnc1Jlc3BvbnNlIiiC0+STAiISIC92MS97cGFyZW50PXByb3ZpZGVycy8qfS9jb25maWdzEsABChRVcGRhdGVQcm92aWRlckNvbmZpZxI2LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlUHJvdmlkZXJDb25maWdSZXF1ZXN0GjcucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVQcm92aWRlckNvbmZpZ1Jlc3BvbnNlIjeC0+STAjE6BmNvbmZpZzInL3YxL3tjb25maWcubmFtZT1wcm92aWRlcnMvKi9jb25maWdzLyp9ErEBChREZWxldGVQcm92aWRlckNvbmZpZxI2LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlUHJvdmlkZXJDb25maWdSZXF1ZXN0GjcucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVQcm92aWRlckNvbmZpZ1Jlc3BvbnNlIiiC0+STAiIqIC92MS97bmFtZT1wcm92aWRlcnMvKi9jb25maWdzLyp9ErMBChJUZXN0UHJvdmlkZXJDb25maWcSNC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlc3RQcm92aWRlckNvbmZpZ1JlcXVlc3QaNS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlc3RQcm92aWRlckNvbmZpZ1Jlc3BvbnNlIjCC0+STAio6ASoiJS92MS97bmFtZT1wcm92aWRlcnMvKi9jb25maWdzLyp9OnRlc3QaGcpBFmFpZ2F0ZXdheS5yZWRwYW5kYS5jb21CiAIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQhNQcm92aWRlckNvbmZpZ1Byb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * ProviderConfig represents a configuration for authenticating with a model provider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ProviderConfig
+ */
+export type ProviderConfig = Message<"redpanda.api.aigateway.v1.ProviderConfig"> & {
+  /**
+   * Resource name. Format: `providers/{provider_id}/configs/{config_id}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable label for this configuration (e.g., "Production", "Team A")
+   *
+   * @generated from field: string label = 2;
+   */
+  label: string;
+
+  /**
+   * Configuration type
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ProviderConfigType config_type = 3;
+   */
+  configType: ProviderConfigType;
+
+  /**
+   * Provider-specific configuration (exactly one must be set based on config_type)
+   *
+   * @generated from oneof redpanda.api.aigateway.v1.ProviderConfig.config
+   */
+  config: {
+    /**
+     * API key configuration (for OpenAI, Anthropic, etc.)
+     *
+     * @generated from field: redpanda.api.aigateway.v1.ApiKeyConfig api_key_config = 4;
+     */
+    value: ApiKeyConfig;
+    case: "apiKeyConfig";
+  } | {
+    /**
+     * AWS credentials configuration
+     *
+     * @generated from field: redpanda.api.aigateway.v1.AwsCredentialsConfig aws_credentials_config = 5;
+     */
+    value: AwsCredentialsConfig;
+    case: "awsCredentialsConfig";
+  } | {
+    /**
+     * AWS IAM role configuration
+     *
+     * @generated from field: redpanda.api.aigateway.v1.AwsIamRoleConfig aws_iam_role_config = 6;
+     */
+    value: AwsIamRoleConfig;
+    case: "awsIamRoleConfig";
+  } | {
+    /**
+     * GCP service account configuration
+     *
+     * @generated from field: redpanda.api.aigateway.v1.GcpServiceAccountConfig gcp_service_account_config = 7;
+     */
+    value: GcpServiceAccountConfig;
+    case: "gcpServiceAccountConfig";
+  } | {
+    /**
+     * Azure OpenAI credentials configuration
+     *
+     * @generated from field: redpanda.api.aigateway.v1.AzureCredentialsConfig azure_credentials_config = 8;
+     */
+    value: AzureCredentialsConfig;
+    case: "azureCredentialsConfig";
+  } | { case: undefined; value?: undefined };
+
+  /**
+   * Whether this configuration is enabled
+   *
+   * @generated from field: bool enabled = 9;
+   */
+  enabled: boolean;
+
+  /**
+   * Priority for load balancing (higher = preferred)
+   *
+   * @generated from field: int32 priority = 10;
+   */
+  priority: number;
+
+  /**
+   * Output only. Last time this configuration was used
+   *
+   * @generated from field: google.protobuf.Timestamp last_used_at = 11;
+   */
+  lastUsedAt?: Timestamp;
+
+  /**
+   * Output only. Number of times this configuration has been used
+   *
+   * @generated from field: int64 use_count = 12;
+   */
+  useCount: bigint;
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 13;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 14;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Creator
+   *
+   * @generated from field: string creator = 15;
+   */
+  creator: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ProviderConfig.
+ * Use `create(ProviderConfigSchema)` to create a new message.
+ */
+export const ProviderConfigSchema: GenMessage<ProviderConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 0);
+
+/**
+ * ApiKeyConfig for providers using API key authentication.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ApiKeyConfig
+ */
+export type ApiKeyConfig = Message<"redpanda.api.aigateway.v1.ApiKeyConfig"> & {
+  /**
+   * The API key (input only - masked in responses)
+   *
+   * @generated from field: string api_key = 1;
+   */
+  apiKey: string;
+
+  /**
+   * Output only. Masked version of the API key (e.g., "sk-...xyz")
+   *
+   * @generated from field: string api_key_masked = 2;
+   */
+  apiKeyMasked: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ApiKeyConfig.
+ * Use `create(ApiKeyConfigSchema)` to create a new message.
+ */
+export const ApiKeyConfigSchema: GenMessage<ApiKeyConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 1);
+
+/**
+ * AwsCredentialsConfig for AWS Bedrock using access key/secret key.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AwsCredentialsConfig
+ */
+export type AwsCredentialsConfig = Message<"redpanda.api.aigateway.v1.AwsCredentialsConfig"> & {
+  /**
+   * AWS access key ID (input only - masked in responses)
+   *
+   * @generated from field: string access_key_id = 1;
+   */
+  accessKeyId: string;
+
+  /**
+   * AWS secret access key (input only - never returned)
+   *
+   * @generated from field: string secret_access_key = 2;
+   */
+  secretAccessKey: string;
+
+  /**
+   * AWS region (e.g., "us-east-1")
+   *
+   * @generated from field: string region = 3;
+   */
+  region: string;
+
+  /**
+   * Output only. Masked access key ID
+   *
+   * @generated from field: string access_key_id_masked = 4;
+   */
+  accessKeyIdMasked: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AwsCredentialsConfig.
+ * Use `create(AwsCredentialsConfigSchema)` to create a new message.
+ */
+export const AwsCredentialsConfigSchema: GenMessage<AwsCredentialsConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 2);
+
+/**
+ * AwsIamRoleConfig for AWS Bedrock using IAM role assumption.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AwsIamRoleConfig
+ */
+export type AwsIamRoleConfig = Message<"redpanda.api.aigateway.v1.AwsIamRoleConfig"> & {
+  /**
+   * IAM role ARN to assume
+   *
+   * @generated from field: string role_arn = 1;
+   */
+  roleArn: string;
+
+  /**
+   * AWS region (e.g., "us-east-1")
+   *
+   * @generated from field: string region = 2;
+   */
+  region: string;
+
+  /**
+   * Optional external ID for cross-account access
+   *
+   * @generated from field: string external_id = 3;
+   */
+  externalId: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AwsIamRoleConfig.
+ * Use `create(AwsIamRoleConfigSchema)` to create a new message.
+ */
+export const AwsIamRoleConfigSchema: GenMessage<AwsIamRoleConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 3);
+
+/**
+ * GcpServiceAccountConfig for Google Vertex AI.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GcpServiceAccountConfig
+ */
+export type GcpServiceAccountConfig = Message<"redpanda.api.aigateway.v1.GcpServiceAccountConfig"> & {
+  /**
+   * Service account JSON key (input only - never returned)
+   *
+   * @generated from field: string service_account_json = 1;
+   */
+  serviceAccountJson: string;
+
+  /**
+   * GCP project ID
+   *
+   * @generated from field: string project_id = 2;
+   */
+  projectId: string;
+
+  /**
+   * GCP region (e.g., "us-central1")
+   *
+   * @generated from field: string region = 3;
+   */
+  region: string;
+
+  /**
+   * Output only. Service account email (extracted from JSON)
+   *
+   * @generated from field: string service_account_email = 4;
+   */
+  serviceAccountEmail: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GcpServiceAccountConfig.
+ * Use `create(GcpServiceAccountConfigSchema)` to create a new message.
+ */
+export const GcpServiceAccountConfigSchema: GenMessage<GcpServiceAccountConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 4);
+
+/**
+ * AzureCredentialsConfig for Azure OpenAI Service.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AzureCredentialsConfig
+ */
+export type AzureCredentialsConfig = Message<"redpanda.api.aigateway.v1.AzureCredentialsConfig"> & {
+  /**
+   * Azure OpenAI API key (input only - masked in responses)
+   *
+   * @generated from field: string api_key = 1;
+   */
+  apiKey: string;
+
+  /**
+   * Azure resource name
+   *
+   * @generated from field: string resource_name = 2;
+   */
+  resourceName: string;
+
+  /**
+   * Azure deployment name (optional, can be specified per-request)
+   *
+   * @generated from field: string deployment_name = 3;
+   */
+  deploymentName: string;
+
+  /**
+   * API version (e.g., "2024-02-01")
+   *
+   * @generated from field: string api_version = 4;
+   */
+  apiVersion: string;
+
+  /**
+   * Output only. Masked API key
+   *
+   * @generated from field: string api_key_masked = 5;
+   */
+  apiKeyMasked: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AzureCredentialsConfig.
+ * Use `create(AzureCredentialsConfigSchema)` to create a new message.
+ */
+export const AzureCredentialsConfigSchema: GenMessage<AzureCredentialsConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 5);
+
+/**
+ * Request message for CreateProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateProviderConfigRequest
+ */
+export type CreateProviderConfigRequest = Message<"redpanda.api.aigateway.v1.CreateProviderConfigRequest"> & {
+  /**
+   * Parent resource name. Format: `providers/{provider_id}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * The configuration to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ProviderConfig config = 2;
+   */
+  config?: ProviderConfig;
+
+  /**
+   * Optional config ID. If empty, server generates one.
+   *
+   * @generated from field: string config_id = 3;
+   */
+  configId: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateProviderConfigRequest.
+ * Use `create(CreateProviderConfigRequestSchema)` to create a new message.
+ */
+export const CreateProviderConfigRequestSchema: GenMessage<CreateProviderConfigRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 6);
+
+/**
+ * Response message for CreateProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateProviderConfigResponse
+ */
+export type CreateProviderConfigResponse = Message<"redpanda.api.aigateway.v1.CreateProviderConfigResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.ProviderConfig config = 1;
+   */
+  config?: ProviderConfig;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateProviderConfigResponse.
+ * Use `create(CreateProviderConfigResponseSchema)` to create a new message.
+ */
+export const CreateProviderConfigResponseSchema: GenMessage<CreateProviderConfigResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 7);
+
+/**
+ * Request message for GetProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetProviderConfigRequest
+ */
+export type GetProviderConfigRequest = Message<"redpanda.api.aigateway.v1.GetProviderConfigRequest"> & {
+  /**
+   * Resource name of the configuration.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetProviderConfigRequest.
+ * Use `create(GetProviderConfigRequestSchema)` to create a new message.
+ */
+export const GetProviderConfigRequestSchema: GenMessage<GetProviderConfigRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 8);
+
+/**
+ * Response message for GetProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetProviderConfigResponse
+ */
+export type GetProviderConfigResponse = Message<"redpanda.api.aigateway.v1.GetProviderConfigResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.ProviderConfig config = 1;
+   */
+  config?: ProviderConfig;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetProviderConfigResponse.
+ * Use `create(GetProviderConfigResponseSchema)` to create a new message.
+ */
+export const GetProviderConfigResponseSchema: GenMessage<GetProviderConfigResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 9);
+
+/**
+ * Request message for ListProviderConfigs RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListProviderConfigsRequest
+ */
+export type ListProviderConfigsRequest = Message<"redpanda.api.aigateway.v1.ListProviderConfigsRequest"> & {
+  /**
+   * Parent resource name. Format: `providers/{provider_id}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of configs to return (max 100)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter by enabled status
+   *
+   * @generated from field: bool filter_enabled = 4;
+   */
+  filterEnabled: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListProviderConfigsRequest.
+ * Use `create(ListProviderConfigsRequestSchema)` to create a new message.
+ */
+export const ListProviderConfigsRequestSchema: GenMessage<ListProviderConfigsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 10);
+
+/**
+ * Response message for ListProviderConfigs RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListProviderConfigsResponse
+ */
+export type ListProviderConfigsResponse = Message<"redpanda.api.aigateway.v1.ListProviderConfigsResponse"> & {
+  /**
+   * The list of configurations (sensitive fields masked)
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.ProviderConfig configs = 1;
+   */
+  configs: ProviderConfig[];
+
+  /**
+   * Token for next page
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListProviderConfigsResponse.
+ * Use `create(ListProviderConfigsResponseSchema)` to create a new message.
+ */
+export const ListProviderConfigsResponseSchema: GenMessage<ListProviderConfigsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 11);
+
+/**
+ * Request message for UpdateProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateProviderConfigRequest
+ */
+export type UpdateProviderConfigRequest = Message<"redpanda.api.aigateway.v1.UpdateProviderConfigRequest"> & {
+  /**
+   * The configuration to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ProviderConfig config = 1;
+   */
+  config?: ProviderConfig;
+
+  /**
+   * The fields to update.
+   * Allowed fields: label, enabled, priority, and config-specific fields
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateProviderConfigRequest.
+ * Use `create(UpdateProviderConfigRequestSchema)` to create a new message.
+ */
+export const UpdateProviderConfigRequestSchema: GenMessage<UpdateProviderConfigRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 12);
+
+/**
+ * Response message for UpdateProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateProviderConfigResponse
+ */
+export type UpdateProviderConfigResponse = Message<"redpanda.api.aigateway.v1.UpdateProviderConfigResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.ProviderConfig config = 1;
+   */
+  config?: ProviderConfig;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateProviderConfigResponse.
+ * Use `create(UpdateProviderConfigResponseSchema)` to create a new message.
+ */
+export const UpdateProviderConfigResponseSchema: GenMessage<UpdateProviderConfigResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 13);
+
+/**
+ * Request message for DeleteProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteProviderConfigRequest
+ */
+export type DeleteProviderConfigRequest = Message<"redpanda.api.aigateway.v1.DeleteProviderConfigRequest"> & {
+  /**
+   * Resource name of the configuration to delete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteProviderConfigRequest.
+ * Use `create(DeleteProviderConfigRequestSchema)` to create a new message.
+ */
+export const DeleteProviderConfigRequestSchema: GenMessage<DeleteProviderConfigRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 14);
+
+/**
+ * Response message for DeleteProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteProviderConfigResponse
+ */
+export type DeleteProviderConfigResponse = Message<"redpanda.api.aigateway.v1.DeleteProviderConfigResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteProviderConfigResponse.
+ * Use `create(DeleteProviderConfigResponseSchema)` to create a new message.
+ */
+export const DeleteProviderConfigResponseSchema: GenMessage<DeleteProviderConfigResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 15);
+
+/**
+ * Request message for TestProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TestProviderConfigRequest
+ */
+export type TestProviderConfigRequest = Message<"redpanda.api.aigateway.v1.TestProviderConfigRequest"> & {
+  /**
+   * Resource name of the configuration to test.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TestProviderConfigRequest.
+ * Use `create(TestProviderConfigRequestSchema)` to create a new message.
+ */
+export const TestProviderConfigRequestSchema: GenMessage<TestProviderConfigRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 16);
+
+/**
+ * Response message for TestProviderConfig RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TestProviderConfigResponse
+ */
+export type TestProviderConfigResponse = Message<"redpanda.api.aigateway.v1.TestProviderConfigResponse"> & {
+  /**
+   * Whether the test was successful
+   *
+   * @generated from field: bool success = 1;
+   */
+  success: boolean;
+
+  /**
+   * Error message if the test failed
+   *
+   * @generated from field: string error_message = 2;
+   */
+  errorMessage: string;
+
+  /**
+   * Response time in milliseconds
+   *
+   * @generated from field: int64 response_time_ms = 3;
+   */
+  responseTimeMs: bigint;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TestProviderConfigResponse.
+ * Use `create(TestProviderConfigResponseSchema)` to create a new message.
+ */
+export const TestProviderConfigResponseSchema: GenMessage<TestProviderConfigResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_provider_config, 17);
+
+/**
+ * ProviderConfigType defines the type of provider configuration.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.ProviderConfigType
+ */
+export enum ProviderConfigType {
+  /**
+   * @generated from enum value: PROVIDER_CONFIG_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Standard API key authentication (OpenAI, Anthropic, Mistral, Cohere, etc.)
+   *
+   * @generated from enum value: PROVIDER_CONFIG_TYPE_API_KEY = 1;
+   */
+  API_KEY = 1,
+
+  /**
+   * AWS credentials (access key + secret key)
+   *
+   * @generated from enum value: PROVIDER_CONFIG_TYPE_AWS_CREDENTIALS = 2;
+   */
+  AWS_CREDENTIALS = 2,
+
+  /**
+   * AWS IAM role (for EC2/ECS/Lambda environments)
+   *
+   * @generated from enum value: PROVIDER_CONFIG_TYPE_AWS_IAM_ROLE = 3;
+   */
+  AWS_IAM_ROLE = 3,
+
+  /**
+   * GCP service account JSON
+   *
+   * @generated from enum value: PROVIDER_CONFIG_TYPE_GCP_SERVICE_ACCOUNT = 4;
+   */
+  GCP_SERVICE_ACCOUNT = 4,
+
+  /**
+   * Azure OpenAI credentials
+   *
+   * @generated from enum value: PROVIDER_CONFIG_TYPE_AZURE_CREDENTIALS = 5;
+   */
+  AZURE_CREDENTIALS = 5,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.ProviderConfigType.
+ */
+export const ProviderConfigTypeSchema: GenEnum<ProviderConfigType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_provider_config, 0);
+
+/**
+ * ProviderConfigService manages encrypted configurations for model providers.
+ * Supports different auth types: API keys, AWS credentials, GCP service accounts, etc.
+ * Resource name: providers/{provider_id}/configs/{config_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.ProviderConfigService
+ */
+export const ProviderConfigService: GenService<{
+  /**
+   * Creates a new provider configuration.
+   * The configuration is encrypted at rest using the control plane encryption key.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.CreateProviderConfig
+   */
+  createProviderConfig: {
+    methodKind: "unary";
+    input: typeof CreateProviderConfigRequestSchema;
+    output: typeof CreateProviderConfigResponseSchema;
+  },
+  /**
+   * Gets a provider configuration by name.
+   * Note: Sensitive fields are masked in the response.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.GetProviderConfig
+   */
+  getProviderConfig: {
+    methodKind: "unary";
+    input: typeof GetProviderConfigRequestSchema;
+    output: typeof GetProviderConfigResponseSchema;
+  },
+  /**
+   * Lists provider configurations.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.ListProviderConfigs
+   */
+  listProviderConfigs: {
+    methodKind: "unary";
+    input: typeof ListProviderConfigsRequestSchema;
+    output: typeof ListProviderConfigsResponseSchema;
+  },
+  /**
+   * Updates a provider configuration.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.UpdateProviderConfig
+   */
+  updateProviderConfig: {
+    methodKind: "unary";
+    input: typeof UpdateProviderConfigRequestSchema;
+    output: typeof UpdateProviderConfigResponseSchema;
+  },
+  /**
+   * Deletes a provider configuration.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.DeleteProviderConfig
+   */
+  deleteProviderConfig: {
+    methodKind: "unary";
+    input: typeof DeleteProviderConfigRequestSchema;
+    output: typeof DeleteProviderConfigResponseSchema;
+  },
+  /**
+   * Tests a provider configuration by attempting to authenticate with the provider.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.ProviderConfigService.TestProviderConfig
+   */
+  testProviderConfig: {
+    methodKind: "unary";
+    input: typeof TestProviderConfigRequestSchema;
+    output: typeof TestProviderConfigResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_provider_config, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/ratelimit-RateLimitService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/ratelimit-RateLimitService_connectquery.ts
new file mode 100644
index 0000000000..5df344307f
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/ratelimit-RateLimitService_connectquery.ts
@@ -0,0 +1,30 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/ratelimit.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { RateLimitService } from "./ratelimit_pb";
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.CreateRateLimit
+ */
+export const createRateLimit = RateLimitService.method.createRateLimit;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.GetRateLimit
+ */
+export const getRateLimit = RateLimitService.method.getRateLimit;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.ListRateLimits
+ */
+export const listRateLimits = RateLimitService.method.listRateLimits;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.UpdateRateLimit
+ */
+export const updateRateLimit = RateLimitService.method.updateRateLimit;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.DeleteRateLimit
+ */
+export const deleteRateLimit = RateLimitService.method.deleteRateLimit;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/ratelimit_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/ratelimit_pb.ts
new file mode 100644
index 0000000000..b66187b19b
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/ratelimit_pb.ts
@@ -0,0 +1,368 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/ratelimit.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/ratelimit.proto.
+ */
+export const file_redpanda_api_aigateway_v1_ratelimit: GenFile = /*@__PURE__*/
+  fileDesc("CilyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3JhdGVsaW1pdC5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSJTChdDcmVhdGVSYXRlTGltaXRSZXNwb25zZRI4CgpyYXRlX2xpbWl0GAEgASgLMiQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SYXRlTGltaXQiUAoUR2V0UmF0ZUxpbWl0UmVzcG9uc2USOAoKcmF0ZV9saW1pdBgBIAEoCzIkLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmF0ZUxpbWl0IlMKF1VwZGF0ZVJhdGVMaW1pdFJlc3BvbnNlEjgKCnJhdGVfbGltaXQYASABKAsyJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJhdGVMaW1pdCIZChdEZWxldGVSYXRlTGltaXRSZXNwb25zZSLOBgoJUmF0ZUxpbWl0EhEKBG5hbWUYASABKAlCA+BBCBIgCgxkaXNwbGF5X25hbWUYAiABKAlCCuBBArpIBHICEAESEwoLZGVzY3JpcHRpb24YAyABKAkSHgoKZXhwcmVzc2lvbhgEIAEoCUIK4EECukgEcgIQARIVCg1rZXlfZXh0cmFjdG9yGAUgASgJEiQKE3JlcXVlc3RzX3Blcl9zZWNvbmQYBiABKANCB7pIBCICKAASJAoTcmVxdWVzdHNfcGVyX21pbnV0ZRgHIAEoA0IHukgEIgIoABIhChByZXF1ZXN0c19wZXJfZGF5GAggASgDQge6SAQiAigAEg8KB2VuYWJsZWQYCyABKAgSRAoIbWV0YWRhdGEYDCADKAsyMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJhdGVMaW1pdC5NZXRhZGF0YUVudHJ5EjQKC2NyZWF0ZV90aW1lGA0gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEjQKC3VwZGF0ZV90aW1lGA4gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATrcAupBaQogYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9SYXRlTGltaXQSK2dhdGV3YXlzL3tnYXRld2F5fS9yYXRlLWxpbWl0cy97cmF0ZV9saW1pdH0SGHJhdGUtbGltaXRzL3tyYXRlX2xpbWl0fbpI7AEa6QEKHHJhdGVsaW1pdC5hdF9sZWFzdF9vbmVfbGltaXQSbmF0IGxlYXN0IG9uZSByZXF1ZXN0IGxpbWl0IChyZXF1ZXN0c19wZXJfc2Vjb25kLCByZXF1ZXN0c19wZXJfbWludXRlLCByZXF1ZXN0c19wZXJfZGF5KSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAwGll0aGlzLnJlcXVlc3RzX3Blcl9zZWNvbmQgPiAwIHx8IHRoaXMucmVxdWVzdHNfcGVyX21pbnV0ZSA+IDAgfHwgdGhpcy5yZXF1ZXN0c19wZXJfZGF5ID4gMCKCAQoWQ3JlYXRlUmF0ZUxpbWl0UmVxdWVzdBIOCgZwYXJlbnQYASABKAkSQwoKcmF0ZV9saW1pdBgDIAEoCzIkLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmF0ZUxpbWl0QgngQQK6SAPIAQFKBAgCEANSDXJhdGVfbGltaXRfaWQiTQoTR2V0UmF0ZUxpbWl0UmVxdWVzdBI2CgRuYW1lGAEgASgJQijgQQL6QSIKIGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vUmF0ZUxpbWl0InAKFUxpc3RSYXRlTGltaXRzUmVxdWVzdBIOCgZwYXJlbnQYASABKAkSEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkSDgoGZmlsdGVyGAQgASgJEhAKCG9yZGVyX2J5GAUgASgJIoABChZMaXN0UmF0ZUxpbWl0c1Jlc3BvbnNlEjkKC3JhdGVfbGltaXRzGAEgAygLMiQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SYXRlTGltaXQSFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJEhIKCnRvdGFsX3NpemUYAyABKAUijgEKFlVwZGF0ZVJhdGVMaW1pdFJlcXVlc3QSQwoKcmF0ZV9saW1pdBgBIAEoCzIkLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmF0ZUxpbWl0QgngQQK6SAPIAQESLwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrIlAKFkRlbGV0ZVJhdGVMaW1pdFJlcXVlc3QSNgoEbmFtZRgBIAEoCUIo4EEC+kEiCiBhaWdhdGV3YXkucmVkcGFuZGEuY29tL1JhdGVMaW1pdDKOCAoQUmF0ZUxpbWl0U2VydmljZRLQAQoPQ3JlYXRlUmF0ZUxpbWl0EjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVSYXRlTGltaXRSZXF1ZXN0GjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVSYXRlTGltaXRSZXNwb25zZSJWgtPkkwJQOgpyYXRlX2xpbWl0Wh06CnJhdGVfbGltaXQiDy92MS9yYXRlLWxpbWl0cyIjL3YxL3twYXJlbnQ9Z2F0ZXdheXMvKn0vcmF0ZS1saW1pdHMSuAEKDEdldFJhdGVMaW1pdBIuLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0UmF0ZUxpbWl0UmVxdWVzdBovLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0UmF0ZUxpbWl0UmVzcG9uc2UiR4LT5JMCQVoaEhgvdjEve25hbWU9cmF0ZS1saW1pdHMvKn0SIy92MS97bmFtZT1nYXRld2F5cy8qL3JhdGUtbGltaXRzLyp9ErUBCg5MaXN0UmF0ZUxpbWl0cxIwLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFJhdGVMaW1pdHNSZXF1ZXN0GjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0UmF0ZUxpbWl0c1Jlc3BvbnNlIj6C0+STAjhaERIPL3YxL3JhdGUtbGltaXRzEiMvdjEve3BhcmVudD1nYXRld2F5cy8qfS9yYXRlLWxpbWl0cxLvAQoPVXBkYXRlUmF0ZUxpbWl0EjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVSYXRlTGltaXRSZXF1ZXN0GjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVSYXRlTGltaXRSZXNwb25zZSJ1gtPkkwJvOgpyYXRlX2xpbWl0WjE6CnJhdGVfbGltaXQyIy92MS97cmF0ZV9saW1pdC5uYW1lPXJhdGUtbGltaXRzLyp9Mi4vdjEve3JhdGVfbGltaXQubmFtZT1nYXRld2F5cy8qL3JhdGUtbGltaXRzLyp9EsEBCg9EZWxldGVSYXRlTGltaXQSMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZVJhdGVMaW1pdFJlcXVlc3QaMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZVJhdGVMaW1pdFJlc3BvbnNlIkeC0+STAkFaGioYL3YxL3tuYW1lPXJhdGUtbGltaXRzLyp9KiMvdjEve25hbWU9Z2F0ZXdheXMvKi9yYXRlLWxpbWl0cy8qfUKDAgodY29tLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjFCDlJhdGVsaW1pdFByb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Response message for CreateRateLimit RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateRateLimitResponse
+ */
+export type CreateRateLimitResponse = Message<"redpanda.api.aigateway.v1.CreateRateLimitResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RateLimit rate_limit = 1;
+   */
+  rateLimit?: RateLimit;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateRateLimitResponse.
+ * Use `create(CreateRateLimitResponseSchema)` to create a new message.
+ */
+export const CreateRateLimitResponseSchema: GenMessage<CreateRateLimitResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 0);
+
+/**
+ * Response message for GetRateLimit RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetRateLimitResponse
+ */
+export type GetRateLimitResponse = Message<"redpanda.api.aigateway.v1.GetRateLimitResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RateLimit rate_limit = 1;
+   */
+  rateLimit?: RateLimit;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetRateLimitResponse.
+ * Use `create(GetRateLimitResponseSchema)` to create a new message.
+ */
+export const GetRateLimitResponseSchema: GenMessage<GetRateLimitResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 1);
+
+/**
+ * Response message for UpdateRateLimit RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateRateLimitResponse
+ */
+export type UpdateRateLimitResponse = Message<"redpanda.api.aigateway.v1.UpdateRateLimitResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RateLimit rate_limit = 1;
+   */
+  rateLimit?: RateLimit;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateRateLimitResponse.
+ * Use `create(UpdateRateLimitResponseSchema)` to create a new message.
+ */
+export const UpdateRateLimitResponseSchema: GenMessage<UpdateRateLimitResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 2);
+
+/**
+ * Response message for DeleteRateLimit RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteRateLimitResponse
+ */
+export type DeleteRateLimitResponse = Message<"redpanda.api.aigateway.v1.DeleteRateLimitResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteRateLimitResponse.
+ * Use `create(DeleteRateLimitResponseSchema)` to create a new message.
+ */
+export const DeleteRateLimitResponseSchema: GenMessage<DeleteRateLimitResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 3);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.RateLimit
+ */
+export type RateLimit = Message<"redpanda.api.aigateway.v1.RateLimit"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * CEL expression for rule matching (e.g., "request.headers['X-Tier'][0] == 'free'")
+   *
+   * @generated from field: string expression = 4;
+   */
+  expression: string;
+
+  /**
+   * CEL expression to extract rate limit key (e.g., "request.headers['X-User-ID'][0]")
+   * If not provided, a global rate limit is applied
+   *
+   * @generated from field: string key_extractor = 5;
+   */
+  keyExtractor: string;
+
+  /**
+   * Request-based limits (pre-request enforcement)
+   * At least one limit should be non-zero
+   * For token/cost-based limiting, use SpendLimitService instead (aligns with CUE schema)
+   *
+   * 0 = unlimited
+   *
+   * @generated from field: int64 requests_per_second = 6;
+   */
+  requestsPerSecond: bigint;
+
+  /**
+   * 0 = unlimited
+   *
+   * @generated from field: int64 requests_per_minute = 7;
+   */
+  requestsPerMinute: bigint;
+
+  /**
+   * 0 = unlimited
+   *
+   * @generated from field: int64 requests_per_day = 8;
+   */
+  requestsPerDay: bigint;
+
+  /**
+   * @generated from field: bool enabled = 11;
+   */
+  enabled: boolean;
+
+  /**
+   * @generated from field: map<string, string> metadata = 12;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * @generated from field: google.protobuf.Timestamp create_time = 13;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp update_time = 14;
+   */
+  updateTime?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RateLimit.
+ * Use `create(RateLimitSchema)` to create a new message.
+ */
+export const RateLimitSchema: GenMessage<RateLimit> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 4);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateRateLimitRequest
+ */
+export type CreateRateLimitRequest = Message<"redpanda.api.aigateway.v1.CreateRateLimitRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RateLimit rate_limit = 3;
+   */
+  rateLimit?: RateLimit;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateRateLimitRequest.
+ * Use `create(CreateRateLimitRequestSchema)` to create a new message.
+ */
+export const CreateRateLimitRequestSchema: GenMessage<CreateRateLimitRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 5);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetRateLimitRequest
+ */
+export type GetRateLimitRequest = Message<"redpanda.api.aigateway.v1.GetRateLimitRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetRateLimitRequest.
+ * Use `create(GetRateLimitRequestSchema)` to create a new message.
+ */
+export const GetRateLimitRequestSchema: GenMessage<GetRateLimitRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 6);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListRateLimitsRequest
+ */
+export type ListRateLimitsRequest = Message<"redpanda.api.aigateway.v1.ListRateLimitsRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListRateLimitsRequest.
+ * Use `create(ListRateLimitsRequestSchema)` to create a new message.
+ */
+export const ListRateLimitsRequestSchema: GenMessage<ListRateLimitsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 7);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListRateLimitsResponse
+ */
+export type ListRateLimitsResponse = Message<"redpanda.api.aigateway.v1.ListRateLimitsResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.RateLimit rate_limits = 1;
+   */
+  rateLimits: RateLimit[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListRateLimitsResponse.
+ * Use `create(ListRateLimitsResponseSchema)` to create a new message.
+ */
+export const ListRateLimitsResponseSchema: GenMessage<ListRateLimitsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 8);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateRateLimitRequest
+ */
+export type UpdateRateLimitRequest = Message<"redpanda.api.aigateway.v1.UpdateRateLimitRequest"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RateLimit rate_limit = 1;
+   */
+  rateLimit?: RateLimit;
+
+  /**
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateRateLimitRequest.
+ * Use `create(UpdateRateLimitRequestSchema)` to create a new message.
+ */
+export const UpdateRateLimitRequestSchema: GenMessage<UpdateRateLimitRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 9);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteRateLimitRequest
+ */
+export type DeleteRateLimitRequest = Message<"redpanda.api.aigateway.v1.DeleteRateLimitRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteRateLimitRequest.
+ * Use `create(DeleteRateLimitRequestSchema)` to create a new message.
+ */
+export const DeleteRateLimitRequestSchema: GenMessage<DeleteRateLimitRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_ratelimit, 10);
+
+/**
+ * @generated from service redpanda.api.aigateway.v1.RateLimitService
+ */
+export const RateLimitService: GenService<{
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.CreateRateLimit
+   */
+  createRateLimit: {
+    methodKind: "unary";
+    input: typeof CreateRateLimitRequestSchema;
+    output: typeof CreateRateLimitResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.GetRateLimit
+   */
+  getRateLimit: {
+    methodKind: "unary";
+    input: typeof GetRateLimitRequestSchema;
+    output: typeof GetRateLimitResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.ListRateLimits
+   */
+  listRateLimits: {
+    methodKind: "unary";
+    input: typeof ListRateLimitsRequestSchema;
+    output: typeof ListRateLimitsResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.UpdateRateLimit
+   */
+  updateRateLimit: {
+    methodKind: "unary";
+    input: typeof UpdateRateLimitRequestSchema;
+    output: typeof UpdateRateLimitResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RateLimitService.DeleteRateLimit
+   */
+  deleteRateLimit: {
+    methodKind: "unary";
+    input: typeof DeleteRateLimitRequestSchema;
+    output: typeof DeleteRateLimitResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_ratelimit, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/role-RoleService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/role-RoleService_connectquery.ts
new file mode 100644
index 0000000000..b0fd517f45
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/role-RoleService_connectquery.ts
@@ -0,0 +1,69 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/role.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { RoleService } from "./role_pb";
+
+/**
+ * Creates a new role within an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.RoleService.CreateRole
+ */
+export const createRole = RoleService.method.createRole;
+
+/**
+ * Gets a role by name.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.RoleService.GetRole
+ */
+export const getRole = RoleService.method.getRole;
+
+/**
+ * Lists roles within an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.RoleService.ListRoles
+ */
+export const listRoles = RoleService.method.listRoles;
+
+/**
+ * Updates a role.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.RoleService.UpdateRole
+ */
+export const updateRole = RoleService.method.updateRole;
+
+/**
+ * Deletes a role.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.RoleService.DeleteRole
+ */
+export const deleteRole = RoleService.method.deleteRole;
+
+/**
+ * Assigns a role to a team.
+ * Implements Cedar pattern: Team in Role
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.RoleService.AssignTeamRole
+ */
+export const assignTeamRole = RoleService.method.assignTeamRole;
+
+/**
+ * Unassigns a role from a team.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.RoleService.UnassignTeamRole
+ */
+export const unassignTeamRole = RoleService.method.unassignTeamRole;
+
+/**
+ * Lists teams assigned to a role.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.RoleService.ListRoleTeams
+ */
+export const listRoleTeams = RoleService.method.listRoleTeams;
+
+/**
+ * Lists roles assigned to a team.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.RoleService.ListTeamRoles
+ */
+export const listTeamRoles = RoleService.method.listTeamRoles;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/role_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/role_pb.ts
new file mode 100644
index 0000000000..115d098b16
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/role_pb.ts
@@ -0,0 +1,748 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/role.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/role.proto.
+ */
+export const file_redpanda_api_aigateway_v1_role: GenFile = /*@__PURE__*/
+  fileDesc("CiRyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3JvbGUucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEiwgMKBFJvbGUSEQoEbmFtZRgBIAEoCUID4EEIEiMKDGRpc3BsYXlfbmFtZRgCIAEoCUIN4EECukgHcgUQARj/ARIYCgtkZXNjcmlwdGlvbhgDIAEoCUID4EEBEj8KCG1ldGFkYXRhGAQgAygLMi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Sb2xlLk1ldGFkYXRhRW50cnkSNAoLY3JlYXRlX3RpbWUYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSNAoLdXBkYXRlX3RpbWUYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSFAoHY3JlYXRvchgHIAEoCUID4EEDEhQKB3VwZGF0ZXIYCCABKAlCA+BBAxovCg1NZXRhZGF0YUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAE6XupBWwobYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Sb2xlEjxhY2NvdW50cy97YWNjb3VudH0vb3JnYW5pemF0aW9ucy97b3JnYW5pemF0aW9ufS9yb2xlcy97cm9sZX0iygEKElRlYW1Sb2xlQXNzaWdubWVudBIxCgR0ZWFtGAEgASgJQiPgQQL6QR0KG2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vVGVhbRIxCgRyb2xlGAIgASgJQiPgQQL6QR0KG2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vUm9sZRI0Cgthc3NpZ25lZF9hdBgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIYCgthc3NpZ25lZF9ieRgEIAEoCUID4EEDIpoBChFDcmVhdGVSb2xlUmVxdWVzdBI7CgZwYXJlbnQYASABKAlCK+BBAvpBJQojYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Pcmdhbml6YXRpb24SFAoHcm9sZV9pZBgCIAEoCUID4EEBEjIKBHJvbGUYAyABKAsyHy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJvbGVCA+BBAiJDChJDcmVhdGVSb2xlUmVzcG9uc2USLQoEcm9sZRgBIAEoCzIfLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm9sZSJDCg5HZXRSb2xlUmVxdWVzdBIxCgRuYW1lGAEgASgJQiPgQQL6QR0KG2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vUm9sZSJACg9HZXRSb2xlUmVzcG9uc2USLQoEcm9sZRgBIAEoCzIfLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm9sZSK2AQoQTGlzdFJvbGVzUmVxdWVzdBI7CgZwYXJlbnQYASABKAlCK+BBAvpBJQojYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Pcmdhbml6YXRpb24SIAoJcGFnZV9zaXplGAIgASgFQg3gQQG6SAcaBRjoBygAEhcKCnBhZ2VfdG9rZW4YAyABKAlCA+BBARITCgZmaWx0ZXIYBCABKAlCA+BBARIVCghvcmRlcl9ieRgFIAEoCUID4EEBInAKEUxpc3RSb2xlc1Jlc3BvbnNlEi4KBXJvbGVzGAEgAygLMh8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Sb2xlEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFIn0KEVVwZGF0ZVJvbGVSZXF1ZXN0EjIKBHJvbGUYASABKAsyHy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJvbGVCA+BBAhI0Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCA+BBASJDChJVcGRhdGVSb2xlUmVzcG9uc2USLQoEcm9sZRgBIAEoCzIfLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm9sZSJaChFEZWxldGVSb2xlUmVxdWVzdBIxCgRuYW1lGAEgASgJQiPgQQL6QR0KG2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vUm9sZRISCgVmb3JjZRgCIAEoCEID4EEBIhQKEkRlbGV0ZVJvbGVSZXNwb25zZSJ9ChVBc3NpZ25UZWFtUm9sZVJlcXVlc3QSMQoEcm9sZRgBIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1JvbGUSMQoEdGVhbRgCIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1RlYW0iWwoWQXNzaWduVGVhbVJvbGVSZXNwb25zZRJBCgphc3NpZ25tZW50GAEgASgLMi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UZWFtUm9sZUFzc2lnbm1lbnQifwoXVW5hc3NpZ25UZWFtUm9sZVJlcXVlc3QSMQoEcm9sZRgBIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1JvbGUSMQoEdGVhbRgCIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1RlYW0iGgoYVW5hc3NpZ25UZWFtUm9sZVJlc3BvbnNlIoQBChRMaXN0Um9sZVRlYW1zUmVxdWVzdBIxCgRyb2xlGAEgASgJQiPgQQL6QR0KG2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vUm9sZRIgCglwYWdlX3NpemUYAiABKAVCDeBBAbpIBxoFGOgHKAASFwoKcGFnZV90b2tlbhgDIAEoCUID4EEBIogBChVMaXN0Um9sZVRlYW1zUmVzcG9uc2USQgoLYXNzaWdubWVudHMYASADKAsyLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlYW1Sb2xlQXNzaWdubWVudBIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSKEAQoUTGlzdFRlYW1Sb2xlc1JlcXVlc3QSMQoEdGVhbRgBIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1RlYW0SIAoJcGFnZV9zaXplGAIgASgFQg3gQQG6SAcaBRjoBygAEhcKCnBhZ2VfdG9rZW4YAyABKAlCA+BBASKIAQoVTGlzdFRlYW1Sb2xlc1Jlc3BvbnNlEkIKC2Fzc2lnbm1lbnRzGAEgAygLMi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UZWFtUm9sZUFzc2lnbm1lbnQSFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJEhIKCnRvdGFsX3NpemUYAyABKAUywgwKC1JvbGVTZXJ2aWNlEqYBCgpDcmVhdGVSb2xlEiwucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVSb2xlUmVxdWVzdBotLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlUm9sZVJlc3BvbnNlIjuC0+STAjU6BHJvbGUiLS92MS97cGFyZW50PWFjY291bnRzLyovb3JnYW5pemF0aW9ucy8qfS9yb2xlcxKXAQoHR2V0Um9sZRIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0Um9sZVJlcXVlc3QaKi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldFJvbGVSZXNwb25zZSI1gtPkkwIvEi0vdjEve25hbWU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovcm9sZXMvKn0SnQEKCUxpc3RSb2xlcxIrLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFJvbGVzUmVxdWVzdBosLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFJvbGVzUmVzcG9uc2UiNYLT5JMCLxItL3YxL3twYXJlbnQ9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyp9L3JvbGVzEqsBCgpVcGRhdGVSb2xlEiwucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVSb2xlUmVxdWVzdBotLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlUm9sZVJlc3BvbnNlIkCC0+STAjo6BHJvbGUyMi92MS97cm9sZS5uYW1lPWFjY291bnRzLyovb3JnYW5pemF0aW9ucy8qL3JvbGVzLyp9EqABCgpEZWxldGVSb2xlEiwucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVSb2xlUmVxdWVzdBotLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlUm9sZVJlc3BvbnNlIjWC0+STAi8qLS92MS97bmFtZT1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKi9yb2xlcy8qfRK6AQoOQXNzaWduVGVhbVJvbGUSMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkFzc2lnblRlYW1Sb2xlUmVxdWVzdBoxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXNzaWduVGVhbVJvbGVSZXNwb25zZSJDgtPkkwI9OgEqIjgvdjEve3JvbGU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovcm9sZXMvKn06YXNzaWduVGVhbRLCAQoQVW5hc3NpZ25UZWFtUm9sZRIyLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVW5hc3NpZ25UZWFtUm9sZVJlcXVlc3QaMy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVuYXNzaWduVGVhbVJvbGVSZXNwb25zZSJFgtPkkwI/OgEqIjovdjEve3JvbGU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovcm9sZXMvKn06dW5hc3NpZ25UZWFtEq8BCg1MaXN0Um9sZVRlYW1zEi8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0Um9sZVRlYW1zUmVxdWVzdBowLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFJvbGVUZWFtc1Jlc3BvbnNlIjuC0+STAjUSMy92MS97cm9sZT1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKi9yb2xlcy8qfS90ZWFtcxKvAQoNTGlzdFRlYW1Sb2xlcxIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFRlYW1Sb2xlc1JlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RUZWFtUm9sZXNSZXNwb25zZSI7gtPkkwI1EjMvdjEve3RlYW09YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovdGVhbXMvKn0vcm9sZXMaGcpBFmFpZ2F0ZXdheS5yZWRwYW5kYS5jb21C/gEKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQglSb2xlUHJvdG9QAVpLZ28ucGFuZGEuZGV2L3JlZHBhbmRhLWFpZ3cvcHJvdG9zL2dlbi9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxO2FpZ2F0ZXdheXYxogIDUkFBqgIZUmVkcGFuZGEuQXBpLkFpZ2F0ZXdheS5WMcoCGVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjHiAiVSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYxXEdQQk1ldGFkYXRh6gIcUmVkcGFuZGE6OkFwaTo6QWlnYXRld2F5OjpWMWIGcHJvdG8z", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Role represents a named Cedar entity within an organization.
+ * Roles can be assigned to teams. Permissions are defined via Cedar policies.
+ * Cedar entity type: AIGateway::Role
+ *
+ * @generated from message redpanda.api.aigateway.v1.Role
+ */
+export type Role = Message<"redpanda.api.aigateway.v1.Role"> & {
+  /**
+   * Resource name. Format: `accounts/{account}/organizations/{organization}/roles/{role}`
+   * Role ID is a globally unique, sortable identifier (XID).
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name (must be unique within organization)
+   * This is used in Cedar policies: AIGateway::Role::"Admin"
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Metadata for arbitrary key-value pairs
+   *
+   * @generated from field: map<string, string> metadata = 4;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 5;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 6;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Creator (API key or OIDC subject)
+   *
+   * @generated from field: string creator = 7;
+   */
+  creator: string;
+
+  /**
+   * Output only. Last updater (API key or OIDC subject)
+   *
+   * @generated from field: string updater = 8;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Role.
+ * Use `create(RoleSchema)` to create a new message.
+ */
+export const RoleSchema: GenMessage<Role> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 0);
+
+/**
+ * TeamRoleAssignment represents the assignment of a role to a team.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TeamRoleAssignment
+ */
+export type TeamRoleAssignment = Message<"redpanda.api.aigateway.v1.TeamRoleAssignment"> & {
+  /**
+   * Reference to the team.
+   * Format: `accounts/{account}/organizations/{organization}/teams/{team}`
+   *
+   * @generated from field: string team = 1;
+   */
+  team: string;
+
+  /**
+   * Reference to the role.
+   * Format: `accounts/{account}/organizations/{organization}/roles/{role}`
+   *
+   * @generated from field: string role = 2;
+   */
+  role: string;
+
+  /**
+   * Output only. When the assignment was created
+   *
+   * @generated from field: google.protobuf.Timestamp assigned_at = 3;
+   */
+  assignedAt?: Timestamp;
+
+  /**
+   * Output only. Who created the assignment
+   *
+   * @generated from field: string assigned_by = 4;
+   */
+  assignedBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TeamRoleAssignment.
+ * Use `create(TeamRoleAssignmentSchema)` to create a new message.
+ */
+export const TeamRoleAssignmentSchema: GenMessage<TeamRoleAssignment> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 1);
+
+/**
+ * Request message for CreateRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateRoleRequest
+ */
+export type CreateRoleRequest = Message<"redpanda.api.aigateway.v1.CreateRoleRequest"> & {
+  /**
+   * Required: Parent organization.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * The role ID to use. If empty, server generates one.
+   *
+   * @generated from field: string role_id = 2;
+   */
+  roleId: string;
+
+  /**
+   * Required: The role resource to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Role role = 3;
+   */
+  role?: Role;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateRoleRequest.
+ * Use `create(CreateRoleRequestSchema)` to create a new message.
+ */
+export const CreateRoleRequestSchema: GenMessage<CreateRoleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 2);
+
+/**
+ * Response message for CreateRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateRoleResponse
+ */
+export type CreateRoleResponse = Message<"redpanda.api.aigateway.v1.CreateRoleResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Role role = 1;
+   */
+  role?: Role;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateRoleResponse.
+ * Use `create(CreateRoleResponseSchema)` to create a new message.
+ */
+export const CreateRoleResponseSchema: GenMessage<CreateRoleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 3);
+
+/**
+ * Request message for GetRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetRoleRequest
+ */
+export type GetRoleRequest = Message<"redpanda.api.aigateway.v1.GetRoleRequest"> & {
+  /**
+   * Resource name of the role.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetRoleRequest.
+ * Use `create(GetRoleRequestSchema)` to create a new message.
+ */
+export const GetRoleRequestSchema: GenMessage<GetRoleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 4);
+
+/**
+ * Response message for GetRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetRoleResponse
+ */
+export type GetRoleResponse = Message<"redpanda.api.aigateway.v1.GetRoleResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Role role = 1;
+   */
+  role?: Role;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetRoleResponse.
+ * Use `create(GetRoleResponseSchema)` to create a new message.
+ */
+export const GetRoleResponseSchema: GenMessage<GetRoleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 5);
+
+/**
+ * Request message for ListRoles RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListRolesRequest
+ */
+export type ListRolesRequest = Message<"redpanda.api.aigateway.v1.ListRolesRequest"> & {
+  /**
+   * Required: Parent organization.
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of roles to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous ListRoles call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter expression (CEL syntax)
+   *
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * Comma-separated list of fields to order by
+   *
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListRolesRequest.
+ * Use `create(ListRolesRequestSchema)` to create a new message.
+ */
+export const ListRolesRequestSchema: GenMessage<ListRolesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 6);
+
+/**
+ * Response message for ListRoles RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListRolesResponse
+ */
+export type ListRolesResponse = Message<"redpanda.api.aigateway.v1.ListRolesResponse"> & {
+  /**
+   * The list of roles
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.Role roles = 1;
+   */
+  roles: Role[];
+
+  /**
+   * Token for next page (empty if no more pages)
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count of matching roles
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListRolesResponse.
+ * Use `create(ListRolesResponseSchema)` to create a new message.
+ */
+export const ListRolesResponseSchema: GenMessage<ListRolesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 7);
+
+/**
+ * Request message for UpdateRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateRoleRequest
+ */
+export type UpdateRoleRequest = Message<"redpanda.api.aigateway.v1.UpdateRoleRequest"> & {
+  /**
+   * Required: The role resource to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Role role = 1;
+   */
+  role?: Role;
+
+  /**
+   * The fields to update.
+   * Allowed fields: display_name, description, metadata
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateRoleRequest.
+ * Use `create(UpdateRoleRequestSchema)` to create a new message.
+ */
+export const UpdateRoleRequestSchema: GenMessage<UpdateRoleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 8);
+
+/**
+ * Response message for UpdateRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateRoleResponse
+ */
+export type UpdateRoleResponse = Message<"redpanda.api.aigateway.v1.UpdateRoleResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Role role = 1;
+   */
+  role?: Role;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateRoleResponse.
+ * Use `create(UpdateRoleResponseSchema)` to create a new message.
+ */
+export const UpdateRoleResponseSchema: GenMessage<UpdateRoleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 9);
+
+/**
+ * Request message for DeleteRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteRoleRequest
+ */
+export type DeleteRoleRequest = Message<"redpanda.api.aigateway.v1.DeleteRoleRequest"> & {
+  /**
+   * Resource name of the role to delete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * If true, unassign all teams from this role before deleting
+   *
+   * @generated from field: bool force = 2;
+   */
+  force: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteRoleRequest.
+ * Use `create(DeleteRoleRequestSchema)` to create a new message.
+ */
+export const DeleteRoleRequestSchema: GenMessage<DeleteRoleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 10);
+
+/**
+ * Response message for DeleteRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteRoleResponse
+ */
+export type DeleteRoleResponse = Message<"redpanda.api.aigateway.v1.DeleteRoleResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteRoleResponse.
+ * Use `create(DeleteRoleResponseSchema)` to create a new message.
+ */
+export const DeleteRoleResponseSchema: GenMessage<DeleteRoleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 11);
+
+/**
+ * Request message for AssignTeamRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AssignTeamRoleRequest
+ */
+export type AssignTeamRoleRequest = Message<"redpanda.api.aigateway.v1.AssignTeamRoleRequest"> & {
+  /**
+   * Required: Role to assign.
+   * Format: `accounts/{account}/organizations/{organization}/roles/{role}`
+   *
+   * @generated from field: string role = 1;
+   */
+  role: string;
+
+  /**
+   * Required: Team to assign the role to.
+   * Format: `accounts/{account}/organizations/{organization}/teams/{team}`
+   *
+   * @generated from field: string team = 2;
+   */
+  team: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AssignTeamRoleRequest.
+ * Use `create(AssignTeamRoleRequestSchema)` to create a new message.
+ */
+export const AssignTeamRoleRequestSchema: GenMessage<AssignTeamRoleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 12);
+
+/**
+ * Response message for AssignTeamRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AssignTeamRoleResponse
+ */
+export type AssignTeamRoleResponse = Message<"redpanda.api.aigateway.v1.AssignTeamRoleResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.TeamRoleAssignment assignment = 1;
+   */
+  assignment?: TeamRoleAssignment;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AssignTeamRoleResponse.
+ * Use `create(AssignTeamRoleResponseSchema)` to create a new message.
+ */
+export const AssignTeamRoleResponseSchema: GenMessage<AssignTeamRoleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 13);
+
+/**
+ * Request message for UnassignTeamRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UnassignTeamRoleRequest
+ */
+export type UnassignTeamRoleRequest = Message<"redpanda.api.aigateway.v1.UnassignTeamRoleRequest"> & {
+  /**
+   * Required: Role to unassign.
+   * Format: `accounts/{account}/organizations/{organization}/roles/{role}`
+   *
+   * @generated from field: string role = 1;
+   */
+  role: string;
+
+  /**
+   * Required: Team to unassign the role from.
+   * Format: `accounts/{account}/organizations/{organization}/teams/{team}`
+   *
+   * @generated from field: string team = 2;
+   */
+  team: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UnassignTeamRoleRequest.
+ * Use `create(UnassignTeamRoleRequestSchema)` to create a new message.
+ */
+export const UnassignTeamRoleRequestSchema: GenMessage<UnassignTeamRoleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 14);
+
+/**
+ * Response message for UnassignTeamRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UnassignTeamRoleResponse
+ */
+export type UnassignTeamRoleResponse = Message<"redpanda.api.aigateway.v1.UnassignTeamRoleResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UnassignTeamRoleResponse.
+ * Use `create(UnassignTeamRoleResponseSchema)` to create a new message.
+ */
+export const UnassignTeamRoleResponseSchema: GenMessage<UnassignTeamRoleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 15);
+
+/**
+ * Request message for ListRoleTeams RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListRoleTeamsRequest
+ */
+export type ListRoleTeamsRequest = Message<"redpanda.api.aigateway.v1.ListRoleTeamsRequest"> & {
+  /**
+   * Required: Role to list teams for.
+   * Format: `accounts/{account}/organizations/{organization}/roles/{role}`
+   *
+   * @generated from field: string role = 1;
+   */
+  role: string;
+
+  /**
+   * Maximum number of assignments to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListRoleTeamsRequest.
+ * Use `create(ListRoleTeamsRequestSchema)` to create a new message.
+ */
+export const ListRoleTeamsRequestSchema: GenMessage<ListRoleTeamsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 16);
+
+/**
+ * Response message for ListRoleTeams RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListRoleTeamsResponse
+ */
+export type ListRoleTeamsResponse = Message<"redpanda.api.aigateway.v1.ListRoleTeamsResponse"> & {
+  /**
+   * The list of team role assignments
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.TeamRoleAssignment assignments = 1;
+   */
+  assignments: TeamRoleAssignment[];
+
+  /**
+   * Token for next page
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListRoleTeamsResponse.
+ * Use `create(ListRoleTeamsResponseSchema)` to create a new message.
+ */
+export const ListRoleTeamsResponseSchema: GenMessage<ListRoleTeamsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 17);
+
+/**
+ * Request message for ListTeamRoles RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListTeamRolesRequest
+ */
+export type ListTeamRolesRequest = Message<"redpanda.api.aigateway.v1.ListTeamRolesRequest"> & {
+  /**
+   * Required: Team to list roles for.
+   * Format: `accounts/{account}/organizations/{organization}/teams/{team}`
+   *
+   * @generated from field: string team = 1;
+   */
+  team: string;
+
+  /**
+   * Maximum number of assignments to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListTeamRolesRequest.
+ * Use `create(ListTeamRolesRequestSchema)` to create a new message.
+ */
+export const ListTeamRolesRequestSchema: GenMessage<ListTeamRolesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 18);
+
+/**
+ * Response message for ListTeamRoles RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListTeamRolesResponse
+ */
+export type ListTeamRolesResponse = Message<"redpanda.api.aigateway.v1.ListTeamRolesResponse"> & {
+  /**
+   * The list of team role assignments
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.TeamRoleAssignment assignments = 1;
+   */
+  assignments: TeamRoleAssignment[];
+
+  /**
+   * Token for next page
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListTeamRolesResponse.
+ * Use `create(ListTeamRolesResponseSchema)` to create a new message.
+ */
+export const ListTeamRolesResponseSchema: GenMessage<ListTeamRolesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_role, 19);
+
+/**
+ * RoleService manages roles within organizations.
+ * Roles are Cedar entities that teams can be assigned to.
+ * Permissions for roles are defined via Cedar policies, not stored in the role itself.
+ * Resource name: accounts/{account_id}/organizations/{organization_id}/roles/{role_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.RoleService
+ */
+export const RoleService: GenService<{
+  /**
+   * Creates a new role within an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.RoleService.CreateRole
+   */
+  createRole: {
+    methodKind: "unary";
+    input: typeof CreateRoleRequestSchema;
+    output: typeof CreateRoleResponseSchema;
+  },
+  /**
+   * Gets a role by name.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.RoleService.GetRole
+   */
+  getRole: {
+    methodKind: "unary";
+    input: typeof GetRoleRequestSchema;
+    output: typeof GetRoleResponseSchema;
+  },
+  /**
+   * Lists roles within an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.RoleService.ListRoles
+   */
+  listRoles: {
+    methodKind: "unary";
+    input: typeof ListRolesRequestSchema;
+    output: typeof ListRolesResponseSchema;
+  },
+  /**
+   * Updates a role.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.RoleService.UpdateRole
+   */
+  updateRole: {
+    methodKind: "unary";
+    input: typeof UpdateRoleRequestSchema;
+    output: typeof UpdateRoleResponseSchema;
+  },
+  /**
+   * Deletes a role.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.RoleService.DeleteRole
+   */
+  deleteRole: {
+    methodKind: "unary";
+    input: typeof DeleteRoleRequestSchema;
+    output: typeof DeleteRoleResponseSchema;
+  },
+  /**
+   * Assigns a role to a team.
+   * Implements Cedar pattern: Team in Role
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.RoleService.AssignTeamRole
+   */
+  assignTeamRole: {
+    methodKind: "unary";
+    input: typeof AssignTeamRoleRequestSchema;
+    output: typeof AssignTeamRoleResponseSchema;
+  },
+  /**
+   * Unassigns a role from a team.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.RoleService.UnassignTeamRole
+   */
+  unassignTeamRole: {
+    methodKind: "unary";
+    input: typeof UnassignTeamRoleRequestSchema;
+    output: typeof UnassignTeamRoleResponseSchema;
+  },
+  /**
+   * Lists teams assigned to a role.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.RoleService.ListRoleTeams
+   */
+  listRoleTeams: {
+    methodKind: "unary";
+    input: typeof ListRoleTeamsRequestSchema;
+    output: typeof ListRoleTeamsResponseSchema;
+  },
+  /**
+   * Lists roles assigned to a team.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.RoleService.ListTeamRoles
+   */
+  listTeamRoles: {
+    methodKind: "unary";
+    input: typeof ListTeamRolesRequestSchema;
+    output: typeof ListTeamRolesResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_role, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/routing-RoutingService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/routing-RoutingService_connectquery.ts
new file mode 100644
index 0000000000..6c6dfe4f6d
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/routing-RoutingService_connectquery.ts
@@ -0,0 +1,30 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/routing.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { RoutingService } from "./routing_pb";
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RoutingService.CreateRoutingRule
+ */
+export const createRoutingRule = RoutingService.method.createRoutingRule;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RoutingService.GetRoutingRule
+ */
+export const getRoutingRule = RoutingService.method.getRoutingRule;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RoutingService.ListRoutingRules
+ */
+export const listRoutingRules = RoutingService.method.listRoutingRules;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RoutingService.UpdateRoutingRule
+ */
+export const updateRoutingRule = RoutingService.method.updateRoutingRule;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.RoutingService.DeleteRoutingRule
+ */
+export const deleteRoutingRule = RoutingService.method.deleteRoutingRule;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/routing_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/routing_pb.ts
new file mode 100644
index 0000000000..d14bcc18d9
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/routing_pb.ts
@@ -0,0 +1,351 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/routing.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/routing.proto.
+ */
+export const file_redpanda_api_aigateway_v1_routing: GenFile = /*@__PURE__*/
+  fileDesc("CidyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3JvdXRpbmcucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEiWQoZQ3JlYXRlUm91dGluZ1J1bGVSZXNwb25zZRI8Cgxyb3V0aW5nX3J1bGUYASABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJvdXRpbmdSdWxlIlYKFkdldFJvdXRpbmdSdWxlUmVzcG9uc2USPAoMcm91dGluZ19ydWxlGAEgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Sb3V0aW5nUnVsZSJZChlVcGRhdGVSb3V0aW5nUnVsZVJlc3BvbnNlEjwKDHJvdXRpbmdfcnVsZRgBIAEoCzImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm91dGluZ1J1bGUiGwoZRGVsZXRlUm91dGluZ1J1bGVSZXNwb25zZSKSBQoLUm91dGluZ1J1bGUSEQoEbmFtZRgBIAEoCUID4EEIEiAKDGRpc3BsYXlfbmFtZRgCIAEoCUIK4EECukgEcgIQARITCgtkZXNjcmlwdGlvbhgDIAEoCRIfCghwcmlvcml0eRgEIAEoBUIN4EECukgHGgUY5wcoABIeCgpleHByZXNzaW9uGAUgASgJQgrgQQK6SARyAhABEkcKDGJhY2tlbmRfcG9vbBgGIAEoCUIx4EEC+kEkCiJhaWdhdGV3YXkucmVkcGFuZGEuY29tL0JhY2tlbmRQb29sukgEcgIQARJBCg1mYWxsYmFja19wb29sGAsgASgJQirgQQH6QSQKImFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vQmFja2VuZFBvb2wSDwoHZW5hYmxlZBgHIAEoCBJGCghtZXRhZGF0YRgIIAMoCzI0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm91dGluZ1J1bGUuTWV0YWRhdGFFbnRyeRI0CgtjcmVhdGVfdGltZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxI0Cgt1cGRhdGVfdGltZRgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxovCg1NZXRhZGF0YUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAE6dupBcwoiYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Sb3V0aW5nUnVsZRIvZ2F0ZXdheXMve2dhdGV3YXl9L3JvdXRpbmctcnVsZXMve3JvdXRpbmdfcnVsZX0SHHJvdXRpbmctcnVsZXMve3JvdXRpbmdfcnVsZX0ihAEKGENyZWF0ZVJvdXRpbmdSdWxlUmVxdWVzdBIOCgZwYXJlbnQYASABKAkSQQoMcm91dGluZ19ydWxlGAMgASgLMiYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Sb3V0aW5nUnVsZUID4EECSgQIAhADUg9yb3V0aW5nX3J1bGVfaWQiUQoVR2V0Um91dGluZ1J1bGVSZXF1ZXN0EjgKBG5hbWUYASABKAlCKuBBAvpBJAoiYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Sb3V0aW5nUnVsZSJyChdMaXN0Um91dGluZ1J1bGVzUmVxdWVzdBIOCgZwYXJlbnQYASABKAkSEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkSDgoGZmlsdGVyGAQgASgJEhAKCG9yZGVyX2J5GAUgASgJIoYBChhMaXN0Um91dGluZ1J1bGVzUmVzcG9uc2USPQoNcm91dGluZ19ydWxlcxgBIAMoCzImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm91dGluZ1J1bGUSFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJEhIKCnRvdGFsX3NpemUYAyABKAUijgEKGFVwZGF0ZVJvdXRpbmdSdWxlUmVxdWVzdBJBCgxyb3V0aW5nX3J1bGUYASABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJvdXRpbmdSdWxlQgPgQQISLwoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrIlQKGERlbGV0ZVJvdXRpbmdSdWxlUmVxdWVzdBI4CgRuYW1lGAEgASgJQirgQQL6QSQKImFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vUm91dGluZ1J1bGUyywgKDlJvdXRpbmdTZXJ2aWNlEt4BChFDcmVhdGVSb3V0aW5nUnVsZRIzLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlUm91dGluZ1J1bGVSZXF1ZXN0GjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVSb3V0aW5nUnVsZVJlc3BvbnNlIl6C0+STAlg6DHJvdXRpbmdfcnVsZVohOgxyb3V0aW5nX3J1bGUiES92MS9yb3V0aW5nLXJ1bGVzIiUvdjEve3BhcmVudD1nYXRld2F5cy8qfS9yb3V0aW5nLXJ1bGVzEsIBCg5HZXRSb3V0aW5nUnVsZRIwLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0Um91dGluZ1J1bGVSZXF1ZXN0GjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRSb3V0aW5nUnVsZVJlc3BvbnNlIkuC0+STAkVaHBIaL3YxL3tuYW1lPXJvdXRpbmctcnVsZXMvKn0SJS92MS97bmFtZT1nYXRld2F5cy8qL3JvdXRpbmctcnVsZXMvKn0SvwEKEExpc3RSb3V0aW5nUnVsZXMSMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RSb3V0aW5nUnVsZXNSZXF1ZXN0GjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0Um91dGluZ1J1bGVzUmVzcG9uc2UiQoLT5JMCPFoTEhEvdjEvcm91dGluZy1ydWxlcxIlL3YxL3twYXJlbnQ9Z2F0ZXdheXMvKn0vcm91dGluZy1ydWxlcxKCAgoRVXBkYXRlUm91dGluZ1J1bGUSMy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZVJvdXRpbmdSdWxlUmVxdWVzdBo0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlUm91dGluZ1J1bGVSZXNwb25zZSKBAYLT5JMCezoMcm91dGluZ19ydWxlWjc6DHJvdXRpbmdfcnVsZTInL3YxL3tyb3V0aW5nX3J1bGUubmFtZT1yb3V0aW5nLXJ1bGVzLyp9MjIvdjEve3JvdXRpbmdfcnVsZS5uYW1lPWdhdGV3YXlzLyovcm91dGluZy1ydWxlcy8qfRLLAQoRRGVsZXRlUm91dGluZ1J1bGUSMy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZVJvdXRpbmdSdWxlUmVxdWVzdBo0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlUm91dGluZ1J1bGVSZXNwb25zZSJLgtPkkwJFWhwqGi92MS97bmFtZT1yb3V0aW5nLXJ1bGVzLyp9KiUvdjEve25hbWU9Z2F0ZXdheXMvKi9yb3V0aW5nLXJ1bGVzLyp9QoECCh1jb20ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MUIMUm91dGluZ1Byb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Response message for CreateRoutingRule RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateRoutingRuleResponse
+ */
+export type CreateRoutingRuleResponse = Message<"redpanda.api.aigateway.v1.CreateRoutingRuleResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RoutingRule routing_rule = 1;
+   */
+  routingRule?: RoutingRule;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateRoutingRuleResponse.
+ * Use `create(CreateRoutingRuleResponseSchema)` to create a new message.
+ */
+export const CreateRoutingRuleResponseSchema: GenMessage<CreateRoutingRuleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 0);
+
+/**
+ * Response message for GetRoutingRule RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetRoutingRuleResponse
+ */
+export type GetRoutingRuleResponse = Message<"redpanda.api.aigateway.v1.GetRoutingRuleResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RoutingRule routing_rule = 1;
+   */
+  routingRule?: RoutingRule;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetRoutingRuleResponse.
+ * Use `create(GetRoutingRuleResponseSchema)` to create a new message.
+ */
+export const GetRoutingRuleResponseSchema: GenMessage<GetRoutingRuleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 1);
+
+/**
+ * Response message for UpdateRoutingRule RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateRoutingRuleResponse
+ */
+export type UpdateRoutingRuleResponse = Message<"redpanda.api.aigateway.v1.UpdateRoutingRuleResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RoutingRule routing_rule = 1;
+   */
+  routingRule?: RoutingRule;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateRoutingRuleResponse.
+ * Use `create(UpdateRoutingRuleResponseSchema)` to create a new message.
+ */
+export const UpdateRoutingRuleResponseSchema: GenMessage<UpdateRoutingRuleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 2);
+
+/**
+ * Response message for DeleteRoutingRule RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteRoutingRuleResponse
+ */
+export type DeleteRoutingRuleResponse = Message<"redpanda.api.aigateway.v1.DeleteRoutingRuleResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteRoutingRuleResponse.
+ * Use `create(DeleteRoutingRuleResponseSchema)` to create a new message.
+ */
+export const DeleteRoutingRuleResponseSchema: GenMessage<DeleteRoutingRuleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 3);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.RoutingRule
+ */
+export type RoutingRule = Message<"redpanda.api.aigateway.v1.RoutingRule"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * @generated from field: int32 priority = 4;
+   */
+  priority: number;
+
+  /**
+   * @generated from field: string expression = 5;
+   */
+  expression: string;
+
+  /**
+   * @generated from field: string backend_pool = 6;
+   */
+  backendPool: string;
+
+  /**
+   * Optional fallback backend pool to use when primary pool fails.
+   * Must reference a different pool than backend_pool.
+   *
+   * @generated from field: string fallback_pool = 11;
+   */
+  fallbackPool: string;
+
+  /**
+   * @generated from field: bool enabled = 7;
+   */
+  enabled: boolean;
+
+  /**
+   * @generated from field: map<string, string> metadata = 8;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * @generated from field: google.protobuf.Timestamp create_time = 9;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp update_time = 10;
+   */
+  updateTime?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RoutingRule.
+ * Use `create(RoutingRuleSchema)` to create a new message.
+ */
+export const RoutingRuleSchema: GenMessage<RoutingRule> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 4);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateRoutingRuleRequest
+ */
+export type CreateRoutingRuleRequest = Message<"redpanda.api.aigateway.v1.CreateRoutingRuleRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RoutingRule routing_rule = 3;
+   */
+  routingRule?: RoutingRule;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateRoutingRuleRequest.
+ * Use `create(CreateRoutingRuleRequestSchema)` to create a new message.
+ */
+export const CreateRoutingRuleRequestSchema: GenMessage<CreateRoutingRuleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 5);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetRoutingRuleRequest
+ */
+export type GetRoutingRuleRequest = Message<"redpanda.api.aigateway.v1.GetRoutingRuleRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetRoutingRuleRequest.
+ * Use `create(GetRoutingRuleRequestSchema)` to create a new message.
+ */
+export const GetRoutingRuleRequestSchema: GenMessage<GetRoutingRuleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 6);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListRoutingRulesRequest
+ */
+export type ListRoutingRulesRequest = Message<"redpanda.api.aigateway.v1.ListRoutingRulesRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListRoutingRulesRequest.
+ * Use `create(ListRoutingRulesRequestSchema)` to create a new message.
+ */
+export const ListRoutingRulesRequestSchema: GenMessage<ListRoutingRulesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 7);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListRoutingRulesResponse
+ */
+export type ListRoutingRulesResponse = Message<"redpanda.api.aigateway.v1.ListRoutingRulesResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.RoutingRule routing_rules = 1;
+   */
+  routingRules: RoutingRule[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListRoutingRulesResponse.
+ * Use `create(ListRoutingRulesResponseSchema)` to create a new message.
+ */
+export const ListRoutingRulesResponseSchema: GenMessage<ListRoutingRulesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 8);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateRoutingRuleRequest
+ */
+export type UpdateRoutingRuleRequest = Message<"redpanda.api.aigateway.v1.UpdateRoutingRuleRequest"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.RoutingRule routing_rule = 1;
+   */
+  routingRule?: RoutingRule;
+
+  /**
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateRoutingRuleRequest.
+ * Use `create(UpdateRoutingRuleRequestSchema)` to create a new message.
+ */
+export const UpdateRoutingRuleRequestSchema: GenMessage<UpdateRoutingRuleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 9);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteRoutingRuleRequest
+ */
+export type DeleteRoutingRuleRequest = Message<"redpanda.api.aigateway.v1.DeleteRoutingRuleRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteRoutingRuleRequest.
+ * Use `create(DeleteRoutingRuleRequestSchema)` to create a new message.
+ */
+export const DeleteRoutingRuleRequestSchema: GenMessage<DeleteRoutingRuleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_routing, 10);
+
+/**
+ * @generated from service redpanda.api.aigateway.v1.RoutingService
+ */
+export const RoutingService: GenService<{
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RoutingService.CreateRoutingRule
+   */
+  createRoutingRule: {
+    methodKind: "unary";
+    input: typeof CreateRoutingRuleRequestSchema;
+    output: typeof CreateRoutingRuleResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RoutingService.GetRoutingRule
+   */
+  getRoutingRule: {
+    methodKind: "unary";
+    input: typeof GetRoutingRuleRequestSchema;
+    output: typeof GetRoutingRuleResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RoutingService.ListRoutingRules
+   */
+  listRoutingRules: {
+    methodKind: "unary";
+    input: typeof ListRoutingRulesRequestSchema;
+    output: typeof ListRoutingRulesResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RoutingService.UpdateRoutingRule
+   */
+  updateRoutingRule: {
+    methodKind: "unary";
+    input: typeof UpdateRoutingRuleRequestSchema;
+    output: typeof UpdateRoutingRuleResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.RoutingService.DeleteRoutingRule
+   */
+  deleteRoutingRule: {
+    methodKind: "unary";
+    input: typeof DeleteRoutingRuleRequestSchema;
+    output: typeof DeleteRoutingRuleResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_routing, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/settings-SettingsService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/settings-SettingsService_connectquery.ts
new file mode 100644
index 0000000000..8f20376f43
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/settings-SettingsService_connectquery.ts
@@ -0,0 +1,19 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/settings.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { SettingsService } from "./settings_pb";
+
+/**
+ * Gets the global settings for the entire deployment.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SettingsService.GetSettings
+ */
+export const getSettings = SettingsService.method.getSettings;
+
+/**
+ * Updates the global settings for the entire deployment.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SettingsService.UpdateSettings
+ */
+export const updateSettings = SettingsService.method.updateSettings;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/settings_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/settings_pb.ts
new file mode 100644
index 0000000000..5bef10a4d3
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/settings_pb.ts
@@ -0,0 +1,699 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/settings.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/settings.proto.
+ */
+export const file_redpanda_api_aigateway_v1_settings: GenFile = /*@__PURE__*/
+  fileDesc("CihyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3NldHRpbmdzLnByb3RvEhlyZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxIhQKEkdldFNldHRpbmdzUmVxdWVzdCJMChNHZXRTZXR0aW5nc1Jlc3BvbnNlEjUKCHNldHRpbmdzGAEgASgLMiMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5TZXR0aW5ncyJTChVVcGRhdGVTZXR0aW5nc1JlcXVlc3QSOgoIc2V0dGluZ3MYASABKAsyIy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNldHRpbmdzQgPgQQIiTwoWVXBkYXRlU2V0dGluZ3NSZXNwb25zZRI1CghzZXR0aW5ncxgBIAEoCzIjLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU2V0dGluZ3MisAMKCFNldHRpbmdzEjMKB3N0b3JhZ2UYASABKAsyIi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlN0b3JhZ2USSgoVcmF0ZV9saW1pdGVyX2RlZmF1bHRzGAIgASgLMisucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SYXRlTGltaXRlckluZnJhEkwKFnNwZW5kX2xpbWl0ZXJfZGVmYXVsdHMYAyABKAsyLC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNwZW5kTGltaXRlckluZnJhEjMKBG9pZGMYBCABKAsyJS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9JRENDb25maWcSQAoLbWNwX2dhdGV3YXkYBSABKAsyKy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk1DUEdhdGV3YXlDb25maWcSLgoKY3JlYXRlZF9hdBhkIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKdXBkYXRlZF9hdBhlIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAihQEKB1N0b3JhZ2USNwoFcmVkaXMYASADKAsyKC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJlZGlzSW5zdGFuY2USQQoKcG9zdGdyZXNxbBgCIAMoCzItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUG9zdGdyZVNRTEluc3RhbmNlIvsCCg1SZWRpc0luc3RhbmNlEhYKAmlkGAEgASgJQgrgQQK6SARyAhABEhsKB2FkZHJlc3MYAiABKAlCCuBBArpIBHICEAESEwoLZGVzY3JpcHRpb24YAyABKAkSEAoIcGFzc3dvcmQYBCABKAkSEwoLdGxzX2VuYWJsZWQYBSABKAgSIAoYdGxzX2luc2VjdXJlX3NraXBfdmVyaWZ5GAYgASgIEhUKDXRsc19jZXJ0X2ZpbGUYByABKAkSFAoMdGxzX2tleV9maWxlGAggASgJEhgKEHRsc19jYV9jZXJ0X2ZpbGUYCSABKAkSFwoPdGxzX3NlcnZlcl9uYW1lGAogASgJEhoKCXBvb2xfc2l6ZRgLIAEoBUIHukgEGgIoARIYCgd0aW1lb3V0GAwgASgFQge6SAQaAigBEkEKCWRhdGFiYXNlcxgNIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVkaXNEYXRhYmFzZXNCA+BBAiJ3Cg5SZWRpc0RhdGFiYXNlcxIdCgxyYXRlX2xpbWl0ZXIYASABKAVCB7pIBBoCKAASJAoTdG9rZW5fdHJhY2tlcl9jYWNoZRgCIAEoBUIHukgEGgIoABIgCg9zZXNzaW9uX21hbmFnZXIYAyABKAVCB7pIBBoCKAAi1gIKElBvc3RncmVTUUxJbnN0YW5jZRIWCgJpZBgBIAEoCUIK4EECukgEcgIQARIYCgRob3N0GAIgASgJQgrgQQK6SARyAhABEhwKBHBvcnQYAyABKAVCDuBBArpICBoGGP//AygBEhwKCGRhdGFiYXNlGAQgASgJQgrgQQK6SARyAhABEhgKBHVzZXIYBSABKAlCCuBBArpIBHICEAESEAoIcGFzc3dvcmQYBiABKAkSEwoLZGVzY3JpcHRpb24YByABKAkSEAoIc3NsX21vZGUYCCABKAkSGgoJbWF4X2Nvbm5zGAkgASgFQge6SAQaAigBEhoKCW1pbl9jb25ucxgKIAEoBUIHukgEGgIoABIiChFtYXhfY29ubl9saWZldGltZRgLIAEoBUIHukgEGgIoABIjChJtYXhfY29ubl9pZGxlX3RpbWUYDCABKAVCB7pIBBoCKAAiSAoQUmF0ZUxpbWl0ZXJJbmZyYRIPCgdlbmFibGVkGAEgASgIEg8KB25vZGVfaWQYAiABKAkSEgoKc3RvcmFnZV9pZBgDIAEoCSJqChFTcGVuZExpbWl0ZXJJbmZyYRIPCgdlbmFibGVkGAEgASgIEkQKDXRva2VuX3RyYWNrZXIYAiABKAsyLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRva2VuVHJhY2tlckNvbmZpZyK1AQoSVG9rZW5UcmFja2VyQ29uZmlnEhQKDHN0b3JhZ2VfdHlwZRgBIAEoCRINCgVhc3luYxgCIAEoCBIcCgtidWZmZXJfc2l6ZRgDIAEoBUIHukgEGgIoARIfCg5mbHVzaF9pbnRlcnZhbBgEIAEoBUIHukgEGgIoARI7CgVjYWNoZRgFIAEoCzIsLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVG9rZW5UcmFja2VyQ2FjaGUiRQoRVG9rZW5UcmFja2VyQ2FjaGUSDwoHZW5hYmxlZBgBIAEoCBILCgN0dGwYAiABKAkSEgoKc3RvcmFnZV9pZBgDIAEoCSJwCgpPSURDQ29uZmlnEg8KB2VuYWJsZWQYASABKAgSEgoKaXNzdWVyX3VybBgCIAEoCRIZChFhbGxvd2VkX2F1ZGllbmNlcxgDIAMoCRIiChFjbG9ja19za2V3X2xlZXdheRgEIAEoBUIHukgEGgIoACJfChBNQ1BHYXRld2F5Q29uZmlnEksKD3Nlc3Npb25fbWFuYWdlchgBIAEoCzIyLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTUNQU2Vzc2lvbk1hbmFnZXJDb25maWciTwoXTUNQU2Vzc2lvbk1hbmFnZXJDb25maWcSEgoKc3RvcmFnZV9pZBgBIAEoCRIgChhlbmZvcmNlX2lkZW50aXR5X2JpbmRpbmcYAiABKAgyyQIKD1NldHRpbmdzU2VydmljZRKCAQoLR2V0U2V0dGluZ3MSLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldFNldHRpbmdzUmVxdWVzdBouLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0U2V0dGluZ3NSZXNwb25zZSIUgtPkkwIOEgwvdjEvc2V0dGluZ3MSlQEKDlVwZGF0ZVNldHRpbmdzEjAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVTZXR0aW5nc1JlcXVlc3QaMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZVNldHRpbmdzUmVzcG9uc2UiHoLT5JMCGDoIc2V0dGluZ3MaDC92MS9zZXR0aW5ncxoZykEWYWlnYXRld2F5LnJlZHBhbmRhLmNvbUKCAgodY29tLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjFCDVNldHRpbmdzUHJvdG9QAVpLZ28ucGFuZGEuZGV2L3JlZHBhbmRhLWFpZ3cvcHJvdG9zL2dlbi9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxO2FpZ2F0ZXdheXYxogIDUkFBqgIZUmVkcGFuZGEuQXBpLkFpZ2F0ZXdheS5WMcoCGVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjHiAiVSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYxXEdQQk1ldGFkYXRh6gIcUmVkcGFuZGE6OkFwaTo6QWlnYXRld2F5OjpWMWIGcHJvdG8z", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_protobuf_timestamp]);
+
+/**
+ * Request message for GetSettings RPC.
+ *
+ * Empty - settings are global (only one row exists)
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSettingsRequest
+ */
+export type GetSettingsRequest = Message<"redpanda.api.aigateway.v1.GetSettingsRequest"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSettingsRequest.
+ * Use `create(GetSettingsRequestSchema)` to create a new message.
+ */
+export const GetSettingsRequestSchema: GenMessage<GetSettingsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 0);
+
+/**
+ * Response message for GetSettings RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSettingsResponse
+ */
+export type GetSettingsResponse = Message<"redpanda.api.aigateway.v1.GetSettingsResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Settings settings = 1;
+   */
+  settings?: Settings;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSettingsResponse.
+ * Use `create(GetSettingsResponseSchema)` to create a new message.
+ */
+export const GetSettingsResponseSchema: GenMessage<GetSettingsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 1);
+
+/**
+ * Request message for UpdateSettings RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateSettingsRequest
+ */
+export type UpdateSettingsRequest = Message<"redpanda.api.aigateway.v1.UpdateSettingsRequest"> & {
+  /**
+   * Required: Updated settings
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Settings settings = 1;
+   */
+  settings?: Settings;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateSettingsRequest.
+ * Use `create(UpdateSettingsRequestSchema)` to create a new message.
+ */
+export const UpdateSettingsRequestSchema: GenMessage<UpdateSettingsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 2);
+
+/**
+ * Response message for UpdateSettings RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateSettingsResponse
+ */
+export type UpdateSettingsResponse = Message<"redpanda.api.aigateway.v1.UpdateSettingsResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Settings settings = 1;
+   */
+  settings?: Settings;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateSettingsResponse.
+ * Use `create(UpdateSettingsResponseSchema)` to create a new message.
+ */
+export const UpdateSettingsResponseSchema: GenMessage<UpdateSettingsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 3);
+
+/**
+ * Settings represents global deployment-wide configuration.
+ * These settings are shared by ALL virtual gateways.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Settings
+ */
+export type Settings = Message<"redpanda.api.aigateway.v1.Settings"> & {
+  /**
+   * Global storage configuration (Redis, PostgreSQL instances)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Storage storage = 1;
+   */
+  storage?: Storage;
+
+  /**
+   * Global rate limiter infrastructure defaults (optional)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.RateLimiterInfra rate_limiter_defaults = 2;
+   */
+  rateLimiterDefaults?: RateLimiterInfra;
+
+  /**
+   * Global spend limiter infrastructure defaults (optional)
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimiterInfra spend_limiter_defaults = 3;
+   */
+  spendLimiterDefaults?: SpendLimiterInfra;
+
+  /**
+   * Global OIDC authentication configuration (optional)
+   * When enabled, all gateways will require JWT token validation
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OIDCConfig oidc = 4;
+   */
+  oidc?: OIDCConfig;
+
+  /**
+   * Global MCP gateway configuration (optional)
+   * Configures session management for all MCP backends
+   *
+   * @generated from field: redpanda.api.aigateway.v1.MCPGatewayConfig mcp_gateway = 5;
+   */
+  mcpGateway?: MCPGatewayConfig;
+
+  /**
+   * Metadata
+   *
+   * @generated from field: google.protobuf.Timestamp created_at = 100;
+   */
+  createdAt?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp updated_at = 101;
+   */
+  updatedAt?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Settings.
+ * Use `create(SettingsSchema)` to create a new message.
+ */
+export const SettingsSchema: GenMessage<Settings> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 4);
+
+/**
+ * Storage represents centralized storage configuration.
+ * Components reference these storage backends by ID.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Storage
+ */
+export type Storage = Message<"redpanda.api.aigateway.v1.Storage"> & {
+  /**
+   * List of Redis instances for distributed state
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.RedisInstance redis = 1;
+   */
+  redis: RedisInstance[];
+
+  /**
+   * List of PostgreSQL instances for persistent storage
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.PostgreSQLInstance postgresql = 2;
+   */
+  postgresql: PostgreSQLInstance[];
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Storage.
+ * Use `create(StorageSchema)` to create a new message.
+ */
+export const StorageSchema: GenMessage<Storage> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 5);
+
+/**
+ * RedisInstance represents a single Redis instance configuration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RedisInstance
+ */
+export type RedisInstance = Message<"redpanda.api.aigateway.v1.RedisInstance"> & {
+  /**
+   * Required: Unique identifier for this Redis instance
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * Required: Redis server address (host:port)
+   *
+   * @generated from field: string address = 2;
+   */
+  address: string;
+
+  /**
+   * Optional: Human-readable description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Optional: Redis password
+   *
+   * @generated from field: string password = 4;
+   */
+  password: string;
+
+  /**
+   * Optional: TLS configuration
+   *
+   * @generated from field: bool tls_enabled = 5;
+   */
+  tlsEnabled: boolean;
+
+  /**
+   * @generated from field: bool tls_insecure_skip_verify = 6;
+   */
+  tlsInsecureSkipVerify: boolean;
+
+  /**
+   * @generated from field: string tls_cert_file = 7;
+   */
+  tlsCertFile: string;
+
+  /**
+   * @generated from field: string tls_key_file = 8;
+   */
+  tlsKeyFile: string;
+
+  /**
+   * @generated from field: string tls_ca_cert_file = 9;
+   */
+  tlsCaCertFile: string;
+
+  /**
+   * @generated from field: string tls_server_name = 10;
+   */
+  tlsServerName: string;
+
+  /**
+   * Optional: Connection pool size (default: 50)
+   *
+   * @generated from field: int32 pool_size = 11;
+   */
+  poolSize: number;
+
+  /**
+   * Optional: Redis operation timeout in milliseconds (default: 200)
+   *
+   * @generated from field: int32 timeout = 12;
+   */
+  timeout: number;
+
+  /**
+   * Required: Database allocation per component
+   *
+   * @generated from field: redpanda.api.aigateway.v1.RedisDatabases databases = 13;
+   */
+  databases?: RedisDatabases;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RedisInstance.
+ * Use `create(RedisInstanceSchema)` to create a new message.
+ */
+export const RedisInstanceSchema: GenMessage<RedisInstance> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 6);
+
+/**
+ * RedisDatabases defines database numbers for each component.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RedisDatabases
+ */
+export type RedisDatabases = Message<"redpanda.api.aigateway.v1.RedisDatabases"> & {
+  /**
+   * Database for rate limiter counters (default: 0)
+   *
+   * @generated from field: int32 rate_limiter = 1;
+   */
+  rateLimiter: number;
+
+  /**
+   * Database for token tracker query cache (default: 1)
+   *
+   * @generated from field: int32 token_tracker_cache = 2;
+   */
+  tokenTrackerCache: number;
+
+  /**
+   * Database for MCP session manager (default: 2)
+   *
+   * @generated from field: int32 session_manager = 3;
+   */
+  sessionManager: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RedisDatabases.
+ * Use `create(RedisDatabasesSchema)` to create a new message.
+ */
+export const RedisDatabasesSchema: GenMessage<RedisDatabases> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 7);
+
+/**
+ * PostgreSQLInstance represents a single PostgreSQL instance configuration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.PostgreSQLInstance
+ */
+export type PostgreSQLInstance = Message<"redpanda.api.aigateway.v1.PostgreSQLInstance"> & {
+  /**
+   * Required: Unique identifier for this PostgreSQL instance
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * Required: PostgreSQL host
+   *
+   * @generated from field: string host = 2;
+   */
+  host: string;
+
+  /**
+   * Required: PostgreSQL port (default: 5432)
+   *
+   * @generated from field: int32 port = 3;
+   */
+  port: number;
+
+  /**
+   * Required: Database name
+   *
+   * @generated from field: string database = 4;
+   */
+  database: string;
+
+  /**
+   * Required: Database user
+   *
+   * @generated from field: string user = 5;
+   */
+  user: string;
+
+  /**
+   * Optional: Database password
+   *
+   * @generated from field: string password = 6;
+   */
+  password: string;
+
+  /**
+   * Optional: Human-readable description
+   *
+   * @generated from field: string description = 7;
+   */
+  description: string;
+
+  /**
+   * Optional: SSL mode (default: "require")
+   * Valid values: "disable", "require", "verify-ca", "verify-full"
+   *
+   * @generated from field: string ssl_mode = 8;
+   */
+  sslMode: string;
+
+  /**
+   * Optional: Connection pool settings
+   *
+   * Default: 20
+   *
+   * @generated from field: int32 max_conns = 9;
+   */
+  maxConns: number;
+
+  /**
+   * Default: 5
+   *
+   * @generated from field: int32 min_conns = 10;
+   */
+  minConns: number;
+
+  /**
+   * seconds, default: 3600
+   *
+   * @generated from field: int32 max_conn_lifetime = 11;
+   */
+  maxConnLifetime: number;
+
+  /**
+   * seconds, default: 300
+   *
+   * @generated from field: int32 max_conn_idle_time = 12;
+   */
+  maxConnIdleTime: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.PostgreSQLInstance.
+ * Use `create(PostgreSQLInstanceSchema)` to create a new message.
+ */
+export const PostgreSQLInstanceSchema: GenMessage<PostgreSQLInstance> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 8);
+
+/**
+ * RateLimiterInfra represents global rate limiter infrastructure configuration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RateLimiterInfra
+ */
+export type RateLimiterInfra = Message<"redpanda.api.aigateway.v1.RateLimiterInfra"> & {
+  /**
+   * Enable rate limiting globally
+   *
+   * @generated from field: bool enabled = 1;
+   */
+  enabled: boolean;
+
+  /**
+   * Node ID for distributed coordination
+   *
+   * @generated from field: string node_id = 2;
+   */
+  nodeId: string;
+
+  /**
+   * Optional: Reference to storage.redis[].id
+   * When not specified, uses first Redis instance
+   *
+   * @generated from field: string storage_id = 3;
+   */
+  storageId: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RateLimiterInfra.
+ * Use `create(RateLimiterInfraSchema)` to create a new message.
+ */
+export const RateLimiterInfraSchema: GenMessage<RateLimiterInfra> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 9);
+
+/**
+ * SpendLimiterInfra represents global spend limiter infrastructure configuration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.SpendLimiterInfra
+ */
+export type SpendLimiterInfra = Message<"redpanda.api.aigateway.v1.SpendLimiterInfra"> & {
+  /**
+   * Enable spend limiting globally
+   *
+   * @generated from field: bool enabled = 1;
+   */
+  enabled: boolean;
+
+  /**
+   * Token tracker configuration
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TokenTrackerConfig token_tracker = 2;
+   */
+  tokenTracker?: TokenTrackerConfig;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SpendLimiterInfra.
+ * Use `create(SpendLimiterInfraSchema)` to create a new message.
+ */
+export const SpendLimiterInfraSchema: GenMessage<SpendLimiterInfra> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 10);
+
+/**
+ * TokenTrackerConfig represents token tracking configuration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TokenTrackerConfig
+ */
+export type TokenTrackerConfig = Message<"redpanda.api.aigateway.v1.TokenTrackerConfig"> & {
+  /**
+   * Storage backend type
+   *
+   * "postgresql", "redpanda", etc.
+   *
+   * @generated from field: string storage_type = 1;
+   */
+  storageType: string;
+
+  /**
+   * Async write settings
+   *
+   * @generated from field: bool async = 2;
+   */
+  async: boolean;
+
+  /**
+   * @generated from field: int32 buffer_size = 3;
+   */
+  bufferSize: number;
+
+  /**
+   * seconds
+   *
+   * @generated from field: int32 flush_interval = 4;
+   */
+  flushInterval: number;
+
+  /**
+   * Query cache configuration
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TokenTrackerCache cache = 5;
+   */
+  cache?: TokenTrackerCache;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TokenTrackerConfig.
+ * Use `create(TokenTrackerConfigSchema)` to create a new message.
+ */
+export const TokenTrackerConfigSchema: GenMessage<TokenTrackerConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 11);
+
+/**
+ * TokenTrackerCache represents token tracker cache configuration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TokenTrackerCache
+ */
+export type TokenTrackerCache = Message<"redpanda.api.aigateway.v1.TokenTrackerCache"> & {
+  /**
+   * Enable caching
+   *
+   * @generated from field: bool enabled = 1;
+   */
+  enabled: boolean;
+
+  /**
+   * Cache TTL (e.g., "5m", "10s")
+   *
+   * @generated from field: string ttl = 2;
+   */
+  ttl: string;
+
+  /**
+   * Optional: Reference to storage.redis[].id
+   * When not specified, uses first Redis instance
+   *
+   * @generated from field: string storage_id = 3;
+   */
+  storageId: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TokenTrackerCache.
+ * Use `create(TokenTrackerCacheSchema)` to create a new message.
+ */
+export const TokenTrackerCacheSchema: GenMessage<TokenTrackerCache> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 12);
+
+/**
+ * OIDCConfig represents global OIDC authentication configuration.
+ * When enabled, all gateways will validate JWT tokens from the configured issuer.
+ *
+ * @generated from message redpanda.api.aigateway.v1.OIDCConfig
+ */
+export type OIDCConfig = Message<"redpanda.api.aigateway.v1.OIDCConfig"> & {
+  /**
+   * Enable/disable OIDC authentication globally
+   *
+   * @generated from field: bool enabled = 1;
+   */
+  enabled: boolean;
+
+  /**
+   * OIDC issuer URL for token validation
+   * Example: "https://accounts.google.com", "https://auth0.com"
+   *
+   * @generated from field: string issuer_url = 2;
+   */
+  issuerUrl: string;
+
+  /**
+   * List of valid audience claims (client IDs)
+   * Tokens must have at least one matching audience
+   *
+   * @generated from field: repeated string allowed_audiences = 3;
+   */
+  allowedAudiences: string[];
+
+  /**
+   * Clock skew tolerance in seconds for token validation
+   * Accounts for time differences between servers (default: 600)
+   *
+   * @generated from field: int32 clock_skew_leeway = 4;
+   */
+  clockSkewLeeway: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.OIDCConfig.
+ * Use `create(OIDCConfigSchema)` to create a new message.
+ */
+export const OIDCConfigSchema: GenMessage<OIDCConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 13);
+
+/**
+ * MCPGatewayConfig represents global configuration for MCP (Model Context Protocol) backends.
+ * These settings apply to ALL MCP backends in the deployment.
+ *
+ * @generated from message redpanda.api.aigateway.v1.MCPGatewayConfig
+ */
+export type MCPGatewayConfig = Message<"redpanda.api.aigateway.v1.MCPGatewayConfig"> & {
+  /**
+   * Session manager configuration for MCP backends
+   *
+   * @generated from field: redpanda.api.aigateway.v1.MCPSessionManagerConfig session_manager = 1;
+   */
+  sessionManager?: MCPSessionManagerConfig;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.MCPGatewayConfig.
+ * Use `create(MCPGatewayConfigSchema)` to create a new message.
+ */
+export const MCPGatewayConfigSchema: GenMessage<MCPGatewayConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 14);
+
+/**
+ * MCPSessionManagerConfig configures session storage for MCP backends.
+ * When not specified, auto-detects Redis from global storage.redis[].
+ *
+ * @generated from message redpanda.api.aigateway.v1.MCPSessionManagerConfig
+ */
+export type MCPSessionManagerConfig = Message<"redpanda.api.aigateway.v1.MCPSessionManagerConfig"> & {
+  /**
+   * Optional: Reference to storage.redis[].id for session storage
+   * When not specified, uses first Redis instance from storage.redis[]
+   * Falls back to in-memory if no Redis configured
+   *
+   * @generated from field: string storage_id = 1;
+   */
+  storageId: string;
+
+  /**
+   * Optional: Bind sessions to OIDC subject claim (default: true)
+   * When enabled, each OIDC user gets isolated session
+   *
+   * @generated from field: bool enforce_identity_binding = 2;
+   */
+  enforceIdentityBinding: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.MCPSessionManagerConfig.
+ * Use `create(MCPSessionManagerConfigSchema)` to create a new message.
+ */
+export const MCPSessionManagerConfigSchema: GenMessage<MCPSessionManagerConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_settings, 15);
+
+/**
+ * SettingsService manages global deployment-wide settings.
+ * Settings are shared by ALL virtual gateways in the deployment.
+ *
+ * @generated from service redpanda.api.aigateway.v1.SettingsService
+ */
+export const SettingsService: GenService<{
+  /**
+   * Gets the global settings for the entire deployment.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SettingsService.GetSettings
+   */
+  getSettings: {
+    methodKind: "unary";
+    input: typeof GetSettingsRequestSchema;
+    output: typeof GetSettingsResponseSchema;
+  },
+  /**
+   * Updates the global settings for the entire deployment.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SettingsService.UpdateSettings
+   */
+  updateSettings: {
+    methodKind: "unary";
+    input: typeof UpdateSettingsRequestSchema;
+    output: typeof UpdateSettingsResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_settings, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/spend_limit-SpendLimitService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/spend_limit-SpendLimitService_connectquery.ts
new file mode 100644
index 0000000000..b95bc3b793
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/spend_limit-SpendLimitService_connectquery.ts
@@ -0,0 +1,35 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/spend_limit.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { SpendLimitService } from "./spend_limit_pb";
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.CreateSpendLimit
+ */
+export const createSpendLimit = SpendLimitService.method.createSpendLimit;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.GetSpendLimit
+ */
+export const getSpendLimit = SpendLimitService.method.getSpendLimit;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.ListSpendLimits
+ */
+export const listSpendLimits = SpendLimitService.method.listSpendLimits;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.UpdateSpendLimit
+ */
+export const updateSpendLimit = SpendLimitService.method.updateSpendLimit;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.DeleteSpendLimit
+ */
+export const deleteSpendLimit = SpendLimitService.method.deleteSpendLimit;
+
+/**
+ * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.GetSpendLimitUsage
+ */
+export const getSpendLimitUsage = SpendLimitService.method.getSpendLimitUsage;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/spend_limit_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/spend_limit_pb.ts
new file mode 100644
index 0000000000..958a716c66
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/spend_limit_pb.ts
@@ -0,0 +1,577 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/spend_limit.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/spend_limit.proto.
+ */
+export const file_redpanda_api_aigateway_v1_spend_limit: GenFile = /*@__PURE__*/
+  fileDesc("CityZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3NwZW5kX2xpbWl0LnByb3RvEhlyZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxIlYKGENyZWF0ZVNwZW5kTGltaXRSZXNwb25zZRI6CgtzcGVuZF9saW1pdBgBIAEoCzIlLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRMaW1pdCJTChVHZXRTcGVuZExpbWl0UmVzcG9uc2USOgoLc3BlbmRfbGltaXQYASABKAsyJS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNwZW5kTGltaXQiVgoYVXBkYXRlU3BlbmRMaW1pdFJlc3BvbnNlEjoKC3NwZW5kX2xpbWl0GAEgASgLMiUucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5TcGVuZExpbWl0IhoKGERlbGV0ZVNwZW5kTGltaXRSZXNwb25zZSJjChpHZXRTcGVuZExpbWl0VXNhZ2VSZXNwb25zZRJFChFzcGVuZF9saW1pdF91c2FnZRgBIAEoCzIqLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRMaW1pdFVzYWdlIt8HCgpTcGVuZExpbWl0EhEKBG5hbWUYASABKAlCA+BBCBIgCgxkaXNwbGF5X25hbWUYAiABKAlCCuBBArpIBHICEAESEwoLZGVzY3JpcHRpb24YAyABKAkSJAoQbWF0Y2hfZXhwcmVzc2lvbhgEIAEoCUIK4EECukgEcgIQARIVCg1rZXlfZXh0cmFjdG9yGAUgASgJEh8KC2xpbWl0X2NlbnRzGAYgASgDQgrgQQK6SAQiAigAEkYKBndpbmRvdxgHIAEoCzIrLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRMaW1pdFdpbmRvd0IJ4EECukgDyAEBEkgKBmFjdGlvbhgIIAEoDjIrLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRMaW1pdEFjdGlvbkIL4EECukgFggECIAASGAoQYWxlcnRfdGhyZXNob2xkcxgJIAMoBRIPCgdlbmFibGVkGAogASgIEkUKCG1ldGFkYXRhGAsgAygLMjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5TcGVuZExpbWl0Lk1ldGFkYXRhRW50cnkSNAoLY3JlYXRlX3RpbWUYDCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSNAoLdXBkYXRlX3RpbWUYDSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSIgoRdG9rZW5zX3Blcl9taW51dGUYDiABKANCB7pIBCICKAASHwoOdG9rZW5zX3Blcl9kYXkYDyABKANCB7pIBCICKAAaLwoNTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBOsIC6kFuCiFhaWdhdGV3YXkucmVkcGFuZGEuY29tL1NwZW5kTGltaXQSLWdhdGV3YXlzL3tnYXRld2F5fS9zcGVuZC1saW1pdHMve3NwZW5kX2xpbWl0fRIac3BlbmQtbGltaXRzL3tzcGVuZF9saW1pdH26SM0BGsoBCh1zcGVuZGxpbWl0LmF0X2xlYXN0X29uZV9saW1pdBJaYXQgbGVhc3Qgb25lIGxpbWl0IChsaW1pdF9jZW50cywgdG9rZW5zX3Blcl9taW51dGUsIHRva2Vuc19wZXJfZGF5KSBtdXN0IGJlIGdyZWF0ZXIgdGhhbiAwGk10aGlzLmxpbWl0X2NlbnRzID4gMCB8fCB0aGlzLnRva2Vuc19wZXJfbWludXRlID4gMCB8fCB0aGlzLnRva2Vuc19wZXJfZGF5ID4gMCKMAQoQU3BlbmRMaW1pdFdpbmRvdxIdCgxzaXplX3NlY29uZHMYASABKAVCB7pIBBoCIAASRwoEdHlwZRgCIAEoDjIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRMaW1pdFdpbmRvd1R5cGVCCLpIBYIBAiAAEhAKCHJlc2V0X2F0GAMgASgJIpACCg9TcGVuZExpbWl0VXNhZ2USOwoLc3BlbmRfbGltaXQYASABKAlCJvpBIwohYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9TcGVuZExpbWl0EhsKE2N1cnJlbnRfc3BlbmRfY2VudHMYAiABKAMSEwoLbGltaXRfY2VudHMYAyABKAMSFwoPcGVyY2VudGFnZV91c2VkGAQgASgFEjAKDHdpbmRvd19zdGFydBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKd2luZG93X2VuZBgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEwoLaXNfZXhjZWVkZWQYByABKAgihgEKF0NyZWF0ZVNwZW5kTGltaXRSZXF1ZXN0Eg4KBnBhcmVudBgBIAEoCRJFCgtzcGVuZF9saW1pdBgDIAEoCzIlLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRMaW1pdEIJ4EECukgDyAEBSgQIAhADUg5zcGVuZF9saW1pdF9pZCJPChRHZXRTcGVuZExpbWl0UmVxdWVzdBI3CgRuYW1lGAEgASgJQingQQL6QSMKIWFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vU3BlbmRMaW1pdCJxChZMaXN0U3BlbmRMaW1pdHNSZXF1ZXN0Eg4KBnBhcmVudBgBIAEoCRIRCglwYWdlX3NpemUYAiABKAUSEgoKcGFnZV90b2tlbhgDIAEoCRIOCgZmaWx0ZXIYBCABKAkSEAoIb3JkZXJfYnkYBSABKAkigwEKF0xpc3RTcGVuZExpbWl0c1Jlc3BvbnNlEjsKDHNwZW5kX2xpbWl0cxgBIAMoCzIlLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU3BlbmRMaW1pdBIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSKRAQoXVXBkYXRlU3BlbmRMaW1pdFJlcXVlc3QSRQoLc3BlbmRfbGltaXQYASABKAsyJS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlNwZW5kTGltaXRCCeBBArpIA8gBARIvCgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2siUgoXRGVsZXRlU3BlbmRMaW1pdFJlcXVlc3QSNwoEbmFtZRgBIAEoCUIp4EEC+kEjCiFhaWdhdGV3YXkucmVkcGFuZGEuY29tL1NwZW5kTGltaXQiZwoZR2V0U3BlbmRMaW1pdFVzYWdlUmVxdWVzdBI3CgRuYW1lGAEgASgJQingQQL6QSMKIWFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vU3BlbmRMaW1pdBIRCglrZXlfdmFsdWUYAiABKAkq8wEKFFNwZW5kTGltaXRXaW5kb3dUeXBlEicKI1NQRU5EX0xJTUlUX1dJTkRPV19UWVBFX1VOU1BFQ0lGSUVEEAASIwofU1BFTkRfTElNSVRfV0lORE9XX1RZUEVfU0xJRElORxABEiEKHVNQRU5EX0xJTUlUX1dJTkRPV19UWVBFX0ZJWEVEEAISIQodU1BFTkRfTElNSVRfV0lORE9XX1RZUEVfREFJTFkQAxIiCh5TUEVORF9MSU1JVF9XSU5ET1dfVFlQRV9XRUVLTFkQBBIjCh9TUEVORF9MSU1JVF9XSU5ET1dfVFlQRV9NT05USExZEAUqlAEKEFNwZW5kTGltaXRBY3Rpb24SIgoeU1BFTkRfTElNSVRfQUNUSU9OX1VOU1BFQ0lGSUVEEAASHAoYU1BFTkRfTElNSVRfQUNUSU9OX0JMT0NLEAESHAoYU1BFTkRfTElNSVRfQUNUSU9OX0FMRVJUEAISIAocU1BFTkRfTElNSVRfQUNUSU9OX0RPV05HUkFERRADMo8KChFTcGVuZExpbWl0U2VydmljZRLXAQoQQ3JlYXRlU3BlbmRMaW1pdBIyLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlU3BlbmRMaW1pdFJlcXVlc3QaMy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNyZWF0ZVNwZW5kTGltaXRSZXNwb25zZSJagtPkkwJUOgtzcGVuZF9saW1pdFofOgtzcGVuZF9saW1pdCIQL3YxL3NwZW5kLWxpbWl0cyIkL3YxL3twYXJlbnQ9Z2F0ZXdheXMvKn0vc3BlbmQtbGltaXRzEr0BCg1HZXRTcGVuZExpbWl0Ei8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRTcGVuZExpbWl0UmVxdWVzdBowLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0U3BlbmRMaW1pdFJlc3BvbnNlIkmC0+STAkNaGxIZL3YxL3tuYW1lPXNwZW5kLWxpbWl0cy8qfRIkL3YxL3tuYW1lPWdhdGV3YXlzLyovc3BlbmQtbGltaXRzLyp9EroBCg9MaXN0U3BlbmRMaW1pdHMSMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RTcGVuZExpbWl0c1JlcXVlc3QaMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RTcGVuZExpbWl0c1Jlc3BvbnNlIkCC0+STAjpaEhIQL3YxL3NwZW5kLWxpbWl0cxIkL3YxL3twYXJlbnQ9Z2F0ZXdheXMvKn0vc3BlbmQtbGltaXRzEvgBChBVcGRhdGVTcGVuZExpbWl0EjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVTcGVuZExpbWl0UmVxdWVzdBozLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlU3BlbmRMaW1pdFJlc3BvbnNlInuC0+STAnU6C3NwZW5kX2xpbWl0WjQ6C3NwZW5kX2xpbWl0MiUvdjEve3NwZW5kX2xpbWl0Lm5hbWU9c3BlbmQtbGltaXRzLyp9MjAvdjEve3NwZW5kX2xpbWl0Lm5hbWU9Z2F0ZXdheXMvKi9zcGVuZC1saW1pdHMvKn0SxgEKEERlbGV0ZVNwZW5kTGltaXQSMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZVNwZW5kTGltaXRSZXF1ZXN0GjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVTcGVuZExpbWl0UmVzcG9uc2UiSYLT5JMCQ1obKhkvdjEve25hbWU9c3BlbmQtbGltaXRzLyp9KiQvdjEve25hbWU9Z2F0ZXdheXMvKi9zcGVuZC1saW1pdHMvKn0S3gEKEkdldFNwZW5kTGltaXRVc2FnZRI0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0U3BlbmRMaW1pdFVzYWdlUmVxdWVzdBo1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0U3BlbmRMaW1pdFVzYWdlUmVzcG9uc2UiW4LT5JMCVVokEiIvdjEve25hbWU9c3BlbmQtbGltaXRzLyp9OmdldFVzYWdlEi0vdjEve25hbWU9Z2F0ZXdheXMvKi9zcGVuZC1saW1pdHMvKn06Z2V0VXNhZ2VChAIKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQg9TcGVuZExpbWl0UHJvdG9QAVpLZ28ucGFuZGEuZGV2L3JlZHBhbmRhLWFpZ3cvcHJvdG9zL2dlbi9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxO2FpZ2F0ZXdheXYxogIDUkFBqgIZUmVkcGFuZGEuQXBpLkFpZ2F0ZXdheS5WMcoCGVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjHiAiVSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYxXEdQQk1ldGFkYXRh6gIcUmVkcGFuZGE6OkFwaTo6QWlnYXRld2F5OjpWMWIGcHJvdG8z", [file_buf_validate_validate, file_google_api_annotations, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Response message for CreateSpendLimit RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateSpendLimitResponse
+ */
+export type CreateSpendLimitResponse = Message<"redpanda.api.aigateway.v1.CreateSpendLimitResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimit spend_limit = 1;
+   */
+  spendLimit?: SpendLimit;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateSpendLimitResponse.
+ * Use `create(CreateSpendLimitResponseSchema)` to create a new message.
+ */
+export const CreateSpendLimitResponseSchema: GenMessage<CreateSpendLimitResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 0);
+
+/**
+ * Response message for GetSpendLimit RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSpendLimitResponse
+ */
+export type GetSpendLimitResponse = Message<"redpanda.api.aigateway.v1.GetSpendLimitResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimit spend_limit = 1;
+   */
+  spendLimit?: SpendLimit;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendLimitResponse.
+ * Use `create(GetSpendLimitResponseSchema)` to create a new message.
+ */
+export const GetSpendLimitResponseSchema: GenMessage<GetSpendLimitResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 1);
+
+/**
+ * Response message for UpdateSpendLimit RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateSpendLimitResponse
+ */
+export type UpdateSpendLimitResponse = Message<"redpanda.api.aigateway.v1.UpdateSpendLimitResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimit spend_limit = 1;
+   */
+  spendLimit?: SpendLimit;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateSpendLimitResponse.
+ * Use `create(UpdateSpendLimitResponseSchema)` to create a new message.
+ */
+export const UpdateSpendLimitResponseSchema: GenMessage<UpdateSpendLimitResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 2);
+
+/**
+ * Response message for DeleteSpendLimit RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteSpendLimitResponse
+ */
+export type DeleteSpendLimitResponse = Message<"redpanda.api.aigateway.v1.DeleteSpendLimitResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteSpendLimitResponse.
+ * Use `create(DeleteSpendLimitResponseSchema)` to create a new message.
+ */
+export const DeleteSpendLimitResponseSchema: GenMessage<DeleteSpendLimitResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 3);
+
+/**
+ * Response message for GetSpendLimitUsage RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetSpendLimitUsageResponse
+ */
+export type GetSpendLimitUsageResponse = Message<"redpanda.api.aigateway.v1.GetSpendLimitUsageResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimitUsage spend_limit_usage = 1;
+   */
+  spendLimitUsage?: SpendLimitUsage;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendLimitUsageResponse.
+ * Use `create(GetSpendLimitUsageResponseSchema)` to create a new message.
+ */
+export const GetSpendLimitUsageResponseSchema: GenMessage<GetSpendLimitUsageResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 4);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.SpendLimit
+ */
+export type SpendLimit = Message<"redpanda.api.aigateway.v1.SpendLimit"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * @generated from field: string match_expression = 4;
+   */
+  matchExpression: string;
+
+  /**
+   * CEL expression to extract spend limit key (e.g., "request.headers['X-User-ID'][0]")
+   * If not provided, a global spend limit is applied
+   * Example: request.context.oidc_claims.sub (per-user budgets)
+   * Example: request.context.oidc_claims.org_id (per-organization budgets)
+   *
+   * @generated from field: string key_extractor = 5;
+   */
+  keyExtractor: string;
+
+  /**
+   * @generated from field: int64 limit_cents = 6;
+   */
+  limitCents: bigint;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimitWindow window = 7;
+   */
+  window?: SpendLimitWindow;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimitAction action = 8;
+   */
+  action: SpendLimitAction;
+
+  /**
+   * @generated from field: repeated int32 alert_thresholds = 9;
+   */
+  alertThresholds: number[];
+
+  /**
+   * @generated from field: bool enabled = 10;
+   */
+  enabled: boolean;
+
+  /**
+   * @generated from field: map<string, string> metadata = 11;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * @generated from field: google.protobuf.Timestamp create_time = 12;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp update_time = 13;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Token-based limits (usage quotas, combined input+output tokens)
+   * Aligns with CUE schema: schema_spendlimit.cue lines 27-30
+   * 0 = unlimited
+   *
+   * @generated from field: int64 tokens_per_minute = 14;
+   */
+  tokensPerMinute: bigint;
+
+  /**
+   * @generated from field: int64 tokens_per_day = 15;
+   */
+  tokensPerDay: bigint;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SpendLimit.
+ * Use `create(SpendLimitSchema)` to create a new message.
+ */
+export const SpendLimitSchema: GenMessage<SpendLimit> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 5);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.SpendLimitWindow
+ */
+export type SpendLimitWindow = Message<"redpanda.api.aigateway.v1.SpendLimitWindow"> & {
+  /**
+   * @generated from field: int32 size_seconds = 1;
+   */
+  sizeSeconds: number;
+
+  /**
+   * Must not be UNSPECIFIED
+   *
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimitWindowType type = 2;
+   */
+  type: SpendLimitWindowType;
+
+  /**
+   * @generated from field: string reset_at = 3;
+   */
+  resetAt: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SpendLimitWindow.
+ * Use `create(SpendLimitWindowSchema)` to create a new message.
+ */
+export const SpendLimitWindowSchema: GenMessage<SpendLimitWindow> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 6);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.SpendLimitUsage
+ */
+export type SpendLimitUsage = Message<"redpanda.api.aigateway.v1.SpendLimitUsage"> & {
+  /**
+   * @generated from field: string spend_limit = 1;
+   */
+  spendLimit: string;
+
+  /**
+   * @generated from field: int64 current_spend_cents = 2;
+   */
+  currentSpendCents: bigint;
+
+  /**
+   * @generated from field: int64 limit_cents = 3;
+   */
+  limitCents: bigint;
+
+  /**
+   * @generated from field: int32 percentage_used = 4;
+   */
+  percentageUsed: number;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp window_start = 5;
+   */
+  windowStart?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp window_end = 6;
+   */
+  windowEnd?: Timestamp;
+
+  /**
+   * @generated from field: bool is_exceeded = 7;
+   */
+  isExceeded: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SpendLimitUsage.
+ * Use `create(SpendLimitUsageSchema)` to create a new message.
+ */
+export const SpendLimitUsageSchema: GenMessage<SpendLimitUsage> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 7);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.CreateSpendLimitRequest
+ */
+export type CreateSpendLimitRequest = Message<"redpanda.api.aigateway.v1.CreateSpendLimitRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimit spend_limit = 3;
+   */
+  spendLimit?: SpendLimit;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateSpendLimitRequest.
+ * Use `create(CreateSpendLimitRequestSchema)` to create a new message.
+ */
+export const CreateSpendLimitRequestSchema: GenMessage<CreateSpendLimitRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 8);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetSpendLimitRequest
+ */
+export type GetSpendLimitRequest = Message<"redpanda.api.aigateway.v1.GetSpendLimitRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendLimitRequest.
+ * Use `create(GetSpendLimitRequestSchema)` to create a new message.
+ */
+export const GetSpendLimitRequestSchema: GenMessage<GetSpendLimitRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 9);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListSpendLimitsRequest
+ */
+export type ListSpendLimitsRequest = Message<"redpanda.api.aigateway.v1.ListSpendLimitsRequest"> & {
+  /**
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListSpendLimitsRequest.
+ * Use `create(ListSpendLimitsRequestSchema)` to create a new message.
+ */
+export const ListSpendLimitsRequestSchema: GenMessage<ListSpendLimitsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 10);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.ListSpendLimitsResponse
+ */
+export type ListSpendLimitsResponse = Message<"redpanda.api.aigateway.v1.ListSpendLimitsResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.SpendLimit spend_limits = 1;
+   */
+  spendLimits: SpendLimit[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListSpendLimitsResponse.
+ * Use `create(ListSpendLimitsResponseSchema)` to create a new message.
+ */
+export const ListSpendLimitsResponseSchema: GenMessage<ListSpendLimitsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 11);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.UpdateSpendLimitRequest
+ */
+export type UpdateSpendLimitRequest = Message<"redpanda.api.aigateway.v1.UpdateSpendLimitRequest"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.SpendLimit spend_limit = 1;
+   */
+  spendLimit?: SpendLimit;
+
+  /**
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateSpendLimitRequest.
+ * Use `create(UpdateSpendLimitRequestSchema)` to create a new message.
+ */
+export const UpdateSpendLimitRequestSchema: GenMessage<UpdateSpendLimitRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 12);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.DeleteSpendLimitRequest
+ */
+export type DeleteSpendLimitRequest = Message<"redpanda.api.aigateway.v1.DeleteSpendLimitRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteSpendLimitRequest.
+ * Use `create(DeleteSpendLimitRequestSchema)` to create a new message.
+ */
+export const DeleteSpendLimitRequestSchema: GenMessage<DeleteSpendLimitRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 13);
+
+/**
+ * @generated from message redpanda.api.aigateway.v1.GetSpendLimitUsageRequest
+ */
+export type GetSpendLimitUsageRequest = Message<"redpanda.api.aigateway.v1.GetSpendLimitUsageRequest"> & {
+  /**
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * The extracted key value to get usage for (e.g., user ID, org ID)
+   * If not provided, returns global usage
+   *
+   * @generated from field: string key_value = 2;
+   */
+  keyValue: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetSpendLimitUsageRequest.
+ * Use `create(GetSpendLimitUsageRequestSchema)` to create a new message.
+ */
+export const GetSpendLimitUsageRequestSchema: GenMessage<GetSpendLimitUsageRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_spend_limit, 14);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.SpendLimitWindowType
+ */
+export enum SpendLimitWindowType {
+  /**
+   * @generated from enum value: SPEND_LIMIT_WINDOW_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: SPEND_LIMIT_WINDOW_TYPE_SLIDING = 1;
+   */
+  SLIDING = 1,
+
+  /**
+   * @generated from enum value: SPEND_LIMIT_WINDOW_TYPE_FIXED = 2;
+   */
+  FIXED = 2,
+
+  /**
+   * @generated from enum value: SPEND_LIMIT_WINDOW_TYPE_DAILY = 3;
+   */
+  DAILY = 3,
+
+  /**
+   * @generated from enum value: SPEND_LIMIT_WINDOW_TYPE_WEEKLY = 4;
+   */
+  WEEKLY = 4,
+
+  /**
+   * @generated from enum value: SPEND_LIMIT_WINDOW_TYPE_MONTHLY = 5;
+   */
+  MONTHLY = 5,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.SpendLimitWindowType.
+ */
+export const SpendLimitWindowTypeSchema: GenEnum<SpendLimitWindowType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_spend_limit, 0);
+
+/**
+ * @generated from enum redpanda.api.aigateway.v1.SpendLimitAction
+ */
+export enum SpendLimitAction {
+  /**
+   * @generated from enum value: SPEND_LIMIT_ACTION_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: SPEND_LIMIT_ACTION_BLOCK = 1;
+   */
+  BLOCK = 1,
+
+  /**
+   * @generated from enum value: SPEND_LIMIT_ACTION_ALERT = 2;
+   */
+  ALERT = 2,
+
+  /**
+   * @generated from enum value: SPEND_LIMIT_ACTION_DOWNGRADE = 3;
+   */
+  DOWNGRADE = 3,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.SpendLimitAction.
+ */
+export const SpendLimitActionSchema: GenEnum<SpendLimitAction> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_spend_limit, 1);
+
+/**
+ * @generated from service redpanda.api.aigateway.v1.SpendLimitService
+ */
+export const SpendLimitService: GenService<{
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.CreateSpendLimit
+   */
+  createSpendLimit: {
+    methodKind: "unary";
+    input: typeof CreateSpendLimitRequestSchema;
+    output: typeof CreateSpendLimitResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.GetSpendLimit
+   */
+  getSpendLimit: {
+    methodKind: "unary";
+    input: typeof GetSpendLimitRequestSchema;
+    output: typeof GetSpendLimitResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.ListSpendLimits
+   */
+  listSpendLimits: {
+    methodKind: "unary";
+    input: typeof ListSpendLimitsRequestSchema;
+    output: typeof ListSpendLimitsResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.UpdateSpendLimit
+   */
+  updateSpendLimit: {
+    methodKind: "unary";
+    input: typeof UpdateSpendLimitRequestSchema;
+    output: typeof UpdateSpendLimitResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.DeleteSpendLimit
+   */
+  deleteSpendLimit: {
+    methodKind: "unary";
+    input: typeof DeleteSpendLimitRequestSchema;
+    output: typeof DeleteSpendLimitResponseSchema;
+  },
+  /**
+   * @generated from rpc redpanda.api.aigateway.v1.SpendLimitService.GetSpendLimitUsage
+   */
+  getSpendLimitUsage: {
+    methodKind: "unary";
+    input: typeof GetSpendLimitUsageRequestSchema;
+    output: typeof GetSpendLimitUsageResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_spend_limit, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/sso-SSOService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/sso-SSOService_connectquery.ts
new file mode 100644
index 0000000000..60d7150b6c
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/sso-SSOService_connectquery.ts
@@ -0,0 +1,87 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/sso.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { SSOService } from "./sso_pb";
+
+/**
+ * Creates a new identity provider within an account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.CreateIdentityProvider
+ */
+export const createIdentityProvider = SSOService.method.createIdentityProvider;
+
+/**
+ * Gets an identity provider by name.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.GetIdentityProvider
+ */
+export const getIdentityProvider = SSOService.method.getIdentityProvider;
+
+/**
+ * Lists identity providers within an account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.ListIdentityProviders
+ */
+export const listIdentityProviders = SSOService.method.listIdentityProviders;
+
+/**
+ * Updates an identity provider.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.UpdateIdentityProvider
+ */
+export const updateIdentityProvider = SSOService.method.updateIdentityProvider;
+
+/**
+ * Deletes an identity provider.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.DeleteIdentityProvider
+ */
+export const deleteIdentityProvider = SSOService.method.deleteIdentityProvider;
+
+/**
+ * Adds an email domain to an identity provider for Home Realm Discovery.
+ * The domain must be verified via DNS TXT record before it becomes active.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.AddDomain
+ */
+export const addDomain = SSOService.method.addDomain;
+
+/**
+ * Lists domains associated with an identity provider.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.ListDomains
+ */
+export const listDomains = SSOService.method.listDomains;
+
+/**
+ * Removes a domain from an identity provider.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.RemoveDomain
+ */
+export const removeDomain = SSOService.method.removeDomain;
+
+/**
+ * Initiates or retries domain verification via DNS TXT record.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.VerifyDomain
+ */
+export const verifyDomain = SSOService.method.verifyDomain;
+
+/**
+ * Looks up the identity provider for an email address based on domain.
+ * Used during login to determine which IdP to redirect to.
+ * Returns NOT_FOUND if no IdP is configured for the domain.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.LookupIdPByEmail
+ */
+export const lookupIdPByEmail = SSOService.method.lookupIdPByEmail;
+
+/**
+ * Tests OIDC credentials using the client credentials grant.
+ * Validates that the client_id and client_secret can obtain a token
+ * and returns the decoded token claims.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.SSOService.TestCredentials
+ */
+export const testCredentials = SSOService.method.testCredentials;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/sso_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/sso_pb.ts
new file mode 100644
index 0000000000..9e5ceda19f
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/sso_pb.ts
@@ -0,0 +1,1334 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/sso.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/sso.proto.
+ */
+export const file_redpanda_api_aigateway_v1_sso: GenFile = /*@__PURE__*/
+  fileDesc("CiNyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3Nzby5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSKeBwoQSWRlbnRpdHlQcm92aWRlchIRCgRuYW1lGAEgASgJQgPgQQgSIwoMZGlzcGxheV9uYW1lGAIgASgJQg3gQQK6SAdyBRABGP8BEkwKBHR5cGUYAyABKA4yLy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLklkZW50aXR5UHJvdmlkZXJUeXBlQg3gQQK6SAeCAQQQASAAEg8KB2VuYWJsZWQYBCABKAgSRwoLb2lkY19jb25maWcYBSABKAsyLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLk9JRENQcm92aWRlckNvbmZpZ0ID4EECEkAKDmNsYWltX21hcHBpbmdzGAYgASgLMigucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DbGFpbU1hcHBpbmdzEkoKEGppdF9wcm92aXNpb25pbmcYByABKAsyMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkpJVFByb3Zpc2lvbmluZ0NvbmZpZxIZChFhdXRvX2xpbmtfZW5hYmxlZBgNIAEoCBI6CgthdXRoX21ldGhvZBgOIAEoDjIlLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQXV0aE1ldGhvZBJLCghtZXRhZGF0YRgPIAMoCzI5LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuSWRlbnRpdHlQcm92aWRlci5NZXRhZGF0YUVudHJ5EkYKEXByb3ZpZGVyX3RlbXBsYXRlGAggASgOMisucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Qcm92aWRlclRlbXBsYXRlEjQKC2NyZWF0ZV90aW1lGAkgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEjQKC3VwZGF0ZV90aW1lGAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEhQKB2NyZWF0b3IYCyABKAlCA+BBAxIUCgd1cGRhdGVyGAwgASgJQgPgQQMaLwoNTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBOmfqQWQKJ2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vSWRlbnRpdHlQcm92aWRlchI5YWNjb3VudHMve2FjY291bnR9L2lkZW50aXR5LXByb3ZpZGVycy97aWRlbnRpdHlfcHJvdmlkZXJ9IpgCChJPSURDUHJvdmlkZXJDb25maWcSIQoKaXNzdWVyX3VybBgBIAEoCUIN4EECukgHcgUQARiAEBIgCgljbGllbnRfaWQYAiABKAlCDeBBArpIB3IFEAEY/wESGgoNY2xpZW50X3NlY3JldBgDIAEoCUID4EEEEg4KBnNjb3BlcxgEIAMoCRIZChFhbGxvd2VkX2F1ZGllbmNlcxgJIAMoCRIRCglsb2dpbl91cmwYCiABKAkSHgoWYXV0aG9yaXphdGlvbl9lbmRwb2ludBgFIAEoCRIWCg50b2tlbl9lbmRwb2ludBgGIAEoCRIZChF1c2VyaW5mb19lbmRwb2ludBgHIAEoCRIQCghqd2tzX3VyaRgIIAEoCSKMAgoNQ2xhaW1NYXBwaW5ncxITCgtlbWFpbF9jbGFpbRgBIAEoCRISCgpuYW1lX2NsYWltGAIgASgJEhgKEGdpdmVuX25hbWVfY2xhaW0YAyABKAkSGQoRZmFtaWx5X25hbWVfY2xhaW0YBCABKAkSFQoNcGljdHVyZV9jbGFpbRgFIAEoCRJRCg1jdXN0b21fY2xhaW1zGAYgAygLMjoucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DbGFpbU1hcHBpbmdzLkN1c3RvbUNsYWltc0VudHJ5GjMKEUN1c3RvbUNsYWltc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEipgEKFUpJVFByb3Zpc2lvbmluZ0NvbmZpZxIPCgdlbmFibGVkGAEgASgIEkYKFGRlZmF1bHRfb3JnYW5pemF0aW9uGAIgASgJQij6QSUKI2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT3JnYW5pemF0aW9uEjQKDGRlZmF1bHRfcm9sZRgDIAEoCUIeukgbchlSBWFkbWluUgZtZW1iZXJSBnZpZXdlclIAIusDCgtFbWFpbERvbWFpbhIRCgRuYW1lGAEgASgJQgPgQQgSHQoGZG9tYWluGAIgASgJQg3gQQK6SAdyBRABGP0BEg8KB2VuYWJsZWQYAyABKAgSVQoTdmVyaWZpY2F0aW9uX3N0YXR1cxgEIAEoDjIzLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRG9tYWluVmVyaWZpY2F0aW9uU3RhdHVzQgPgQQMSHwoSdmVyaWZpY2F0aW9uX3Rva2VuGAUgASgJQgPgQQMSQAoXdmVyaWZpY2F0aW9uX2V4cGlyZXNfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSNAoLdmVyaWZpZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSNAoLY3JlYXRlX3RpbWUYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQM6c+pBcAoiYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9FbWFpbERvbWFpbhJKYWNjb3VudHMve2FjY291bnR9L2lkZW50aXR5LXByb3ZpZGVycy97aWRlbnRpdHlfcHJvdmlkZXJ9L2RvbWFpbnMve2RvbWFpbn0ixwEKHUNyZWF0ZUlkZW50aXR5UHJvdmlkZXJSZXF1ZXN0EjYKBnBhcmVudBgBIAEoCUIm4EEC+kEgCh5haWdhdGV3YXkucmVkcGFuZGEuY29tL0FjY291bnQSIQoUaWRlbnRpdHlfcHJvdmlkZXJfaWQYAiABKAlCA+BBARJLChFpZGVudGl0eV9wcm92aWRlchgDIAEoCzIrLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuSWRlbnRpdHlQcm92aWRlckID4EECImgKHkNyZWF0ZUlkZW50aXR5UHJvdmlkZXJSZXNwb25zZRJGChFpZGVudGl0eV9wcm92aWRlchgBIAEoCzIrLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuSWRlbnRpdHlQcm92aWRlciJbChpHZXRJZGVudGl0eVByb3ZpZGVyUmVxdWVzdBI9CgRuYW1lGAEgASgJQi/gQQL6QSkKJ2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vSWRlbnRpdHlQcm92aWRlciKGAQobR2V0SWRlbnRpdHlQcm92aWRlclJlc3BvbnNlEkYKEWlkZW50aXR5X3Byb3ZpZGVyGAEgASgLMisucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5JZGVudGl0eVByb3ZpZGVyEh8KEmxpbmtlZF91c2Vyc19jb3VudBgCIAEoBUID4EEDIq0BChxMaXN0SWRlbnRpdHlQcm92aWRlcnNSZXF1ZXN0EjYKBnBhcmVudBgBIAEoCUIm4EEC+kEgCh5haWdhdGV3YXkucmVkcGFuZGEuY29tL0FjY291bnQSHwoJcGFnZV9zaXplGAIgASgFQgzgQQG6SAYaBBhkKAASFwoKcGFnZV90b2tlbhgDIAEoCUID4EEBEhsKDmZpbHRlcl9lbmFibGVkGAQgASgIQgPgQQEilQEKHUxpc3RJZGVudGl0eVByb3ZpZGVyc1Jlc3BvbnNlEkcKEmlkZW50aXR5X3Byb3ZpZGVycxgBIAMoCzIrLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuSWRlbnRpdHlQcm92aWRlchIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSKiAQodVXBkYXRlSWRlbnRpdHlQcm92aWRlclJlcXVlc3QSSwoRaWRlbnRpdHlfcHJvdmlkZXIYASABKAsyKy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLklkZW50aXR5UHJvdmlkZXJCA+BBAhI0Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCA+BBASJoCh5VcGRhdGVJZGVudGl0eVByb3ZpZGVyUmVzcG9uc2USRgoRaWRlbnRpdHlfcHJvdmlkZXIYASABKAsyKy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLklkZW50aXR5UHJvdmlkZXIicgodRGVsZXRlSWRlbnRpdHlQcm92aWRlclJlcXVlc3QSPQoEbmFtZRgBIAEoCUIv4EEC+kEpCidhaWdhdGV3YXkucmVkcGFuZGEuY29tL0lkZW50aXR5UHJvdmlkZXISEgoFZm9yY2UYAiABKAhCA+BBASIgCh5EZWxldGVJZGVudGl0eVByb3ZpZGVyUmVzcG9uc2UicgoQQWRkRG9tYWluUmVxdWVzdBI/CgZwYXJlbnQYASABKAlCL+BBAvpBKQonYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9JZGVudGl0eVByb3ZpZGVyEh0KBmRvbWFpbhgCIAEoCUIN4EECukgHcgUQARj9ASJ0ChFBZGREb21haW5SZXNwb25zZRI8CgxlbWFpbF9kb21haW4YASABKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkVtYWlsRG9tYWluEiEKGXZlcmlmaWNhdGlvbl9pbnN0cnVjdGlvbnMYAiABKAkijwEKEkxpc3REb21haW5zUmVxdWVzdBI/CgZwYXJlbnQYASABKAlCL+BBAvpBKQonYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9JZGVudGl0eVByb3ZpZGVyEh8KCXBhZ2Vfc2l6ZRgCIAEoBUIM4EEBukgGGgQYZCgAEhcKCnBhZ2VfdG9rZW4YAyABKAlCA+BBASJ7ChNMaXN0RG9tYWluc1Jlc3BvbnNlEjcKB2RvbWFpbnMYASADKAsyJi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkVtYWlsRG9tYWluEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFIk8KE1JlbW92ZURvbWFpblJlcXVlc3QSOAoEbmFtZRgBIAEoCUIq4EEC+kEkCiJhaWdhdGV3YXkucmVkcGFuZGEuY29tL0VtYWlsRG9tYWluIhYKFFJlbW92ZURvbWFpblJlc3BvbnNlIk8KE1ZlcmlmeURvbWFpblJlcXVlc3QSOAoEbmFtZRgBIAEoCUIq4EEC+kEkCiJhaWdhdGV3YXkucmVkcGFuZGEuY29tL0VtYWlsRG9tYWluIn0KFFZlcmlmeURvbWFpblJlc3BvbnNlEjwKDGVtYWlsX2RvbWFpbhgBIAEoCzImLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRW1haWxEb21haW4SEAoIdmVyaWZpZWQYAiABKAgSFQoNZXJyb3JfbWVzc2FnZRgDIAEoCSJsChdMb29rdXBJZFBCeUVtYWlsUmVxdWVzdBI2CgZwYXJlbnQYASABKAlCJuBBAvpBIAoeYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9BY2NvdW50EhkKBWVtYWlsGAIgASgJQgrgQQK6SARyAmABIqwBChhMb29rdXBJZFBCeUVtYWlsUmVzcG9uc2USRgoRaWRlbnRpdHlfcHJvdmlkZXIYASABKAsyKy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLklkZW50aXR5UHJvdmlkZXISDwoHaGFzX2lkcBgCIAEoCBIZChFhdXRob3JpemF0aW9uX3VybBgDIAEoCRIcChRhbGxvd19wYXNzd29yZF9sb2dpbhgEIAEoCCKRAQoWVGVzdENyZWRlbnRpYWxzUmVxdWVzdBIhCgppc3N1ZXJfdXJsGAEgASgJQg3gQQK6SAdyBRABGIAQEiAKCWNsaWVudF9pZBgCIAEoCUIN4EECukgHcgUQARj/ARIkCg1jbGllbnRfc2VjcmV0GAMgASgJQg3gQQK6SAdyBRABGIAESgQIBBAFUgZzY29wZXMiggIKF1Rlc3RDcmVkZW50aWFsc1Jlc3BvbnNlEg8KB3N1Y2Nlc3MYASABKAgSFQoNZXJyb3JfbWVzc2FnZRgCIAEoCRJOCgZjbGFpbXMYBSADKAsyPi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlc3RDcmVkZW50aWFsc1Jlc3BvbnNlLkNsYWltc0VudHJ5EhwKFGFjY2Vzc190b2tlbl9wcmV2aWV3GAYgASgJGi0KC0NsYWltc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAFKBAgDEARKBAgEEAVSCnRva2VuX3R5cGVSCmV4cGlyZXNfaW4qXwoUSWRlbnRpdHlQcm92aWRlclR5cGUSJgoiSURFTlRJVFlfUFJPVklERVJfVFlQRV9VTlNQRUNJRklFRBAAEh8KG0lERU5USVRZX1BST1ZJREVSX1RZUEVfT0lEQxABKmkKCkF1dGhNZXRob2QSGwoXQVVUSF9NRVRIT0RfVU5TUEVDSUZJRUQQABIiCh5BVVRIX01FVEhPRF9BVVRIT1JJWkFUSU9OX0NPREUQARIaChZBVVRIX01FVEhPRF9KV1RfQkVBUkVSEAIq6QEKEFByb3ZpZGVyVGVtcGxhdGUSIQodUFJPVklERVJfVEVNUExBVEVfVU5TUEVDSUZJRUQQABIdChlQUk9WSURFUl9URU1QTEFURV9HRU5FUklDEAESHAoYUFJPVklERVJfVEVNUExBVEVfR09PR0xFEAISHAoYUFJPVklERVJfVEVNUExBVEVfR0lUSFVCEAMSGgoWUFJPVklERVJfVEVNUExBVEVfT0tUQRAEEh4KGlBST1ZJREVSX1RFTVBMQVRFX0FaVVJFX0FEEAUSGwoXUFJPVklERVJfVEVNUExBVEVfQVVUSDAQBirmAQoYRG9tYWluVmVyaWZpY2F0aW9uU3RhdHVzEioKJkRPTUFJTl9WRVJJRklDQVRJT05fU1RBVFVTX1VOU1BFQ0lGSUVEEAASJgoiRE9NQUlOX1ZFUklGSUNBVElPTl9TVEFUVVNfUEVORElORxABEicKI0RPTUFJTl9WRVJJRklDQVRJT05fU1RBVFVTX1ZFUklGSUVEEAISJQohRE9NQUlOX1ZFUklGSUNBVElPTl9TVEFUVVNfRkFJTEVEEAMSJgoiRE9NQUlOX1ZFUklGSUNBVElPTl9TVEFUVVNfRVhQSVJFRBAEMtMQCgpTU09TZXJ2aWNlEtQBChZDcmVhdGVJZGVudGl0eVByb3ZpZGVyEjgucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVJZGVudGl0eVByb3ZpZGVyUmVxdWVzdBo5LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlSWRlbnRpdHlQcm92aWRlclJlc3BvbnNlIkWC0+STAj86EWlkZW50aXR5X3Byb3ZpZGVyIiovdjEve3BhcmVudD1hY2NvdW50cy8qfS9pZGVudGl0eS1wcm92aWRlcnMSuAEKE0dldElkZW50aXR5UHJvdmlkZXISNS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldElkZW50aXR5UHJvdmlkZXJSZXF1ZXN0GjYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRJZGVudGl0eVByb3ZpZGVyUmVzcG9uc2UiMoLT5JMCLBIqL3YxL3tuYW1lPWFjY291bnRzLyovaWRlbnRpdHktcHJvdmlkZXJzLyp9Er4BChVMaXN0SWRlbnRpdHlQcm92aWRlcnMSNy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RJZGVudGl0eVByb3ZpZGVyc1JlcXVlc3QaOC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RJZGVudGl0eVByb3ZpZGVyc1Jlc3BvbnNlIjKC0+STAiwSKi92MS97cGFyZW50PWFjY291bnRzLyp9L2lkZW50aXR5LXByb3ZpZGVycxLmAQoWVXBkYXRlSWRlbnRpdHlQcm92aWRlchI4LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlSWRlbnRpdHlQcm92aWRlclJlcXVlc3QaOS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZUlkZW50aXR5UHJvdmlkZXJSZXNwb25zZSJXgtPkkwJROhFpZGVudGl0eV9wcm92aWRlcjI8L3YxL3tpZGVudGl0eV9wcm92aWRlci5uYW1lPWFjY291bnRzLyovaWRlbnRpdHktcHJvdmlkZXJzLyp9EsEBChZEZWxldGVJZGVudGl0eVByb3ZpZGVyEjgucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVJZGVudGl0eVByb3ZpZGVyUmVxdWVzdBo5LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlSWRlbnRpdHlQcm92aWRlclJlc3BvbnNlIjKC0+STAiwqKi92MS97bmFtZT1hY2NvdW50cy8qL2lkZW50aXR5LXByb3ZpZGVycy8qfRKnAQoJQWRkRG9tYWluEisucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BZGREb21haW5SZXF1ZXN0GiwucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BZGREb21haW5SZXNwb25zZSI/gtPkkwI5OgEqIjQvdjEve3BhcmVudD1hY2NvdW50cy8qL2lkZW50aXR5LXByb3ZpZGVycy8qfS9kb21haW5zEqoBCgtMaXN0RG9tYWlucxItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdERvbWFpbnNSZXF1ZXN0Gi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0RG9tYWluc1Jlc3BvbnNlIjyC0+STAjYSNC92MS97cGFyZW50PWFjY291bnRzLyovaWRlbnRpdHktcHJvdmlkZXJzLyp9L2RvbWFpbnMSrQEKDFJlbW92ZURvbWFpbhIuLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVtb3ZlRG9tYWluUmVxdWVzdBovLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVtb3ZlRG9tYWluUmVzcG9uc2UiPILT5JMCNio0L3YxL3tuYW1lPWFjY291bnRzLyovaWRlbnRpdHktcHJvdmlkZXJzLyovZG9tYWlucy8qfRK0AQoMVmVyaWZ5RG9tYWluEi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5WZXJpZnlEb21haW5SZXF1ZXN0Gi8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5WZXJpZnlEb21haW5SZXNwb25zZSJDgtPkkwI9IjsvdjEve25hbWU9YWNjb3VudHMvKi9pZGVudGl0eS1wcm92aWRlcnMvKi9kb21haW5zLyp9OnZlcmlmeRK9AQoQTG9va3VwSWRQQnlFbWFpbBIyLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTG9va3VwSWRQQnlFbWFpbFJlcXVlc3QaMy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxvb2t1cElkUEJ5RW1haWxSZXNwb25zZSJAgtPkkwI6EjgvdjEve3BhcmVudD1hY2NvdW50cy8qfS9pZGVudGl0eS1wcm92aWRlcnM6bG9va3VwQnlFbWFpbBKrAQoPVGVzdENyZWRlbnRpYWxzEjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UZXN0Q3JlZGVudGlhbHNSZXF1ZXN0GjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UZXN0Q3JlZGVudGlhbHNSZXNwb25zZSIxgtPkkwIrOgEqIiYvdjEvaWRlbnRpdHktcHJvdmlkZXJzOnRlc3RDcmVkZW50aWFscxoZykEWYWlnYXRld2F5LnJlZHBhbmRhLmNvbUL9AQodY29tLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjFCCFNzb1Byb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * IdentityProvider represents an external OIDC identity provider configuration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.IdentityProvider
+ */
+export type IdentityProvider = Message<"redpanda.api.aigateway.v1.IdentityProvider"> & {
+  /**
+   * Resource name. Format: `accounts/{account}/identity-providers/{identity_provider}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name shown in UI (e.g., "Corporate Okta")
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Provider type. Currently only OIDC is supported.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.IdentityProviderType type = 3;
+   */
+  type: IdentityProviderType;
+
+  /**
+   * Whether this IdP is enabled for authentication.
+   *
+   * @generated from field: bool enabled = 4;
+   */
+  enabled: boolean;
+
+  /**
+   * OIDC configuration.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.OIDCProviderConfig oidc_config = 5;
+   */
+  oidcConfig?: OIDCProviderConfig;
+
+  /**
+   * Claim mappings from IdP claims to internal user attributes.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ClaimMappings claim_mappings = 6;
+   */
+  claimMappings?: ClaimMappings;
+
+  /**
+   * JIT (Just-In-Time) provisioning settings.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.JITProvisioningConfig jit_provisioning = 7;
+   */
+  jitProvisioning?: JITProvisioningConfig;
+
+  /**
+   * Whether to automatically link SSO identities to existing users by email.
+   * When enabled, if a user logs in via SSO and their verified email matches
+   * an existing user account, the SSO identity is linked to that account.
+   *
+   * @generated from field: bool auto_link_enabled = 13;
+   */
+  autoLinkEnabled: boolean;
+
+  /**
+   * Authentication method this IdP supports.
+   * AUTH_METHOD_AUTHORIZATION_CODE for browser SSO, AUTH_METHOD_JWT_BEARER for API tokens.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.AuthMethod auth_method = 14;
+   */
+  authMethod: AuthMethod;
+
+  /**
+   * Metadata for system management and bootstrap tracking.
+   * Used to mark IdPs as system_managed (synced from config).
+   *
+   * @generated from field: map<string, string> metadata = 15;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Provider template used for pre-built configurations.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.ProviderTemplate provider_template = 8;
+   */
+  providerTemplate: ProviderTemplate;
+
+  /**
+   * Output only. Creation timestamp.
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 9;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp.
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 10;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Creator (user ID or service account).
+   *
+   * @generated from field: string creator = 11;
+   */
+  creator: string;
+
+  /**
+   * Output only. Last updater.
+   *
+   * @generated from field: string updater = 12;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.IdentityProvider.
+ * Use `create(IdentityProviderSchema)` to create a new message.
+ */
+export const IdentityProviderSchema: GenMessage<IdentityProvider> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 0);
+
+/**
+ * OIDCProviderConfig contains OIDC-specific configuration for identity providers.
+ *
+ * @generated from message redpanda.api.aigateway.v1.OIDCProviderConfig
+ */
+export type OIDCProviderConfig = Message<"redpanda.api.aigateway.v1.OIDCProviderConfig"> & {
+  /**
+   * Required. The issuer URL (e.g., "https://accounts.google.com").
+   * Used for OIDC discovery (.well-known/openid-configuration).
+   *
+   * @generated from field: string issuer_url = 1;
+   */
+  issuerUrl: string;
+
+  /**
+   * Required. OAuth2 client ID from the IdP.
+   *
+   * @generated from field: string client_id = 2;
+   */
+  clientId: string;
+
+  /**
+   * OAuth2 client secret. Only provided in create/update requests.
+   * Never returned in get/list responses (stored via SecretsService).
+   *
+   * @generated from field: string client_secret = 3;
+   */
+  clientSecret: string;
+
+  /**
+   * OAuth2 scopes to request. Defaults to ["openid", "profile", "email"].
+   *
+   * @generated from field: repeated string scopes = 4;
+   */
+  scopes: string[];
+
+  /**
+   * Allowed audiences for token validation (required for jwt_bearer auth_method).
+   * Tokens must contain at least one of these audiences in the "aud" claim.
+   * SECURITY: Without this for jwt_bearer, any token from the issuer would be
+   * accepted, allowing tokens issued for other applications to access the API.
+   *
+   * @generated from field: repeated string allowed_audiences = 9;
+   */
+  allowedAudiences: string[];
+
+  /**
+   * Login URL for auth failure redirect (required for jwt_bearer auth_method).
+   * When authentication fails, the API returns this URL so the WebUI can
+   * redirect the user back to the parent application for re-authentication.
+   *
+   * @generated from field: string login_url = 10;
+   */
+  loginUrl: string;
+
+  /**
+   * Optional. Custom authorization endpoint (overrides discovery).
+   *
+   * @generated from field: string authorization_endpoint = 5;
+   */
+  authorizationEndpoint: string;
+
+  /**
+   * Optional. Custom token endpoint (overrides discovery).
+   *
+   * @generated from field: string token_endpoint = 6;
+   */
+  tokenEndpoint: string;
+
+  /**
+   * Optional. Custom userinfo endpoint (overrides discovery).
+   *
+   * @generated from field: string userinfo_endpoint = 7;
+   */
+  userinfoEndpoint: string;
+
+  /**
+   * Optional. Custom JWKS URI (overrides discovery).
+   *
+   * @generated from field: string jwks_uri = 8;
+   */
+  jwksUri: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.OIDCProviderConfig.
+ * Use `create(OIDCProviderConfigSchema)` to create a new message.
+ */
+export const OIDCProviderConfigSchema: GenMessage<OIDCProviderConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 1);
+
+/**
+ * ClaimMappings defines how external IdP claims map to internal user attributes.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ClaimMappings
+ */
+export type ClaimMappings = Message<"redpanda.api.aigateway.v1.ClaimMappings"> & {
+  /**
+   * Claim containing the user's email address.
+   * Default: "email"
+   *
+   * @generated from field: string email_claim = 1;
+   */
+  emailClaim: string;
+
+  /**
+   * Claim containing the user's display name.
+   * Default: "name"
+   *
+   * @generated from field: string name_claim = 2;
+   */
+  nameClaim: string;
+
+  /**
+   * Claim containing the user's given/first name.
+   * Default: "given_name"
+   *
+   * @generated from field: string given_name_claim = 3;
+   */
+  givenNameClaim: string;
+
+  /**
+   * Claim containing the user's family/last name.
+   * Default: "family_name"
+   *
+   * @generated from field: string family_name_claim = 4;
+   */
+  familyNameClaim: string;
+
+  /**
+   * Claim containing the user's profile picture URL.
+   * Default: "picture"
+   *
+   * @generated from field: string picture_claim = 5;
+   */
+  pictureClaim: string;
+
+  /**
+   * Additional custom claim mappings.
+   * Key: internal attribute name, Value: external claim name
+   *
+   * @generated from field: map<string, string> custom_claims = 6;
+   */
+  customClaims: { [key: string]: string };
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ClaimMappings.
+ * Use `create(ClaimMappingsSchema)` to create a new message.
+ */
+export const ClaimMappingsSchema: GenMessage<ClaimMappings> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 2);
+
+/**
+ * JITProvisioningConfig controls automatic user creation on first login.
+ *
+ * @generated from message redpanda.api.aigateway.v1.JITProvisioningConfig
+ */
+export type JITProvisioningConfig = Message<"redpanda.api.aigateway.v1.JITProvisioningConfig"> & {
+  /**
+   * Whether to automatically create users on first SSO login.
+   *
+   * @generated from field: bool enabled = 1;
+   */
+  enabled: boolean;
+
+  /**
+   * Default organization to add JIT-provisioned users to.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string default_organization = 2;
+   */
+  defaultOrganization: string;
+
+  /**
+   * Default role for JIT-provisioned users in the organization.
+   * Values: "admin", "member", "viewer". Default: "member"
+   *
+   * @generated from field: string default_role = 3;
+   */
+  defaultRole: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.JITProvisioningConfig.
+ * Use `create(JITProvisioningConfigSchema)` to create a new message.
+ */
+export const JITProvisioningConfigSchema: GenMessage<JITProvisioningConfig> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 3);
+
+/**
+ * EmailDomain represents an email domain mapped to an identity provider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.EmailDomain
+ */
+export type EmailDomain = Message<"redpanda.api.aigateway.v1.EmailDomain"> & {
+  /**
+   * Resource name. Format: `accounts/{account}/identity-providers/{idp}/domains/{domain}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * The email domain (e.g., "example.com").
+   *
+   * @generated from field: string domain = 2;
+   */
+  domain: string;
+
+  /**
+   * Whether this domain is enabled for Home Realm Discovery.
+   * Only verified domains can be enabled.
+   *
+   * @generated from field: bool enabled = 3;
+   */
+  enabled: boolean;
+
+  /**
+   * Verification status.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.DomainVerificationStatus verification_status = 4;
+   */
+  verificationStatus: DomainVerificationStatus;
+
+  /**
+   * DNS TXT record value for verification.
+   * Add as: _redpanda-aigateway-verify.{domain} TXT "{verification_token}"
+   *
+   * @generated from field: string verification_token = 5;
+   */
+  verificationToken: string;
+
+  /**
+   * Verification token expiration time.
+   *
+   * @generated from field: google.protobuf.Timestamp verification_expires_at = 6;
+   */
+  verificationExpiresAt?: Timestamp;
+
+  /**
+   * When the domain was verified.
+   *
+   * @generated from field: google.protobuf.Timestamp verified_at = 7;
+   */
+  verifiedAt?: Timestamp;
+
+  /**
+   * Output only. Creation timestamp.
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 8;
+   */
+  createTime?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.EmailDomain.
+ * Use `create(EmailDomainSchema)` to create a new message.
+ */
+export const EmailDomainSchema: GenMessage<EmailDomain> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 4);
+
+/**
+ * Request message for CreateIdentityProvider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateIdentityProviderRequest
+ */
+export type CreateIdentityProviderRequest = Message<"redpanda.api.aigateway.v1.CreateIdentityProviderRequest"> & {
+  /**
+   * Required. Parent account.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Optional. The IdP ID to use. If empty, server generates one.
+   *
+   * @generated from field: string identity_provider_id = 2;
+   */
+  identityProviderId: string;
+
+  /**
+   * Required. The identity provider to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.IdentityProvider identity_provider = 3;
+   */
+  identityProvider?: IdentityProvider;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateIdentityProviderRequest.
+ * Use `create(CreateIdentityProviderRequestSchema)` to create a new message.
+ */
+export const CreateIdentityProviderRequestSchema: GenMessage<CreateIdentityProviderRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 5);
+
+/**
+ * Response message for CreateIdentityProvider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateIdentityProviderResponse
+ */
+export type CreateIdentityProviderResponse = Message<"redpanda.api.aigateway.v1.CreateIdentityProviderResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.IdentityProvider identity_provider = 1;
+   */
+  identityProvider?: IdentityProvider;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateIdentityProviderResponse.
+ * Use `create(CreateIdentityProviderResponseSchema)` to create a new message.
+ */
+export const CreateIdentityProviderResponseSchema: GenMessage<CreateIdentityProviderResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 6);
+
+/**
+ * Request message for GetIdentityProvider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetIdentityProviderRequest
+ */
+export type GetIdentityProviderRequest = Message<"redpanda.api.aigateway.v1.GetIdentityProviderRequest"> & {
+  /**
+   * Required. Resource name of the identity provider.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetIdentityProviderRequest.
+ * Use `create(GetIdentityProviderRequestSchema)` to create a new message.
+ */
+export const GetIdentityProviderRequestSchema: GenMessage<GetIdentityProviderRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 7);
+
+/**
+ * Response message for GetIdentityProvider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetIdentityProviderResponse
+ */
+export type GetIdentityProviderResponse = Message<"redpanda.api.aigateway.v1.GetIdentityProviderResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.IdentityProvider identity_provider = 1;
+   */
+  identityProvider?: IdentityProvider;
+
+  /**
+   * Output only. Number of users linked to this identity provider via SSO.
+   *
+   * @generated from field: int32 linked_users_count = 2;
+   */
+  linkedUsersCount: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetIdentityProviderResponse.
+ * Use `create(GetIdentityProviderResponseSchema)` to create a new message.
+ */
+export const GetIdentityProviderResponseSchema: GenMessage<GetIdentityProviderResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 8);
+
+/**
+ * Request message for ListIdentityProviders.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListIdentityProvidersRequest
+ */
+export type ListIdentityProvidersRequest = Message<"redpanda.api.aigateway.v1.ListIdentityProvidersRequest"> & {
+  /**
+   * Required. Parent account.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of IdPs to return (max 100).
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call.
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter by enabled status.
+   *
+   * @generated from field: bool filter_enabled = 4;
+   */
+  filterEnabled: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListIdentityProvidersRequest.
+ * Use `create(ListIdentityProvidersRequestSchema)` to create a new message.
+ */
+export const ListIdentityProvidersRequestSchema: GenMessage<ListIdentityProvidersRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 9);
+
+/**
+ * Response message for ListIdentityProviders.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListIdentityProvidersResponse
+ */
+export type ListIdentityProvidersResponse = Message<"redpanda.api.aigateway.v1.ListIdentityProvidersResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.IdentityProvider identity_providers = 1;
+   */
+  identityProviders: IdentityProvider[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListIdentityProvidersResponse.
+ * Use `create(ListIdentityProvidersResponseSchema)` to create a new message.
+ */
+export const ListIdentityProvidersResponseSchema: GenMessage<ListIdentityProvidersResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 10);
+
+/**
+ * Request message for UpdateIdentityProvider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateIdentityProviderRequest
+ */
+export type UpdateIdentityProviderRequest = Message<"redpanda.api.aigateway.v1.UpdateIdentityProviderRequest"> & {
+  /**
+   * Required. The identity provider to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.IdentityProvider identity_provider = 1;
+   */
+  identityProvider?: IdentityProvider;
+
+  /**
+   * Fields to update. If not specified, all non-empty fields are updated.
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateIdentityProviderRequest.
+ * Use `create(UpdateIdentityProviderRequestSchema)` to create a new message.
+ */
+export const UpdateIdentityProviderRequestSchema: GenMessage<UpdateIdentityProviderRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 11);
+
+/**
+ * Response message for UpdateIdentityProvider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateIdentityProviderResponse
+ */
+export type UpdateIdentityProviderResponse = Message<"redpanda.api.aigateway.v1.UpdateIdentityProviderResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.IdentityProvider identity_provider = 1;
+   */
+  identityProvider?: IdentityProvider;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateIdentityProviderResponse.
+ * Use `create(UpdateIdentityProviderResponseSchema)` to create a new message.
+ */
+export const UpdateIdentityProviderResponseSchema: GenMessage<UpdateIdentityProviderResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 12);
+
+/**
+ * Request message for DeleteIdentityProvider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteIdentityProviderRequest
+ */
+export type DeleteIdentityProviderRequest = Message<"redpanda.api.aigateway.v1.DeleteIdentityProviderRequest"> & {
+  /**
+   * Required. Resource name of the identity provider to delete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * If true, also delete all associated domains and user identity links.
+   *
+   * @generated from field: bool force = 2;
+   */
+  force: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteIdentityProviderRequest.
+ * Use `create(DeleteIdentityProviderRequestSchema)` to create a new message.
+ */
+export const DeleteIdentityProviderRequestSchema: GenMessage<DeleteIdentityProviderRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 13);
+
+/**
+ * Response message for DeleteIdentityProvider.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteIdentityProviderResponse
+ */
+export type DeleteIdentityProviderResponse = Message<"redpanda.api.aigateway.v1.DeleteIdentityProviderResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteIdentityProviderResponse.
+ * Use `create(DeleteIdentityProviderResponseSchema)` to create a new message.
+ */
+export const DeleteIdentityProviderResponseSchema: GenMessage<DeleteIdentityProviderResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 14);
+
+/**
+ * Request message for AddDomain.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AddDomainRequest
+ */
+export type AddDomainRequest = Message<"redpanda.api.aigateway.v1.AddDomainRequest"> & {
+  /**
+   * Required. Parent identity provider.
+   * Format: `accounts/{account}/identity-providers/{idp}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Required. The email domain to add (e.g., "example.com").
+   *
+   * @generated from field: string domain = 2;
+   */
+  domain: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AddDomainRequest.
+ * Use `create(AddDomainRequestSchema)` to create a new message.
+ */
+export const AddDomainRequestSchema: GenMessage<AddDomainRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 15);
+
+/**
+ * Response message for AddDomain.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AddDomainResponse
+ */
+export type AddDomainResponse = Message<"redpanda.api.aigateway.v1.AddDomainResponse"> & {
+  /**
+   * The created domain with verification instructions.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.EmailDomain email_domain = 1;
+   */
+  emailDomain?: EmailDomain;
+
+  /**
+   * Instructions for DNS verification.
+   *
+   * @generated from field: string verification_instructions = 2;
+   */
+  verificationInstructions: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AddDomainResponse.
+ * Use `create(AddDomainResponseSchema)` to create a new message.
+ */
+export const AddDomainResponseSchema: GenMessage<AddDomainResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 16);
+
+/**
+ * Request message for ListDomains.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListDomainsRequest
+ */
+export type ListDomainsRequest = Message<"redpanda.api.aigateway.v1.ListDomainsRequest"> & {
+  /**
+   * Required. Parent identity provider.
+   * Format: `accounts/{account}/identity-providers/{idp}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of domains to return.
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call.
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListDomainsRequest.
+ * Use `create(ListDomainsRequestSchema)` to create a new message.
+ */
+export const ListDomainsRequestSchema: GenMessage<ListDomainsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 17);
+
+/**
+ * Response message for ListDomains.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListDomainsResponse
+ */
+export type ListDomainsResponse = Message<"redpanda.api.aigateway.v1.ListDomainsResponse"> & {
+  /**
+   * @generated from field: repeated redpanda.api.aigateway.v1.EmailDomain domains = 1;
+   */
+  domains: EmailDomain[];
+
+  /**
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListDomainsResponse.
+ * Use `create(ListDomainsResponseSchema)` to create a new message.
+ */
+export const ListDomainsResponseSchema: GenMessage<ListDomainsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 18);
+
+/**
+ * Request message for RemoveDomain.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RemoveDomainRequest
+ */
+export type RemoveDomainRequest = Message<"redpanda.api.aigateway.v1.RemoveDomainRequest"> & {
+  /**
+   * Required. Resource name of the domain to remove.
+   * Format: `accounts/{account}/identity-providers/{idp}/domains/{domain}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RemoveDomainRequest.
+ * Use `create(RemoveDomainRequestSchema)` to create a new message.
+ */
+export const RemoveDomainRequestSchema: GenMessage<RemoveDomainRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 19);
+
+/**
+ * Response message for RemoveDomain.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RemoveDomainResponse
+ */
+export type RemoveDomainResponse = Message<"redpanda.api.aigateway.v1.RemoveDomainResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RemoveDomainResponse.
+ * Use `create(RemoveDomainResponseSchema)` to create a new message.
+ */
+export const RemoveDomainResponseSchema: GenMessage<RemoveDomainResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 20);
+
+/**
+ * Request message for VerifyDomain.
+ *
+ * @generated from message redpanda.api.aigateway.v1.VerifyDomainRequest
+ */
+export type VerifyDomainRequest = Message<"redpanda.api.aigateway.v1.VerifyDomainRequest"> & {
+  /**
+   * Required. Resource name of the domain to verify.
+   * Format: `accounts/{account}/identity-providers/{idp}/domains/{domain}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.VerifyDomainRequest.
+ * Use `create(VerifyDomainRequestSchema)` to create a new message.
+ */
+export const VerifyDomainRequestSchema: GenMessage<VerifyDomainRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 21);
+
+/**
+ * Response message for VerifyDomain.
+ *
+ * @generated from message redpanda.api.aigateway.v1.VerifyDomainResponse
+ */
+export type VerifyDomainResponse = Message<"redpanda.api.aigateway.v1.VerifyDomainResponse"> & {
+  /**
+   * Updated domain with verification result.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.EmailDomain email_domain = 1;
+   */
+  emailDomain?: EmailDomain;
+
+  /**
+   * Whether verification succeeded.
+   *
+   * @generated from field: bool verified = 2;
+   */
+  verified: boolean;
+
+  /**
+   * Error message if verification failed.
+   *
+   * @generated from field: string error_message = 3;
+   */
+  errorMessage: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.VerifyDomainResponse.
+ * Use `create(VerifyDomainResponseSchema)` to create a new message.
+ */
+export const VerifyDomainResponseSchema: GenMessage<VerifyDomainResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 22);
+
+/**
+ * Request message for LookupIdPByEmail.
+ *
+ * @generated from message redpanda.api.aigateway.v1.LookupIdPByEmailRequest
+ */
+export type LookupIdPByEmailRequest = Message<"redpanda.api.aigateway.v1.LookupIdPByEmailRequest"> & {
+  /**
+   * Required. Parent account.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Required. The email address to look up.
+   *
+   * @generated from field: string email = 2;
+   */
+  email: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.LookupIdPByEmailRequest.
+ * Use `create(LookupIdPByEmailRequestSchema)` to create a new message.
+ */
+export const LookupIdPByEmailRequestSchema: GenMessage<LookupIdPByEmailRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 23);
+
+/**
+ * Response message for LookupIdPByEmail.
+ *
+ * @generated from message redpanda.api.aigateway.v1.LookupIdPByEmailResponse
+ */
+export type LookupIdPByEmailResponse = Message<"redpanda.api.aigateway.v1.LookupIdPByEmailResponse"> & {
+  /**
+   * The identity provider for this email domain.
+   * Empty if no IdP is configured (user should use password login).
+   *
+   * @generated from field: redpanda.api.aigateway.v1.IdentityProvider identity_provider = 1;
+   */
+  identityProvider?: IdentityProvider;
+
+  /**
+   * Whether an IdP was found for this email domain.
+   *
+   * @generated from field: bool has_idp = 2;
+   */
+  hasIdp: boolean;
+
+  /**
+   * The authorization URL to redirect the user to.
+   * Only set if has_idp is true.
+   *
+   * @generated from field: string authorization_url = 3;
+   */
+  authorizationUrl: string;
+
+  /**
+   * Whether the user can also authenticate via password.
+   * True if the user exists and has a password set (e.g., super admins).
+   * When both has_idp and allow_password_login are true, UI should show both options.
+   *
+   * @generated from field: bool allow_password_login = 4;
+   */
+  allowPasswordLogin: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.LookupIdPByEmailResponse.
+ * Use `create(LookupIdPByEmailResponseSchema)` to create a new message.
+ */
+export const LookupIdPByEmailResponseSchema: GenMessage<LookupIdPByEmailResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 24);
+
+/**
+ * Request message for TestCredentials.
+ * Tests that the client_id and client_secret are valid by attempting
+ * a client credentials grant. No scopes are sent - we only validate credentials.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TestCredentialsRequest
+ */
+export type TestCredentialsRequest = Message<"redpanda.api.aigateway.v1.TestCredentialsRequest"> & {
+  /**
+   * Required. The OIDC issuer URL.
+   *
+   * @generated from field: string issuer_url = 1;
+   */
+  issuerUrl: string;
+
+  /**
+   * Required. The OAuth2 client ID.
+   *
+   * @generated from field: string client_id = 2;
+   */
+  clientId: string;
+
+  /**
+   * Required. The OAuth2 client secret.
+   *
+   * @generated from field: string client_secret = 3;
+   */
+  clientSecret: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TestCredentialsRequest.
+ * Use `create(TestCredentialsRequestSchema)` to create a new message.
+ */
+export const TestCredentialsRequestSchema: GenMessage<TestCredentialsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 25);
+
+/**
+ * Response message for TestCredentials.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TestCredentialsResponse
+ */
+export type TestCredentialsResponse = Message<"redpanda.api.aigateway.v1.TestCredentialsResponse"> & {
+  /**
+   * Whether the test succeeded.
+   *
+   * @generated from field: bool success = 1;
+   */
+  success: boolean;
+
+  /**
+   * Error message if the test failed (or success note if credentials valid).
+   *
+   * @generated from field: string error_message = 2;
+   */
+  errorMessage: string;
+
+  /**
+   * Decoded token claims as JSON.
+   * Contains standard claims (iss, sub, aud, exp, iat) and custom claims.
+   *
+   * @generated from field: map<string, string> claims = 5;
+   */
+  claims: { [key: string]: string };
+
+  /**
+   * The raw access token (truncated for security).
+   * Shows first 10 and last 10 characters with ... in between.
+   *
+   * @generated from field: string access_token_preview = 6;
+   */
+  accessTokenPreview: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TestCredentialsResponse.
+ * Use `create(TestCredentialsResponseSchema)` to create a new message.
+ */
+export const TestCredentialsResponseSchema: GenMessage<TestCredentialsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_sso, 26);
+
+/**
+ * IdentityProviderType specifies the protocol used by the identity provider.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.IdentityProviderType
+ */
+export enum IdentityProviderType {
+  /**
+   * @generated from enum value: IDENTITY_PROVIDER_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * OpenID Connect (OIDC) provider
+   *
+   * @generated from enum value: IDENTITY_PROVIDER_TYPE_OIDC = 1;
+   */
+  OIDC = 1,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.IdentityProviderType.
+ */
+export const IdentityProviderTypeSchema: GenEnum<IdentityProviderType> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_sso, 0);
+
+/**
+ * AuthMethod specifies how an IdP can be used for authentication.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.AuthMethod
+ */
+export enum AuthMethod {
+  /**
+   * @generated from enum value: AUTH_METHOD_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * OAuth2 Authorization Code flow with PKCE (browser SSO).
+   * Used for WebUI login where the user is redirected to the IdP.
+   *
+   * @generated from enum value: AUTH_METHOD_AUTHORIZATION_CODE = 1;
+   */
+  AUTHORIZATION_CODE = 1,
+
+  /**
+   * Direct Bearer token validation (API authentication).
+   * Used for CLI/API access where tokens are obtained externally.
+   *
+   * @generated from enum value: AUTH_METHOD_JWT_BEARER = 2;
+   */
+  JWT_BEARER = 2,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.AuthMethod.
+ */
+export const AuthMethodSchema: GenEnum<AuthMethod> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_sso, 1);
+
+/**
+ * ProviderTemplate identifies pre-built provider configurations.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.ProviderTemplate
+ */
+export enum ProviderTemplate {
+  /**
+   * @generated from enum value: PROVIDER_TEMPLATE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Generic OIDC provider (manual configuration)
+   *
+   * @generated from enum value: PROVIDER_TEMPLATE_GENERIC = 1;
+   */
+  GENERIC = 1,
+
+  /**
+   * Google Workspace / Google Cloud Identity
+   *
+   * @generated from enum value: PROVIDER_TEMPLATE_GOOGLE = 2;
+   */
+  GOOGLE = 2,
+
+  /**
+   * GitHub (OAuth2 with OIDC-like claims)
+   *
+   * @generated from enum value: PROVIDER_TEMPLATE_GITHUB = 3;
+   */
+  GITHUB = 3,
+
+  /**
+   * Okta
+   *
+   * @generated from enum value: PROVIDER_TEMPLATE_OKTA = 4;
+   */
+  OKTA = 4,
+
+  /**
+   * Microsoft Azure AD / Entra ID
+   *
+   * @generated from enum value: PROVIDER_TEMPLATE_AZURE_AD = 5;
+   */
+  AZURE_AD = 5,
+
+  /**
+   * Auth0
+   *
+   * @generated from enum value: PROVIDER_TEMPLATE_AUTH0 = 6;
+   */
+  AUTH0 = 6,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.ProviderTemplate.
+ */
+export const ProviderTemplateSchema: GenEnum<ProviderTemplate> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_sso, 2);
+
+/**
+ * DomainVerificationStatus indicates the verification state of a domain.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.DomainVerificationStatus
+ */
+export enum DomainVerificationStatus {
+  /**
+   * @generated from enum value: DOMAIN_VERIFICATION_STATUS_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Verification pending - DNS record not yet added or checked
+   *
+   * @generated from enum value: DOMAIN_VERIFICATION_STATUS_PENDING = 1;
+   */
+  PENDING = 1,
+
+  /**
+   * Domain successfully verified
+   *
+   * @generated from enum value: DOMAIN_VERIFICATION_STATUS_VERIFIED = 2;
+   */
+  VERIFIED = 2,
+
+  /**
+   * Verification failed (DNS record not found or mismatch)
+   *
+   * @generated from enum value: DOMAIN_VERIFICATION_STATUS_FAILED = 3;
+   */
+  FAILED = 3,
+
+  /**
+   * Verification token expired
+   *
+   * @generated from enum value: DOMAIN_VERIFICATION_STATUS_EXPIRED = 4;
+   */
+  EXPIRED = 4,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.DomainVerificationStatus.
+ */
+export const DomainVerificationStatusSchema: GenEnum<DomainVerificationStatus> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_sso, 3);
+
+/**
+ * SSOService manages external identity providers for federated authentication.
+ * Identity providers allow users to authenticate via external OIDC providers (Google, Okta, etc.)
+ * while the gateway remains the central authentication authority.
+ * Resource name: accounts/{account_id}/identity-providers/{idp_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.SSOService
+ */
+export const SSOService: GenService<{
+  /**
+   * Creates a new identity provider within an account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.CreateIdentityProvider
+   */
+  createIdentityProvider: {
+    methodKind: "unary";
+    input: typeof CreateIdentityProviderRequestSchema;
+    output: typeof CreateIdentityProviderResponseSchema;
+  },
+  /**
+   * Gets an identity provider by name.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.GetIdentityProvider
+   */
+  getIdentityProvider: {
+    methodKind: "unary";
+    input: typeof GetIdentityProviderRequestSchema;
+    output: typeof GetIdentityProviderResponseSchema;
+  },
+  /**
+   * Lists identity providers within an account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.ListIdentityProviders
+   */
+  listIdentityProviders: {
+    methodKind: "unary";
+    input: typeof ListIdentityProvidersRequestSchema;
+    output: typeof ListIdentityProvidersResponseSchema;
+  },
+  /**
+   * Updates an identity provider.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.UpdateIdentityProvider
+   */
+  updateIdentityProvider: {
+    methodKind: "unary";
+    input: typeof UpdateIdentityProviderRequestSchema;
+    output: typeof UpdateIdentityProviderResponseSchema;
+  },
+  /**
+   * Deletes an identity provider.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.DeleteIdentityProvider
+   */
+  deleteIdentityProvider: {
+    methodKind: "unary";
+    input: typeof DeleteIdentityProviderRequestSchema;
+    output: typeof DeleteIdentityProviderResponseSchema;
+  },
+  /**
+   * Adds an email domain to an identity provider for Home Realm Discovery.
+   * The domain must be verified via DNS TXT record before it becomes active.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.AddDomain
+   */
+  addDomain: {
+    methodKind: "unary";
+    input: typeof AddDomainRequestSchema;
+    output: typeof AddDomainResponseSchema;
+  },
+  /**
+   * Lists domains associated with an identity provider.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.ListDomains
+   */
+  listDomains: {
+    methodKind: "unary";
+    input: typeof ListDomainsRequestSchema;
+    output: typeof ListDomainsResponseSchema;
+  },
+  /**
+   * Removes a domain from an identity provider.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.RemoveDomain
+   */
+  removeDomain: {
+    methodKind: "unary";
+    input: typeof RemoveDomainRequestSchema;
+    output: typeof RemoveDomainResponseSchema;
+  },
+  /**
+   * Initiates or retries domain verification via DNS TXT record.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.VerifyDomain
+   */
+  verifyDomain: {
+    methodKind: "unary";
+    input: typeof VerifyDomainRequestSchema;
+    output: typeof VerifyDomainResponseSchema;
+  },
+  /**
+   * Looks up the identity provider for an email address based on domain.
+   * Used during login to determine which IdP to redirect to.
+   * Returns NOT_FOUND if no IdP is configured for the domain.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.LookupIdPByEmail
+   */
+  lookupIdPByEmail: {
+    methodKind: "unary";
+    input: typeof LookupIdPByEmailRequestSchema;
+    output: typeof LookupIdPByEmailResponseSchema;
+  },
+  /**
+   * Tests OIDC credentials using the client credentials grant.
+   * Validates that the client_id and client_secret can obtain a token
+   * and returns the decoded token claims.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.SSOService.TestCredentials
+   */
+  testCredentials: {
+    methodKind: "unary";
+    input: typeof TestCredentialsRequestSchema;
+    output: typeof TestCredentialsResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_sso, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/team-TeamService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/team-TeamService_connectquery.ts
new file mode 100644
index 0000000000..0c8cce18a5
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/team-TeamService_connectquery.ts
@@ -0,0 +1,75 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/team.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { TeamService } from "./team_pb";
+
+/**
+ * Creates a new team within an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.CreateTeam
+ */
+export const createTeam = TeamService.method.createTeam;
+
+/**
+ * Gets a team by name.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.GetTeam
+ */
+export const getTeam = TeamService.method.getTeam;
+
+/**
+ * Lists teams within an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.ListTeams
+ */
+export const listTeams = TeamService.method.listTeams;
+
+/**
+ * Updates a team.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.UpdateTeam
+ */
+export const updateTeam = TeamService.method.updateTeam;
+
+/**
+ * Deletes a team.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.DeleteTeam
+ */
+export const deleteTeam = TeamService.method.deleteTeam;
+
+/**
+ * Adds a user to a team.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.AddTeamMember
+ */
+export const addTeamMember = TeamService.method.addTeamMember;
+
+/**
+ * Gets a team membership.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.GetTeamMember
+ */
+export const getTeamMember = TeamService.method.getTeamMember;
+
+/**
+ * Lists members of a team.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.ListTeamMembers
+ */
+export const listTeamMembers = TeamService.method.listTeamMembers;
+
+/**
+ * Updates a team member's role.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.UpdateTeamMember
+ */
+export const updateTeamMember = TeamService.method.updateTeamMember;
+
+/**
+ * Removes a user from a team.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.TeamService.RemoveTeamMember
+ */
+export const removeTeamMember = TeamService.method.removeTeamMember;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/team_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/team_pb.ts
new file mode 100644
index 0000000000..4dc0caf351
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/team_pb.ts
@@ -0,0 +1,818 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/team.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/team.proto.
+ */
+export const file_redpanda_api_aigateway_v1_team: GenFile = /*@__PURE__*/
+  fileDesc("CiRyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3RlYW0ucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEi0wMKBFRlYW0SEQoEbmFtZRgBIAEoCUID4EEIEiMKDGRpc3BsYXlfbmFtZRgCIAEoCUIN4EECukgHcgUQARj/ARIYCgtkZXNjcmlwdGlvbhgDIAEoCUID4EEBEg8KB2VuYWJsZWQYBCABKAgSPwoIbWV0YWRhdGEYBSADKAsyLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlYW0uTWV0YWRhdGFFbnRyeRI0CgtjcmVhdGVfdGltZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxI0Cgt1cGRhdGVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIUCgdjcmVhdG9yGAggASgJQgPgQQMSFAoHdXBkYXRlchgJIAEoCUID4EEDGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATpe6kFbChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1RlYW0SPGFjY291bnRzL3thY2NvdW50fS9vcmdhbml6YXRpb25zL3tvcmdhbml6YXRpb259L3RlYW1zL3t0ZWFtfSLZAgoOVGVhbU1lbWJlcnNoaXASEQoEbmFtZRgBIAEoCUID4EEIEjEKBHVzZXIYAiABKAlCI+BBAvpBHQobYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Vc2VyEjYKBHJvbGUYAyABKA4yIy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlYW1Sb2xlQgPgQQISNAoLY3JlYXRlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSFAoHY3JlYXRvchgFIAEoCUID4EEDOn3qQXoKJWFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vVGVhbU1lbWJlcnNoaXASUWFjY291bnRzL3thY2NvdW50fS9vcmdhbml6YXRpb25zL3tvcmdhbml6YXRpb259L3RlYW1zL3t0ZWFtfS9tZW1iZXJzL3ttZW1iZXJzaGlwfSKaAQoRQ3JlYXRlVGVhbVJlcXVlc3QSOwoGcGFyZW50GAEgASgJQivgQQL6QSUKI2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT3JnYW5pemF0aW9uEhQKB3RlYW1faWQYAiABKAlCA+BBARIyCgR0ZWFtGAMgASgLMh8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UZWFtQgPgQQIiQwoSQ3JlYXRlVGVhbVJlc3BvbnNlEi0KBHRlYW0YASABKAsyHy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlYW0iQwoOR2V0VGVhbVJlcXVlc3QSMQoEbmFtZRgBIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1RlYW0iQAoPR2V0VGVhbVJlc3BvbnNlEi0KBHRlYW0YASABKAsyHy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlYW0itgEKEExpc3RUZWFtc1JlcXVlc3QSOwoGcGFyZW50GAEgASgJQivgQQL6QSUKI2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT3JnYW5pemF0aW9uEiAKCXBhZ2Vfc2l6ZRgCIAEoBUIN4EEBukgHGgUY6AcoABIXCgpwYWdlX3Rva2VuGAMgASgJQgPgQQESEwoGZmlsdGVyGAQgASgJQgPgQQESFQoIb3JkZXJfYnkYBSABKAlCA+BBASJwChFMaXN0VGVhbXNSZXNwb25zZRIuCgV0ZWFtcxgBIAMoCzIfLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVGVhbRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSJ9ChFVcGRhdGVUZWFtUmVxdWVzdBIyCgR0ZWFtGAEgASgLMh8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UZWFtQgPgQQISNAoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQgPgQQEiQwoSVXBkYXRlVGVhbVJlc3BvbnNlEi0KBHRlYW0YASABKAsyHy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlRlYW0iWgoRRGVsZXRlVGVhbVJlcXVlc3QSMQoEbmFtZRgBIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1RlYW0SEgoFZm9yY2UYAiABKAhCA+BBASIUChJEZWxldGVUZWFtUmVzcG9uc2UitgEKFEFkZFRlYW1NZW1iZXJSZXF1ZXN0EjMKBnBhcmVudBgBIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1RlYW0SMQoEdXNlchgCIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1VzZXISNgoEcm9sZRgDIAEoDjIjLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVGVhbVJvbGVCA+BBAiJWChVBZGRUZWFtTWVtYmVyUmVzcG9uc2USPQoKbWVtYmVyc2hpcBgBIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVGVhbU1lbWJlcnNoaXAiUwoUR2V0VGVhbU1lbWJlclJlcXVlc3QSOwoEbmFtZRgBIAEoCUIt4EEC+kEnCiVhaWdhdGV3YXkucmVkcGFuZGEuY29tL1RlYW1NZW1iZXJzaGlwIlYKFUdldFRlYW1NZW1iZXJSZXNwb25zZRI9CgptZW1iZXJzaGlwGAEgASgLMikucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UZWFtTWVtYmVyc2hpcCKIAQoWTGlzdFRlYW1NZW1iZXJzUmVxdWVzdBIzCgZwYXJlbnQYASABKAlCI+BBAvpBHQobYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9UZWFtEiAKCXBhZ2Vfc2l6ZRgCIAEoBUIN4EEBukgHGgUY6AcoABIXCgpwYWdlX3Rva2VuGAMgASgJQgPgQQEihgEKF0xpc3RUZWFtTWVtYmVyc1Jlc3BvbnNlEj4KC21lbWJlcnNoaXBzGAEgAygLMikucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5UZWFtTWVtYmVyc2hpcBIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSKTAQoXVXBkYXRlVGVhbU1lbWJlclJlcXVlc3QSQgoKbWVtYmVyc2hpcBgBIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVGVhbU1lbWJlcnNoaXBCA+BBAhI0Cgt1cGRhdGVfbWFzaxgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5GaWVsZE1hc2tCA+BBASJZChhVcGRhdGVUZWFtTWVtYmVyUmVzcG9uc2USPQoKbWVtYmVyc2hpcBgBIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVGVhbU1lbWJlcnNoaXAiVgoXUmVtb3ZlVGVhbU1lbWJlclJlcXVlc3QSOwoEbmFtZRgBIAEoCUIt4EEC+kEnCiVhaWdhdGV3YXkucmVkcGFuZGEuY29tL1RlYW1NZW1iZXJzaGlwIhoKGFJlbW92ZVRlYW1NZW1iZXJSZXNwb25zZSpmCghUZWFtUm9sZRIZChVURUFNX1JPTEVfVU5TUEVDSUZJRUQQABITCg9URUFNX1JPTEVfQURNSU4QARIUChBURUFNX1JPTEVfTUVNQkVSEAISFAoQVEVBTV9ST0xFX1ZJRVdFUhADMpMOCgtUZWFtU2VydmljZRKmAQoKQ3JlYXRlVGVhbRIsLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlVGVhbVJlcXVlc3QaLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNyZWF0ZVRlYW1SZXNwb25zZSI7gtPkkwI1OgR0ZWFtIi0vdjEve3BhcmVudD1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKn0vdGVhbXMSlwEKB0dldFRlYW0SKS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldFRlYW1SZXF1ZXN0GioucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRUZWFtUmVzcG9uc2UiNYLT5JMCLxItL3YxL3tuYW1lPWFjY291bnRzLyovb3JnYW5pemF0aW9ucy8qL3RlYW1zLyp9Ep0BCglMaXN0VGVhbXMSKy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RUZWFtc1JlcXVlc3QaLC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RUZWFtc1Jlc3BvbnNlIjWC0+STAi8SLS92MS97cGFyZW50PWFjY291bnRzLyovb3JnYW5pemF0aW9ucy8qfS90ZWFtcxKrAQoKVXBkYXRlVGVhbRIsLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlVGVhbVJlcXVlc3QaLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZVRlYW1SZXNwb25zZSJAgtPkkwI6OgR0ZWFtMjIvdjEve3RlYW0ubmFtZT1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKi90ZWFtcy8qfRKgAQoKRGVsZXRlVGVhbRIsLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlVGVhbVJlcXVlc3QaLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZVRlYW1SZXNwb25zZSI1gtPkkwIvKi0vdjEve25hbWU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovdGVhbXMvKn0StgEKDUFkZFRlYW1NZW1iZXISLy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkFkZFRlYW1NZW1iZXJSZXF1ZXN0GjAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5BZGRUZWFtTWVtYmVyUmVzcG9uc2UiQoLT5JMCPDoBKiI3L3YxL3twYXJlbnQ9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovdGVhbXMvKn0vbWVtYmVycxKzAQoNR2V0VGVhbU1lbWJlchIvLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0VGVhbU1lbWJlclJlcXVlc3QaMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldFRlYW1NZW1iZXJSZXNwb25zZSI/gtPkkwI5EjcvdjEve25hbWU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovdGVhbXMvKi9tZW1iZXJzLyp9ErkBCg9MaXN0VGVhbU1lbWJlcnMSMS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RUZWFtTWVtYmVyc1JlcXVlc3QaMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RUZWFtTWVtYmVyc1Jlc3BvbnNlIj+C0+STAjkSNy92MS97cGFyZW50PWFjY291bnRzLyovb3JnYW5pemF0aW9ucy8qL3RlYW1zLyp9L21lbWJlcnMSygEKEFVwZGF0ZVRlYW1NZW1iZXISMi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZVRlYW1NZW1iZXJSZXF1ZXN0GjMucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVUZWFtTWVtYmVyUmVzcG9uc2UiTYLT5JMCRzoBKjJCL3YxL3ttZW1iZXJzaGlwLm5hbWU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovdGVhbXMvKi9tZW1iZXJzLyp9ErwBChBSZW1vdmVUZWFtTWVtYmVyEjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SZW1vdmVUZWFtTWVtYmVyUmVxdWVzdBozLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVtb3ZlVGVhbU1lbWJlclJlc3BvbnNlIj+C0+STAjkqNy92MS97bmFtZT1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKi90ZWFtcy8qL21lbWJlcnMvKn0aGcpBFmFpZ2F0ZXdheS5yZWRwYW5kYS5jb21C/gEKHWNvbS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxQglUZWFtUHJvdG9QAVpLZ28ucGFuZGEuZGV2L3JlZHBhbmRhLWFpZ3cvcHJvdG9zL2dlbi9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxO2FpZ2F0ZXdheXYxogIDUkFBqgIZUmVkcGFuZGEuQXBpLkFpZ2F0ZXdheS5WMcoCGVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjHiAiVSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYxXEdQQk1ldGFkYXRh6gIcUmVkcGFuZGE6OkFwaTo6QWlnYXRld2F5OjpWMWIGcHJvdG8z", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Team represents a group of users within an organization.
+ * Teams are used for access control and collaboration.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Team
+ */
+export type Team = Message<"redpanda.api.aigateway.v1.Team"> & {
+  /**
+   * Resource name. Format: `accounts/{account}/organizations/{organization}/teams/{team}`
+   * Team ID is a globally unique, sortable identifier (XID).
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name (must be unique within organization)
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Whether this team is active
+   *
+   * @generated from field: bool enabled = 4;
+   */
+  enabled: boolean;
+
+  /**
+   * Metadata for arbitrary key-value pairs
+   *
+   * @generated from field: map<string, string> metadata = 5;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 6;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 7;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Creator (API key or OIDC subject)
+   *
+   * @generated from field: string creator = 8;
+   */
+  creator: string;
+
+  /**
+   * Output only. Last updater (API key or OIDC subject)
+   *
+   * @generated from field: string updater = 9;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Team.
+ * Use `create(TeamSchema)` to create a new message.
+ */
+export const TeamSchema: GenMessage<Team> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 0);
+
+/**
+ * TeamMembership represents a user's membership in a team.
+ *
+ * @generated from message redpanda.api.aigateway.v1.TeamMembership
+ */
+export type TeamMembership = Message<"redpanda.api.aigateway.v1.TeamMembership"> & {
+  /**
+   * Resource name. Format: `accounts/{account}/organizations/{organization}/teams/{team}/members/{membership}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Reference to the user.
+   * Format: `accounts/{account}/organizations/{organization}/users/{user}`
+   *
+   * @generated from field: string user = 2;
+   */
+  user: string;
+
+  /**
+   * Role in the team: admin, member, viewer
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TeamRole role = 3;
+   */
+  role: TeamRole;
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 4;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Creator (API key or OIDC subject)
+   *
+   * @generated from field: string creator = 5;
+   */
+  creator: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.TeamMembership.
+ * Use `create(TeamMembershipSchema)` to create a new message.
+ */
+export const TeamMembershipSchema: GenMessage<TeamMembership> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 1);
+
+/**
+ * Request message for CreateTeam RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateTeamRequest
+ */
+export type CreateTeamRequest = Message<"redpanda.api.aigateway.v1.CreateTeamRequest"> & {
+  /**
+   * Required: Parent organization.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * The team ID to use. If empty, server generates one.
+   *
+   * @generated from field: string team_id = 2;
+   */
+  teamId: string;
+
+  /**
+   * Required: The team resource to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Team team = 3;
+   */
+  team?: Team;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateTeamRequest.
+ * Use `create(CreateTeamRequestSchema)` to create a new message.
+ */
+export const CreateTeamRequestSchema: GenMessage<CreateTeamRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 2);
+
+/**
+ * Response message for CreateTeam RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateTeamResponse
+ */
+export type CreateTeamResponse = Message<"redpanda.api.aigateway.v1.CreateTeamResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Team team = 1;
+   */
+  team?: Team;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateTeamResponse.
+ * Use `create(CreateTeamResponseSchema)` to create a new message.
+ */
+export const CreateTeamResponseSchema: GenMessage<CreateTeamResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 3);
+
+/**
+ * Request message for GetTeam RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetTeamRequest
+ */
+export type GetTeamRequest = Message<"redpanda.api.aigateway.v1.GetTeamRequest"> & {
+  /**
+   * Resource name of the team.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetTeamRequest.
+ * Use `create(GetTeamRequestSchema)` to create a new message.
+ */
+export const GetTeamRequestSchema: GenMessage<GetTeamRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 4);
+
+/**
+ * Response message for GetTeam RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetTeamResponse
+ */
+export type GetTeamResponse = Message<"redpanda.api.aigateway.v1.GetTeamResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Team team = 1;
+   */
+  team?: Team;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetTeamResponse.
+ * Use `create(GetTeamResponseSchema)` to create a new message.
+ */
+export const GetTeamResponseSchema: GenMessage<GetTeamResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 5);
+
+/**
+ * Request message for ListTeams RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListTeamsRequest
+ */
+export type ListTeamsRequest = Message<"redpanda.api.aigateway.v1.ListTeamsRequest"> & {
+  /**
+   * Required: Parent organization.
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of teams to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous ListTeams call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter expression (CEL syntax)
+   *
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * Comma-separated list of fields to order by
+   *
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListTeamsRequest.
+ * Use `create(ListTeamsRequestSchema)` to create a new message.
+ */
+export const ListTeamsRequestSchema: GenMessage<ListTeamsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 6);
+
+/**
+ * Response message for ListTeams RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListTeamsResponse
+ */
+export type ListTeamsResponse = Message<"redpanda.api.aigateway.v1.ListTeamsResponse"> & {
+  /**
+   * The list of teams
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.Team teams = 1;
+   */
+  teams: Team[];
+
+  /**
+   * Token for next page (empty if no more pages)
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count of matching teams
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListTeamsResponse.
+ * Use `create(ListTeamsResponseSchema)` to create a new message.
+ */
+export const ListTeamsResponseSchema: GenMessage<ListTeamsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 7);
+
+/**
+ * Request message for UpdateTeam RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateTeamRequest
+ */
+export type UpdateTeamRequest = Message<"redpanda.api.aigateway.v1.UpdateTeamRequest"> & {
+  /**
+   * Required: The team resource to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Team team = 1;
+   */
+  team?: Team;
+
+  /**
+   * The fields to update.
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateTeamRequest.
+ * Use `create(UpdateTeamRequestSchema)` to create a new message.
+ */
+export const UpdateTeamRequestSchema: GenMessage<UpdateTeamRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 8);
+
+/**
+ * Response message for UpdateTeam RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateTeamResponse
+ */
+export type UpdateTeamResponse = Message<"redpanda.api.aigateway.v1.UpdateTeamResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Team team = 1;
+   */
+  team?: Team;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateTeamResponse.
+ * Use `create(UpdateTeamResponseSchema)` to create a new message.
+ */
+export const UpdateTeamResponseSchema: GenMessage<UpdateTeamResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 9);
+
+/**
+ * Request message for DeleteTeam RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteTeamRequest
+ */
+export type DeleteTeamRequest = Message<"redpanda.api.aigateway.v1.DeleteTeamRequest"> & {
+  /**
+   * Resource name of the team to delete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * If true, cascade delete all memberships
+   *
+   * @generated from field: bool force = 2;
+   */
+  force: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteTeamRequest.
+ * Use `create(DeleteTeamRequestSchema)` to create a new message.
+ */
+export const DeleteTeamRequestSchema: GenMessage<DeleteTeamRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 10);
+
+/**
+ * Response message for DeleteTeam RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteTeamResponse
+ */
+export type DeleteTeamResponse = Message<"redpanda.api.aigateway.v1.DeleteTeamResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteTeamResponse.
+ * Use `create(DeleteTeamResponseSchema)` to create a new message.
+ */
+export const DeleteTeamResponseSchema: GenMessage<DeleteTeamResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 11);
+
+/**
+ * Request message for AddTeamMember RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AddTeamMemberRequest
+ */
+export type AddTeamMemberRequest = Message<"redpanda.api.aigateway.v1.AddTeamMemberRequest"> & {
+  /**
+   * Required: Parent team.
+   * Format: `accounts/{account}/organizations/{organization}/teams/{team}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Required: User to add.
+   * Format: `accounts/{account}/organizations/{organization}/users/{user}`
+   *
+   * @generated from field: string user = 2;
+   */
+  user: string;
+
+  /**
+   * Required: Role for the membership
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TeamRole role = 3;
+   */
+  role: TeamRole;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AddTeamMemberRequest.
+ * Use `create(AddTeamMemberRequestSchema)` to create a new message.
+ */
+export const AddTeamMemberRequestSchema: GenMessage<AddTeamMemberRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 12);
+
+/**
+ * Response message for AddTeamMember RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AddTeamMemberResponse
+ */
+export type AddTeamMemberResponse = Message<"redpanda.api.aigateway.v1.AddTeamMemberResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.TeamMembership membership = 1;
+   */
+  membership?: TeamMembership;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AddTeamMemberResponse.
+ * Use `create(AddTeamMemberResponseSchema)` to create a new message.
+ */
+export const AddTeamMemberResponseSchema: GenMessage<AddTeamMemberResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 13);
+
+/**
+ * Request message for GetTeamMember RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetTeamMemberRequest
+ */
+export type GetTeamMemberRequest = Message<"redpanda.api.aigateway.v1.GetTeamMemberRequest"> & {
+  /**
+   * Resource name of the membership.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetTeamMemberRequest.
+ * Use `create(GetTeamMemberRequestSchema)` to create a new message.
+ */
+export const GetTeamMemberRequestSchema: GenMessage<GetTeamMemberRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 14);
+
+/**
+ * Response message for GetTeamMember RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetTeamMemberResponse
+ */
+export type GetTeamMemberResponse = Message<"redpanda.api.aigateway.v1.GetTeamMemberResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.TeamMembership membership = 1;
+   */
+  membership?: TeamMembership;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetTeamMemberResponse.
+ * Use `create(GetTeamMemberResponseSchema)` to create a new message.
+ */
+export const GetTeamMemberResponseSchema: GenMessage<GetTeamMemberResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 15);
+
+/**
+ * Request message for ListTeamMembers RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListTeamMembersRequest
+ */
+export type ListTeamMembersRequest = Message<"redpanda.api.aigateway.v1.ListTeamMembersRequest"> & {
+  /**
+   * Required: Parent team.
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of members to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous ListTeamMembers call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListTeamMembersRequest.
+ * Use `create(ListTeamMembersRequestSchema)` to create a new message.
+ */
+export const ListTeamMembersRequestSchema: GenMessage<ListTeamMembersRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 16);
+
+/**
+ * Response message for ListTeamMembers RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListTeamMembersResponse
+ */
+export type ListTeamMembersResponse = Message<"redpanda.api.aigateway.v1.ListTeamMembersResponse"> & {
+  /**
+   * The list of memberships
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.TeamMembership memberships = 1;
+   */
+  memberships: TeamMembership[];
+
+  /**
+   * Token for next page
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListTeamMembersResponse.
+ * Use `create(ListTeamMembersResponseSchema)` to create a new message.
+ */
+export const ListTeamMembersResponseSchema: GenMessage<ListTeamMembersResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 17);
+
+/**
+ * Request message for UpdateTeamMember RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateTeamMemberRequest
+ */
+export type UpdateTeamMemberRequest = Message<"redpanda.api.aigateway.v1.UpdateTeamMemberRequest"> & {
+  /**
+   * Required: The membership to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.TeamMembership membership = 1;
+   */
+  membership?: TeamMembership;
+
+  /**
+   * The fields to update (only role is updatable)
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateTeamMemberRequest.
+ * Use `create(UpdateTeamMemberRequestSchema)` to create a new message.
+ */
+export const UpdateTeamMemberRequestSchema: GenMessage<UpdateTeamMemberRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 18);
+
+/**
+ * Response message for UpdateTeamMember RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateTeamMemberResponse
+ */
+export type UpdateTeamMemberResponse = Message<"redpanda.api.aigateway.v1.UpdateTeamMemberResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.TeamMembership membership = 1;
+   */
+  membership?: TeamMembership;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateTeamMemberResponse.
+ * Use `create(UpdateTeamMemberResponseSchema)` to create a new message.
+ */
+export const UpdateTeamMemberResponseSchema: GenMessage<UpdateTeamMemberResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 19);
+
+/**
+ * Request message for RemoveTeamMember RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RemoveTeamMemberRequest
+ */
+export type RemoveTeamMemberRequest = Message<"redpanda.api.aigateway.v1.RemoveTeamMemberRequest"> & {
+  /**
+   * Resource name of the membership to remove.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RemoveTeamMemberRequest.
+ * Use `create(RemoveTeamMemberRequestSchema)` to create a new message.
+ */
+export const RemoveTeamMemberRequestSchema: GenMessage<RemoveTeamMemberRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 20);
+
+/**
+ * Response message for RemoveTeamMember RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RemoveTeamMemberResponse
+ */
+export type RemoveTeamMemberResponse = Message<"redpanda.api.aigateway.v1.RemoveTeamMemberResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RemoveTeamMemberResponse.
+ * Use `create(RemoveTeamMemberResponseSchema)` to create a new message.
+ */
+export const RemoveTeamMemberResponseSchema: GenMessage<RemoveTeamMemberResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_team, 21);
+
+/**
+ * TeamRole defines the role a user can have in a team.
+ *
+ * @generated from enum redpanda.api.aigateway.v1.TeamRole
+ */
+export enum TeamRole {
+  /**
+   * @generated from enum value: TEAM_ROLE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Full team management permissions
+   *
+   * @generated from enum value: TEAM_ROLE_ADMIN = 1;
+   */
+  ADMIN = 1,
+
+  /**
+   * Standard team member permissions
+   *
+   * @generated from enum value: TEAM_ROLE_MEMBER = 2;
+   */
+  MEMBER = 2,
+
+  /**
+   * Read-only access
+   *
+   * @generated from enum value: TEAM_ROLE_VIEWER = 3;
+   */
+  VIEWER = 3,
+}
+
+/**
+ * Describes the enum redpanda.api.aigateway.v1.TeamRole.
+ */
+export const TeamRoleSchema: GenEnum<TeamRole> = /*@__PURE__*/
+  enumDesc(file_redpanda_api_aigateway_v1_team, 0);
+
+/**
+ * TeamService manages teams within organizations.
+ * A team is a group of users for access control and collaboration.
+ * Resource name: accounts/{account_id}/organizations/{organization_id}/teams/{team_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.TeamService
+ */
+export const TeamService: GenService<{
+  /**
+   * Creates a new team within an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.CreateTeam
+   */
+  createTeam: {
+    methodKind: "unary";
+    input: typeof CreateTeamRequestSchema;
+    output: typeof CreateTeamResponseSchema;
+  },
+  /**
+   * Gets a team by name.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.GetTeam
+   */
+  getTeam: {
+    methodKind: "unary";
+    input: typeof GetTeamRequestSchema;
+    output: typeof GetTeamResponseSchema;
+  },
+  /**
+   * Lists teams within an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.ListTeams
+   */
+  listTeams: {
+    methodKind: "unary";
+    input: typeof ListTeamsRequestSchema;
+    output: typeof ListTeamsResponseSchema;
+  },
+  /**
+   * Updates a team.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.UpdateTeam
+   */
+  updateTeam: {
+    methodKind: "unary";
+    input: typeof UpdateTeamRequestSchema;
+    output: typeof UpdateTeamResponseSchema;
+  },
+  /**
+   * Deletes a team.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.DeleteTeam
+   */
+  deleteTeam: {
+    methodKind: "unary";
+    input: typeof DeleteTeamRequestSchema;
+    output: typeof DeleteTeamResponseSchema;
+  },
+  /**
+   * Adds a user to a team.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.AddTeamMember
+   */
+  addTeamMember: {
+    methodKind: "unary";
+    input: typeof AddTeamMemberRequestSchema;
+    output: typeof AddTeamMemberResponseSchema;
+  },
+  /**
+   * Gets a team membership.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.GetTeamMember
+   */
+  getTeamMember: {
+    methodKind: "unary";
+    input: typeof GetTeamMemberRequestSchema;
+    output: typeof GetTeamMemberResponseSchema;
+  },
+  /**
+   * Lists members of a team.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.ListTeamMembers
+   */
+  listTeamMembers: {
+    methodKind: "unary";
+    input: typeof ListTeamMembersRequestSchema;
+    output: typeof ListTeamMembersResponseSchema;
+  },
+  /**
+   * Updates a team member's role.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.UpdateTeamMember
+   */
+  updateTeamMember: {
+    methodKind: "unary";
+    input: typeof UpdateTeamMemberRequestSchema;
+    output: typeof UpdateTeamMemberResponseSchema;
+  },
+  /**
+   * Removes a user from a team.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.TeamService.RemoveTeamMember
+   */
+  removeTeamMember: {
+    methodKind: "unary";
+    input: typeof RemoveTeamMemberRequestSchema;
+    output: typeof RemoveTeamMemberResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_team, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/user-UserService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/user-UserService_connectquery.ts
new file mode 100644
index 0000000000..62b6518093
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/user-UserService_connectquery.ts
@@ -0,0 +1,99 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/user.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { UserService } from "./user_pb";
+
+/**
+ * Creates a new user within an account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.CreateUser
+ */
+export const createUser = UserService.method.createUser;
+
+/**
+ * Gets a user by name.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.GetUser
+ */
+export const getUser = UserService.method.getUser;
+
+/**
+ * Lists users within an account.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.ListUsers
+ */
+export const listUsers = UserService.method.listUsers;
+
+/**
+ * Updates a user.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.UpdateUser
+ */
+export const updateUser = UserService.method.updateUser;
+
+/**
+ * Deletes a user.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.DeleteUser
+ */
+export const deleteUser = UserService.method.deleteUser;
+
+/**
+ * Lists organizations that a user belongs to.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.ListUserOrganizations
+ */
+export const listUserOrganizations = UserService.method.listUserOrganizations;
+
+/**
+ * Adds a user to an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.AddUserToOrganization
+ */
+export const addUserToOrganization = UserService.method.addUserToOrganization;
+
+/**
+ * Updates a user's role in an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.UpdateUserOrganizationRole
+ */
+export const updateUserOrganizationRole = UserService.method.updateUserOrganizationRole;
+
+/**
+ * Removes a user from an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.RemoveUserFromOrganization
+ */
+export const removeUserFromOrganization = UserService.method.removeUserFromOrganization;
+
+/**
+ * Lists teams that a user belongs to.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.ListUserTeams
+ */
+export const listUserTeams = UserService.method.listUserTeams;
+
+/**
+ * Gets information about a user's personal access token (non-secret info only).
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.GetPersonalTokenInfo
+ */
+export const getPersonalTokenInfo = UserService.method.getPersonalTokenInfo;
+
+/**
+ * Rotates a user's personal access token.
+ * The old token is invalidated and a new one is generated.
+ * The new token is returned only once and should be stored securely.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.RotatePersonalToken
+ */
+export const rotatePersonalToken = UserService.method.rotatePersonalToken;
+
+/**
+ * Reveals the user's personal access token.
+ * Requires re-authentication with the user's password for security.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.UserService.RevealPersonalToken
+ */
+export const revealPersonalToken = UserService.method.revealPersonalToken;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/user_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/user_pb.ts
new file mode 100644
index 0000000000..1496e4c351
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/user_pb.ts
@@ -0,0 +1,1126 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/user.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/user.proto.
+ */
+export const file_redpanda_api_aigateway_v1_user: GenFile = /*@__PURE__*/
+  fileDesc("CiRyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3VzZXIucHJvdG8SGXJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEinAUKBFVzZXISEQoEbmFtZRgBIAEoCUID4EEIEhkKBWVtYWlsGAIgASgJQgrgQQK6SARyAmABEiMKDGRpc3BsYXlfbmFtZRgDIAEoCUIN4EECukgHcgUQARj/ARIZCgxvaWRjX3N1YmplY3QYBCABKAlCA+BBARIPCgdlbmFibGVkGAUgASgIEj8KCG1ldGFkYXRhGAYgAygLMi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Vc2VyLk1ldGFkYXRhRW50cnkSNAoLY3JlYXRlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSNAoLdXBkYXRlX3RpbWUYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgPgQQMSOAoPbGFzdF9sb2dpbl90aW1lGAkgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEID4EEDEhQKB2NyZWF0b3IYCiABKAlCA+BBAxIUCgd1cGRhdGVyGAsgASgJQgPgQQMSSQoUZGVmYXVsdF9vcmdhbml6YXRpb24YDCABKAlCK+BBAfpBJQojYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Pcmdhbml6YXRpb24SQwoRZGVmYXVsdF93b3Jrc3BhY2UYDSABKAlCKOBBAfpBIgogYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Xb3Jrc3BhY2UaLwoNTWV0YWRhdGFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBOkHqQT4KG2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vVXNlchIfYWNjb3VudHMve2FjY291bnR9L3VzZXJzL3t1c2VyfSLrAgoWT3JnYW5pemF0aW9uTWVtYmVyc2hpcBIRCgRuYW1lGAEgASgJQgPgQQgSQQoMb3JnYW5pemF0aW9uGAIgASgJQivgQQL6QSUKI2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT3JnYW5pemF0aW9uEiYKGW9yZ2FuaXphdGlvbl9kaXNwbGF5X25hbWUYAyABKAlCA+BBAxItCgRyb2xlGAQgASgJQh/gQQK6SBlyF1IFYWRtaW5SBm1lbWJlclIGdmlld2VyEjIKCWpvaW5fdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAzpw6kFtCi1haWdhdGV3YXkucmVkcGFuZGEuY29tL09yZ2FuaXphdGlvbk1lbWJlcnNoaXASPGFjY291bnRzL3thY2NvdW50fS91c2Vycy97dXNlcn0vb3JnYW5pemF0aW9ucy97b3JnYW5pemF0aW9ufSKIAgoRQ3JlYXRlVXNlclJlcXVlc3QSNgoGcGFyZW50GAEgASgJQibgQQL6QSAKHmFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vQWNjb3VudBIUCgd1c2VyX2lkGAIgASgJQgPgQQESMgoEdXNlchgDIAEoCzIfLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXNlckID4EECEkkKFGluaXRpYWxfb3JnYW5pemF0aW9uGAQgASgJQivgQQH6QSUKI2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT3JnYW5pemF0aW9uEiYKGWluaXRpYWxfb3JnYW5pemF0aW9uX3JvbGUYBSABKAlCA+BBASJnChJDcmVhdGVVc2VyUmVzcG9uc2USLQoEdXNlchgBIAEoCzIfLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXNlchIiChVwZXJzb25hbF9hY2Nlc3NfdG9rZW4YAiABKAlCA+BBAyJDCg5HZXRVc2VyUmVxdWVzdBIxCgRuYW1lGAEgASgJQiPgQQL6QR0KG2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vVXNlciJACg9HZXRVc2VyUmVzcG9uc2USLQoEdXNlchgBIAEoCzIfLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXNlciKxAQoQTGlzdFVzZXJzUmVxdWVzdBI2CgZwYXJlbnQYASABKAlCJuBBAvpBIAoeYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9BY2NvdW50EiAKCXBhZ2Vfc2l6ZRgCIAEoBUIN4EEBukgHGgUY6AcoABIXCgpwYWdlX3Rva2VuGAMgASgJQgPgQQESEwoGZmlsdGVyGAQgASgJQgPgQQESFQoIb3JkZXJfYnkYBSABKAlCA+BBASJwChFMaXN0VXNlcnNSZXNwb25zZRIuCgV1c2VycxgBIAMoCzIfLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXNlchIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSJ9ChFVcGRhdGVVc2VyUmVxdWVzdBIyCgR1c2VyGAEgASgLMh8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Vc2VyQgPgQQISNAoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQgPgQQEiQwoSVXBkYXRlVXNlclJlc3BvbnNlEi0KBHVzZXIYASABKAsyHy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVzZXIiWgoRRGVsZXRlVXNlclJlcXVlc3QSMQoEbmFtZRgBIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1VzZXISEgoFZm9yY2UYAiABKAhCA+BBASIUChJEZWxldGVVc2VyUmVzcG9uc2UijgEKHExpc3RVc2VyT3JnYW5pemF0aW9uc1JlcXVlc3QSMwoGcGFyZW50GAEgASgJQiPgQQL6QR0KG2FpZ2F0ZXdheS5yZWRwYW5kYS5jb20vVXNlchIgCglwYWdlX3NpemUYAiABKAVCDeBBAbpIBxoFGOgHKAASFwoKcGFnZV90b2tlbhgDIAEoCUID4EEBIpQBCh1MaXN0VXNlck9yZ2FuaXphdGlvbnNSZXNwb25zZRJGCgttZW1iZXJzaGlwcxgBIAMoCzIxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT3JnYW5pemF0aW9uTWVtYmVyc2hpcBIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEgoKdG90YWxfc2l6ZRgDIAEoBSLHAQocQWRkVXNlclRvT3JnYW5pemF0aW9uUmVxdWVzdBIzCgZwYXJlbnQYASABKAlCI+BBAvpBHQobYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Vc2VyEkEKDG9yZ2FuaXphdGlvbhgCIAEoCUIr4EEC+kElCiNhaWdhdGV3YXkucmVkcGFuZGEuY29tL09yZ2FuaXphdGlvbhIvCgRyb2xlGAMgASgJQiHgQQG6SBtyGVIFYWRtaW5SBm1lbWJlclIGdmlld2VyUgAiZgodQWRkVXNlclRvT3JnYW5pemF0aW9uUmVzcG9uc2USRQoKbWVtYmVyc2hpcBgBIAEoCzIxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuT3JnYW5pemF0aW9uTWVtYmVyc2hpcCKXAQohVXBkYXRlVXNlck9yZ2FuaXphdGlvblJvbGVSZXF1ZXN0EkMKBG5hbWUYASABKAlCNeBBAvpBLwotYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Pcmdhbml6YXRpb25NZW1iZXJzaGlwEi0KBHJvbGUYAiABKAlCH+BBArpIGXIXUgVhZG1pblIGbWVtYmVyUgZ2aWV3ZXIiawoiVXBkYXRlVXNlck9yZ2FuaXphdGlvblJvbGVSZXNwb25zZRJFCgptZW1iZXJzaGlwGAEgASgLMjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Pcmdhbml6YXRpb25NZW1iZXJzaGlwImgKIVJlbW92ZVVzZXJGcm9tT3JnYW5pemF0aW9uUmVxdWVzdBJDCgRuYW1lGAEgASgJQjXgQQL6QS8KLWFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vT3JnYW5pemF0aW9uTWVtYmVyc2hpcCIkCiJSZW1vdmVVc2VyRnJvbU9yZ2FuaXphdGlvblJlc3BvbnNlIoYBChRMaXN0VXNlclRlYW1zUmVxdWVzdBIzCgZwYXJlbnQYASABKAlCI+BBAvpBHQobYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Vc2VyEiAKCXBhZ2Vfc2l6ZRgCIAEoBUIN4EEBukgHGgUY6AcoABIXCgpwYWdlX3Rva2VuGAMgASgJQgPgQQEiiAEKFUxpc3RVc2VyVGVhbXNSZXNwb25zZRJCCgttZW1iZXJzaGlwcxgBIAMoCzItLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXNlclRlYW1NZW1iZXJzaGlwEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFInoKElVzZXJUZWFtTWVtYmVyc2hpcBIMCgR0ZWFtGAEgASgJEhkKEXRlYW1fZGlzcGxheV9uYW1lGAIgASgJEgwKBHJvbGUYAyABKAkSLQoJam9pbl90aW1lGAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCJQChtHZXRQZXJzb25hbFRva2VuSW5mb1JlcXVlc3QSMQoEbmFtZRgBIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1VzZXIivQEKHEdldFBlcnNvbmFsVG9rZW5JbmZvUmVzcG9uc2USEAoIdG9rZW5faWQYASABKAkSMwoPbGFzdF9yb3RhdGVkX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpleHBpcmVzX2F0GAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIVCg1yb3RhdGlvbl9kYXlzGAQgASgFEg8KB2VuYWJsZWQYBSABKAgiTwoaUm90YXRlUGVyc29uYWxUb2tlblJlcXVlc3QSMQoEbmFtZRgBIAEoCUIj4EEC+kEdChthaWdhdGV3YXkucmVkcGFuZGEuY29tL1VzZXIiQQobUm90YXRlUGVyc29uYWxUb2tlblJlc3BvbnNlEiIKFXBlcnNvbmFsX2FjY2Vzc190b2tlbhgBIAEoCUID4EEDIm0KGlJldmVhbFBlcnNvbmFsVG9rZW5SZXF1ZXN0EjEKBG5hbWUYASABKAlCI+BBAvpBHQobYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Vc2VyEhwKCHBhc3N3b3JkGAIgASgJQgrgQQK6SARyAhABIkEKG1JldmVhbFBlcnNvbmFsVG9rZW5SZXNwb25zZRIiChVwZXJzb25hbF9hY2Nlc3NfdG9rZW4YASABKAlCA+BBAzKvEgoLVXNlclNlcnZpY2USlgEKCkNyZWF0ZVVzZXISLC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkNyZWF0ZVVzZXJSZXF1ZXN0Gi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5DcmVhdGVVc2VyUmVzcG9uc2UiK4LT5JMCJToEdXNlciIdL3YxL3twYXJlbnQ9YWNjb3VudHMvKn0vdXNlcnMShwEKB0dldFVzZXISKS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldFVzZXJSZXF1ZXN0GioucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRVc2VyUmVzcG9uc2UiJYLT5JMCHxIdL3YxL3tuYW1lPWFjY291bnRzLyovdXNlcnMvKn0SjQEKCUxpc3RVc2VycxIrLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFVzZXJzUmVxdWVzdBosLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFVzZXJzUmVzcG9uc2UiJYLT5JMCHxIdL3YxL3twYXJlbnQ9YWNjb3VudHMvKn0vdXNlcnMSmwEKClVwZGF0ZVVzZXISLC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlVwZGF0ZVVzZXJSZXF1ZXN0Gi0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVVc2VyUmVzcG9uc2UiMILT5JMCKjoEdXNlcjIiL3YxL3t1c2VyLm5hbWU9YWNjb3VudHMvKi91c2Vycy8qfRKQAQoKRGVsZXRlVXNlchIsLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlVXNlclJlcXVlc3QaLS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZVVzZXJSZXNwb25zZSIlgtPkkwIfKh0vdjEve25hbWU9YWNjb3VudHMvKi91c2Vycy8qfRLBAQoVTGlzdFVzZXJPcmdhbml6YXRpb25zEjcucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0VXNlck9yZ2FuaXphdGlvbnNSZXF1ZXN0GjgucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0VXNlck9yZ2FuaXphdGlvbnNSZXNwb25zZSI1gtPkkwIvEi0vdjEve3BhcmVudD1hY2NvdW50cy8qL3VzZXJzLyp9L29yZ2FuaXphdGlvbnMSxAEKFUFkZFVzZXJUb09yZ2FuaXphdGlvbhI3LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQWRkVXNlclRvT3JnYW5pemF0aW9uUmVxdWVzdBo4LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQWRkVXNlclRvT3JnYW5pemF0aW9uUmVzcG9uc2UiOILT5JMCMjoBKiItL3YxL3twYXJlbnQ9YWNjb3VudHMvKi91c2Vycy8qfS9vcmdhbml6YXRpb25zEtMBChpVcGRhdGVVc2VyT3JnYW5pemF0aW9uUm9sZRI8LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVXBkYXRlVXNlck9yZ2FuaXphdGlvblJvbGVSZXF1ZXN0Gj0ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVVc2VyT3JnYW5pemF0aW9uUm9sZVJlc3BvbnNlIjiC0+STAjI6ASoyLS92MS97bmFtZT1hY2NvdW50cy8qL3VzZXJzLyovb3JnYW5pemF0aW9ucy8qfRLQAQoaUmVtb3ZlVXNlckZyb21Pcmdhbml6YXRpb24SPC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJlbW92ZVVzZXJGcm9tT3JnYW5pemF0aW9uUmVxdWVzdBo9LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUmVtb3ZlVXNlckZyb21Pcmdhbml6YXRpb25SZXNwb25zZSI1gtPkkwIvKi0vdjEve25hbWU9YWNjb3VudHMvKi91c2Vycy8qL29yZ2FuaXphdGlvbnMvKn0SoQEKDUxpc3RVc2VyVGVhbXMSLy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RVc2VyVGVhbXNSZXF1ZXN0GjAucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5MaXN0VXNlclRlYW1zUmVzcG9uc2UiLYLT5JMCJxIlL3YxL3twYXJlbnQ9YWNjb3VudHMvKi91c2Vycy8qfS90ZWFtcxK9AQoUR2V0UGVyc29uYWxUb2tlbkluZm8SNi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkdldFBlcnNvbmFsVG9rZW5JbmZvUmVxdWVzdBo3LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0UGVyc29uYWxUb2tlbkluZm9SZXNwb25zZSI0gtPkkwIuEiwvdjEve25hbWU9YWNjb3VudHMvKi91c2Vycy8qfS9wZXJzb25hbC10b2tlbhLBAQoTUm90YXRlUGVyc29uYWxUb2tlbhI1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuUm90YXRlUGVyc29uYWxUb2tlblJlcXVlc3QaNi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJvdGF0ZVBlcnNvbmFsVG9rZW5SZXNwb25zZSI7gtPkkwI1IjMvdjEve25hbWU9YWNjb3VudHMvKi91c2Vycy8qfS9wZXJzb25hbC10b2tlbjpyb3RhdGUSxAEKE1JldmVhbFBlcnNvbmFsVG9rZW4SNS5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlJldmVhbFBlcnNvbmFsVG9rZW5SZXF1ZXN0GjYucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5SZXZlYWxQZXJzb25hbFRva2VuUmVzcG9uc2UiPoLT5JMCODoBKiIzL3YxL3tuYW1lPWFjY291bnRzLyovdXNlcnMvKn0vcGVyc29uYWwtdG9rZW46cmV2ZWFsGhnKQRZhaWdhdGV3YXkucmVkcGFuZGEuY29tQv4BCh1jb20ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MUIJVXNlclByb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * User represents an individual user account within an account.
+ * Users can be members of multiple organizations within their account.
+ *
+ * @generated from message redpanda.api.aigateway.v1.User
+ */
+export type User = Message<"redpanda.api.aigateway.v1.User"> & {
+  /**
+   * Resource name. Format: `accounts/{account}/users/{user}`
+   * User ID is a globally unique, sortable identifier (XID).
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Required: Email address (must be unique within account)
+   *
+   * @generated from field: string email = 2;
+   */
+  email: string;
+
+  /**
+   * Human-readable display name
+   *
+   * @generated from field: string display_name = 3;
+   */
+  displayName: string;
+
+  /**
+   * Optional: OIDC subject claim for auto-provisioning
+   * When set, this user can be automatically matched to OIDC tokens
+   *
+   * @generated from field: string oidc_subject = 4;
+   */
+  oidcSubject: string;
+
+  /**
+   * Whether this user is active
+   *
+   * @generated from field: bool enabled = 5;
+   */
+  enabled: boolean;
+
+  /**
+   * Metadata for arbitrary key-value pairs
+   *
+   * @generated from field: map<string, string> metadata = 6;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 7;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 8;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Last login timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp last_login_time = 9;
+   */
+  lastLoginTime?: Timestamp;
+
+  /**
+   * Output only. Creator (API key or OIDC subject)
+   *
+   * @generated from field: string creator = 10;
+   */
+  creator: string;
+
+  /**
+   * Output only. Last updater (API key or OIDC subject)
+   *
+   * @generated from field: string updater = 11;
+   */
+  updater: string;
+
+  /**
+   * Optional: Default organization context for UI
+   * Format: `accounts/{account}/organizations/{organization}`
+   * When set, this organization is pre-selected in the UI organization switcher
+   *
+   * @generated from field: string default_organization = 12;
+   */
+  defaultOrganization: string;
+
+  /**
+   * Optional: Default workspace context for UI
+   * Format: `accounts/{account}/organizations/{organization}/workspaces/{workspace}`
+   * When set, this workspace is pre-selected when navigating to workspace-scoped pages
+   *
+   * @generated from field: string default_workspace = 13;
+   */
+  defaultWorkspace: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.User.
+ * Use `create(UserSchema)` to create a new message.
+ */
+export const UserSchema: GenMessage<User> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 0);
+
+/**
+ * OrganizationMembership represents a user's membership in an organization.
+ *
+ * @generated from message redpanda.api.aigateway.v1.OrganizationMembership
+ */
+export type OrganizationMembership = Message<"redpanda.api.aigateway.v1.OrganizationMembership"> & {
+  /**
+   * Resource name. Format: `accounts/{account}/users/{user}/organizations/{organization}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Reference to the organization.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string organization = 2;
+   */
+  organization: string;
+
+  /**
+   * Organization display name (for convenience)
+   *
+   * @generated from field: string organization_display_name = 3;
+   */
+  organizationDisplayName: string;
+
+  /**
+   * User's role in the organization: admin, member, viewer
+   *
+   * @generated from field: string role = 4;
+   */
+  role: string;
+
+  /**
+   * When the user joined the organization
+   *
+   * @generated from field: google.protobuf.Timestamp join_time = 5;
+   */
+  joinTime?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.OrganizationMembership.
+ * Use `create(OrganizationMembershipSchema)` to create a new message.
+ */
+export const OrganizationMembershipSchema: GenMessage<OrganizationMembership> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 1);
+
+/**
+ * Request message for CreateUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateUserRequest
+ */
+export type CreateUserRequest = Message<"redpanda.api.aigateway.v1.CreateUserRequest"> & {
+  /**
+   * Required: Parent account.
+   * Format: `accounts/{account}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * The user ID to use. If empty, server generates one.
+   *
+   * @generated from field: string user_id = 2;
+   */
+  userId: string;
+
+  /**
+   * Required: The user resource to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.User user = 3;
+   */
+  user?: User;
+
+  /**
+   * Optional: Initial organization membership.
+   * If provided, the user is added to this organization with the specified role.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string initial_organization = 4;
+   */
+  initialOrganization: string;
+
+  /**
+   * Role for the initial organization membership (default: "member")
+   *
+   * @generated from field: string initial_organization_role = 5;
+   */
+  initialOrganizationRole: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateUserRequest.
+ * Use `create(CreateUserRequestSchema)` to create a new message.
+ */
+export const CreateUserRequestSchema: GenMessage<CreateUserRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 2);
+
+/**
+ * Response message for CreateUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateUserResponse
+ */
+export type CreateUserResponse = Message<"redpanda.api.aigateway.v1.CreateUserResponse"> & {
+  /**
+   * The created user.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.User user = 1;
+   */
+  user?: User;
+
+  /**
+   * The personal access token (JWT) for this user.
+   * This is shown only once at creation time. The user can later reveal it
+   * via RevealPersonalToken (requires password re-authentication).
+   * Use as: Authorization: Bearer <token>
+   *
+   * @generated from field: string personal_access_token = 2;
+   */
+  personalAccessToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateUserResponse.
+ * Use `create(CreateUserResponseSchema)` to create a new message.
+ */
+export const CreateUserResponseSchema: GenMessage<CreateUserResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 3);
+
+/**
+ * Request message for GetUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetUserRequest
+ */
+export type GetUserRequest = Message<"redpanda.api.aigateway.v1.GetUserRequest"> & {
+  /**
+   * Resource name of the user.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetUserRequest.
+ * Use `create(GetUserRequestSchema)` to create a new message.
+ */
+export const GetUserRequestSchema: GenMessage<GetUserRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 4);
+
+/**
+ * Response message for GetUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetUserResponse
+ */
+export type GetUserResponse = Message<"redpanda.api.aigateway.v1.GetUserResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.User user = 1;
+   */
+  user?: User;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetUserResponse.
+ * Use `create(GetUserResponseSchema)` to create a new message.
+ */
+export const GetUserResponseSchema: GenMessage<GetUserResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 5);
+
+/**
+ * Request message for ListUsers RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListUsersRequest
+ */
+export type ListUsersRequest = Message<"redpanda.api.aigateway.v1.ListUsersRequest"> & {
+  /**
+   * Required: Parent account.
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of users to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous ListUsers call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter expression (CEL syntax)
+   * Examples:
+   *   enabled == true
+   *   email.endsWith("@example.com")
+   *   oidc_subject != ""
+   *
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * Comma-separated list of fields to order by
+   *
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListUsersRequest.
+ * Use `create(ListUsersRequestSchema)` to create a new message.
+ */
+export const ListUsersRequestSchema: GenMessage<ListUsersRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 6);
+
+/**
+ * Response message for ListUsers RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListUsersResponse
+ */
+export type ListUsersResponse = Message<"redpanda.api.aigateway.v1.ListUsersResponse"> & {
+  /**
+   * The list of users
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.User users = 1;
+   */
+  users: User[];
+
+  /**
+   * Token for next page (empty if no more pages)
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count of matching users
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListUsersResponse.
+ * Use `create(ListUsersResponseSchema)` to create a new message.
+ */
+export const ListUsersResponseSchema: GenMessage<ListUsersResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 7);
+
+/**
+ * Request message for UpdateUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateUserRequest
+ */
+export type UpdateUserRequest = Message<"redpanda.api.aigateway.v1.UpdateUserRequest"> & {
+  /**
+   * Required: The user resource to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.User user = 1;
+   */
+  user?: User;
+
+  /**
+   * The fields to update.
+   * Allowed fields: email, display_name, oidc_subject, enabled, metadata, default_organization, default_workspace
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateUserRequest.
+ * Use `create(UpdateUserRequestSchema)` to create a new message.
+ */
+export const UpdateUserRequestSchema: GenMessage<UpdateUserRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 8);
+
+/**
+ * Response message for UpdateUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateUserResponse
+ */
+export type UpdateUserResponse = Message<"redpanda.api.aigateway.v1.UpdateUserResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.User user = 1;
+   */
+  user?: User;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateUserResponse.
+ * Use `create(UpdateUserResponseSchema)` to create a new message.
+ */
+export const UpdateUserResponseSchema: GenMessage<UpdateUserResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 9);
+
+/**
+ * Request message for DeleteUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteUserRequest
+ */
+export type DeleteUserRequest = Message<"redpanda.api.aigateway.v1.DeleteUserRequest"> & {
+  /**
+   * Resource name of the user to delete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * If true, cascade delete all memberships (organization and team)
+   *
+   * @generated from field: bool force = 2;
+   */
+  force: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteUserRequest.
+ * Use `create(DeleteUserRequestSchema)` to create a new message.
+ */
+export const DeleteUserRequestSchema: GenMessage<DeleteUserRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 10);
+
+/**
+ * Response message for DeleteUser RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteUserResponse
+ */
+export type DeleteUserResponse = Message<"redpanda.api.aigateway.v1.DeleteUserResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteUserResponse.
+ * Use `create(DeleteUserResponseSchema)` to create a new message.
+ */
+export const DeleteUserResponseSchema: GenMessage<DeleteUserResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 11);
+
+/**
+ * Request message for ListUserOrganizations RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListUserOrganizationsRequest
+ */
+export type ListUserOrganizationsRequest = Message<"redpanda.api.aigateway.v1.ListUserOrganizationsRequest"> & {
+  /**
+   * Required: Parent user.
+   * Format: `accounts/{account}/users/{user}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of memberships to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListUserOrganizationsRequest.
+ * Use `create(ListUserOrganizationsRequestSchema)` to create a new message.
+ */
+export const ListUserOrganizationsRequestSchema: GenMessage<ListUserOrganizationsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 12);
+
+/**
+ * Response message for ListUserOrganizations RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListUserOrganizationsResponse
+ */
+export type ListUserOrganizationsResponse = Message<"redpanda.api.aigateway.v1.ListUserOrganizationsResponse"> & {
+  /**
+   * Organization memberships for this user
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.OrganizationMembership memberships = 1;
+   */
+  memberships: OrganizationMembership[];
+
+  /**
+   * Token for next page
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListUserOrganizationsResponse.
+ * Use `create(ListUserOrganizationsResponseSchema)` to create a new message.
+ */
+export const ListUserOrganizationsResponseSchema: GenMessage<ListUserOrganizationsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 13);
+
+/**
+ * Request message for AddUserToOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AddUserToOrganizationRequest
+ */
+export type AddUserToOrganizationRequest = Message<"redpanda.api.aigateway.v1.AddUserToOrganizationRequest"> & {
+  /**
+   * Required: Parent user.
+   * Format: `accounts/{account}/users/{user}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Required: The organization to add the user to.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string organization = 2;
+   */
+  organization: string;
+
+  /**
+   * Role for the membership: admin, member, viewer (default: "member")
+   *
+   * @generated from field: string role = 3;
+   */
+  role: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AddUserToOrganizationRequest.
+ * Use `create(AddUserToOrganizationRequestSchema)` to create a new message.
+ */
+export const AddUserToOrganizationRequestSchema: GenMessage<AddUserToOrganizationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 14);
+
+/**
+ * Response message for AddUserToOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.AddUserToOrganizationResponse
+ */
+export type AddUserToOrganizationResponse = Message<"redpanda.api.aigateway.v1.AddUserToOrganizationResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OrganizationMembership membership = 1;
+   */
+  membership?: OrganizationMembership;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.AddUserToOrganizationResponse.
+ * Use `create(AddUserToOrganizationResponseSchema)` to create a new message.
+ */
+export const AddUserToOrganizationResponseSchema: GenMessage<AddUserToOrganizationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 15);
+
+/**
+ * Request message for UpdateUserOrganizationRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateUserOrganizationRoleRequest
+ */
+export type UpdateUserOrganizationRoleRequest = Message<"redpanda.api.aigateway.v1.UpdateUserOrganizationRoleRequest"> & {
+  /**
+   * Required: Resource name of the membership.
+   * Format: `accounts/{account}/users/{user}/organizations/{organization}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Required: New role for the membership: admin, member, viewer
+   *
+   * @generated from field: string role = 2;
+   */
+  role: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateUserOrganizationRoleRequest.
+ * Use `create(UpdateUserOrganizationRoleRequestSchema)` to create a new message.
+ */
+export const UpdateUserOrganizationRoleRequestSchema: GenMessage<UpdateUserOrganizationRoleRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 16);
+
+/**
+ * Response message for UpdateUserOrganizationRole RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateUserOrganizationRoleResponse
+ */
+export type UpdateUserOrganizationRoleResponse = Message<"redpanda.api.aigateway.v1.UpdateUserOrganizationRoleResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.OrganizationMembership membership = 1;
+   */
+  membership?: OrganizationMembership;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateUserOrganizationRoleResponse.
+ * Use `create(UpdateUserOrganizationRoleResponseSchema)` to create a new message.
+ */
+export const UpdateUserOrganizationRoleResponseSchema: GenMessage<UpdateUserOrganizationRoleResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 17);
+
+/**
+ * Request message for RemoveUserFromOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RemoveUserFromOrganizationRequest
+ */
+export type RemoveUserFromOrganizationRequest = Message<"redpanda.api.aigateway.v1.RemoveUserFromOrganizationRequest"> & {
+  /**
+   * Required: Resource name of the membership to remove.
+   * Format: `accounts/{account}/users/{user}/organizations/{organization}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RemoveUserFromOrganizationRequest.
+ * Use `create(RemoveUserFromOrganizationRequestSchema)` to create a new message.
+ */
+export const RemoveUserFromOrganizationRequestSchema: GenMessage<RemoveUserFromOrganizationRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 18);
+
+/**
+ * Response message for RemoveUserFromOrganization RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RemoveUserFromOrganizationResponse
+ */
+export type RemoveUserFromOrganizationResponse = Message<"redpanda.api.aigateway.v1.RemoveUserFromOrganizationResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RemoveUserFromOrganizationResponse.
+ * Use `create(RemoveUserFromOrganizationResponseSchema)` to create a new message.
+ */
+export const RemoveUserFromOrganizationResponseSchema: GenMessage<RemoveUserFromOrganizationResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 19);
+
+/**
+ * Request message for ListUserTeams RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListUserTeamsRequest
+ */
+export type ListUserTeamsRequest = Message<"redpanda.api.aigateway.v1.ListUserTeamsRequest"> & {
+  /**
+   * Required: Parent user.
+   * Format: `accounts/{account}/users/{user}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of teams to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListUserTeamsRequest.
+ * Use `create(ListUserTeamsRequestSchema)` to create a new message.
+ */
+export const ListUserTeamsRequestSchema: GenMessage<ListUserTeamsRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 20);
+
+/**
+ * Response message for ListUserTeams RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListUserTeamsResponse
+ */
+export type ListUserTeamsResponse = Message<"redpanda.api.aigateway.v1.ListUserTeamsResponse"> & {
+  /**
+   * Team memberships for this user
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.UserTeamMembership memberships = 1;
+   */
+  memberships: UserTeamMembership[];
+
+  /**
+   * Token for next page
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListUserTeamsResponse.
+ * Use `create(ListUserTeamsResponseSchema)` to create a new message.
+ */
+export const ListUserTeamsResponseSchema: GenMessage<ListUserTeamsResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 21);
+
+/**
+ * UserTeamMembership represents a user's membership from the user's perspective.
+ * Includes team details for convenience.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UserTeamMembership
+ */
+export type UserTeamMembership = Message<"redpanda.api.aigateway.v1.UserTeamMembership"> & {
+  /**
+   * Reference to the team.
+   * Format: `accounts/{account}/organizations/{organization}/teams/{team}`
+   *
+   * @generated from field: string team = 1;
+   */
+  team: string;
+
+  /**
+   * Team display name (for convenience)
+   *
+   * @generated from field: string team_display_name = 2;
+   */
+  teamDisplayName: string;
+
+  /**
+   * User's role in the team
+   *
+   * @generated from field: string role = 3;
+   */
+  role: string;
+
+  /**
+   * When the user joined the team
+   *
+   * @generated from field: google.protobuf.Timestamp join_time = 4;
+   */
+  joinTime?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UserTeamMembership.
+ * Use `create(UserTeamMembershipSchema)` to create a new message.
+ */
+export const UserTeamMembershipSchema: GenMessage<UserTeamMembership> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 22);
+
+/**
+ * Request message for GetPersonalTokenInfo RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetPersonalTokenInfoRequest
+ */
+export type GetPersonalTokenInfoRequest = Message<"redpanda.api.aigateway.v1.GetPersonalTokenInfoRequest"> & {
+  /**
+   * Resource name of the user.
+   * Format: `accounts/{account}/users/{user}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetPersonalTokenInfoRequest.
+ * Use `create(GetPersonalTokenInfoRequestSchema)` to create a new message.
+ */
+export const GetPersonalTokenInfoRequestSchema: GenMessage<GetPersonalTokenInfoRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 23);
+
+/**
+ * Response message for GetPersonalTokenInfo RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetPersonalTokenInfoResponse
+ */
+export type GetPersonalTokenInfoResponse = Message<"redpanda.api.aigateway.v1.GetPersonalTokenInfoResponse"> & {
+  /**
+   * Truncated token ID for display (e.g., "...abc12345")
+   * This is the last 8 characters of the JWT ID (jti claim).
+   *
+   * @generated from field: string token_id = 1;
+   */
+  tokenId: string;
+
+  /**
+   * When the token was last rotated.
+   *
+   * @generated from field: google.protobuf.Timestamp last_rotated_at = 2;
+   */
+  lastRotatedAt?: Timestamp;
+
+  /**
+   * When the token expires and needs rotation.
+   *
+   * @generated from field: google.protobuf.Timestamp expires_at = 3;
+   */
+  expiresAt?: Timestamp;
+
+  /**
+   * Rotation period in days (admin-configurable).
+   *
+   * @generated from field: int32 rotation_days = 4;
+   */
+  rotationDays: number;
+
+  /**
+   * Whether the token is currently enabled.
+   *
+   * @generated from field: bool enabled = 5;
+   */
+  enabled: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetPersonalTokenInfoResponse.
+ * Use `create(GetPersonalTokenInfoResponseSchema)` to create a new message.
+ */
+export const GetPersonalTokenInfoResponseSchema: GenMessage<GetPersonalTokenInfoResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 24);
+
+/**
+ * Request message for RotatePersonalToken RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RotatePersonalTokenRequest
+ */
+export type RotatePersonalTokenRequest = Message<"redpanda.api.aigateway.v1.RotatePersonalTokenRequest"> & {
+  /**
+   * Resource name of the user.
+   * Format: `accounts/{account}/users/{user}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RotatePersonalTokenRequest.
+ * Use `create(RotatePersonalTokenRequestSchema)` to create a new message.
+ */
+export const RotatePersonalTokenRequestSchema: GenMessage<RotatePersonalTokenRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 25);
+
+/**
+ * Response message for RotatePersonalToken RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RotatePersonalTokenResponse
+ */
+export type RotatePersonalTokenResponse = Message<"redpanda.api.aigateway.v1.RotatePersonalTokenResponse"> & {
+  /**
+   * The new personal access token (JWT).
+   * This is shown only once. Store it securely.
+   * Use as: Authorization: Bearer <token>
+   *
+   * @generated from field: string personal_access_token = 1;
+   */
+  personalAccessToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RotatePersonalTokenResponse.
+ * Use `create(RotatePersonalTokenResponseSchema)` to create a new message.
+ */
+export const RotatePersonalTokenResponseSchema: GenMessage<RotatePersonalTokenResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 26);
+
+/**
+ * Request message for RevealPersonalToken RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RevealPersonalTokenRequest
+ */
+export type RevealPersonalTokenRequest = Message<"redpanda.api.aigateway.v1.RevealPersonalTokenRequest"> & {
+  /**
+   * Resource name of the user.
+   * Format: `accounts/{account}/users/{user}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * User's password for re-authentication.
+   * Required to reveal the token for security.
+   *
+   * @generated from field: string password = 2;
+   */
+  password: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RevealPersonalTokenRequest.
+ * Use `create(RevealPersonalTokenRequestSchema)` to create a new message.
+ */
+export const RevealPersonalTokenRequestSchema: GenMessage<RevealPersonalTokenRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 27);
+
+/**
+ * Response message for RevealPersonalToken RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.RevealPersonalTokenResponse
+ */
+export type RevealPersonalTokenResponse = Message<"redpanda.api.aigateway.v1.RevealPersonalTokenResponse"> & {
+  /**
+   * The full personal access token (JWT).
+   * Use as: Authorization: Bearer <token>
+   *
+   * @generated from field: string personal_access_token = 1;
+   */
+  personalAccessToken: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.RevealPersonalTokenResponse.
+ * Use `create(RevealPersonalTokenResponseSchema)` to create a new message.
+ */
+export const RevealPersonalTokenResponseSchema: GenMessage<RevealPersonalTokenResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_user, 28);
+
+/**
+ * UserService manages users within accounts.
+ * Users represent individual accounts that can authenticate and access resources.
+ * Users belong to accounts and have memberships in organizations.
+ * Resource name: accounts/{account_id}/users/{user_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.UserService
+ */
+export const UserService: GenService<{
+  /**
+   * Creates a new user within an account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.CreateUser
+   */
+  createUser: {
+    methodKind: "unary";
+    input: typeof CreateUserRequestSchema;
+    output: typeof CreateUserResponseSchema;
+  },
+  /**
+   * Gets a user by name.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.GetUser
+   */
+  getUser: {
+    methodKind: "unary";
+    input: typeof GetUserRequestSchema;
+    output: typeof GetUserResponseSchema;
+  },
+  /**
+   * Lists users within an account.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.ListUsers
+   */
+  listUsers: {
+    methodKind: "unary";
+    input: typeof ListUsersRequestSchema;
+    output: typeof ListUsersResponseSchema;
+  },
+  /**
+   * Updates a user.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.UpdateUser
+   */
+  updateUser: {
+    methodKind: "unary";
+    input: typeof UpdateUserRequestSchema;
+    output: typeof UpdateUserResponseSchema;
+  },
+  /**
+   * Deletes a user.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.DeleteUser
+   */
+  deleteUser: {
+    methodKind: "unary";
+    input: typeof DeleteUserRequestSchema;
+    output: typeof DeleteUserResponseSchema;
+  },
+  /**
+   * Lists organizations that a user belongs to.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.ListUserOrganizations
+   */
+  listUserOrganizations: {
+    methodKind: "unary";
+    input: typeof ListUserOrganizationsRequestSchema;
+    output: typeof ListUserOrganizationsResponseSchema;
+  },
+  /**
+   * Adds a user to an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.AddUserToOrganization
+   */
+  addUserToOrganization: {
+    methodKind: "unary";
+    input: typeof AddUserToOrganizationRequestSchema;
+    output: typeof AddUserToOrganizationResponseSchema;
+  },
+  /**
+   * Updates a user's role in an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.UpdateUserOrganizationRole
+   */
+  updateUserOrganizationRole: {
+    methodKind: "unary";
+    input: typeof UpdateUserOrganizationRoleRequestSchema;
+    output: typeof UpdateUserOrganizationRoleResponseSchema;
+  },
+  /**
+   * Removes a user from an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.RemoveUserFromOrganization
+   */
+  removeUserFromOrganization: {
+    methodKind: "unary";
+    input: typeof RemoveUserFromOrganizationRequestSchema;
+    output: typeof RemoveUserFromOrganizationResponseSchema;
+  },
+  /**
+   * Lists teams that a user belongs to.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.ListUserTeams
+   */
+  listUserTeams: {
+    methodKind: "unary";
+    input: typeof ListUserTeamsRequestSchema;
+    output: typeof ListUserTeamsResponseSchema;
+  },
+  /**
+   * Gets information about a user's personal access token (non-secret info only).
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.GetPersonalTokenInfo
+   */
+  getPersonalTokenInfo: {
+    methodKind: "unary";
+    input: typeof GetPersonalTokenInfoRequestSchema;
+    output: typeof GetPersonalTokenInfoResponseSchema;
+  },
+  /**
+   * Rotates a user's personal access token.
+   * The old token is invalidated and a new one is generated.
+   * The new token is returned only once and should be stored securely.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.RotatePersonalToken
+   */
+  rotatePersonalToken: {
+    methodKind: "unary";
+    input: typeof RotatePersonalTokenRequestSchema;
+    output: typeof RotatePersonalTokenResponseSchema;
+  },
+  /**
+   * Reveals the user's personal access token.
+   * Requires re-authentication with the user's password for security.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.UserService.RevealPersonalToken
+   */
+  revealPersonalToken: {
+    methodKind: "unary";
+    input: typeof RevealPersonalTokenRequestSchema;
+    output: typeof RevealPersonalTokenResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_user, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/visual_metadata-VisualMetadataService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/visual_metadata-VisualMetadataService_connectquery.ts
new file mode 100644
index 0000000000..7c2c6594fc
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/visual_metadata-VisualMetadataService_connectquery.ts
@@ -0,0 +1,27 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/visual_metadata.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { VisualMetadataService } from "./visual_metadata_pb";
+
+/**
+ * Gets visual metadata for a gateway (optionally for a specific user).
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.VisualMetadataService.GetVisualMetadata
+ */
+export const getVisualMetadata = VisualMetadataService.method.getVisualMetadata;
+
+/**
+ * Creates or updates visual metadata for a gateway.
+ * Uses upsert semantics - creates if not exists, updates if exists.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.VisualMetadataService.SaveVisualMetadata
+ */
+export const saveVisualMetadata = VisualMetadataService.method.saveVisualMetadata;
+
+/**
+ * Deletes visual metadata for a gateway.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.VisualMetadataService.DeleteVisualMetadata
+ */
+export const deleteVisualMetadata = VisualMetadataService.method.deleteVisualMetadata;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/visual_metadata_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/visual_metadata_pb.ts
new file mode 100644
index 0000000000..d6a89f134b
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/visual_metadata_pb.ts
@@ -0,0 +1,323 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/visual_metadata.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_struct, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { JsonObject, Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/visual_metadata.proto.
+ */
+export const file_redpanda_api_aigateway_v1_visual_metadata: GenFile = /*@__PURE__*/
+  fileDesc("Ci9yZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3Zpc3VhbF9tZXRhZGF0YS5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSJGChhHZXRWaXN1YWxNZXRhZGF0YVJlcXVlc3QSGQoMZ2F0ZXdheV9uYW1lGAEgASgJQgPgQQISDwoHdXNlcl9pZBgCIAEoCSJfChlHZXRWaXN1YWxNZXRhZGF0YVJlc3BvbnNlEkIKD3Zpc3VhbF9tZXRhZGF0YRgBIAEoCzIpLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVmlzdWFsTWV0YWRhdGEi5wEKGVNhdmVWaXN1YWxNZXRhZGF0YVJlcXVlc3QSGQoMZ2F0ZXdheV9uYW1lGAEgASgJQgPgQQISDwoHdXNlcl9pZBgCIAEoCRI0Cg5ub2RlX3Bvc2l0aW9ucxgDIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RCA+BBAhI6Cgh2aWV3cG9ydBgEIAEoCzIjLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuVmlld3BvcnRCA+BBAhIsCgt1aV9zZXR0aW5ncxgFIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QiYAoaU2F2ZVZpc3VhbE1ldGFkYXRhUmVzcG9uc2USQgoPdmlzdWFsX21ldGFkYXRhGAEgASgLMikucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5WaXN1YWxNZXRhZGF0YSJJChtEZWxldGVWaXN1YWxNZXRhZGF0YVJlcXVlc3QSGQoMZ2F0ZXdheV9uYW1lGAEgASgJQgPgQQISDwoHdXNlcl9pZBgCIAEoCSIeChxEZWxldGVWaXN1YWxNZXRhZGF0YVJlc3BvbnNlIq0CCg5WaXN1YWxNZXRhZGF0YRIUCgxnYXRld2F5X25hbWUYASABKAkSDwoHdXNlcl9pZBgCIAEoCRIvCg5ub2RlX3Bvc2l0aW9ucxgDIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSNQoIdmlld3BvcnQYBCABKAsyIy5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLlZpZXdwb3J0EiwKC3VpX3NldHRpbmdzGAUgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIuCgpjcmVhdGVkX2F0GAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgp1cGRhdGVkX2F0GAsgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCIuCghWaWV3cG9ydBIJCgF4GAEgASgBEgkKAXkYAiABKAESDAoEem9vbRgDIAEoATLjBAoVVmlzdWFsTWV0YWRhdGFTZXJ2aWNlErMBChFHZXRWaXN1YWxNZXRhZGF0YRIzLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuR2V0VmlzdWFsTWV0YWRhdGFSZXF1ZXN0GjQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRWaXN1YWxNZXRhZGF0YVJlc3BvbnNlIjOC0+STAi0SKy92MS9nYXRld2F5cy97Z2F0ZXdheV9uYW1lfS92aXN1YWwtbWV0YWRhdGESuQEKElNhdmVWaXN1YWxNZXRhZGF0YRI0LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU2F2ZVZpc3VhbE1ldGFkYXRhUmVxdWVzdBo1LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuU2F2ZVZpc3VhbE1ldGFkYXRhUmVzcG9uc2UiNoLT5JMCMDoBKhorL3YxL2dhdGV3YXlzL3tnYXRld2F5X25hbWV9L3Zpc3VhbC1tZXRhZGF0YRK8AQoURGVsZXRlVmlzdWFsTWV0YWRhdGESNi5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkRlbGV0ZVZpc3VhbE1ldGFkYXRhUmVxdWVzdBo3LnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuRGVsZXRlVmlzdWFsTWV0YWRhdGFSZXNwb25zZSIzgtPkkwItKisvdjEvZ2F0ZXdheXMve2dhdGV3YXlfbmFtZX0vdmlzdWFsLW1ldGFkYXRhGhnKQRZhaWdhdGV3YXkucmVkcGFuZGEuY29tQogCCh1jb20ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MUITVmlzdWFsTWV0YWRhdGFQcm90b1ABWktnby5wYW5kYS5kZXYvcmVkcGFuZGEtYWlndy9wcm90b3MvZ2VuL3JlZHBhbmRhL2FwaS9haWdhdGV3YXkvdjE7YWlnYXRld2F5djGiAgNSQUGqAhlSZWRwYW5kYS5BcGkuQWlnYXRld2F5LlYxygIZUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMeICJVJlZHBhbmRhXEFwaVxBaWdhdGV3YXlcVjFcR1BCTWV0YWRhdGHqAhxSZWRwYW5kYTo6QXBpOjpBaWdhdGV3YXk6OlYxYgZwcm90bzM", [file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_protobuf_struct, file_google_protobuf_timestamp]);
+
+/**
+ * Request message for GetVisualMetadata RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetVisualMetadataRequest
+ */
+export type GetVisualMetadataRequest = Message<"redpanda.api.aigateway.v1.GetVisualMetadataRequest"> & {
+  /**
+   * Required: Gateway name (e.g., "my-gateway")
+   *
+   * @generated from field: string gateway_name = 1;
+   */
+  gatewayName: string;
+
+  /**
+   * Optional: User ID for user-specific layout.
+   * If not provided, returns the shared/default layout.
+   *
+   * @generated from field: string user_id = 2;
+   */
+  userId: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetVisualMetadataRequest.
+ * Use `create(GetVisualMetadataRequestSchema)` to create a new message.
+ */
+export const GetVisualMetadataRequestSchema: GenMessage<GetVisualMetadataRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_visual_metadata, 0);
+
+/**
+ * Response message for GetVisualMetadata RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetVisualMetadataResponse
+ */
+export type GetVisualMetadataResponse = Message<"redpanda.api.aigateway.v1.GetVisualMetadataResponse"> & {
+  /**
+   * The visual metadata, or null if none exists.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.VisualMetadata visual_metadata = 1;
+   */
+  visualMetadata?: VisualMetadata;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetVisualMetadataResponse.
+ * Use `create(GetVisualMetadataResponseSchema)` to create a new message.
+ */
+export const GetVisualMetadataResponseSchema: GenMessage<GetVisualMetadataResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_visual_metadata, 1);
+
+/**
+ * Request message for SaveVisualMetadata RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.SaveVisualMetadataRequest
+ */
+export type SaveVisualMetadataRequest = Message<"redpanda.api.aigateway.v1.SaveVisualMetadataRequest"> & {
+  /**
+   * Required: Gateway name (e.g., "my-gateway")
+   *
+   * @generated from field: string gateway_name = 1;
+   */
+  gatewayName: string;
+
+  /**
+   * Optional: User ID for user-specific layout.
+   * If not provided, saves as shared/default layout.
+   *
+   * @generated from field: string user_id = 2;
+   */
+  userId: string;
+
+  /**
+   * Required: Node positions as JSON object mapping node IDs to {x, y}.
+   * Example: {"rate-limit-default": {"x": 100, "y": 200}}
+   *
+   * @generated from field: google.protobuf.Struct node_positions = 3;
+   */
+  nodePositions?: JsonObject;
+
+  /**
+   * Required: Viewport state with x, y offset and zoom level.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Viewport viewport = 4;
+   */
+  viewport?: Viewport;
+
+  /**
+   * Optional: Additional UI settings (minimap visible, etc.)
+   *
+   * @generated from field: google.protobuf.Struct ui_settings = 5;
+   */
+  uiSettings?: JsonObject;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SaveVisualMetadataRequest.
+ * Use `create(SaveVisualMetadataRequestSchema)` to create a new message.
+ */
+export const SaveVisualMetadataRequestSchema: GenMessage<SaveVisualMetadataRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_visual_metadata, 2);
+
+/**
+ * Response message for SaveVisualMetadata RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.SaveVisualMetadataResponse
+ */
+export type SaveVisualMetadataResponse = Message<"redpanda.api.aigateway.v1.SaveVisualMetadataResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.VisualMetadata visual_metadata = 1;
+   */
+  visualMetadata?: VisualMetadata;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.SaveVisualMetadataResponse.
+ * Use `create(SaveVisualMetadataResponseSchema)` to create a new message.
+ */
+export const SaveVisualMetadataResponseSchema: GenMessage<SaveVisualMetadataResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_visual_metadata, 3);
+
+/**
+ * Request message for DeleteVisualMetadata RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteVisualMetadataRequest
+ */
+export type DeleteVisualMetadataRequest = Message<"redpanda.api.aigateway.v1.DeleteVisualMetadataRequest"> & {
+  /**
+   * Required: Gateway name (e.g., "my-gateway")
+   *
+   * @generated from field: string gateway_name = 1;
+   */
+  gatewayName: string;
+
+  /**
+   * Optional: User ID for user-specific layout.
+   * If not provided, deletes the shared/default layout.
+   *
+   * @generated from field: string user_id = 2;
+   */
+  userId: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteVisualMetadataRequest.
+ * Use `create(DeleteVisualMetadataRequestSchema)` to create a new message.
+ */
+export const DeleteVisualMetadataRequestSchema: GenMessage<DeleteVisualMetadataRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_visual_metadata, 4);
+
+/**
+ * Response message for DeleteVisualMetadata RPC.
+ *
+ * Empty response on success.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteVisualMetadataResponse
+ */
+export type DeleteVisualMetadataResponse = Message<"redpanda.api.aigateway.v1.DeleteVisualMetadataResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteVisualMetadataResponse.
+ * Use `create(DeleteVisualMetadataResponseSchema)` to create a new message.
+ */
+export const DeleteVisualMetadataResponseSchema: GenMessage<DeleteVisualMetadataResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_visual_metadata, 5);
+
+/**
+ * VisualMetadata represents the visual editor state for a gateway.
+ *
+ * @generated from message redpanda.api.aigateway.v1.VisualMetadata
+ */
+export type VisualMetadata = Message<"redpanda.api.aigateway.v1.VisualMetadata"> & {
+  /**
+   * Gateway name this metadata belongs to.
+   *
+   * @generated from field: string gateway_name = 1;
+   */
+  gatewayName: string;
+
+  /**
+   * User ID if this is a user-specific layout, empty for shared layout.
+   *
+   * @generated from field: string user_id = 2;
+   */
+  userId: string;
+
+  /**
+   * Node positions as JSON object mapping node IDs to {x, y} coordinates.
+   *
+   * @generated from field: google.protobuf.Struct node_positions = 3;
+   */
+  nodePositions?: JsonObject;
+
+  /**
+   * Viewport state.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Viewport viewport = 4;
+   */
+  viewport?: Viewport;
+
+  /**
+   * Additional UI settings.
+   *
+   * @generated from field: google.protobuf.Struct ui_settings = 5;
+   */
+  uiSettings?: JsonObject;
+
+  /**
+   * Timestamps.
+   *
+   * @generated from field: google.protobuf.Timestamp created_at = 10;
+   */
+  createdAt?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp updated_at = 11;
+   */
+  updatedAt?: Timestamp;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.VisualMetadata.
+ * Use `create(VisualMetadataSchema)` to create a new message.
+ */
+export const VisualMetadataSchema: GenMessage<VisualMetadata> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_visual_metadata, 6);
+
+/**
+ * Viewport represents the visual editor viewport state.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Viewport
+ */
+export type Viewport = Message<"redpanda.api.aigateway.v1.Viewport"> & {
+  /**
+   * X offset of the viewport.
+   *
+   * @generated from field: double x = 1;
+   */
+  x: number;
+
+  /**
+   * Y offset of the viewport.
+   *
+   * @generated from field: double y = 2;
+   */
+  y: number;
+
+  /**
+   * Zoom level (1.0 = 100%).
+   *
+   * @generated from field: double zoom = 3;
+   */
+  zoom: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Viewport.
+ * Use `create(ViewportSchema)` to create a new message.
+ */
+export const ViewportSchema: GenMessage<Viewport> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_visual_metadata, 7);
+
+/**
+ * VisualMetadataService manages UI-specific visual editor state.
+ * This is purely a UI concern and is kept separate from gateway configuration.
+ * Stores node positions, viewport state, and UI preferences for the visual editor.
+ *
+ * @generated from service redpanda.api.aigateway.v1.VisualMetadataService
+ */
+export const VisualMetadataService: GenService<{
+  /**
+   * Gets visual metadata for a gateway (optionally for a specific user).
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.VisualMetadataService.GetVisualMetadata
+   */
+  getVisualMetadata: {
+    methodKind: "unary";
+    input: typeof GetVisualMetadataRequestSchema;
+    output: typeof GetVisualMetadataResponseSchema;
+  },
+  /**
+   * Creates or updates visual metadata for a gateway.
+   * Uses upsert semantics - creates if not exists, updates if exists.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.VisualMetadataService.SaveVisualMetadata
+   */
+  saveVisualMetadata: {
+    methodKind: "unary";
+    input: typeof SaveVisualMetadataRequestSchema;
+    output: typeof SaveVisualMetadataResponseSchema;
+  },
+  /**
+   * Deletes visual metadata for a gateway.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.VisualMetadataService.DeleteVisualMetadata
+   */
+  deleteVisualMetadata: {
+    methodKind: "unary";
+    input: typeof DeleteVisualMetadataRequestSchema;
+    output: typeof DeleteVisualMetadataResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_visual_metadata, 0);
+
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/workspace-WorkspaceService_connectquery.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/workspace-WorkspaceService_connectquery.ts
new file mode 100644
index 0000000000..17560690d0
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/workspace-WorkspaceService_connectquery.ts
@@ -0,0 +1,40 @@
+// @generated by protoc-gen-connect-query v2.0.1 with parameter "target=ts,js_import_style=legacy_commonjs"
+// @generated from file redpanda/api/aigateway/v1/workspace.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import { WorkspaceService } from "./workspace_pb";
+
+/**
+ * Creates a new workspace within an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.CreateWorkspace
+ */
+export const createWorkspace = WorkspaceService.method.createWorkspace;
+
+/**
+ * Gets a workspace by name.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.GetWorkspace
+ */
+export const getWorkspace = WorkspaceService.method.getWorkspace;
+
+/**
+ * Lists workspaces within an organization.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.ListWorkspaces
+ */
+export const listWorkspaces = WorkspaceService.method.listWorkspaces;
+
+/**
+ * Updates a workspace.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.UpdateWorkspace
+ */
+export const updateWorkspace = WorkspaceService.method.updateWorkspace;
+
+/**
+ * Deletes a workspace.
+ *
+ * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.DeleteWorkspace
+ */
+export const deleteWorkspace = WorkspaceService.method.deleteWorkspace;
diff --git a/frontend/src/protogen/redpanda/api/aigateway/v1/workspace_pb.ts b/frontend/src/protogen/redpanda/api/aigateway/v1/workspace_pb.ts
new file mode 100644
index 0000000000..f2e41d6fb1
--- /dev/null
+++ b/frontend/src/protogen/redpanda/api/aigateway/v1/workspace_pb.ts
@@ -0,0 +1,435 @@
+// @generated by protoc-gen-es v2.2.5 with parameter "target=ts"
+// @generated from file redpanda/api/aigateway/v1/workspace.proto (package redpanda.api.aigateway.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv1";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb";
+import { file_google_api_annotations } from "../../../../google/api/annotations_pb";
+import { file_google_api_client } from "../../../../google/api/client_pb";
+import { file_google_api_field_behavior } from "../../../../google/api/field_behavior_pb";
+import { file_google_api_resource } from "../../../../google/api/resource_pb";
+import type { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file redpanda/api/aigateway/v1/workspace.proto.
+ */
+export const file_redpanda_api_aigateway_v1_workspace: GenFile = /*@__PURE__*/
+  fileDesc("CilyZWRwYW5kYS9hcGkvYWlnYXRld2F5L3YxL3dvcmtzcGFjZS5wcm90bxIZcmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MSLsAwoJV29ya3NwYWNlEhEKBG5hbWUYASABKAlCA+BBCBIjCgxkaXNwbGF5X25hbWUYAiABKAlCDeBBArpIB3IFEAEY/wESGAoLZGVzY3JpcHRpb24YAyABKAlCA+BBARIPCgdlbmFibGVkGAQgASgIEkQKCG1ldGFkYXRhGAUgAygLMjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Xb3Jrc3BhY2UuTWV0YWRhdGFFbnRyeRI0CgtjcmVhdGVfdGltZRgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxI0Cgt1cGRhdGVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCA+BBAxIUCgdjcmVhdG9yGAggASgJQgPgQQMSFAoHdXBkYXRlchgJIAEoCUID4EEDGi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATpt6kFqCiBhaWdhdGV3YXkucmVkcGFuZGEuY29tL1dvcmtzcGFjZRJGYWNjb3VudHMve2FjY291bnR9L29yZ2FuaXphdGlvbnMve29yZ2FuaXphdGlvbn0vd29ya3NwYWNlcy97d29ya3NwYWNlfSKuAQoWQ3JlYXRlV29ya3NwYWNlUmVxdWVzdBI7CgZwYXJlbnQYASABKAlCK+BBAvpBJQojYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Pcmdhbml6YXRpb24SGQoMd29ya3NwYWNlX2lkGAIgASgJQgPgQQESPAoJd29ya3NwYWNlGAMgASgLMiQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Xb3Jrc3BhY2VCA+BBAiJSChdDcmVhdGVXb3Jrc3BhY2VSZXNwb25zZRI3Cgl3b3Jrc3BhY2UYASABKAsyJC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLldvcmtzcGFjZSJNChNHZXRXb3Jrc3BhY2VSZXF1ZXN0EjYKBG5hbWUYASABKAlCKOBBAvpBIgogYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Xb3Jrc3BhY2UiTwoUR2V0V29ya3NwYWNlUmVzcG9uc2USNwoJd29ya3NwYWNlGAEgASgLMiQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Xb3Jrc3BhY2UiuwEKFUxpc3RXb3Jrc3BhY2VzUmVxdWVzdBI7CgZwYXJlbnQYASABKAlCK+BBAvpBJQojYWlnYXRld2F5LnJlZHBhbmRhLmNvbS9Pcmdhbml6YXRpb24SIAoJcGFnZV9zaXplGAIgASgFQg3gQQG6SAcaBRjoBygAEhcKCnBhZ2VfdG9rZW4YAyABKAlCA+BBARITCgZmaWx0ZXIYBCABKAlCA+BBARIVCghvcmRlcl9ieRgFIAEoCUID4EEBIn8KFkxpc3RXb3Jrc3BhY2VzUmVzcG9uc2USOAoKd29ya3NwYWNlcxgBIAMoCzIkLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuV29ya3NwYWNlEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRISCgp0b3RhbF9zaXplGAMgASgFIowBChZVcGRhdGVXb3Jrc3BhY2VSZXF1ZXN0EjwKCXdvcmtzcGFjZRgBIAEoCzIkLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuV29ya3NwYWNlQgPgQQISNAoLdXBkYXRlX21hc2sYAiABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQgPgQQEiUgoXVXBkYXRlV29ya3NwYWNlUmVzcG9uc2USNwoJd29ya3NwYWNlGAEgASgLMiQucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5Xb3Jrc3BhY2UiZAoWRGVsZXRlV29ya3NwYWNlUmVxdWVzdBI2CgRuYW1lGAEgASgJQijgQQL6QSIKIGFpZ2F0ZXdheS5yZWRwYW5kYS5jb20vV29ya3NwYWNlEhIKBWZvcmNlGAIgASgIQgPgQQEiGQoXRGVsZXRlV29ya3NwYWNlUmVzcG9uc2Uy1AcKEFdvcmtzcGFjZVNlcnZpY2USvwEKD0NyZWF0ZVdvcmtzcGFjZRIxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlV29ya3NwYWNlUmVxdWVzdBoyLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuQ3JlYXRlV29ya3NwYWNlUmVzcG9uc2UiRYLT5JMCPzoJd29ya3NwYWNlIjIvdjEve3BhcmVudD1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKn0vd29ya3NwYWNlcxKrAQoMR2V0V29ya3NwYWNlEi4ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRXb3Jrc3BhY2VSZXF1ZXN0Gi8ucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5HZXRXb3Jrc3BhY2VSZXNwb25zZSI6gtPkkwI0EjIvdjEve25hbWU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovd29ya3NwYWNlcy8qfRKxAQoOTGlzdFdvcmtzcGFjZXMSMC5yZWRwYW5kYS5hcGkuYWlnYXRld2F5LnYxLkxpc3RXb3Jrc3BhY2VzUmVxdWVzdBoxLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjEuTGlzdFdvcmtzcGFjZXNSZXNwb25zZSI6gtPkkwI0EjIvdjEve3BhcmVudD1hY2NvdW50cy8qL29yZ2FuaXphdGlvbnMvKn0vd29ya3NwYWNlcxLJAQoPVXBkYXRlV29ya3NwYWNlEjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVXb3Jrc3BhY2VSZXF1ZXN0GjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5VcGRhdGVXb3Jrc3BhY2VSZXNwb25zZSJPgtPkkwJJOgl3b3Jrc3BhY2UyPC92MS97d29ya3NwYWNlLm5hbWU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovd29ya3NwYWNlcy8qfRK0AQoPRGVsZXRlV29ya3NwYWNlEjEucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVXb3Jrc3BhY2VSZXF1ZXN0GjIucmVkcGFuZGEuYXBpLmFpZ2F0ZXdheS52MS5EZWxldGVXb3Jrc3BhY2VSZXNwb25zZSI6gtPkkwI0KjIvdjEve25hbWU9YWNjb3VudHMvKi9vcmdhbml6YXRpb25zLyovd29ya3NwYWNlcy8qfRoZykEWYWlnYXRld2F5LnJlZHBhbmRhLmNvbUKDAgodY29tLnJlZHBhbmRhLmFwaS5haWdhdGV3YXkudjFCDldvcmtzcGFjZVByb3RvUAFaS2dvLnBhbmRhLmRldi9yZWRwYW5kYS1haWd3L3Byb3Rvcy9nZW4vcmVkcGFuZGEvYXBpL2FpZ2F0ZXdheS92MTthaWdhdGV3YXl2MaICA1JBQaoCGVJlZHBhbmRhLkFwaS5BaWdhdGV3YXkuVjHKAhlSZWRwYW5kYVxBcGlcQWlnYXRld2F5XFYx4gIlUmVkcGFuZGFcQXBpXEFpZ2F0ZXdheVxWMVxHUEJNZXRhZGF0YeoCHFJlZHBhbmRhOjpBcGk6OkFpZ2F0ZXdheTo6VjFiBnByb3RvMw", [file_buf_validate_validate, file_google_api_annotations, file_google_api_client, file_google_api_field_behavior, file_google_api_resource, file_google_protobuf_field_mask, file_google_protobuf_timestamp]);
+
+/**
+ * Workspace represents a grouping for gateways within an organization.
+ * Each gateway belongs to exactly one workspace.
+ *
+ * @generated from message redpanda.api.aigateway.v1.Workspace
+ */
+export type Workspace = Message<"redpanda.api.aigateway.v1.Workspace"> & {
+  /**
+   * Resource name. Format: `accounts/{account}/organizations/{organization}/workspaces/{workspace}`
+   * Workspace ID is a globally unique, sortable identifier (XID).
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * Human-readable display name (must be unique within organization)
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * Optional description
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Whether this workspace is active
+   *
+   * @generated from field: bool enabled = 4;
+   */
+  enabled: boolean;
+
+  /**
+   * Metadata for arbitrary key-value pairs
+   *
+   * @generated from field: map<string, string> metadata = 5;
+   */
+  metadata: { [key: string]: string };
+
+  /**
+   * Output only. Creation timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp create_time = 6;
+   */
+  createTime?: Timestamp;
+
+  /**
+   * Output only. Last update timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp update_time = 7;
+   */
+  updateTime?: Timestamp;
+
+  /**
+   * Output only. Creator (API key or OIDC subject)
+   *
+   * @generated from field: string creator = 8;
+   */
+  creator: string;
+
+  /**
+   * Output only. Last updater (API key or OIDC subject)
+   *
+   * @generated from field: string updater = 9;
+   */
+  updater: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.Workspace.
+ * Use `create(WorkspaceSchema)` to create a new message.
+ */
+export const WorkspaceSchema: GenMessage<Workspace> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 0);
+
+/**
+ * Request message for CreateWorkspace RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateWorkspaceRequest
+ */
+export type CreateWorkspaceRequest = Message<"redpanda.api.aigateway.v1.CreateWorkspaceRequest"> & {
+  /**
+   * Required: Parent organization.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * The workspace ID to use. If empty, server generates one.
+   * Must be a valid XID if provided.
+   *
+   * @generated from field: string workspace_id = 2;
+   */
+  workspaceId: string;
+
+  /**
+   * Required: The workspace resource to create.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Workspace workspace = 3;
+   */
+  workspace?: Workspace;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateWorkspaceRequest.
+ * Use `create(CreateWorkspaceRequestSchema)` to create a new message.
+ */
+export const CreateWorkspaceRequestSchema: GenMessage<CreateWorkspaceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 1);
+
+/**
+ * Response message for CreateWorkspace RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.CreateWorkspaceResponse
+ */
+export type CreateWorkspaceResponse = Message<"redpanda.api.aigateway.v1.CreateWorkspaceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Workspace workspace = 1;
+   */
+  workspace?: Workspace;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.CreateWorkspaceResponse.
+ * Use `create(CreateWorkspaceResponseSchema)` to create a new message.
+ */
+export const CreateWorkspaceResponseSchema: GenMessage<CreateWorkspaceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 2);
+
+/**
+ * Request message for GetWorkspace RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetWorkspaceRequest
+ */
+export type GetWorkspaceRequest = Message<"redpanda.api.aigateway.v1.GetWorkspaceRequest"> & {
+  /**
+   * Resource name of the workspace.
+   * Format: `accounts/{account}/organizations/{organization}/workspaces/{workspace}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetWorkspaceRequest.
+ * Use `create(GetWorkspaceRequestSchema)` to create a new message.
+ */
+export const GetWorkspaceRequestSchema: GenMessage<GetWorkspaceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 3);
+
+/**
+ * Response message for GetWorkspace RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.GetWorkspaceResponse
+ */
+export type GetWorkspaceResponse = Message<"redpanda.api.aigateway.v1.GetWorkspaceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Workspace workspace = 1;
+   */
+  workspace?: Workspace;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.GetWorkspaceResponse.
+ * Use `create(GetWorkspaceResponseSchema)` to create a new message.
+ */
+export const GetWorkspaceResponseSchema: GenMessage<GetWorkspaceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 4);
+
+/**
+ * Request message for ListWorkspaces RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListWorkspacesRequest
+ */
+export type ListWorkspacesRequest = Message<"redpanda.api.aigateway.v1.ListWorkspacesRequest"> & {
+  /**
+   * Required: Parent organization.
+   * Format: `accounts/{account}/organizations/{organization}`
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Maximum number of workspaces to return (max 1000)
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * Page token from a previous ListWorkspaces call
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Filter expression (CEL syntax)
+   *
+   * @generated from field: string filter = 4;
+   */
+  filter: string;
+
+  /**
+   * Comma-separated list of fields to order by
+   *
+   * @generated from field: string order_by = 5;
+   */
+  orderBy: string;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListWorkspacesRequest.
+ * Use `create(ListWorkspacesRequestSchema)` to create a new message.
+ */
+export const ListWorkspacesRequestSchema: GenMessage<ListWorkspacesRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 5);
+
+/**
+ * Response message for ListWorkspaces RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.ListWorkspacesResponse
+ */
+export type ListWorkspacesResponse = Message<"redpanda.api.aigateway.v1.ListWorkspacesResponse"> & {
+  /**
+   * The list of workspaces
+   *
+   * @generated from field: repeated redpanda.api.aigateway.v1.Workspace workspaces = 1;
+   */
+  workspaces: Workspace[];
+
+  /**
+   * Token for next page (empty if no more pages)
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+
+  /**
+   * Total count of matching workspaces
+   *
+   * @generated from field: int32 total_size = 3;
+   */
+  totalSize: number;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.ListWorkspacesResponse.
+ * Use `create(ListWorkspacesResponseSchema)` to create a new message.
+ */
+export const ListWorkspacesResponseSchema: GenMessage<ListWorkspacesResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 6);
+
+/**
+ * Request message for UpdateWorkspace RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateWorkspaceRequest
+ */
+export type UpdateWorkspaceRequest = Message<"redpanda.api.aigateway.v1.UpdateWorkspaceRequest"> & {
+  /**
+   * Required: The workspace resource to update.
+   *
+   * @generated from field: redpanda.api.aigateway.v1.Workspace workspace = 1;
+   */
+  workspace?: Workspace;
+
+  /**
+   * The fields to update.
+   * Allowed fields: display_name, description, enabled, metadata
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateWorkspaceRequest.
+ * Use `create(UpdateWorkspaceRequestSchema)` to create a new message.
+ */
+export const UpdateWorkspaceRequestSchema: GenMessage<UpdateWorkspaceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 7);
+
+/**
+ * Response message for UpdateWorkspace RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.UpdateWorkspaceResponse
+ */
+export type UpdateWorkspaceResponse = Message<"redpanda.api.aigateway.v1.UpdateWorkspaceResponse"> & {
+  /**
+   * @generated from field: redpanda.api.aigateway.v1.Workspace workspace = 1;
+   */
+  workspace?: Workspace;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.UpdateWorkspaceResponse.
+ * Use `create(UpdateWorkspaceResponseSchema)` to create a new message.
+ */
+export const UpdateWorkspaceResponseSchema: GenMessage<UpdateWorkspaceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 8);
+
+/**
+ * Request message for DeleteWorkspace RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteWorkspaceRequest
+ */
+export type DeleteWorkspaceRequest = Message<"redpanda.api.aigateway.v1.DeleteWorkspaceRequest"> & {
+  /**
+   * Resource name of the workspace to delete.
+   * Format: `accounts/{account}/organizations/{organization}/workspaces/{workspace}`
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * If true, cascade delete all child resources (gateways, etc.)
+   *
+   * @generated from field: bool force = 2;
+   */
+  force: boolean;
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteWorkspaceRequest.
+ * Use `create(DeleteWorkspaceRequestSchema)` to create a new message.
+ */
+export const DeleteWorkspaceRequestSchema: GenMessage<DeleteWorkspaceRequest> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 9);
+
+/**
+ * Response message for DeleteWorkspace RPC.
+ *
+ * @generated from message redpanda.api.aigateway.v1.DeleteWorkspaceResponse
+ */
+export type DeleteWorkspaceResponse = Message<"redpanda.api.aigateway.v1.DeleteWorkspaceResponse"> & {
+};
+
+/**
+ * Describes the message redpanda.api.aigateway.v1.DeleteWorkspaceResponse.
+ * Use `create(DeleteWorkspaceResponseSchema)` to create a new message.
+ */
+export const DeleteWorkspaceResponseSchema: GenMessage<DeleteWorkspaceResponse> = /*@__PURE__*/
+  messageDesc(file_redpanda_api_aigateway_v1_workspace, 10);
+
+/**
+ * WorkspaceService manages workspaces within organizations.
+ * A workspace is a grouping for gateways within an organization.
+ * Resource name: accounts/{account_id}/organizations/{organization_id}/workspaces/{workspace_id}
+ *
+ * @generated from service redpanda.api.aigateway.v1.WorkspaceService
+ */
+export const WorkspaceService: GenService<{
+  /**
+   * Creates a new workspace within an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.CreateWorkspace
+   */
+  createWorkspace: {
+    methodKind: "unary";
+    input: typeof CreateWorkspaceRequestSchema;
+    output: typeof CreateWorkspaceResponseSchema;
+  },
+  /**
+   * Gets a workspace by name.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.GetWorkspace
+   */
+  getWorkspace: {
+    methodKind: "unary";
+    input: typeof GetWorkspaceRequestSchema;
+    output: typeof GetWorkspaceResponseSchema;
+  },
+  /**
+   * Lists workspaces within an organization.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.ListWorkspaces
+   */
+  listWorkspaces: {
+    methodKind: "unary";
+    input: typeof ListWorkspacesRequestSchema;
+    output: typeof ListWorkspacesResponseSchema;
+  },
+  /**
+   * Updates a workspace.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.UpdateWorkspace
+   */
+  updateWorkspace: {
+    methodKind: "unary";
+    input: typeof UpdateWorkspaceRequestSchema;
+    output: typeof UpdateWorkspaceResponseSchema;
+  },
+  /**
+   * Deletes a workspace.
+   *
+   * @generated from rpc redpanda.api.aigateway.v1.WorkspaceService.DeleteWorkspace
+   */
+  deleteWorkspace: {
+    methodKind: "unary";
+    input: typeof DeleteWorkspaceRequestSchema;
+    output: typeof DeleteWorkspaceResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_redpanda_api_aigateway_v1_workspace, 0);
+
diff --git a/frontend/src/react-query/api/ai-gateway.tsx b/frontend/src/react-query/api/ai-gateway.tsx
new file mode 100644
index 0000000000..ed5f6963ca
--- /dev/null
+++ b/frontend/src/react-query/api/ai-gateway.tsx
@@ -0,0 +1,57 @@
+/**
+ * AI Gateway Query Hooks
+ *
+ * IMPORTANT: All queries in this file must use the AI Gateway transport.
+ * Use `useAIGatewayTransport()` hook to create the transport that points to /.redpanda/api/
+ *
+ * The AI Gateway transport is configured to proxy requests through:
+ * - Dev: /.redpanda/api/redpanda.api.aigateway.v1.* proxied to AI Gateway service
+ * - Prod: /.redpanda/api/redpanda.api.aigateway.v1.* handled by backend proxy
+ */
+
+import { create } from '@bufbuild/protobuf';
+import type { GenMessage } from '@bufbuild/protobuf/codegenv1';
+import type { ConnectError } from '@connectrpc/connect';
+import { useQuery } from '@connectrpc/connect-query';
+import type { UseQueryResult } from '@tanstack/react-query';
+import { useAIGatewayTransport } from 'hooks/use-ai-gateway-transport';
+import {
+  type ListGatewaysRequest,
+  ListGatewaysRequestSchema,
+  type ListGatewaysResponse,
+} from 'protogen/redpanda/api/aigateway/v1/gateway_pb';
+import { listGateways } from 'protogen/redpanda/api/aigateway/v1/gateway-GatewayService_connectquery';
+import type { MessageInit, QueryOptions } from 'react-query/react-query.utils';
+
+const AI_GATEWAY_DEFAULT_PAGE_SIZE = 50;
+
+/**
+ * Hook to list AI Gateways using the AI Gateway v1 API
+ *
+ * @note This hook uses AI Gateway transport - requires /.redpanda/api/ proxy configuration
+ *
+ * @example
+ * // List all gateways
+ * useListGatewaysQuery()
+ *
+ * @example
+ * // List gateways with custom page size
+ * useListGatewaysQuery({ pageSize: 100 })
+ */
+export const useListGatewaysQuery = (
+  input?: MessageInit<ListGatewaysRequest>,
+  options?: QueryOptions<GenMessage<ListGatewaysRequest>, ListGatewaysResponse>
+): UseQueryResult<ListGatewaysResponse, ConnectError> => {
+  const transport = useAIGatewayTransport();
+
+  const listGatewaysRequest = create(ListGatewaysRequestSchema, {
+    parent: input?.parent ?? '',
+    pageToken: input?.pageToken ?? '',
+    pageSize: input?.pageSize ?? AI_GATEWAY_DEFAULT_PAGE_SIZE,
+  });
+
+  return useQuery(listGateways, listGatewaysRequest, {
+    enabled: options?.enabled,
+    transport,
+  });
+};
diff --git a/frontend/src/react-query/api/ai-gateway/model-providers.tsx b/frontend/src/react-query/api/ai-gateway/model-providers.tsx
new file mode 100644
index 0000000000..bca7b2965f
--- /dev/null
+++ b/frontend/src/react-query/api/ai-gateway/model-providers.tsx
@@ -0,0 +1,64 @@
+/**
+ * AI Gateway Model Providers Query Hook
+ *
+ * IMPORTANT: All queries in this file must use the AI Gateway transport.
+ * Use `useAIGatewayTransport()` hook to create the transport that points to /.redpanda/api/
+ */
+
+import { create } from '@bufbuild/protobuf';
+import type { GenMessage } from '@bufbuild/protobuf/codegenv1';
+import type { ConnectError } from '@connectrpc/connect';
+import { useQuery } from '@connectrpc/connect-query';
+import type { UseQueryResult } from '@tanstack/react-query';
+import { useAIGatewayTransport } from 'hooks/use-ai-gateway-transport';
+import {
+  type ListModelProvidersRequest,
+  ListModelProvidersRequestSchema,
+  type ListModelProvidersResponse,
+} from 'protogen/redpanda/api/aigateway/v1/model_providers_pb';
+import { listModelProviders } from 'protogen/redpanda/api/aigateway/v1/model_providers-ModelProvidersService_connectquery';
+import type { MessageInit, QueryOptions } from 'react-query/react-query.utils';
+
+const AI_GATEWAY_DEFAULT_PAGE_SIZE = 50;
+
+// Provider regex for stripping name prefix
+const PROVIDER_PREFIX_REGEX = /^model_providers\//;
+
+// Transform function for model providers - strips "model_providers/" prefix from names
+const transformModelProviders = (response: ListModelProvidersResponse) => ({
+  ...response,
+  modelProviders: response.modelProviders.map((provider) => ({
+    ...provider,
+    name: provider.name.replace(PROVIDER_PREFIX_REGEX, ''),
+  })),
+});
+
+/**
+ * Hook to list Model Providers using the AI Gateway v1 API
+ * Lists available LLM providers (OpenAI, Anthropic, Google, etc.)
+ *
+ * @note Provider names are automatically transformed to strip the "model_providers/" prefix
+ * @note This hook uses AI Gateway transport - requires /.redpanda/api/ proxy configuration
+ *
+ * @example
+ * // Get all enabled providers
+ * useListModelProvidersQuery({ filter: 'enabled = "true"' })
+ */
+export const useListModelProvidersQuery = (
+  input?: MessageInit<ListModelProvidersRequest>,
+  options?: QueryOptions<GenMessage<ListModelProvidersRequest>, ListModelProvidersResponse>
+): UseQueryResult<ReturnType<typeof transformModelProviders>, ConnectError> => {
+  const transport = useAIGatewayTransport();
+
+  const listModelProvidersRequest = create(ListModelProvidersRequestSchema, {
+    pageToken: input?.pageToken ?? '',
+    pageSize: input?.pageSize ?? AI_GATEWAY_DEFAULT_PAGE_SIZE,
+    ...(input?.filter && { filter: input.filter }),
+  });
+
+  return useQuery(listModelProviders, listModelProvidersRequest, {
+    enabled: options?.enabled,
+    transport,
+    select: transformModelProviders,
+  });
+};
diff --git a/frontend/src/react-query/api/ai-gateway/models.tsx b/frontend/src/react-query/api/ai-gateway/models.tsx
new file mode 100644
index 0000000000..39963f6858
--- /dev/null
+++ b/frontend/src/react-query/api/ai-gateway/models.tsx
@@ -0,0 +1,70 @@
+/**
+ * AI Gateway Models Query Hook
+ *
+ * IMPORTANT: All queries in this file must use the AI Gateway transport.
+ * Use `useAIGatewayTransport()` hook to create the transport that points to /.redpanda/api/
+ */
+
+import { create } from '@bufbuild/protobuf';
+import type { GenMessage } from '@bufbuild/protobuf/codegenv1';
+import type { ConnectError } from '@connectrpc/connect';
+import { useQuery } from '@connectrpc/connect-query';
+import type { UseQueryResult } from '@tanstack/react-query';
+import { useAIGatewayTransport } from 'hooks/use-ai-gateway-transport';
+import {
+  type ListModelsRequest,
+  ListModelsRequestSchema,
+  type ListModelsResponse,
+} from 'protogen/redpanda/api/aigateway/v1/models_pb';
+import { listModels } from 'protogen/redpanda/api/aigateway/v1/models-ModelsService_connectquery';
+import type { MessageInit, QueryOptions } from 'react-query/react-query.utils';
+
+const AI_GATEWAY_DEFAULT_PAGE_SIZE = 50;
+
+// Model regex for stripping name prefix
+const MODEL_PREFIX_REGEX = /^models\/[^/]+\//;
+
+// Transform function for models - strips "models/provider/" prefix from names
+// e.g., "models/openai/gpt-4o-mini" -> "gpt-4o-mini"
+const transformModels = (response: ListModelsResponse) => ({
+  ...response,
+  models: response.models.map((model) => ({
+    ...model,
+    name: model.name.replace(MODEL_PREFIX_REGEX, ''),
+  })),
+});
+
+/**
+ * Hook to list Models using the AI Gateway v1 API
+ * Lists available models, optionally filtered by provider
+ *
+ * @note Model names are automatically transformed to strip the "models/provider/" prefix
+ * @note This hook uses AI Gateway transport - requires /.redpanda/api/ proxy configuration
+ *
+ * @example
+ * // Filter by provider
+ * useListModelsQuery({ filter: 'provider = "openai"' })
+ *
+ * @example
+ * // Filter by provider and enabled status
+ * useListModelsQuery({ filter: 'provider = "openai" AND enabled = "true"' })
+ */
+export const useListModelsQuery = (
+  input?: MessageInit<ListModelsRequest>,
+  options?: QueryOptions<GenMessage<ListModelsRequest>, ListModelsResponse>
+): UseQueryResult<ReturnType<typeof transformModels>, ConnectError> => {
+  const transport = useAIGatewayTransport();
+
+  const listModelsRequest = create(ListModelsRequestSchema, {
+    pageToken: input?.pageToken ?? '',
+    pageSize: input?.pageSize ?? AI_GATEWAY_DEFAULT_PAGE_SIZE,
+    ...(input?.filter && { filter: input.filter }),
+    ...(input?.orderBy && { orderBy: input.orderBy }),
+  });
+
+  return useQuery(listModels, listModelsRequest, {
+    enabled: options?.enabled,
+    transport,
+    select: transformModels,
+  });
+};
diff --git a/frontend/start-cloud.sh b/frontend/start-cloud.sh
index dca06a25e4..f230d2c2e9 100755
--- a/frontend/start-cloud.sh
+++ b/frontend/start-cloud.sh
@@ -26,7 +26,13 @@ if [ -z "$BACKEND_URL" ]; then
   exit 1
 fi
 
+# Extract cluster ID from backend URL
+# Example: https://console-2fd2fedf.d5mst2vnnfekmiescdb0.fmc.ign.cloud.redpanda.com
+# Extracts: d5mst2vnnfekmiescdb0
+CLUSTER_ID=$(echo "$BACKEND_URL" | sed -E 's/.*\.([a-z0-9]+)\.(fmc\.ign|rpd)\.cloud\.redpanda\.com.*/\1/')
+
 export PROXY_TARGET="$BACKEND_URL"
+export AI_GATEWAY_URL="https://ai-gateway.${CLUSTER_ID}.clusters.ign.rdpa.co"
 export REACT_APP_ENABLED_FEATURES=SINGLE_SIGN_ON,REASSIGN_PARTITIONS
 
 echo "Starting frontend dev server..."
diff --git a/proto/gen/openapi/openapi.v1alpha2.json b/proto/gen/openapi/openapi.v1alpha2.json
index 5f2227ffcd..8920d4b7ac 100644
--- a/proto/gen/openapi/openapi.v1alpha2.json
+++ b/proto/gen/openapi/openapi.v1alpha2.json
@@ -1 +1 @@
-{"components":{"schemas":{"ACL.Operation":{"description":"The operation that is allowed or denied (e.g. READ).","enum":["OPERATION_ANY","OPERATION_ALL","OPERATION_READ","OPERATION_WRITE","OPERATION_CREATE","OPERATION_DELETE","OPERATION_ALTER","OPERATION_DESCRIBE","OPERATION_CLUSTER_ACTION","OPERATION_DESCRIBE_CONFIGS","OPERATION_ALTER_CONFIGS","OPERATION_IDEMPOTENT_WRITE","OPERATION_CREATE_TOKENS","OPERATION_DESCRIBE_TOKENS"],"type":"string"},"Action":{"enum":["ACTION_PREPARE","ACTION_EXECUTE","ACTION_FINISH","ACTION_CANCEL"],"type":"string"},"BadRequest":{"description":"Describes violations in a client request. This error type focuses on the\nsyntactic aspects of the request.","properties":{"field_violations":{"description":"Describes all violations in a client request.","items":{"$ref":"#/components/schemas/FieldViolation"},"type":"array"}},"title":"BadRequest","type":"object"},"Config":{"properties":{"name":{"description":"A topic-level config key (e.g. `segment.bytes`).","type":"string"},"value":{"description":"A topic-level config value (e.g. 1073741824).","nullable":true,"type":"string"}},"type":"object"},"ConfigAlterOperation":{"enum":["CONFIG_ALTER_OPERATION_SET","CONFIG_ALTER_OPERATION_DELETE","CONFIG_ALTER_OPERATION_APPEND","CONFIG_ALTER_OPERATION_SUBTRACT"],"type":"string"},"ConfigSource":{"enum":["CONFIG_SOURCE_DYNAMIC_TOPIC_CONFIG","CONFIG_SOURCE_DYNAMIC_BROKER_CONFIG","CONFIG_SOURCE_DYNAMIC_DEFAULT_BROKER_CONFIG","CONFIG_SOURCE_STATIC_BROKER_CONFIG","CONFIG_SOURCE_DEFAULT_CONFIG","CONFIG_SOURCE_DYNAMIC_BROKER_LOGGER_CONFIG"],"type":"string"},"ConfigSynonym":{"properties":{"name":{"type":"string"},"source":{"$ref":"#/components/schemas/ConfigSource"},"value":{"nullable":true,"type":"string"}},"type":"object"},"ConfigType":{"enum":["CONFIG_TYPE_BOOLEAN","CONFIG_TYPE_STRING","CONFIG_TYPE_INT","CONFIG_TYPE_SHORT","CONFIG_TYPE_LONG","CONFIG_TYPE_DOUBLE","CONFIG_TYPE_LIST","CONFIG_TYPE_CLASS","CONFIG_TYPE_PASSWORD"],"type":"string"},"Configuration":{"properties":{"config_synonyms":{"description":"If no config value is set at the topic level, it will inherit the value\nset at the broker or cluster level. `name` is the corresponding config\nkey whose value is inherited. `source` indicates whether the inherited\nconfig is default, broker, etc.","items":{"$ref":"#/components/schemas/ConfigSynonym"},"type":"array"},"documentation":{"description":"Config documentation.","nullable":true,"type":"string"},"name":{"description":"A topic-level config key (e.g. `segment.bytes`).","type":"string"},"read_only":{"description":"Whether the config is read-only, or is dynamic and can be altered.","type":"boolean"},"sensitive":{"description":"Whether this is a sensitive config key and value.","type":"boolean"},"source":{"$ref":"#/components/schemas/ConfigSource"},"type":{"$ref":"#/components/schemas/ConfigType"},"value":{"description":"A topic-level config value (e.g. 1073741824).","nullable":true,"type":"string"}},"type":"object"},"ConnectCluster":{"properties":{"address":{"description":"The host address of the Kafka Connect cluster.","type":"string"},"info":{"$ref":"#/components/schemas/ConnectCluster.Info"},"name":{"description":"Unique name of connect cluster. For Redpanda Cloud, the value is `redpanda`.","type":"string"},"plugins":{"items":{"$ref":"#/components/schemas/ConnectorPlugin"},"type":"array"}},"type":"object"},"ConnectCluster.Info":{"properties":{"commit":{"description":"The git commit ID of the connect worker source code.","type":"string"},"kafka_cluster_id":{"description":"Cluster ID.","type":"string"},"version":{"description":"Connect worker version.","type":"string"}},"type":"object"},"Connector":{"properties":{"state":{"description":"State of the connector instance.","type":"string"},"trace":{"description":"String value of stack trace.","type":"string"},"worker_id":{"description":"ID of worker that the connector is assigned to.","type":"string"}},"type":"object"},"ConnectorError":{"properties":{"content":{"description":"Detailed description of the error.","type":"string"},"title":{"description":"Short description of the error.","type":"string"},"type":{"$ref":"#/components/schemas/ConnectorError.Type"}},"title":"ConnectorError is the error of a connector, this is holistic error\nabstraction, made parsing the error trace of connector or Task","type":"object"},"ConnectorError.Type":{"description":"Error level.","enum":["TYPE_ERROR","TYPE_WARNING"],"type":"string"},"ConnectorHolisticState":{"description":"State of a connector or one of its tasks, as described in the [Kafka Connect documentation](https://kafka.apache.org/documentation.html#connect_administration). Takes into account not just the state of the connector instance itself, but also the tasks within the connector.\n\n - CONNECTOR_HOLISTIC_STATE_PAUSED: The connector or task has been administratively paused.\n - CONNECTOR_HOLISTIC_STATE_RESTARTING: The connector or task is restarting.\n - CONNECTOR_HOLISTIC_STATE_DESTROYED: The connector is destroyed, regardless of any tasks.\n - CONNECTOR_HOLISTIC_STATE_STOPPED: The connector or task has been stopped.\n - CONNECTOR_HOLISTIC_STATE_UNASSIGNED: - The connector or task has not yet been assigned to a worker,\n- THe connector is running, but there are unassigned tasks.\n - CONNECTOR_HOLISTIC_STATE_HEALTHY: The connector is running, \u003e 0 tasks, all of them in running state.\n - CONNECTOR_HOLISTIC_STATE_UNHEALTHY: - The connector has failed,\n- The connector is running, but has no tasks,\n- Connector is running and has tasks, but all tasks have failed.\n - CONNECTOR_HOLISTIC_STATE_DEGRADED: The connector is running and has tasks, and at least one task, but not all, have failed.\n - CONNECTOR_HOLISTIC_STATE_UNKNOWN: The connector or task state could not be determined.","enum":["CONNECTOR_HOLISTIC_STATE_PAUSED","CONNECTOR_HOLISTIC_STATE_RESTARTING","CONNECTOR_HOLISTIC_STATE_DESTROYED","CONNECTOR_HOLISTIC_STATE_STOPPED","CONNECTOR_HOLISTIC_STATE_UNASSIGNED","CONNECTOR_HOLISTIC_STATE_HEALTHY","CONNECTOR_HOLISTIC_STATE_UNHEALTHY","CONNECTOR_HOLISTIC_STATE_DEGRADED","CONNECTOR_HOLISTIC_STATE_UNKNOWN"],"type":"string"},"ConnectorInfoStatus":{"properties":{"info":{"$ref":"#/components/schemas/ConnectorSpec"},"name":{"description":"Name of connector.","type":"string"},"status":{"$ref":"#/components/schemas/ConnectorStatus"}},"type":"object"},"ConnectorPlugin":{"properties":{"class":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"type":"object"},"ConnectorSpec":{"description":"Connector specifications as defined in the Kafka Connect\nAPI. You may include this in the request body when creating a new connector.","properties":{"config":{"additionalProperties":{"type":"string"},"description":"Connector configuration properties.","type":"object"},"name":{"description":"Name of connector.","type":"string"},"tasks":{"items":{"$ref":"#/components/schemas/TaskInfo"},"readOnly":true,"type":"array"},"type":{"readOnly":true,"type":"string"}},"required":["name","config"],"type":"object"},"ConnectorStatus":{"properties":{"connector":{"$ref":"#/components/schemas/Connector"},"errors":{"description":"List of parsed connectors' and tasks' errors.","items":{"$ref":"#/components/schemas/ConnectorError"},"type":"array"},"holistic_state":{"$ref":"#/components/schemas/ConnectorHolisticState"},"name":{"description":"Name of connector.","type":"string"},"tasks":{"description":"Status of connector tasks. For more information, see the [https://docs.redpanda.com/current/deploy/deployment-option/cloud/managed-connectors/monitor-connectors/#connector-tasks](Monitor Connectors) documentation.","items":{"$ref":"#/components/schemas/TaskStatus"},"type":"array"},"type":{"description":"Type of connector (sink or source).","type":"string"}},"type":"object"},"CreateACLRequest":{"properties":{"host":{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","type":"string"},"resource_name":{"description":"The name of the resource this ACL targets.\nFor requests with resource_type CLUSTER, this will default to \"kafka-cluster\".","type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"required":["resource_type","resource_pattern_type","principal","host","operation","permission_type"],"type":"object"},"CreateACLResponse":{"type":"object"},"CreateConnectSecretBody":{"description":"CreateConnectSecretRequest is the request of CreateConnectSecret.","properties":{"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"name":{"description":"Name of connector.","type":"string"},"secret_data":{"description":"The secret data. Must be Base64-encoded.","format":"byte","type":"string"}},"required":["name","secret_data"],"type":"object"},"CreateConnectSecretResponse":{"description":"CreateConnectSecretResponse is the response of CreateConnectSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"CreateConnectorResponse":{"properties":{"connector":{"$ref":"#/components/schemas/ConnectorSpec"}},"type":"object"},"CreatePipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"CreateSecretRequest":{"description":"CreateSecretRequest is the request of CreateSecret.","properties":{"id":{"description":"Secret identifier.","type":"string"},"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"title":"Secret scopes","type":"array"},"secret_data":{"description":"The secret data. Must be Base64-encoded.","format":"byte","type":"string"}},"required":["secret_data"],"type":"object"},"CreateSecretResponse":{"description":"CreateSecretResponse is the response of CreateSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"CreateTopicRequest.Topic":{"properties":{"configs":{"description":"An array of key-value config pairs for a topic.\nThese correspond to Kafka topic-level configs.","items":{"$ref":"#/components/schemas/Config"},"type":"array"},"name":{"description":"Name of topic.","type":"string"},"partition_count":{"description":"The number of partitions to give the topic. If specifying\npartitions manually (see `replica_assignments`), set to -1.\nOr, to use the cluster default partition count, set to null.","format":"int32","nullable":true,"type":"integer"},"replica_assignments":{"description":"Manually specify broker ID assignments for partition replicas. If manually assigning replicas, both `replication_factor` and\n`partition_count` must be -1.","items":{"$ref":"#/components/schemas/ReplicaAssignment"},"type":"array"},"replication_factor":{"description":"The number of replicas every partition must have.\nIf specifying partitions manually (see `replica_assignments`), set to -1.\nOr, to use the cluster default replication factor, set to null.","format":"int32","nullable":true,"type":"integer"}},"type":"object"},"CreateTopicResponse":{"properties":{"name":{"description":"Name of topic.","type":"string"},"partition_count":{"description":"The number of partitions created for the topic.\nThis field has a default value of -1, which may be returned if the broker\ndoes not support v5+ of this request which added support for returning\nthis information.","format":"int32","type":"integer"},"replication_factor":{"description":"The number of replicas per topic partition.\nThis field has a default of -1, which may be returned if the broker\ndoes not support v5+ of this request which added support for returning\nthis information.","format":"int32","type":"integer"}},"type":"object"},"CreateUserRequest.User":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"description":"Username.","type":"string"},"password":{"description":"Password.","type":"string"}},"type":"object"},"CreateUserResponse":{"properties":{"user":{"$ref":"#/components/schemas/CreateUserResponse.User"}},"type":"object"},"CreateUserResponse.User":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"title":"Name of newly-created user","type":"string"}},"type":"object"},"DeleteACLsRequest.Filter":{"properties":{"host":{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","nullable":true,"type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","nullable":true,"type":"string"},"resource_name":{"description":"The name of the resource this ACL targets.","nullable":true,"type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"required":["resource_type","resource_pattern_type","operation","permission_type"],"type":"object"},"DeleteACLsResponse":{"properties":{"matching_acls":{"items":{"$ref":"#/components/schemas/MatchingACL"},"type":"array"}},"type":"object"},"DeleteConnectSecretResponse":{"description":"DeleteConnectSecretResponse is the response of DeleteConnectSecret.","type":"object"},"DeleteMountTaskResponse":{"type":"object"},"DeletePipelineResponse":{"type":"object"},"DeleteSecretResponse":{"description":"DeleteSecretResponse is the response of DeleteSecret.","type":"object"},"DeleteTopicResponse":{"type":"object"},"DeleteTransformResponse":{"type":"object"},"DeleteUserResponse":{"type":"object"},"DeployTransformRequest":{"description":"Metadata required to deploy a new Wasm\ntransform in a Redpanda cluster.","properties":{"environment_variables":{"description":"The environment variables you want to apply to your transform's environment","items":{"$ref":"#/components/schemas/EnvironmentVariable"},"type":"array"},"input_topic_name":{"description":"The input topic to apply the transform to.","example":"orders","type":"string"},"name":{"description":"Name of the transform.","example":"redact-payment-details-in-orders","type":"string"},"output_topic_names":{"description":"Output topic to write the transform results to.","example":"orders-redacted","items":{"type":"string"},"type":"array"}},"required":["name","input_topic_name","output_topic_names"],"type":"object"},"EnvironmentVariable":{"properties":{"key":{"description":"The key of your environment variable.","example":"LOG_LEVEL","type":"string"},"value":{"description":"The value of your environment variable.","example":"DEBUG","type":"string"}},"required":["key","value"],"type":"object"},"ErrorInfo":{"description":"Describes the cause of the error with structured details.\n\nExample of an error when contacting the \"pubsub.googleapis.com\" API when it\nis not enabled:\n\n    { \"reason\": \"API_DISABLED\"\n      \"domain\": \"googleapis.com\"\n      \"metadata\": {\n        \"resource\": \"projects/123\",\n        \"service\": \"pubsub.googleapis.com\"\n      }\n    }\n\nThis response indicates that the pubsub.googleapis.com API is not enabled.\n\nExample of an error that is returned when attempting to create a Spanner\ninstance in a region that is out of stock:\n\n    { \"reason\": \"STOCKOUT\"\n      \"domain\": \"spanner.googleapis.com\",\n      \"metadata\": {\n        \"availableRegions\": \"us-central1,us-east2\"\n      }\n    }","properties":{"domain":{"description":"The logical grouping to which the \"reason\" belongs. The error domain\nis typically the registered service name of the tool or product that\ngenerates the error. Example: \"pubsub.googleapis.com\". If the error is\ngenerated by some common infrastructure, the error domain must be a\nglobally unique value that identifies the infrastructure. For Google API\ninfrastructure, the error domain is \"googleapis.com\".","type":"string"},"metadata":{"additionalProperties":{"type":"string"},"description":"Additional structured details about this error.\n\nKeys must match a regular expression of `[a-z][a-zA-Z0-9-_]+` but should\nideally be lowerCamelCase. Also, they must be limited to 64 characters in\nlength. When identifying the current value of an exceeded limit, the units\nshould be contained in the key, not the value.  For example, rather than\n`{\"instanceLimit\": \"100/request\"}`, should be returned as,\n`{\"instanceLimitPerRequest\": \"100\"}`, if the client exceeds the number of\ninstances that can be created in a single (batch) request.","type":"object"},"reason":{"description":"The reason of the error. This is a constant value that identifies the\nproximate cause of the error. Error reasons are unique within a particular\ndomain of errors. This should be at most 63 characters and match a\nregular expression of `[A-Z][A-Z0-9_]+[A-Z0-9]`, which represents\nUPPER_SNAKE_CASE.","type":"string"}},"title":"ErrorInfo","type":"object"},"FieldViolation":{"description":"A message type used to describe a single bad request field.","properties":{"description":{"description":"A description of why the request element is bad.","type":"string"},"field":{"description":"A path that leads to a field in the request body. The value will be a\nsequence of dot-separated identifiers that identify a protocol buffer\nfield.\n\nConsider the following:\n\n    message CreateContactRequest {\n      message EmailAddress {\n        enum Type {\n          TYPE_UNSPECIFIED = 0;\n          HOME = 1;\n          WORK = 2;\n        }\n\n        optional string email = 1;\n        repeated EmailType type = 2;\n      }\n\n      string full_name = 1;\n      repeated EmailAddress email_addresses = 2;\n    }\n\nIn this example, in proto `field` could take one of the following values:\n\n* `full_name` for a violation in the `full_name` value\n* `email_addresses[1].email` for a violation in the `email` field of the\n  first `email_addresses` message\n* `email_addresses[3].type[2]` for a violation in the second `type`\n  value in the third `email_addresses` message.\n\nIn JSON, the same values are represented as:\n\n* `fullName` for a violation in the `fullName` value\n* `emailAddresses[1].email` for a violation in the `email` field of the\n  first `emailAddresses` message\n* `emailAddresses[3].type[2]` for a violation in the second `type`\n  value in the third `emailAddresses` message.","type":"string"},"localized_message":{"$ref":"#/components/schemas/LocalizedMessage"},"reason":{"description":"The reason of the field-level error. This is a constant value that\nidentifies the proximate cause of the field-level error. It should\nuniquely identify the type of the FieldViolation within the scope of the\ngoogle.rpc.ErrorInfo.domain. This should be at most 63\ncharacters and match a regular expression of `[A-Z][A-Z0-9_]+[A-Z0-9]`,\nwhich represents UPPER_SNAKE_CASE.","type":"string"}},"type":"object"},"GetConnectClusterResponse":{"properties":{"cluster":{"$ref":"#/components/schemas/ConnectCluster"}},"type":"object"},"GetConnectSecretResponse":{"description":"GetConnectSecretResponse is the response of GetConnectSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"GetConnectorConfigResponse":{"properties":{"config":{"additionalProperties":{"type":"string"},"type":"object"}},"type":"object"},"GetConnectorResponse":{"properties":{"connector":{"$ref":"#/components/schemas/ConnectorSpec"}},"type":"object"},"GetConnectorStatusResponse":{"properties":{"status":{"$ref":"#/components/schemas/ConnectorStatus"}},"type":"object"},"GetMountTaskResponse":{"properties":{"task":{"$ref":"#/components/schemas/MountTask"}},"type":"object"},"GetPipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"GetPipelineServiceConfigSchemaResponse":{"properties":{"config_schema":{"description":"JSON schema of the configuration components that are allowed for Connect pipelines.","type":"string"}},"type":"object"},"GetPipelinesBySecretsResponse":{"properties":{"pipelines_for_secret":{"items":{"$ref":"#/components/schemas/PipelinesForSecret"},"type":"array"}},"type":"object"},"GetPipelinesForSecretResponse":{"properties":{"pipelines_for_secret":{"$ref":"#/components/schemas/PipelinesForSecret"}},"type":"object"},"GetSecretResponse":{"description":"GetSecretResponse is the response of GetSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"GetTopicConfigurationsResponse":{"properties":{"configurations":{"items":{"$ref":"#/components/schemas/Configuration"},"type":"array"}},"type":"object"},"GetTransformResponse":{"properties":{"transform":{"$ref":"#/components/schemas/TransformMetadata"}},"type":"object"},"Help":{"description":"Provides links to documentation or for performing an out of band action.\n\nFor example, if a quota check failed with an error indicating the calling\nproject hasn't enabled the accessed service, this can contain a URL pointing\ndirectly to the right place in the developer console to flip the bit.","properties":{"links":{"description":"URL(s) pointing to additional information on handling the current error.","items":{"$ref":"#/components/schemas/Link"},"type":"array"}},"title":"Help","type":"object"},"Link":{"description":"Describes a URL link.","properties":{"description":{"description":"Describes what the link offers.","type":"string"},"url":{"description":"The URL of the link.","type":"string"}},"type":"object"},"ListACLsRequest.Filter":{"properties":{"host":{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","nullable":true,"type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","nullable":true,"type":"string"},"resource_name":{"description":"The name of the resource this ACL targets.","nullable":true,"type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"type":"object"},"ListACLsResponse":{"properties":{"resources":{"items":{"$ref":"#/components/schemas/Resource"},"type":"array"}},"type":"object"},"ListConnectClustersResponse":{"properties":{"clusters":{"items":{"$ref":"#/components/schemas/ConnectCluster"},"type":"array"}},"type":"object"},"ListConnectSecretsResponse":{"description":"ListConnectSecretsResponse is the response of ListConnectSecrets.","properties":{"next_page_token":{"description":"Token to retrieve the next page.","type":"string"},"secrets":{"description":"Secrets retrieved.","items":{"$ref":"#/components/schemas/Secret"},"type":"array"}},"type":"object"},"ListConnectorTopicsResponse":{"properties":{"topics":{"description":"Topic names.","items":{"type":"string"},"type":"array"}},"type":"object"},"ListConnectorsResponse":{"properties":{"connectors":{"description":"List of connectors, where the parent key is the connector name.","items":{"$ref":"#/components/schemas/ConnectorInfoStatus"},"type":"array"},"next_page_token":{"description":"Page Token to fetch the next page. The value can be used as page_token in the next call to this endpoint.","type":"string"}},"type":"object"},"ListMountTasksResponse":{"properties":{"tasks":{"items":{"$ref":"#/components/schemas/MountTask"},"type":"array"}},"type":"object"},"ListMountableTopicsResponse":{"properties":{"topics":{"items":{"$ref":"#/components/schemas/TopicLocation"},"type":"array"}},"type":"object"},"ListPipelinesRequest.Filter":{"properties":{"name_contains":{"description":"Substring match on pipeline name. Case-sensitive.","type":"string"}},"type":"object"},"ListPipelinesResponse":{"properties":{"next_page_token":{"type":"string"},"pipelines":{"items":{"$ref":"#/components/schemas/Pipeline"},"type":"array"}},"type":"object"},"ListSecretScopesResponse":{"description":"ListSecretScopesResponse is the response of ListSecretScopes.","properties":{"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"type":"array"}},"type":"object"},"ListSecretsFilter":{"description":"ListSecretsFilter are the filter options for listing secrets.","properties":{"labels[string][string]":{"additionalProperties":{"type":"string"},"description":"The secret labels to search for.","type":"object"},"name_contains":{"description":"Substring match on secret name. Case-sensitive.","type":"string"},"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"title":"Secret scopes to search for","type":"array"}},"type":"object"},"ListSecretsResponse":{"description":"ListSecretsResponse is the response of ListSecrets.","properties":{"next_page_token":{"description":"Token to retrieve the next page.","type":"string"},"secrets":{"description":"Secrets retrieved.","items":{"$ref":"#/components/schemas/Secret"},"type":"array"}},"type":"object"},"ListTopicsRequest.Filter":{"properties":{"name_contains":{"description":"Substring match on topic name. Case-sensitive.","type":"string"}},"type":"object"},"ListTopicsResponse":{"properties":{"next_page_token":{"type":"string"},"topics":{"items":{"$ref":"#/components/schemas/ListTopicsResponse.Topic"},"type":"array"}},"type":"object"},"ListTopicsResponse.Topic":{"properties":{"internal":{"description":"Whether topic is internal only.","type":"boolean"},"name":{"description":"Topic name.","type":"string"},"partition_count":{"description":"Topic partition count.","format":"int32","type":"integer"},"replication_factor":{"description":"Topic replication factor.","format":"int32","type":"integer"}},"type":"object"},"ListTransformsRequest.Filter":{"properties":{"name_contains":{"description":"Substring match on transform name. Case-sensitive.","type":"string"}},"type":"object"},"ListTransformsResponse":{"properties":{"next_page_token":{"description":"Token to retrieve the next page.","type":"string"},"transforms":{"items":{"$ref":"#/components/schemas/TransformMetadata"},"type":"array"}},"type":"object"},"ListUsersRequest.Filter":{"properties":{"name":{"description":"Username.","type":"string"},"name_contains":{"description":"Substring match on username. Case-sensitive.","type":"string"}},"type":"object"},"ListUsersResponse":{"properties":{"next_page_token":{"description":"Token to retrieve the next page.","type":"string"},"users":{"items":{"$ref":"#/components/schemas/ListUsersResponse.User"},"type":"array"}},"type":"object"},"ListUsersResponse.User":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"description":"Username.","type":"string"}},"type":"object"},"LocalizedMessage":{"description":"Provides a localized error message that is safe to return to the user\nwhich can be attached to an RPC error.","properties":{"locale":{"title":"The locale used following the specification defined at\nhttps://www.rfc-editor.org/rfc/bcp/bcp47.txt.\nExamples are: \"en-US\", \"fr-CH\", \"es-MX\"","type":"string"},"message":{"description":"The localized error message in the above locale.","type":"string"}},"type":"object"},"MatchingACL":{"properties":{"error":{"$ref":"#/components/schemas/rpc.Status"},"host":{"description":"The host address to use for this ACL.","type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies.","type":"string"},"resource_name":{"description":"The name of the resource this ACL targets.","type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"type":"object"},"MountTask":{"properties":{"id":{"description":"Unique identifier for this mount task.","format":"int32","type":"integer"},"state":{"$ref":"#/components/schemas/MountTask.State"},"topics":{"description":"List of topics that are being mounted or unmounted.","items":{"$ref":"#/components/schemas/MountTask.Topic"},"type":"array"},"type":{"$ref":"#/components/schemas/MountTask.Type"}},"type":"object"},"MountTask.State":{"description":" - STATE_PLANNED: Planned: The mount task has been created and is awaiting further actions.\n - STATE_PREPARING: Preparing: The mount task is gathering resources and preparing for execution.\n - STATE_PREPARED: Prepared: All preparations are complete, and the mount task is ready to be executed.\n - STATE_EXECUTING: Executing: The mount task is actively transferring or transforming data.\n - STATE_EXECUTED: Executed: The core mount task actions are complete, but the mount task has not yet cut over or finalized.\n - STATE_CUT_OVER: Cut Over: The mount task has reached a critical point where ownership is transferred or final adjustments are made.\n - STATE_FINISHED: Finished: The mount task has been successfully completed, and no further actions are required.\n - STATE_CANCELING: Canceling: The mount task is in the process of being canceled, and rollback or cleanup actions may be in progress.\n - STATE_CANCELLED: Cancelled: The mount task has been fully canceled, and no further actions will be taken.","enum":["STATE_PLANNED","STATE_PREPARING","STATE_PREPARED","STATE_EXECUTING","STATE_EXECUTED","STATE_CUT_OVER","STATE_FINISHED","STATE_CANCELING","STATE_CANCELLED"],"type":"string"},"MountTask.Topic":{"properties":{"source_topic_reference":{"description":"The topic reference in the object storage bucket.\nThis field is only set for tasks of type MOUNT.","type":"string"},"topic_reference":{"description":"The topic reference within the current cluster, which may be either a simple topic name or a full reference\nin the form: cluster-uuid/topic-name/revision.","type":"string"}},"type":"object"},"MountTask.Type":{"description":" - TYPE_MOUNT: Mount represents the process of making topics available in a cluster by loading them from object storage.\n - TYPE_UNMOUNT: Unmount represents the process of offloading topics back to object storage.","enum":["TYPE_MOUNT","TYPE_UNMOUNT"],"type":"string"},"MountTopicsResponse":{"properties":{"mount_task_id":{"format":"int32","title":"ID of mount","type":"integer"}},"type":"object"},"Options":{"properties":{"include_tasks":{"description":"Restart connector's tasks.","type":"boolean"},"only_failed":{"description":"Restart only connectors that have failed.","type":"boolean"}},"type":"object"},"PartitionStatus":{"enum":["PARTITION_STATUS_RUNNING","PARTITION_STATUS_INACTIVE","PARTITION_STATUS_ERRORED","PARTITION_STATUS_UNKNOWN"],"type":"string"},"PartitionTransformStatus":{"properties":{"broker_id":{"format":"int32","type":"integer"},"lag":{"format":"int32","type":"integer"},"partition_id":{"format":"int32","type":"integer"},"status":{"$ref":"#/components/schemas/PartitionStatus"}},"type":"object"},"PermissionType":{"description":"Whether the operation should be allowed or denied.","enum":["PERMISSION_TYPE_ANY","PERMISSION_TYPE_DENY","PERMISSION_TYPE_ALLOW"],"type":"string"},"Pipeline":{"description":"Defines the pipeline resource.","properties":{"config_yaml":{"description":"The Redpanda Connect pipeline configuration in YAML format. See the [Redpanda Connect Configuration](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/about) documentation for more details.","title":"The pipeline configuration in YAML.\nSee https://docs.redpanda.com/redpanda-connect/configuration/about/","type":"string"},"description":{"description":"Optional pipeline description.","type":"string"},"display_name":{"description":"User-friendly pipeline name.","type":"string"},"id":{"description":"Pipeline ID.","type":"string"},"resources":{"$ref":"#/components/schemas/Resources"},"service_account":{"$ref":"#/components/schemas/ServiceAccount"},"state":{"$ref":"#/components/schemas/Pipeline.State"},"status":{"$ref":"#/components/schemas/Pipeline.Status"}},"required":["id","display_name","config_yaml"],"type":"object"},"Pipeline.State":{"description":"State of the pipeline.\n\n - STATE_STARTING: The pipeline is starting.\n - STATE_RUNNING: The pipeline is running.\n - STATE_STOPPING: The pipeline is in the process of stopping.\n - STATE_STOPPED: The pipeline is stopped and in paused state.\n - STATE_ERROR: The pipeline encountered an error. See [Error Handling](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/error_handling/) for further guidance.\n - STATE_COMPLETED: The pipeline has completed the job successfully.","enum":["STATE_STARTING","STATE_RUNNING","STATE_STOPPING","STATE_STOPPED","STATE_ERROR","STATE_COMPLETED"],"type":"string"},"Pipeline.Status":{"description":"Pipeline status may contain an error message.","properties":{"error":{"type":"string"}},"type":"object"},"PipelineCreate":{"description":"PipelineCreate contains the details for the pipeline creation request.","properties":{"config_yaml":{"description":"The Redpanda Connect pipeline configuration in YAML format. See the [Redpanda Connect Configuration](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/about) documentation for more details.","type":"string"},"description":{"description":"Pipeline description.","type":"string"},"display_name":{"description":"User-friendly pipeline name.","type":"string"},"resources":{"$ref":"#/components/schemas/Resources"},"service_account":{"$ref":"#/components/schemas/ServiceAccount"}},"required":["display_name","config_yaml"],"type":"object"},"PipelineUpdate":{"properties":{"config_yaml":{"description":"The Redpanda Connect pipeline configuration in YAML format. See the [Redpanda Connect Configuration](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/about) documentation for more details.","type":"string"},"description":{"description":"Pipeline description.","type":"string"},"display_name":{"description":"User-friendly pipeline name.","type":"string"},"resources":{"$ref":"#/components/schemas/Resources"},"service_account":{"$ref":"#/components/schemas/ServiceAccount"}},"required":["display_name","config_yaml"],"type":"object"},"PipelinesForSecret":{"properties":{"pipelines":{"items":{"$ref":"#/components/schemas/Pipeline"},"type":"array"},"secret_id":{"type":"string"}},"type":"object"},"Policy":{"properties":{"host":{"description":"The host address for this ACL.","type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies.","type":"string"}},"type":"object"},"QuotaFailure":{"description":"Describes how a quota check failed.\n\nFor example if a daily limit was exceeded for the calling project,\na service could respond with a QuotaFailure detail containing the project\nid and the description of the quota limit that was exceeded.  If the\ncalling project hasn't enabled the service in the developer console, then\na service could respond with the project id and set `service_disabled`\nto true.\n\nAlso see RetryInfo and Help types for other details about handling a\nquota failure.","properties":{"violations":{"description":"Describes all quota violations.","items":{"$ref":"#/components/schemas/QuotaFailure.Violation"},"type":"array"}},"title":"QuotaFailure","type":"object"},"QuotaFailure.Violation":{"description":"A message type used to describe a single quota violation.  For example, a\ndaily quota or a custom quota that was exceeded.","properties":{"api_service":{"description":"The API Service from which the `QuotaFailure.Violation` orginates. In\nsome cases, Quota issues originate from an API Service other than the one\nthat was called. In other words, a dependency of the called API Service\ncould be the cause of the `QuotaFailure`, and this field would have the\ndependency API service name.\n\nFor example, if the called API is Kubernetes Engine API\n(container.googleapis.com), and a quota violation occurs in the\nKubernetes Engine API itself, this field would be\n\"container.googleapis.com\". On the other hand, if the quota violation\noccurs when the Kubernetes Engine API creates VMs in the Compute Engine\nAPI (compute.googleapis.com), this field would be\n\"compute.googleapis.com\".","type":"string"},"description":{"description":"A description of how the quota check failed. Clients can use this\ndescription to find more about the quota configuration in the service's\npublic documentation, or find the relevant quota limit to adjust through\ndeveloper console.\n\nFor example: \"Service disabled\" or \"Daily Limit for read operations\nexceeded\".","type":"string"},"future_quota_value":{"description":"The new quota value being rolled out at the time of the violation. At the\ncompletion of the rollout, this value will be enforced in place of\nquota_value. If no rollout is in progress at the time of the violation,\nthis field is not set.\n\nFor example, if at the time of the violation a rollout is in progress\nchanging the number of CPUs quota from 10 to 20, 20 would be the value of\nthis field.","format":"int64","nullable":true,"type":"string"},"quota_dimensions":{"additionalProperties":{"type":"string"},"description":"The dimensions of the violated quota. Every non-global quota is enforced\non a set of dimensions. While quota metric defines what to count, the\ndimensions specify for what aspects the counter should be increased.\n\nFor example, the quota \"CPUs per region per VM family\" enforces a limit\non the metric \"compute.googleapis.com/cpus_per_vm_family\" on dimensions\n\"region\" and \"vm_family\". And if the violation occurred in region\n\"us-central1\" and for VM family \"n1\", the quota_dimensions would be,\n\n{\n  \"region\": \"us-central1\",\n  \"vm_family\": \"n1\",\n}\n\nWhen a quota is enforced globally, the quota_dimensions would always be\nempty.","type":"object"},"quota_id":{"description":"The id of the violated quota. Also know as \"limit name\", this is the\nunique identifier of a quota in the context of an API service.\n\nFor example, \"CPUS-PER-VM-FAMILY-per-project-region\".","type":"string"},"quota_metric":{"description":"The metric of the violated quota. A quota metric is a named counter to\nmeasure usage, such as API requests or CPUs. When an activity occurs in a\nservice, such as Virtual Machine allocation, one or more quota metrics\nmay be affected.\n\nFor example, \"compute.googleapis.com/cpus_per_vm_family\",\n\"storage.googleapis.com/internet_egress_bandwidth\".","type":"string"},"quota_value":{"description":"The enforced quota value at the time of the `QuotaFailure`.\n\nFor example, if the enforced quota value at the time of the\n`QuotaFailure` on the number of CPUs is \"10\", then the value of this\nfield would reflect this quantity.","format":"int64","type":"string"},"subject":{"description":"The subject on which the quota check failed.\nFor example, \"clientip:\u003cip address of client\u003e\" or \"project:\u003cGoogle\ndeveloper project id\u003e\".","type":"string"}},"type":"object"},"ReplicaAssignment":{"properties":{"partition_id":{"description":"A partition to create.","format":"int32","type":"integer"},"replica_ids":{"description":"The broker IDs the partition replicas are assigned to.","items":{"format":"int32","type":"integer"},"type":"array"}},"type":"object"},"Resource":{"properties":{"acls":{"items":{"$ref":"#/components/schemas/Policy"},"type":"array"},"resource_name":{"description":"The name of the resource this ACL targets.","type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"type":"object"},"ResourcePatternType":{"description":"The pattern to use for matching the specified resource_name\n(any, exact match, literal, or prefixed).","enum":["RESOURCE_PATTERN_TYPE_ANY","RESOURCE_PATTERN_TYPE_MATCH","RESOURCE_PATTERN_TYPE_LITERAL","RESOURCE_PATTERN_TYPE_PREFIXED"],"type":"string"},"ResourceType":{"description":"The type of resource (topic, consumer group, etc.) this\nACL targets.","enum":["RESOURCE_TYPE_ANY","RESOURCE_TYPE_TOPIC","RESOURCE_TYPE_GROUP","RESOURCE_TYPE_CLUSTER","RESOURCE_TYPE_TRANSACTIONAL_ID","RESOURCE_TYPE_DELEGATION_TOKEN","RESOURCE_TYPE_USER"],"type":"string"},"Resources":{"properties":{"cpu_shares":{"description":"`cpu_shares` is a string specifying the amount of CPU to allocate for the\npipeline.\n\nThis follows the [Kubernetes quantity](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/) format. Acceptable\nunits include:\n- Decimal SI units: \"m\" (e.g., \"500m\" for 500 millicores, \"2\" for 2 cores)\nCPU shares can be specified in millicores (1 core = 1000 millicores).\nIf you don't specify a unit, the value is interpreted as the number of cores.","type":"string"},"memory_shares":{"description":"`memory_shares` is a string specifying the amount of memory to allocate for\nthe pipeline.\n\nThis follows the [Kubernetes quantity](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/) format. Acceptable units\ninclude:\n- Decimal SI units: \"K\", \"M\", \"G\", \"T\", \"P\", \"E\" (e.g., \"128M\" for 128\n  megabytes)\n- Binary SI units: \"Ki\", \"Mi\", \"Gi\", \"Ti\", \"Pi\", \"Ei\" (e.g., \"512Mi\" for\n512 mebibytes) If you don't specify a unit, the value is interpreted as\nbytes.","type":"string"}},"required":["memory_shares","cpu_shares"],"type":"object"},"SASLMechanism":{"description":"SASL mechanism to use for authentication.","enum":["SASL_MECHANISM_SCRAM_SHA_256","SASL_MECHANISM_SCRAM_SHA_512"],"type":"string"},"Scope":{"description":"Defines the scope of a secret.","enum":["SCOPE_REDPANDA_CONNECT"],"type":"string"},"Secret":{"description":"Defines the secret resource.","properties":{"id":{"description":"Secret identifier.","readOnly":true,"type":"string"},"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"title":"Secret scopes","type":"array"}},"type":"object"},"ServiceAccount":{"properties":{"client_id":{"type":"string"},"client_secret":{"type":"string"}},"type":"object"},"SetConfiguration":{"properties":{"name":{"description":"A topic-level config key (e.g. `segment.bytes`).","type":"string"},"value":{"description":"A topic-level config value (e.g. 1073741824).","nullable":true,"type":"string"}},"type":"object"},"SetTopicConfigurationsResponse":{"properties":{"configurations":{"description":"Topic's complete set of configurations after this update.","items":{"$ref":"#/components/schemas/Configuration"},"type":"array"}},"type":"object"},"StartPipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"StopPipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"TaskInfo":{"properties":{"connector":{"description":"Name of connector.","type":"string"},"task":{"description":"The connector task ID.","format":"int32","type":"integer"}},"type":"object"},"TaskStatus":{"properties":{"id":{"description":"The connector task ID.","format":"int32","type":"integer"},"state":{"description":"State of connector task.","type":"string"},"trace":{"description":"String value of stack trace.","type":"string"},"worker_id":{"description":"ID of worker that the task is assigned to.","type":"string"}},"type":"object"},"TopicLocation":{"properties":{"name":{"description":"Topic name.","type":"string"},"topic_location":{"description":"Full reference for the unmounted topic in this format: `topic-name/cluster-uuid/revision`.\nUse this as unique identifier for mounting a topic if there are multiple topics available\nwith the same name.","type":"string"}},"type":"object"},"TopicMount":{"description":"TopicMount defines the migration of a topic from the cloud storage into this cluster,\nso that it becomes available via the Kafka API.","properties":{"alias":{"description":"Alias may be provided to mount the topic under a different name. Leave\nblank to re-use the source topic name. The alias does not persist if you\nunmount the topic again.","type":"string"},"source_topic_reference":{"description":"The topic name or full reference of the topic to mount. The full reference\nmust be used in case the same topic exists more than once. This may be the case if\nthe same topic has been unmounted multiple times. List all mountable topics to\nfind the full reference (contains topic name, cluster uuid and revision).","type":"string"}},"required":["source_topic_reference"],"type":"object"},"TransformMetadata":{"properties":{"environment_variables":{"description":"The environment variables you want to apply to your transform's environment","items":{"$ref":"#/components/schemas/EnvironmentVariable"},"type":"array"},"input_topic_name":{"description":"Input topic to apply the transform to.","type":"string"},"name":{"description":"Name of transform.","type":"string"},"output_topic_names":{"description":"Output topics to write the transform results to.","items":{"type":"string"},"type":"array"},"statuses":{"items":{"$ref":"#/components/schemas/PartitionTransformStatus"},"type":"array"}},"type":"object"},"UnmountTopicsResponse":{"properties":{"mount_task_id":{"format":"int32","title":"ID of unmount","type":"integer"}},"type":"object"},"UpdateConfiguration":{"properties":{"name":{"description":"A topic-level config key (e.g. `segment.bytes`).","type":"string"},"operation":{"$ref":"#/components/schemas/ConfigAlterOperation"},"value":{"description":"A topic-level config value (e.g. 1073741824).","nullable":true,"type":"string"}},"type":"object"},"UpdateConnectSecretBody":{"description":"UpdateConnectSecretRequest is the request of UpdateConnectSecret.","properties":{"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"secret_data":{"description":"The secret data. Must be Base64-encoded.","format":"byte","type":"string"}},"required":["secret_data"],"type":"object"},"UpdateConnectSecretResponse":{"description":"UpdateConnectSecretResponse is the response of UpdateConnectSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"UpdateMountTaskBody":{"properties":{"action":{"$ref":"#/components/schemas/Action"}},"required":["action"],"type":"object"},"UpdateMountTaskResponse":{"type":"object"},"UpdatePipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"UpdateSecretBody":{"description":"UpdateSecretRequest is the request of UpdateSecret.","properties":{"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"title":"Secret scopes","type":"array"},"secret_data":{"description":"The secret data. Must be Base64-encoded.","format":"byte","type":"string"}},"required":["secret_data"],"type":"object"},"UpdateSecretResponse":{"description":"UpdateSecretResponse is the response of UpdateSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"UpdateTopicConfigurationsResponse":{"properties":{"configurations":{"description":"Topic's complete set of configurations after applying this partial patch.","items":{"$ref":"#/components/schemas/Configuration"},"type":"array"}},"type":"object"},"UpdateUserRequest.User":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"description":"Username.","type":"string"},"password":{"description":"Password.","type":"string"}},"type":"object"},"UpdateUserResponse":{"properties":{"user":{"$ref":"#/components/schemas/UpdateUserResponse.User"}},"type":"object"},"UpdateUserResponse.User":{"description":"Updated user's name and SASL mechanism.","properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"type":"string"}},"type":"object"},"UpsertConnectorResponse":{"properties":{"connector":{"$ref":"#/components/schemas/ConnectorSpec"}},"type":"object"},"rpc.Status":{"description":"The `Status` type defines a logical error model that is suitable for\ndifferent programming environments, including REST APIs and RPC APIs. It is\nused by [gRPC](https://github.com/grpc). Each `Status` message contains\nthree pieces of data: error code, error message, and error details.\n\nYou can find out more about this error model and how to work with it in the\n[API Design Guide](https://cloud.google.com/apis/design/errors).","properties":{"code":{"description":"RPC status code, as described [here](https://github.com/googleapis/googleapis/blob/b4c238feaa1097c53798ed77035bbfeb7fc72e96/google/rpc/code.proto#L32).","enum":["OK","CANCELLED","UNKNOWN","INVALID_ARGUMENT","DEADLINE_EXCEEDED","NOT_FOUND","ALREADY_EXISTS","PERMISSION_DENIED","UNAUTHENTICATED","RESOURCE_EXHAUSTED","FAILED_PRECONDITION","ABORTED","OUT_OF_RANGE","UNIMPLEMENTED","INTERNAL","UNAVAILABLE","DATA_LOSS"],"format":"int32","type":"string"},"details":{"items":{"description":"Details of the error.","oneOf":[{"allOf":[{"properties":{"@type":{"description":"Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.","enum":["type.googleapis.com/google.rpc.BadRequest"],"type":"string"}}},{"$ref":"#/components/schemas/BadRequest"}]},{"allOf":[{"properties":{"@type":{"description":"Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.","enum":["type.googleapis.com/google.rpc.ErrorInfo"],"type":"string"}}},{"$ref":"#/components/schemas/ErrorInfo"}]},{"allOf":[{"properties":{"@type":{"description":"Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.","enum":["type.googleapis.com/google.rpc.QuotaFailure"],"type":"string"}}},{"$ref":"#/components/schemas/QuotaFailure"}]},{"allOf":[{"properties":{"@type":{"description":"Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.","enum":["type.googleapis.com/google.rpc.Help"],"type":"string"}}},{"$ref":"#/components/schemas/Help"}]}]},"type":"array"},"message":{"description":"Detailed error message. No compatibility guarantees are given for the text contained in this message.","type":"string"}},"type":"object"}},"securitySchemes":{"auth0":{"description":"RedpandaCloud","flows":{"implicit":{"authorizationUrl":"https://auth.prd.cloud.redpanda.com/oauth/authorize","scopes":{},"x-client-id":"dQjapNIAHhF7EQqQToRla3yEII9sUSap"}},"type":"oauth2"}}},"info":{"title":"Redpanda Cloud Data Plane API","version":"v1alpha2"},"openapi":"3.0.3","paths":{"/v1alpha2/acls":{"delete":{"description":"Delete all ACLs that match the filter criteria. The `filter.` query string parameters find matching ACLs that meet all specified conditions.","operationId":"ACLService_DeleteACLs","parameters":[{"description":"The type of resource (topic, consumer group, etc.) this\nACL targets.","in":"query","name":"filter.resource_type","required":true,"schema":{"enum":["RESOURCE_TYPE_ANY","RESOURCE_TYPE_TOPIC","RESOURCE_TYPE_GROUP","RESOURCE_TYPE_CLUSTER","RESOURCE_TYPE_TRANSACTIONAL_ID","RESOURCE_TYPE_DELEGATION_TOKEN","RESOURCE_TYPE_USER"],"type":"string"}},{"description":"The name of the resource this ACL targets.","in":"query","name":"filter.resource_name","schema":{"type":"string"}},{"description":"The pattern to use for matching the specified resource_name\n(any, exact match, literal, or prefixed).","in":"query","name":"filter.resource_pattern_type","required":true,"schema":{"enum":["RESOURCE_PATTERN_TYPE_ANY","RESOURCE_PATTERN_TYPE_MATCH","RESOURCE_PATTERN_TYPE_LITERAL","RESOURCE_PATTERN_TYPE_PREFIXED"],"type":"string"}},{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","in":"query","name":"filter.principal","schema":{"type":"string"}},{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","in":"query","name":"filter.host","schema":{"type":"string"}},{"description":"The operation that is allowed or denied (e.g. READ).","in":"query","name":"filter.operation","required":true,"schema":{"enum":["OPERATION_ANY","OPERATION_ALL","OPERATION_READ","OPERATION_WRITE","OPERATION_CREATE","OPERATION_DELETE","OPERATION_ALTER","OPERATION_DESCRIBE","OPERATION_CLUSTER_ACTION","OPERATION_DESCRIBE_CONFIGS","OPERATION_ALTER_CONFIGS","OPERATION_IDEMPOTENT_WRITE","OPERATION_CREATE_TOKENS","OPERATION_DESCRIBE_TOKENS"],"type":"string"}},{"description":"Whether the operation should be allowed or denied.","in":"query","name":"filter.permission_type","required":true,"schema":{"enum":["PERMISSION_TYPE_ANY","PERMISSION_TYPE_DENY","PERMISSION_TYPE_ALLOW"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteACLsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete ACLs","tags":["Redpanda ACLs (v1alpha2)"]},"get":{"description":"List all ACLs. The `filter.` query string parameters find matching ACLs that meet all specified conditions.","operationId":"ACLService_ListACLs","parameters":[{"description":"The type of resource (topic, consumer group, etc.) this\nACL targets.","in":"query","name":"filter.resource_type","schema":{"enum":["RESOURCE_TYPE_ANY","RESOURCE_TYPE_TOPIC","RESOURCE_TYPE_GROUP","RESOURCE_TYPE_CLUSTER","RESOURCE_TYPE_TRANSACTIONAL_ID","RESOURCE_TYPE_DELEGATION_TOKEN","RESOURCE_TYPE_USER"],"type":"string"}},{"description":"The name of the resource this ACL targets.","in":"query","name":"filter.resource_name","schema":{"type":"string"}},{"description":"The pattern to use for matching the specified resource_name\n(any, exact match, literal, or prefixed).","in":"query","name":"filter.resource_pattern_type","schema":{"enum":["RESOURCE_PATTERN_TYPE_ANY","RESOURCE_PATTERN_TYPE_MATCH","RESOURCE_PATTERN_TYPE_LITERAL","RESOURCE_PATTERN_TYPE_PREFIXED"],"type":"string"}},{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","in":"query","name":"filter.principal","schema":{"type":"string"}},{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","in":"query","name":"filter.host","schema":{"type":"string"}},{"description":"The operation that is allowed or denied (e.g. READ).","in":"query","name":"filter.operation","schema":{"enum":["OPERATION_ANY","OPERATION_ALL","OPERATION_READ","OPERATION_WRITE","OPERATION_CREATE","OPERATION_DELETE","OPERATION_ALTER","OPERATION_DESCRIBE","OPERATION_CLUSTER_ACTION","OPERATION_DESCRIBE_CONFIGS","OPERATION_ALTER_CONFIGS","OPERATION_IDEMPOTENT_WRITE","OPERATION_CREATE_TOKENS","OPERATION_DESCRIBE_TOKENS"],"type":"string"}},{"description":"Whether the operation should be allowed or denied.","in":"query","name":"filter.permission_type","schema":{"enum":["PERMISSION_TYPE_ANY","PERMISSION_TYPE_DENY","PERMISSION_TYPE_ALLOW"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListACLsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List ACLs","tags":["Redpanda ACLs (v1alpha2)"]},"post":{"description":"Create a new ACL.","operationId":"ACLService_CreateACL","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateACLRequest"}}},"required":true,"x-originalParamName":"body"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateACLResponse"}}},"description":"Created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create ACL","tags":["Redpanda ACLs (v1alpha2)"]}},"/v1alpha2/cloud-storage/mount-tasks":{"get":{"description":"This operation retrieves the status of a task responsible for mounting or unmounting topics. It provides details on the task’s type (mount or unmount), its current state, and the topics involved.","operationId":"CloudStorageService_ListMountTasks","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMountTasksResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Retrieve the mount task status","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/cloud-storage/mount-tasks/{id}":{"delete":{"description":"Delete a mount or unmount by ID.","operationId":"CloudStorageService_DeleteMountTask","parameters":[{"description":"Unique identifier of the mount or unmount task to delete.","in":"path","name":"id","required":true,"schema":{"format":"int32","type":"integer"}}],"responses":{"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteMountTaskResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete a mount or unmount","tags":["Cloud Storage (v1alpha2)"]},"get":{"description":"Retrieves the status of a mount or unmount by ID. The response provides details on the operation type (mount or unmount), its current state, and the topics involved. Use the ID returned when you start the mount or unmount, or use the ListMountTasks endpoint to retrieve a list of IDs.","operationId":"CloudStorageService_GetMountTask","parameters":[{"description":"Unique identifier of the mount or unmount task to retrieve.","in":"path","name":"id","required":true,"schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetMountTaskResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get the status of a mount or unmount by ID","tags":["Cloud Storage (v1alpha2)"]},"post":{"description":"This operation allows performing an action on an ongoing mount task.","operationId":"CloudStorageService_UpdateMountTask","parameters":[{"description":"ID is the unique identifier of the mount or unmount to update.","in":"path","name":"id","required":true,"schema":{"format":"int32","type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateMountTaskBody"}}},"required":true,"x-originalParamName":"body"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateMountTaskResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update a mount or unmount","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/cloud-storage/topics/mount":{"post":{"description":"Attach mountable topics from object storage to a cluster, making them available for consumption and production again. Mounting a topic reloads its data and state to the local brokers, allowing active use of the topic.","operationId":"CloudStorageService_MountTopics","requestBody":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/TopicMount"},"required":["topics"],"type":"array"}}},"required":true,"x-originalParamName":"topics"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MountTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Mount topics from object storage","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/cloud-storage/topics/mountable":{"get":{"description":"Retrieve all topics that are currently unmounted and available to be mounted to the cluster. These topics reside in object storage and can be mounted for consumption or production within the cluster.","operationId":"CloudStorageService_ListMountableTopics","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMountableTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List mountable topics","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/cloud-storage/topics/unmount":{"post":{"description":"Unmount topics to object storage, freeing up all local cluster resources. Once you unmount a topic, it can no longer be consumed or produced to. It detaches from the active cluster while its data remains safely stored in the external object storage.","operationId":"CloudStorageService_UnmountTopics","requestBody":{"content":{"application/json":{"schema":{"items":{"type":"string"},"required":["topics"],"type":"array"}}},"description":"List of topics to unmount.","required":true,"x-originalParamName":"topics"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnmountTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Unmount topics to object storage","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters":{"get":{"description":"List connect clusters available for being consumed by the console's kafka-connect service.","operationId":"KafkaConnectService_ListConnectClusters","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListConnectClustersResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List connect clusters","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}":{"get":{"description":"Get information about an available Kafka Connect cluster.","operationId":"KafkaConnectService_GetConnectCluster","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectCluster"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Connect cluster not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get connect cluster","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors":{"get":{"description":"List connectors managed by the Kafka Connect service.","operationId":"KafkaConnectService_ListConnectors","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Value of the next_page_token field returned by the previous response. If not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListConnectorsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List connectors","tags":["Kafka Connect (v1alpha2)"]},"post":{"description":"Create a connector with the specified configuration.","operationId":"KafkaConnectService_CreateConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"required":true,"x-originalParamName":"connector"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"description":"Created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}":{"delete":{"description":"Delete a connector. This operation force stops all tasks and also deletes the connector configuration.","operationId":"KafkaConnectService_DeleteConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete connector","tags":["Kafka Connect (v1alpha2)"]},"get":{"description":"Get information about a connector in a specific cluster.","operationId":"KafkaConnectService_GetConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/config":{"get":{"description":"Get the configuration for the connector.","operationId":"KafkaConnectService_GetConnectorConfig","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get connector configuration","tags":["Kafka Connect (v1alpha2)"]},"put":{"description":"Update the configuration for an existing connector with the specified name, or create a new connector using the given configuration. Returns information about the connector after the change has been made.","operationId":"KafkaConnectService_UpsertConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector. If a connector with this name does not already exist, a new connector is created.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"additionalProperties":{"type":"string"},"required":["config"],"type":"object"}}},"description":"Connector configuration property.","required":true,"x-originalParamName":"config"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"description":"Updated"},"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"description":"Created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Upsert connector configuration","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/pause":{"put":{"description":"Pause the connector and its tasks, which stops messages from processing until the connector is resumed. This call is asynchronous and may take some time to process.","operationId":"KafkaConnectService_PauseConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"202":{"content":{"application/json":{"schema":{}}},"description":"Pause request accepted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Pause connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/restart":{"post":{"description":"Triggers a connector restart. You must specify whether or not tasks are also restarted, and whether only failed connectors are restarted.","operationId":"KafkaConnectService_RestartConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Options"}}},"required":true,"x-originalParamName":"options"},"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Restart connector request success"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Restart connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/resume":{"put":{"description":"Resume a paused connector and its tasks, and resumes message processing. This call is asynchronous and may take some time to process. If the connector was not paused, this operation does not do anything.","operationId":"KafkaConnectService_ResumeConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"202":{"content":{"application/json":{"schema":{}}},"description":"Resume request accepted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Resume connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/status":{"get":{"description":"Gets the current status of the connector, including the state for each of its tasks, error information, etc.","operationId":"KafkaConnectService_GetConnectorStatus","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorStatus"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get connector status","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/stop":{"put":{"description":"Stops a connector, but does not delete it. All tasks for the connector are shut down completely. This call is asynchronous and may take some time to process.","operationId":"KafkaConnectService_StopConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"202":{"content":{"application/json":{"schema":{}}},"description":"Request accepted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Stop connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/topics":{"get":{"description":"Returns a list of connector topic names. If the connector is inactive, this call returns an empty list.","operationId":"KafkaConnectService_ListConnectorTopics","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListConnectorTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List connector topics","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/topics/reset":{"put":{"description":"Resets the set of topic names that the connector is using.","operationId":"KafkaConnectService_ResetConnectorTopics","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector using the topics to be reset.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Reset connector topics","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/secrets":{"get":{"description":"List Kafka Connect cluster secrets. Optional: filter based on secret name and labels.","operationId":"SecretService_ListConnectSecrets","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Substring match on secret name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"This is a request variable of the map type. The query format is \"map_name[key]=value\", e.g. If the map name is Age, the key type is string, and the value type is integer, the query parameter is expressed as Age[\"bob\"]=18","in":"query","name":"filter.labels[string][string]","schema":{"type":"string"}},{"description":"Secret scopes to search for","in":"query","name":"filter.scopes","schema":{"items":{"enum":["SCOPE_REDPANDA_CONNECT"],"type":"string"},"type":"array"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListSecretsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Connect Cluster Secrets","tags":["Secrets (v1alpha2)"]},"post":{"description":"Create a Kafka Connect cluster secret.","operationId":"SecretService_CreateConnectSecret","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateConnectSecretBody"}}},"required":true,"x-originalParamName":"body"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"Secret created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create Connect Cluster Secret","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/secrets/{id}":{"delete":{"description":"Delete a Kafka Connect cluster secret.","operationId":"SecretService_DeleteConnectSecret","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"ID of the secret to delete.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Secret deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete Connect Cluster Secret","tags":["Secrets (v1alpha2)"]},"get":{"description":"Get a specific Kafka Connect cluster secret.","operationId":"SecretService_GetConnectSecret","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"The ID of the secret to retrieve.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Connect Cluster Secret","tags":["Secrets (v1alpha2)"]},"put":{"description":"Update a Kafka Connect cluster secret.","operationId":"SecretService_UpdateConnectSecret","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"ID of the secret to update.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateConnectSecretBody"}}},"required":true,"x-originalParamName":"body"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update Connect Cluster Secret","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/redpanda-connect/config-schema":{"get":{"description":"The configuration schema includes available [components and processors](https://docs.redpanda.com/redpanda-cloud/develop/connect/components/about) in this Redpanda Connect instance.","operationId":"PipelineService_GetPipelineServiceConfigSchema","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetPipelineServiceConfigSchemaResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Retrieve the schema for Redpanda Connect pipeline configurations.","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines":{"get":{"description":"List Redpanda Connect pipelines. Optional: filter based on pipeline name.","operationId":"PipelineService_ListPipelines","parameters":[{"description":"Substring match on pipeline name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListPipelinesResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Redpanda Connect pipelines","tags":["Redpanda Connect Pipeline (v1alpha2)"]},"post":{"description":"Create a new Redpanda Connect pipeline.","operationId":"PipelineService_CreatePipeline","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PipelineCreate"}}},"required":true,"x-originalParamName":"pipeline"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines-by-secrets":{"get":{"description":"Get Redpanda Connect pipelines by secrets.","operationId":"PipelineService_GetPipelinesBySecrets","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetPipelinesBySecretsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Redpanda Connect pipelines by secrets","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines-for-secret":{"get":{"description":"Get Redpanda Connect pipelines for a given secret.","operationId":"PipelineService_GetPipelinesForSecret","parameters":[{"description":"Secret ID.","in":"query","name":"secret_id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetPipelinesForSecretResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Redpanda Connect pipelines for secret","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines/{id}":{"delete":{"description":"Delete a Redpanda Connect pipeline.","operationId":"PipelineService_DeletePipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete a Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]},"get":{"description":"Get a specific Redpanda Connect pipeline.","operationId":"PipelineService_GetPipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]},"put":{"description":"Update the [configuration](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/about) of a Redpanda Connect pipeline.","operationId":"PipelineService_UpdatePipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PipelineUpdate"}}},"required":true,"x-originalParamName":"pipeline"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update a Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines/{id}/start":{"put":{"description":"Start a stopped Redpanda Connect pipeline.","operationId":"PipelineService_StartPipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"Started"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Start a Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines/{id}/stop":{"put":{"description":"Stop a running Redpanda Connect pipeline.","operationId":"PipelineService_StopPipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"Stopped"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Stops a Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/secret-scopes":{"get":{"description":"List supported secret scopes.","operationId":"SecretService_ListSecretScopes","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListSecretScopesResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Secret Scopes","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/secrets":{"get":{"description":"List secrets. Optional: filter based on secret name and labels.","operationId":"SecretService_ListSecrets","parameters":[{"description":"Substring match on secret name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"This is a request variable of the map type. The query format is \"map_name[key]=value\", e.g. If the map name is Age, the key type is string, and the value type is integer, the query parameter is expressed as Age[\"bob\"]=18","in":"query","name":"filter.labels[string]","schema":{"type":"string"}},{"description":"Secret scopes to search for","in":"query","name":"filter.scopes","schema":{"items":{"enum":["SCOPE_REDPANDA_CONNECT"],"type":"string"},"type":"array"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListSecretsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Secrets","tags":["Secrets (v1alpha2)"]},"post":{"description":"Create a secret.","operationId":"SecretService_CreateSecret","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSecretRequest"}}},"description":"CreateSecretRequest is the request of CreateSecret.","required":true,"x-originalParamName":"body"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"Secret created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create Secret","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/secrets/{id}":{"delete":{"description":"Delete a secret.","operationId":"SecretService_DeleteSecret","parameters":[{"description":"The id of the secret to delete.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Secret deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete Secret","tags":["Secrets (v1alpha2)"]},"get":{"description":"Get a secret.","operationId":"SecretService_GetSecret","parameters":[{"description":"The id of the secret to retrieve.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Secret","tags":["Secrets (v1alpha2)"]},"put":{"description":"Update a secret.","operationId":"SecretService_UpdateSecret","parameters":[{"description":"Secret identifier.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateSecretBody"}}},"required":true,"x-originalParamName":"body"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update Secret","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/topics":{"get":{"description":"List topics, with partition count and replication factor. Optional: filter based on topic name.","operationId":"TopicService_ListTopics","parameters":[{"description":"Substring match on topic name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}},{"description":"Value of the next_page_token field returned by the previous response. If not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Topics","tags":["Topics (v1alpha2)"]},"post":{"description":"Create a [topic](https://docs.redpanda.com/current/deploy/deployment-option/cloud/create-topic/).","operationId":"TopicService_CreateTopic","parameters":[{"description":"If true, makes this request a dry run; everything is validated but\nno topics are actually created.","in":"query","name":"validate_only","schema":{"type":"boolean"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateTopicRequest.Topic"}}},"description":"The topic to create.","required":true,"x-originalParamName":"topic"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateTopicResponse"}}},"description":"Topic created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create Topic","tags":["Topics (v1alpha2)"]}},"/v1alpha2/topics/{name}":{"delete":{"description":"Delete the Kafka topic with the requested name.","operationId":"TopicService_DeleteTopic","parameters":[{"description":"Topic name.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Topic deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Requested topic does not exist"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete Topic","tags":["Topics (v1alpha2)"]}},"/v1alpha2/topics/{topic_name}/configurations":{"get":{"description":"Get key-value configs for a topic.","operationId":"TopicService_GetTopicConfigurations","parameters":[{"description":"Topic name","in":"path","name":"topic_name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetTopicConfigurationsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Topic Configurations","tags":["Topics (v1alpha2)"]},"patch":{"description":"Update a subset of the topic configurations.","operationId":"TopicService_UpdateTopicConfigurations","parameters":[{"description":"Topic name","in":"path","name":"topic_name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/UpdateConfiguration"},"type":"array"}}},"required":true,"x-originalParamName":"configurations"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateTopicConfigurationsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update Topic Configuration","tags":["Topics (v1alpha2)"]},"put":{"description":"Update the entire set of key-value configurations for a topic. Config entries that are not provided in the request are removed and will fall back to their default values.","operationId":"TopicService_SetTopicConfigurations","parameters":[{"description":"Name of topic.","in":"path","name":"topic_name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/SetConfiguration"},"type":"array"}}},"required":true,"x-originalParamName":"configurations"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetTopicConfigurationsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Set Topic Configurations","tags":["Topics (v1alpha2)"]}},"/v1alpha2/transforms":{"get":{"description":"Retrieve a list of Wasm transforms. Optional: filter based on transform name.","operationId":"TransformService_ListTransforms","parameters":[{"description":"Substring match on transform name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"example":{"next_page_token":"","transforms":[{"environment_variables":[],"input_topic_name":"topic1","name":"transform1","output_topic_names":["output-topic11","output-topic12"],"statuses":[{"broker_id":1,"lag":1,"partition_id":1,"status":"PARTITION_STATUS_RUNNING"}]},{"environment_variables":[],"input_topic_name":"topic2","name":"transform2","output_topic_names":["output-topic21","output-topic22"],"statuses":[{"broker_id":2,"lag":2,"partition_id":2,"status":"PARTITION_STATUS_RUNNING"}]}]},"schema":{"$ref":"#/components/schemas/ListTransformsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Transforms","tags":["WASM Transforms (v1alpha2)"]},"put":{"description":"Initiate deployment of a new Wasm transform. This endpoint uses multipart/form-data encoding. Following deployment, a brief period is required before the Wasm transform becomes operational. Monitor the partition statuses to check whether the transform is active. This usually takes around 3s, but no longer than 10s.","operationId":"TransformService_DeployTransform","requestBody":{"content":{"multipart/form-data":{"schema":{"example":"{\"name\":\"redact-orders\",\"input_topic_name\":\"orders\",\"output_topic_names\":[\"orders-redacted\"],\"environment_variables\":[{\"key\":\"LOGGER_LEVEL\",\"value\":\"DEBUG\"}]}","properties":{"metadata":{"$ref":"#/components/schemas/DeployTransformRequest"},"wasm_binary":{"description":"Binary file containing the compiled WASM transform. The maximum size for this file is 10MiB.","format":"binary","type":"string"}},"type":"object"}}},"description":"Transform metadata as well as the WASM binary","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TransformMetadata"}}},"description":"Created"}},"summary":"Deploy Transform","tags":["WASM Transforms (v1alpha2)"]}},"/v1alpha2/transforms/{name}":{"delete":{"description":"Delete a Wasm transform with the requested name.","operationId":"TransformService_DeleteTransform","parameters":[{"description":"Name of transform.","example":{"name":"transform1"},"in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"example":{},"schema":{}}},"description":"Transform deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete Transform","tags":["WASM Transforms (v1alpha2)"]},"get":{"description":"Get a specific Wasm transform.","operationId":"TransformService_GetTransform","parameters":[{"description":"Name of transform.","example":{"name":"transform1"},"in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"example":{"transform":{"environment_variables":[],"input_topic_name":"topic1","name":"transform1","output_topic_names":["output-topic1","output-topic2"],"statuses":[{"broker_id":1,"lag":1,"partition_id":1,"status":"PARTITION_STATUS_RUNNING"}]}},"schema":{"$ref":"#/components/schemas/GetTransformResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Transform","tags":["WASM Transforms (v1alpha2)"]}},"/v1alpha2/users":{"get":{"description":"List users. Optional: filter based on username.","operationId":"UserService_ListUsers","parameters":[{"description":"Username.","in":"query","name":"filter.name","schema":{"type":"string"}},{"description":"Substring match on username. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"example":{"next_page_token":"","users":[{"name":"payment-service"},{"name":"jane"}]},"schema":{"$ref":"#/components/schemas/ListUsersResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Users","tags":["Redpanda Users (v1alpha2)"]},"post":{"description":"Create a new user.","operationId":"UserService_CreateUser","requestBody":{"content":{"application/json":{"example":{"mechanism":"SASL_MECHANISM_SCRAM_SHA_256","name":"payment-service","password":"secure-password"},"schema":{"$ref":"#/components/schemas/CreateUserRequest.User"}}},"required":true,"x-originalParamName":"user"},"responses":{"201":{"content":{"application/json":{"example":{"user":{"mechanism":"SASL_MECHANISM_SCRAM_SHA_256","name":"payment-service"}},"schema":{"$ref":"#/components/schemas/CreateUserRequest.User"}}},"description":"User created"},"400":{"content":{"application/json":{"example":{"code":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo","domain":"redpanda.com/dataplane","metadata":{},"reason":"REASON_INVALID_INPUT"},{"@type":"type.googleapis.com/google.rpc.BadRequest","field_violations":[{"description":"value length must be at least 3 characters","field":"user.password","localized_message":null,"reason":""},{"description":"value is required","field":"user.mechanism","localized_message":null,"reason":""}]}],"message":"provided parameters are invalid"},"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Bad request. Check API documentation and update request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create User","tags":["Redpanda Users (v1alpha2)"]}},"/v1alpha2/users/{name}":{"delete":{"description":"Delete the specified user","operationId":"UserService_DeleteUser","parameters":[{"description":"Username","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"example":{},"schema":{}}},"description":"User deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"example":{"code":"NOT_FOUND","details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo","domain":"redpanda.com/dataplane","metadata":{},"reason":"REASON_RESOURCE_NOT_FOUND"}],"message":"user not found"},"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete User","tags":["Redpanda Users (v1alpha2)"]}},"/v1alpha2/users/{user.name}":{"put":{"description":"Update a user's credentials.","operationId":"UserService_UpdateUser","parameters":[{"description":"Username.","in":"path","name":"user.name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"example":{"user":{"mechanism":"SASL_MECHANISM_SCRAM_SHA_256","password":"new-password"}},"schema":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"password":{"description":"Password.","type":"string"}},"type":"object"}}},"required":true,"x-originalParamName":"user"},"responses":{"200":{"content":{"application/json":{"example":{"user":{"mechanism":"SASL_MECHANISM_SCRAM_SHA_256","name":"payment-service"}},"schema":{"$ref":"#/components/schemas/UpdateUserResponse.User"}}},"description":"OK"},"400":{"content":{"application/json":{"example":{"code":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo","domain":"redpanda.com/dataplane","metadata":{},"reason":"REASON_INVALID_INPUT"},{"@type":"type.googleapis.com/google.rpc.BadRequest","field_violations":[{"description":"value length must be at least 3 characters","field":"user.password","localized_message":null,"reason":""},{"description":"value is required","field":"user.mechanism","localized_message":null,"reason":""}]}],"message":"provided parameters are invalid"},"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Bad request. Check API documentation and update request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update User","tags":["Redpanda Users (v1alpha2)"]}}},"security":[{"auth0":[]}],"servers":[{"description":"Data Plane API","url":"{dataplane_api_url}","variables":{"dataplane_api_url":{"default":"https://{dataplane_api_url}","description":"Find the Data Plane API base URL of a cluster by calling the Get Cluster endpoint of the Control Plane API. The dataplane_api.url field is returned in the response body.\u003cbr\u003e\u003cbr\u003e\n\t\t\t\t\tExample (Dedicated): \"https://api-a4cb21.ck09mi9c4vs17hng9gig.fmc.prd.cloud.redpanda.com\"\u003cbr\u003e\n\t\t\t\t\tExample (BYOC): \"https://api-a4cb21.ck09mi9c4vs17hng9gig.byoc.prd.cloud.redpanda.com\""}}}],"tags":[{"description":"Manage Redpanda access control lists (ACLs). See [Redpanda Cloud Authorization](https://docs.redpanda.com/redpanda-cloud/security/authorization/cloud-authorization/) for more information.","name":"Redpanda ACLs (v1alpha2)"},{"description":"Manage Redpanda topics stored in object storage. See: [Mountable Topics](https://docs.redpanda.com/redpanda-cloud/manage/mountable-topics/)","name":"Cloud Storage (v1alpha2)"},{"description":"Manage Wasm transforms in Redpanda.","name":"WASM Transforms (v1alpha2)"},{"description":"Manage [connectors](https://docs.redpanda.com/redpanda-cloud/develop/managed-connectors/) and interact with the Kafka Connect API.","name":"Kafka Connect (v1alpha2)"},{"description":"Create and manage [Redpanda Connect](https://docs.redpanda.com/redpanda-cloud/develop/connect/about) pipelines and their configurations.","name":"Redpanda Connect Pipeline (v1alpha2)"},{"description":"Manage [secrets](https://docs.redpanda.com/redpanda-cloud/security/secrets) for Redpanda Cloud.","name":"Secrets (v1alpha2)"},{"description":"Manage Redpanda topics.","name":"Topics (v1alpha2)"},{"description":"Manage Redpanda users. To manage access, see the Data Plane [ACL endpoints](https://docs.redpanda.com/api/cloud-dataplane-api/#get-/v1alpha2/acls).","name":"Redpanda Users (v1alpha2)"}]}
\ No newline at end of file
+{"components":{"schemas":{"ACL.Operation":{"description":"The operation that is allowed or denied (e.g. READ).","enum":["OPERATION_ANY","OPERATION_ALL","OPERATION_READ","OPERATION_WRITE","OPERATION_CREATE","OPERATION_DELETE","OPERATION_ALTER","OPERATION_DESCRIBE","OPERATION_CLUSTER_ACTION","OPERATION_DESCRIBE_CONFIGS","OPERATION_ALTER_CONFIGS","OPERATION_IDEMPOTENT_WRITE","OPERATION_CREATE_TOKENS","OPERATION_DESCRIBE_TOKENS"],"type":"string"},"Action":{"enum":["ACTION_PREPARE","ACTION_EXECUTE","ACTION_FINISH","ACTION_CANCEL"],"type":"string"},"BadRequest":{"description":"Describes violations in a client request. This error type focuses on the\nsyntactic aspects of the request.","properties":{"field_violations":{"description":"Describes all violations in a client request.","items":{"$ref":"#/components/schemas/FieldViolation"},"type":"array"}},"title":"BadRequest","type":"object"},"Config":{"properties":{"name":{"description":"A topic-level config key (e.g. `segment.bytes`).","type":"string"},"value":{"description":"A topic-level config value (e.g. 1073741824).","nullable":true,"type":"string"}},"type":"object"},"ConfigAlterOperation":{"enum":["CONFIG_ALTER_OPERATION_SET","CONFIG_ALTER_OPERATION_DELETE","CONFIG_ALTER_OPERATION_APPEND","CONFIG_ALTER_OPERATION_SUBTRACT"],"type":"string"},"ConfigSource":{"enum":["CONFIG_SOURCE_DYNAMIC_TOPIC_CONFIG","CONFIG_SOURCE_DYNAMIC_BROKER_CONFIG","CONFIG_SOURCE_DYNAMIC_DEFAULT_BROKER_CONFIG","CONFIG_SOURCE_STATIC_BROKER_CONFIG","CONFIG_SOURCE_DEFAULT_CONFIG","CONFIG_SOURCE_DYNAMIC_BROKER_LOGGER_CONFIG"],"type":"string"},"ConfigSynonym":{"properties":{"name":{"type":"string"},"source":{"$ref":"#/components/schemas/ConfigSource"},"value":{"nullable":true,"type":"string"}},"type":"object"},"ConfigType":{"enum":["CONFIG_TYPE_BOOLEAN","CONFIG_TYPE_STRING","CONFIG_TYPE_INT","CONFIG_TYPE_SHORT","CONFIG_TYPE_LONG","CONFIG_TYPE_DOUBLE","CONFIG_TYPE_LIST","CONFIG_TYPE_CLASS","CONFIG_TYPE_PASSWORD"],"type":"string"},"Configuration":{"properties":{"config_synonyms":{"description":"If no config value is set at the topic level, it will inherit the value\nset at the broker or cluster level. `name` is the corresponding config\nkey whose value is inherited. `source` indicates whether the inherited\nconfig is default, broker, etc.","items":{"$ref":"#/components/schemas/ConfigSynonym"},"type":"array"},"documentation":{"description":"Config documentation.","nullable":true,"type":"string"},"name":{"description":"A topic-level config key (e.g. `segment.bytes`).","type":"string"},"read_only":{"description":"Whether the config is read-only, or is dynamic and can be altered.","type":"boolean"},"sensitive":{"description":"Whether this is a sensitive config key and value.","type":"boolean"},"source":{"$ref":"#/components/schemas/ConfigSource"},"type":{"$ref":"#/components/schemas/ConfigType"},"value":{"description":"A topic-level config value (e.g. 1073741824).","nullable":true,"type":"string"}},"type":"object"},"ConnectCluster":{"properties":{"address":{"description":"The host address of the Kafka Connect cluster.","type":"string"},"info":{"$ref":"#/components/schemas/ConnectCluster.Info"},"name":{"description":"Unique name of connect cluster. For Redpanda Cloud, the value is `redpanda`.","type":"string"},"plugins":{"items":{"$ref":"#/components/schemas/ConnectorPlugin"},"type":"array"}},"type":"object"},"ConnectCluster.Info":{"properties":{"commit":{"description":"The git commit ID of the connect worker source code.","type":"string"},"kafka_cluster_id":{"description":"Cluster ID.","type":"string"},"version":{"description":"Connect worker version.","type":"string"}},"type":"object"},"Connector":{"properties":{"state":{"description":"State of the connector instance.","type":"string"},"trace":{"description":"String value of stack trace.","type":"string"},"worker_id":{"description":"ID of worker that the connector is assigned to.","type":"string"}},"type":"object"},"ConnectorError":{"properties":{"content":{"description":"Detailed description of the error.","type":"string"},"title":{"description":"Short description of the error.","type":"string"},"type":{"$ref":"#/components/schemas/ConnectorError.Type"}},"title":"ConnectorError is the error of a connector, this is holistic error\nabstraction, made parsing the error trace of connector or Task","type":"object"},"ConnectorError.Type":{"description":"Error level.","enum":["TYPE_ERROR","TYPE_WARNING"],"type":"string"},"ConnectorHolisticState":{"description":"State of a connector or one of its tasks, as described in the [Kafka Connect documentation](https://kafka.apache.org/documentation.html#connect_administration). Takes into account not just the state of the connector instance itself, but also the tasks within the connector.\n\n - CONNECTOR_HOLISTIC_STATE_PAUSED: The connector or task has been administratively paused.\n - CONNECTOR_HOLISTIC_STATE_RESTARTING: The connector or task is restarting.\n - CONNECTOR_HOLISTIC_STATE_DESTROYED: The connector is destroyed, regardless of any tasks.\n - CONNECTOR_HOLISTIC_STATE_STOPPED: The connector or task has been stopped.\n - CONNECTOR_HOLISTIC_STATE_UNASSIGNED: - The connector or task has not yet been assigned to a worker,\n- THe connector is running, but there are unassigned tasks.\n - CONNECTOR_HOLISTIC_STATE_HEALTHY: The connector is running, \u003e 0 tasks, all of them in running state.\n - CONNECTOR_HOLISTIC_STATE_UNHEALTHY: - The connector has failed,\n- The connector is running, but has no tasks,\n- Connector is running and has tasks, but all tasks have failed.\n - CONNECTOR_HOLISTIC_STATE_DEGRADED: The connector is running and has tasks, and at least one task, but not all, have failed.\n - CONNECTOR_HOLISTIC_STATE_UNKNOWN: The connector or task state could not be determined.","enum":["CONNECTOR_HOLISTIC_STATE_PAUSED","CONNECTOR_HOLISTIC_STATE_RESTARTING","CONNECTOR_HOLISTIC_STATE_DESTROYED","CONNECTOR_HOLISTIC_STATE_STOPPED","CONNECTOR_HOLISTIC_STATE_UNASSIGNED","CONNECTOR_HOLISTIC_STATE_HEALTHY","CONNECTOR_HOLISTIC_STATE_UNHEALTHY","CONNECTOR_HOLISTIC_STATE_DEGRADED","CONNECTOR_HOLISTIC_STATE_UNKNOWN"],"type":"string"},"ConnectorInfoStatus":{"properties":{"info":{"$ref":"#/components/schemas/ConnectorSpec"},"name":{"description":"Name of connector.","type":"string"},"status":{"$ref":"#/components/schemas/ConnectorStatus"}},"type":"object"},"ConnectorPlugin":{"properties":{"class":{"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"type":"object"},"ConnectorSpec":{"description":"Connector specifications as defined in the Kafka Connect\nAPI. You may include this in the request body when creating a new connector.","properties":{"config":{"additionalProperties":{"type":"string"},"description":"Connector configuration properties.","type":"object"},"name":{"description":"Name of connector.","type":"string"},"tasks":{"items":{"$ref":"#/components/schemas/TaskInfo"},"readOnly":true,"type":"array"},"type":{"readOnly":true,"type":"string"}},"required":["name","config"],"type":"object"},"ConnectorStatus":{"properties":{"connector":{"$ref":"#/components/schemas/Connector"},"errors":{"description":"List of parsed connectors' and tasks' errors.","items":{"$ref":"#/components/schemas/ConnectorError"},"type":"array"},"holistic_state":{"$ref":"#/components/schemas/ConnectorHolisticState"},"name":{"description":"Name of connector.","type":"string"},"tasks":{"description":"Status of connector tasks. For more information, see the [https://docs.redpanda.com/current/deploy/deployment-option/cloud/managed-connectors/monitor-connectors/#connector-tasks](Monitor Connectors) documentation.","items":{"$ref":"#/components/schemas/TaskStatus"},"type":"array"},"type":{"description":"Type of connector (sink or source).","type":"string"}},"type":"object"},"CreateACLRequest":{"properties":{"host":{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","type":"string"},"resource_name":{"description":"The name of the resource this ACL targets.\nFor requests with resource_type CLUSTER, this will default to \"kafka-cluster\".","type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"required":["resource_type","resource_pattern_type","principal","host","operation","permission_type"],"type":"object"},"CreateACLResponse":{"type":"object"},"CreateConnectSecretBody":{"description":"CreateConnectSecretRequest is the request of CreateConnectSecret.","properties":{"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"name":{"description":"Name of connector.","type":"string"},"secret_data":{"description":"The secret data. Must be Base64-encoded.","format":"byte","type":"string"}},"required":["name","secret_data"],"type":"object"},"CreateConnectSecretResponse":{"description":"CreateConnectSecretResponse is the response of CreateConnectSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"CreateConnectorResponse":{"properties":{"connector":{"$ref":"#/components/schemas/ConnectorSpec"}},"type":"object"},"CreatePipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"CreateSecretRequest":{"description":"CreateSecretRequest is the request of CreateSecret.","properties":{"id":{"description":"Secret identifier.","type":"string"},"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"title":"Secret scopes","type":"array"},"secret_data":{"description":"The secret data. Must be Base64-encoded.","format":"byte","type":"string"}},"required":["secret_data"],"type":"object"},"CreateSecretResponse":{"description":"CreateSecretResponse is the response of CreateSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"CreateTopicRequest.Topic":{"properties":{"configs":{"description":"An array of key-value config pairs for a topic.\nThese correspond to Kafka topic-level configs.","items":{"$ref":"#/components/schemas/Config"},"type":"array"},"name":{"description":"Name of topic.","type":"string"},"partition_count":{"description":"The number of partitions to give the topic. If specifying\npartitions manually (see `replica_assignments`), set to -1.\nOr, to use the cluster default partition count, set to null.","format":"int32","nullable":true,"type":"integer"},"replica_assignments":{"description":"Manually specify broker ID assignments for partition replicas. If manually assigning replicas, both `replication_factor` and\n`partition_count` must be -1.","items":{"$ref":"#/components/schemas/ReplicaAssignment"},"type":"array"},"replication_factor":{"description":"The number of replicas every partition must have.\nIf specifying partitions manually (see `replica_assignments`), set to -1.\nOr, to use the cluster default replication factor, set to null.","format":"int32","nullable":true,"type":"integer"}},"type":"object"},"CreateTopicResponse":{"properties":{"name":{"description":"Name of topic.","type":"string"},"partition_count":{"description":"The number of partitions created for the topic.\nThis field has a default value of -1, which may be returned if the broker\ndoes not support v5+ of this request which added support for returning\nthis information.","format":"int32","type":"integer"},"replication_factor":{"description":"The number of replicas per topic partition.\nThis field has a default of -1, which may be returned if the broker\ndoes not support v5+ of this request which added support for returning\nthis information.","format":"int32","type":"integer"}},"type":"object"},"CreateUserRequest.User":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"description":"Username.","type":"string"},"password":{"description":"Password.","type":"string"}},"type":"object"},"CreateUserResponse":{"properties":{"user":{"$ref":"#/components/schemas/CreateUserResponse.User"}},"type":"object"},"CreateUserResponse.User":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"title":"Name of newly-created user","type":"string"}},"type":"object"},"DeleteACLsRequest.Filter":{"properties":{"host":{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","nullable":true,"type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","nullable":true,"type":"string"},"resource_name":{"description":"The name of the resource this ACL targets.","nullable":true,"type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"required":["resource_type","resource_pattern_type","operation","permission_type"],"type":"object"},"DeleteACLsResponse":{"properties":{"matching_acls":{"items":{"$ref":"#/components/schemas/MatchingACL"},"type":"array"}},"type":"object"},"DeleteConnectSecretResponse":{"description":"DeleteConnectSecretResponse is the response of DeleteConnectSecret.","type":"object"},"DeleteMountTaskResponse":{"type":"object"},"DeletePipelineResponse":{"type":"object"},"DeleteSecretResponse":{"description":"DeleteSecretResponse is the response of DeleteSecret.","type":"object"},"DeleteTopicResponse":{"type":"object"},"DeleteTransformResponse":{"type":"object"},"DeleteUserResponse":{"type":"object"},"DeployTransformRequest":{"description":"Metadata required to deploy a new Wasm\ntransform in a Redpanda cluster.","properties":{"environment_variables":{"description":"The environment variables you want to apply to your transform's environment","items":{"$ref":"#/components/schemas/EnvironmentVariable"},"type":"array"},"input_topic_name":{"description":"The input topic to apply the transform to.","example":"orders","type":"string"},"name":{"description":"Name of the transform.","example":"redact-payment-details-in-orders","type":"string"},"output_topic_names":{"description":"Output topic to write the transform results to.","example":"orders-redacted","items":{"type":"string"},"type":"array"}},"required":["name","input_topic_name","output_topic_names"],"type":"object"},"EnvironmentVariable":{"properties":{"key":{"description":"The key of your environment variable.","example":"LOG_LEVEL","type":"string"},"value":{"description":"The value of your environment variable.","example":"DEBUG","type":"string"}},"required":["key","value"],"type":"object"},"ErrorInfo":{"description":"Describes the cause of the error with structured details.\n\nExample of an error when contacting the \"pubsub.googleapis.com\" API when it\nis not enabled:\n\n    { \"reason\": \"API_DISABLED\"\n      \"domain\": \"googleapis.com\"\n      \"metadata\": {\n        \"resource\": \"projects/123\",\n        \"service\": \"pubsub.googleapis.com\"\n      }\n    }\n\nThis response indicates that the pubsub.googleapis.com API is not enabled.\n\nExample of an error that is returned when attempting to create a Spanner\ninstance in a region that is out of stock:\n\n    { \"reason\": \"STOCKOUT\"\n      \"domain\": \"spanner.googleapis.com\",\n      \"metadata\": {\n        \"availableRegions\": \"us-central1,us-east2\"\n      }\n    }","properties":{"domain":{"description":"The logical grouping to which the \"reason\" belongs. The error domain\nis typically the registered service name of the tool or product that\ngenerates the error. Example: \"pubsub.googleapis.com\". If the error is\ngenerated by some common infrastructure, the error domain must be a\nglobally unique value that identifies the infrastructure. For Google API\ninfrastructure, the error domain is \"googleapis.com\".","type":"string"},"metadata":{"additionalProperties":{"type":"string"},"description":"Additional structured details about this error.\n\nKeys must match a regular expression of `[a-z][a-zA-Z0-9-_]+` but should\nideally be lowerCamelCase. Also, they must be limited to 64 characters in\nlength. When identifying the current value of an exceeded limit, the units\nshould be contained in the key, not the value.  For example, rather than\n`{\"instanceLimit\": \"100/request\"}`, should be returned as,\n`{\"instanceLimitPerRequest\": \"100\"}`, if the client exceeds the number of\ninstances that can be created in a single (batch) request.","type":"object"},"reason":{"description":"The reason of the error. This is a constant value that identifies the\nproximate cause of the error. Error reasons are unique within a particular\ndomain of errors. This should be at most 63 characters and match a\nregular expression of `[A-Z][A-Z0-9_]+[A-Z0-9]`, which represents\nUPPER_SNAKE_CASE.","type":"string"}},"title":"ErrorInfo","type":"object"},"FieldViolation":{"description":"A message type used to describe a single bad request field.","properties":{"description":{"description":"A description of why the request element is bad.","type":"string"},"field":{"description":"A path that leads to a field in the request body. The value will be a\nsequence of dot-separated identifiers that identify a protocol buffer\nfield.\n\nConsider the following:\n\n    message CreateContactRequest {\n      message EmailAddress {\n        enum Type {\n          TYPE_UNSPECIFIED = 0;\n          HOME = 1;\n          WORK = 2;\n        }\n\n        optional string email = 1;\n        repeated EmailType type = 2;\n      }\n\n      string full_name = 1;\n      repeated EmailAddress email_addresses = 2;\n    }\n\nIn this example, in proto `field` could take one of the following values:\n\n* `full_name` for a violation in the `full_name` value\n* `email_addresses[1].email` for a violation in the `email` field of the\n  first `email_addresses` message\n* `email_addresses[3].type[2]` for a violation in the second `type`\n  value in the third `email_addresses` message.\n\nIn JSON, the same values are represented as:\n\n* `fullName` for a violation in the `fullName` value\n* `emailAddresses[1].email` for a violation in the `email` field of the\n  first `emailAddresses` message\n* `emailAddresses[3].type[2]` for a violation in the second `type`\n  value in the third `emailAddresses` message.","type":"string"},"localized_message":{"$ref":"#/components/schemas/LocalizedMessage"},"reason":{"description":"The reason of the field-level error. This is a constant value that\nidentifies the proximate cause of the field-level error. It should\nuniquely identify the type of the FieldViolation within the scope of the\ngoogle.rpc.ErrorInfo.domain. This should be at most 63\ncharacters and match a regular expression of `[A-Z][A-Z0-9_]+[A-Z0-9]`,\nwhich represents UPPER_SNAKE_CASE.","type":"string"}},"type":"object"},"GetConnectClusterResponse":{"properties":{"cluster":{"$ref":"#/components/schemas/ConnectCluster"}},"type":"object"},"GetConnectSecretResponse":{"description":"GetConnectSecretResponse is the response of GetConnectSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"GetConnectorConfigResponse":{"properties":{"config":{"additionalProperties":{"type":"string"},"type":"object"}},"type":"object"},"GetConnectorResponse":{"properties":{"connector":{"$ref":"#/components/schemas/ConnectorSpec"}},"type":"object"},"GetConnectorStatusResponse":{"properties":{"status":{"$ref":"#/components/schemas/ConnectorStatus"}},"type":"object"},"GetMountTaskResponse":{"properties":{"task":{"$ref":"#/components/schemas/MountTask"}},"type":"object"},"GetPipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"GetPipelineServiceConfigSchemaResponse":{"properties":{"config_schema":{"description":"JSON schema of the configuration components that are allowed for Connect pipelines.","type":"string"}},"type":"object"},"GetPipelinesBySecretsResponse":{"properties":{"pipelines_for_secret":{"items":{"$ref":"#/components/schemas/PipelinesForSecret"},"type":"array"}},"type":"object"},"GetPipelinesForSecretResponse":{"properties":{"pipelines_for_secret":{"$ref":"#/components/schemas/PipelinesForSecret"}},"type":"object"},"GetSecretResponse":{"description":"GetSecretResponse is the response of GetSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"GetTopicConfigurationsResponse":{"properties":{"configurations":{"items":{"$ref":"#/components/schemas/Configuration"},"type":"array"}},"type":"object"},"GetTransformResponse":{"properties":{"transform":{"$ref":"#/components/schemas/TransformMetadata"}},"type":"object"},"Help":{"description":"Provides links to documentation or for performing an out of band action.\n\nFor example, if a quota check failed with an error indicating the calling\nproject hasn't enabled the accessed service, this can contain a URL pointing\ndirectly to the right place in the developer console to flip the bit.","properties":{"links":{"description":"URL(s) pointing to additional information on handling the current error.","items":{"$ref":"#/components/schemas/Link"},"type":"array"}},"title":"Help","type":"object"},"Link":{"description":"Describes a URL link.","properties":{"description":{"description":"Describes what the link offers.","type":"string"},"url":{"description":"The URL of the link.","type":"string"}},"type":"object"},"ListACLsRequest.Filter":{"properties":{"host":{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","nullable":true,"type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","nullable":true,"type":"string"},"resource_name":{"description":"The name of the resource this ACL targets.","nullable":true,"type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"type":"object"},"ListACLsResponse":{"properties":{"resources":{"items":{"$ref":"#/components/schemas/Resource"},"type":"array"}},"type":"object"},"ListConnectClustersResponse":{"properties":{"clusters":{"items":{"$ref":"#/components/schemas/ConnectCluster"},"type":"array"}},"type":"object"},"ListConnectSecretsResponse":{"description":"ListConnectSecretsResponse is the response of ListConnectSecrets.","properties":{"next_page_token":{"description":"Token to retrieve the next page.","type":"string"},"secrets":{"description":"Secrets retrieved.","items":{"$ref":"#/components/schemas/Secret"},"type":"array"}},"type":"object"},"ListConnectorTopicsResponse":{"properties":{"topics":{"description":"Topic names.","items":{"type":"string"},"type":"array"}},"type":"object"},"ListConnectorsResponse":{"properties":{"connectors":{"description":"List of connectors, where the parent key is the connector name.","items":{"$ref":"#/components/schemas/ConnectorInfoStatus"},"type":"array"},"next_page_token":{"description":"Page Token to fetch the next page. The value can be used as page_token in the next call to this endpoint.","type":"string"}},"type":"object"},"ListMountTasksResponse":{"properties":{"tasks":{"items":{"$ref":"#/components/schemas/MountTask"},"type":"array"}},"type":"object"},"ListMountableTopicsResponse":{"properties":{"topics":{"items":{"$ref":"#/components/schemas/TopicLocation"},"type":"array"}},"type":"object"},"ListPipelinesRequest.Filter":{"properties":{"name_contains":{"description":"Substring match on pipeline name. Case-sensitive.","type":"string"}},"type":"object"},"ListPipelinesResponse":{"properties":{"next_page_token":{"type":"string"},"pipelines":{"items":{"$ref":"#/components/schemas/Pipeline"},"type":"array"}},"type":"object"},"ListSecretScopesResponse":{"description":"ListSecretScopesResponse is the response of ListSecretScopes.","properties":{"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"type":"array"}},"type":"object"},"ListSecretsFilter":{"description":"ListSecretsFilter are the filter options for listing secrets.","properties":{"labels[string][string]":{"additionalProperties":{"type":"string"},"description":"The secret labels to search for.","type":"object"},"name_contains":{"description":"Substring match on secret name. Case-sensitive.","type":"string"},"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"title":"Secret scopes to search for","type":"array"}},"type":"object"},"ListSecretsResponse":{"description":"ListSecretsResponse is the response of ListSecrets.","properties":{"next_page_token":{"description":"Token to retrieve the next page.","type":"string"},"secrets":{"description":"Secrets retrieved.","items":{"$ref":"#/components/schemas/Secret"},"type":"array"}},"type":"object"},"ListTopicsRequest.Filter":{"properties":{"name_contains":{"description":"Substring match on topic name. Case-sensitive.","type":"string"}},"type":"object"},"ListTopicsResponse":{"properties":{"next_page_token":{"type":"string"},"topics":{"items":{"$ref":"#/components/schemas/ListTopicsResponse.Topic"},"type":"array"}},"type":"object"},"ListTopicsResponse.Topic":{"properties":{"internal":{"description":"Whether topic is internal only.","type":"boolean"},"name":{"description":"Topic name.","type":"string"},"partition_count":{"description":"Topic partition count.","format":"int32","type":"integer"},"replication_factor":{"description":"Topic replication factor.","format":"int32","type":"integer"}},"type":"object"},"ListTransformsRequest.Filter":{"properties":{"name_contains":{"description":"Substring match on transform name. Case-sensitive.","type":"string"}},"type":"object"},"ListTransformsResponse":{"properties":{"next_page_token":{"description":"Token to retrieve the next page.","type":"string"},"transforms":{"items":{"$ref":"#/components/schemas/TransformMetadata"},"type":"array"}},"type":"object"},"ListUsersRequest.Filter":{"properties":{"name":{"description":"Username.","type":"string"},"name_contains":{"description":"Substring match on username. Case-sensitive.","type":"string"}},"type":"object"},"ListUsersResponse":{"properties":{"next_page_token":{"description":"Token to retrieve the next page.","type":"string"},"users":{"items":{"$ref":"#/components/schemas/ListUsersResponse.User"},"type":"array"}},"type":"object"},"ListUsersResponse.User":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"description":"Username.","type":"string"}},"type":"object"},"LocalizedMessage":{"description":"Provides a localized error message that is safe to return to the user\nwhich can be attached to an RPC error.","properties":{"locale":{"title":"The locale used following the specification defined at\nhttps://www.rfc-editor.org/rfc/bcp/bcp47.txt.\nExamples are: \"en-US\", \"fr-CH\", \"es-MX\"","type":"string"},"message":{"description":"The localized error message in the above locale.","type":"string"}},"type":"object"},"MatchingACL":{"properties":{"error":{"$ref":"#/components/schemas/rpc.Status"},"host":{"description":"The host address to use for this ACL.","type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies.","type":"string"},"resource_name":{"description":"The name of the resource this ACL targets.","type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"type":"object"},"MountTask":{"properties":{"id":{"description":"Unique identifier for this mount task.","format":"int32","type":"integer"},"state":{"$ref":"#/components/schemas/MountTask.State"},"topics":{"description":"List of topics that are being mounted or unmounted.","items":{"$ref":"#/components/schemas/MountTask.Topic"},"type":"array"},"type":{"$ref":"#/components/schemas/MountTask.Type"}},"type":"object"},"MountTask.State":{"description":" - STATE_PLANNED: Planned: The mount task has been created and is awaiting further actions.\n - STATE_PREPARING: Preparing: The mount task is gathering resources and preparing for execution.\n - STATE_PREPARED: Prepared: All preparations are complete, and the mount task is ready to be executed.\n - STATE_EXECUTING: Executing: The mount task is actively transferring or transforming data.\n - STATE_EXECUTED: Executed: The core mount task actions are complete, but the mount task has not yet cut over or finalized.\n - STATE_CUT_OVER: Cut Over: The mount task has reached a critical point where ownership is transferred or final adjustments are made.\n - STATE_FINISHED: Finished: The mount task has been successfully completed, and no further actions are required.\n - STATE_CANCELING: Canceling: The mount task is in the process of being canceled, and rollback or cleanup actions may be in progress.\n - STATE_CANCELLED: Cancelled: The mount task has been fully canceled, and no further actions will be taken.","enum":["STATE_PLANNED","STATE_PREPARING","STATE_PREPARED","STATE_EXECUTING","STATE_EXECUTED","STATE_CUT_OVER","STATE_FINISHED","STATE_CANCELING","STATE_CANCELLED"],"type":"string"},"MountTask.Topic":{"properties":{"source_topic_reference":{"description":"The topic reference in the object storage bucket.\nThis field is only set for tasks of type MOUNT.","type":"string"},"topic_reference":{"description":"The topic reference within the current cluster, which may be either a simple topic name or a full reference\nin the form: cluster-uuid/topic-name/revision.","type":"string"}},"type":"object"},"MountTask.Type":{"description":" - TYPE_MOUNT: Mount represents the process of making topics available in a cluster by loading them from object storage.\n - TYPE_UNMOUNT: Unmount represents the process of offloading topics back to object storage.","enum":["TYPE_MOUNT","TYPE_UNMOUNT"],"type":"string"},"MountTopicsResponse":{"properties":{"mount_task_id":{"format":"int32","title":"ID of mount","type":"integer"}},"type":"object"},"Options":{"properties":{"include_tasks":{"description":"Restart connector's tasks.","type":"boolean"},"only_failed":{"description":"Restart only connectors that have failed.","type":"boolean"}},"type":"object"},"PartitionStatus":{"enum":["PARTITION_STATUS_RUNNING","PARTITION_STATUS_INACTIVE","PARTITION_STATUS_ERRORED","PARTITION_STATUS_UNKNOWN"],"type":"string"},"PartitionTransformStatus":{"properties":{"broker_id":{"format":"int32","type":"integer"},"lag":{"format":"int32","type":"integer"},"partition_id":{"format":"int32","type":"integer"},"status":{"$ref":"#/components/schemas/PartitionStatus"}},"type":"object"},"PermissionType":{"description":"Whether the operation should be allowed or denied.","enum":["PERMISSION_TYPE_ANY","PERMISSION_TYPE_DENY","PERMISSION_TYPE_ALLOW"],"type":"string"},"Pipeline":{"description":"Defines the pipeline resource.","properties":{"config_yaml":{"description":"The Redpanda Connect pipeline configuration in YAML format. See the [Redpanda Connect Configuration](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/about) documentation for more details.","title":"The pipeline configuration in YAML.\nSee https://docs.redpanda.com/redpanda-connect/configuration/about/","type":"string"},"description":{"description":"Optional pipeline description.","type":"string"},"display_name":{"description":"User-friendly pipeline name.","type":"string"},"id":{"description":"Pipeline ID.","type":"string"},"resources":{"$ref":"#/components/schemas/Resources"},"service_account":{"$ref":"#/components/schemas/ServiceAccount"},"state":{"$ref":"#/components/schemas/Pipeline.State"},"status":{"$ref":"#/components/schemas/Pipeline.Status"}},"required":["id","display_name","config_yaml"],"type":"object"},"Pipeline.State":{"description":"State of the pipeline.\n\n - STATE_STARTING: The pipeline is starting.\n - STATE_RUNNING: The pipeline is running.\n - STATE_STOPPING: The pipeline is in the process of stopping.\n - STATE_STOPPED: The pipeline is stopped and in paused state.\n - STATE_ERROR: The pipeline encountered an error. See [Error Handling](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/error_handling/) for further guidance.\n - STATE_COMPLETED: The pipeline has completed the job successfully.","enum":["STATE_STARTING","STATE_RUNNING","STATE_STOPPING","STATE_STOPPED","STATE_ERROR","STATE_COMPLETED"],"type":"string"},"Pipeline.Status":{"description":"Pipeline status may contain an error message.","properties":{"error":{"type":"string"}},"type":"object"},"PipelineCreate":{"description":"PipelineCreate contains the details for the pipeline creation request.","properties":{"config_yaml":{"description":"The Redpanda Connect pipeline configuration in YAML format. See the [Redpanda Connect Configuration](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/about) documentation for more details.","type":"string"},"description":{"description":"Pipeline description.","type":"string"},"display_name":{"description":"User-friendly pipeline name.","type":"string"},"resources":{"$ref":"#/components/schemas/Resources"},"service_account":{"$ref":"#/components/schemas/ServiceAccount"}},"required":["display_name","config_yaml"],"type":"object"},"PipelineUpdate":{"properties":{"config_yaml":{"description":"The Redpanda Connect pipeline configuration in YAML format. See the [Redpanda Connect Configuration](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/about) documentation for more details.","type":"string"},"description":{"description":"Pipeline description.","type":"string"},"display_name":{"description":"User-friendly pipeline name.","type":"string"},"resources":{"$ref":"#/components/schemas/Resources"},"service_account":{"$ref":"#/components/schemas/ServiceAccount"}},"required":["display_name","config_yaml"],"type":"object"},"PipelinesForSecret":{"properties":{"pipelines":{"items":{"$ref":"#/components/schemas/Pipeline"},"type":"array"},"secret_id":{"type":"string"}},"type":"object"},"Policy":{"properties":{"host":{"description":"The host address for this ACL.","type":"string"},"operation":{"$ref":"#/components/schemas/ACL.Operation"},"permission_type":{"$ref":"#/components/schemas/PermissionType"},"principal":{"description":"The user for whom this ACL applies.","type":"string"}},"type":"object"},"QuotaFailure":{"description":"Describes how a quota check failed.\n\nFor example if a daily limit was exceeded for the calling project,\na service could respond with a QuotaFailure detail containing the project\nid and the description of the quota limit that was exceeded.  If the\ncalling project hasn't enabled the service in the developer console, then\na service could respond with the project id and set `service_disabled`\nto true.\n\nAlso see RetryInfo and Help types for other details about handling a\nquota failure.","properties":{"violations":{"description":"Describes all quota violations.","items":{"$ref":"#/components/schemas/QuotaFailure.Violation"},"type":"array"}},"title":"QuotaFailure","type":"object"},"QuotaFailure.Violation":{"description":"A message type used to describe a single quota violation.  For example, a\ndaily quota or a custom quota that was exceeded.","properties":{"api_service":{"description":"The API Service from which the `QuotaFailure.Violation` orginates. In\nsome cases, Quota issues originate from an API Service other than the one\nthat was called. In other words, a dependency of the called API Service\ncould be the cause of the `QuotaFailure`, and this field would have the\ndependency API service name.\n\nFor example, if the called API is Kubernetes Engine API\n(container.googleapis.com), and a quota violation occurs in the\nKubernetes Engine API itself, this field would be\n\"container.googleapis.com\". On the other hand, if the quota violation\noccurs when the Kubernetes Engine API creates VMs in the Compute Engine\nAPI (compute.googleapis.com), this field would be\n\"compute.googleapis.com\".","type":"string"},"description":{"description":"A description of how the quota check failed. Clients can use this\ndescription to find more about the quota configuration in the service's\npublic documentation, or find the relevant quota limit to adjust through\ndeveloper console.\n\nFor example: \"Service disabled\" or \"Daily Limit for read operations\nexceeded\".","type":"string"},"future_quota_value":{"description":"The new quota value being rolled out at the time of the violation. At the\ncompletion of the rollout, this value will be enforced in place of\nquota_value. If no rollout is in progress at the time of the violation,\nthis field is not set.\n\nFor example, if at the time of the violation a rollout is in progress\nchanging the number of CPUs quota from 10 to 20, 20 would be the value of\nthis field.","format":"int64","nullable":true,"type":"string"},"quota_dimensions":{"additionalProperties":{"type":"string"},"description":"The dimensions of the violated quota. Every non-global quota is enforced\non a set of dimensions. While quota metric defines what to count, the\ndimensions specify for what aspects the counter should be increased.\n\nFor example, the quota \"CPUs per region per VM family\" enforces a limit\non the metric \"compute.googleapis.com/cpus_per_vm_family\" on dimensions\n\"region\" and \"vm_family\". And if the violation occurred in region\n\"us-central1\" and for VM family \"n1\", the quota_dimensions would be,\n\n{\n  \"region\": \"us-central1\",\n  \"vm_family\": \"n1\",\n}\n\nWhen a quota is enforced globally, the quota_dimensions would always be\nempty.","type":"object"},"quota_id":{"description":"The id of the violated quota. Also know as \"limit name\", this is the\nunique identifier of a quota in the context of an API service.\n\nFor example, \"CPUS-PER-VM-FAMILY-per-project-region\".","type":"string"},"quota_metric":{"description":"The metric of the violated quota. A quota metric is a named counter to\nmeasure usage, such as API requests or CPUs. When an activity occurs in a\nservice, such as Virtual Machine allocation, one or more quota metrics\nmay be affected.\n\nFor example, \"compute.googleapis.com/cpus_per_vm_family\",\n\"storage.googleapis.com/internet_egress_bandwidth\".","type":"string"},"quota_value":{"description":"The enforced quota value at the time of the `QuotaFailure`.\n\nFor example, if the enforced quota value at the time of the\n`QuotaFailure` on the number of CPUs is \"10\", then the value of this\nfield would reflect this quantity.","format":"int64","type":"string"},"subject":{"description":"The subject on which the quota check failed.\nFor example, \"clientip:\u003cip address of client\u003e\" or \"project:\u003cGoogle\ndeveloper project id\u003e\".","type":"string"}},"type":"object"},"ReplicaAssignment":{"properties":{"partition_id":{"description":"A partition to create.","format":"int32","type":"integer"},"replica_ids":{"description":"The broker IDs the partition replicas are assigned to.","items":{"format":"int32","type":"integer"},"type":"array"}},"type":"object"},"Resource":{"properties":{"acls":{"items":{"$ref":"#/components/schemas/Policy"},"type":"array"},"resource_name":{"description":"The name of the resource this ACL targets.","type":"string"},"resource_pattern_type":{"$ref":"#/components/schemas/ResourcePatternType"},"resource_type":{"$ref":"#/components/schemas/ResourceType"}},"type":"object"},"ResourcePatternType":{"description":"The pattern to use for matching the specified resource_name\n(any, exact match, literal, or prefixed).","enum":["RESOURCE_PATTERN_TYPE_ANY","RESOURCE_PATTERN_TYPE_MATCH","RESOURCE_PATTERN_TYPE_LITERAL","RESOURCE_PATTERN_TYPE_PREFIXED"],"type":"string"},"ResourceType":{"description":"The type of resource (topic, consumer group, etc.) this\nACL targets.","enum":["RESOURCE_TYPE_ANY","RESOURCE_TYPE_TOPIC","RESOURCE_TYPE_GROUP","RESOURCE_TYPE_CLUSTER","RESOURCE_TYPE_TRANSACTIONAL_ID","RESOURCE_TYPE_DELEGATION_TOKEN","RESOURCE_TYPE_USER"],"type":"string"},"Resources":{"properties":{"cpu_shares":{"description":"`cpu_shares` is a string specifying the amount of CPU to allocate for the\npipeline.\n\nThis follows the [Kubernetes quantity](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/) format. Acceptable\nunits include:\n- Decimal SI units: \"m\" (e.g., \"500m\" for 500 millicores, \"2\" for 2 cores)\nCPU shares can be specified in millicores (1 core = 1000 millicores).\nIf you don't specify a unit, the value is interpreted as the number of cores.","type":"string"},"memory_shares":{"description":"`memory_shares` is a string specifying the amount of memory to allocate for\nthe pipeline.\n\nThis follows the [Kubernetes quantity](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/) format. Acceptable units\ninclude:\n- Decimal SI units: \"K\", \"M\", \"G\", \"T\", \"P\", \"E\" (e.g., \"128M\" for 128\n  megabytes)\n- Binary SI units: \"Ki\", \"Mi\", \"Gi\", \"Ti\", \"Pi\", \"Ei\" (e.g., \"512Mi\" for\n512 mebibytes) If you don't specify a unit, the value is interpreted as\nbytes.","type":"string"}},"required":["memory_shares","cpu_shares"],"type":"object"},"SASLMechanism":{"description":"SASL mechanism to use for authentication.","enum":["SASL_MECHANISM_SCRAM_SHA_256","SASL_MECHANISM_SCRAM_SHA_512"],"type":"string"},"Scope":{"description":"Defines the scope of a secret.","enum":["SCOPE_REDPANDA_CONNECT"],"type":"string"},"Secret":{"description":"Defines the secret resource.","properties":{"id":{"description":"Secret identifier.","readOnly":true,"type":"string"},"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"title":"Secret scopes","type":"array"}},"type":"object"},"ServiceAccount":{"properties":{"client_id":{"type":"string"},"client_secret":{"type":"string"}},"type":"object"},"SetConfiguration":{"properties":{"name":{"description":"A topic-level config key (e.g. `segment.bytes`).","type":"string"},"value":{"description":"A topic-level config value (e.g. 1073741824).","nullable":true,"type":"string"}},"type":"object"},"SetTopicConfigurationsResponse":{"properties":{"configurations":{"description":"Topic's complete set of configurations after this update.","items":{"$ref":"#/components/schemas/Configuration"},"type":"array"}},"type":"object"},"StartPipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"StopPipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"TaskInfo":{"properties":{"connector":{"description":"Name of connector.","type":"string"},"task":{"description":"The connector task ID.","format":"int32","type":"integer"}},"type":"object"},"TaskStatus":{"properties":{"id":{"description":"The connector task ID.","format":"int32","type":"integer"},"state":{"description":"State of connector task.","type":"string"},"trace":{"description":"String value of stack trace.","type":"string"},"worker_id":{"description":"ID of worker that the task is assigned to.","type":"string"}},"type":"object"},"TopicLocation":{"properties":{"name":{"description":"Topic name.","type":"string"},"topic_location":{"description":"Full reference for the unmounted topic in this format: `topic-name/cluster-uuid/revision`.\nUse this as unique identifier for mounting a topic if there are multiple topics available\nwith the same name.","type":"string"}},"type":"object"},"TopicMount":{"description":"TopicMount defines the migration of a topic from the cloud storage into this cluster,\nso that it becomes available via the Kafka API.","properties":{"alias":{"description":"Alias may be provided to mount the topic under a different name. Leave\nblank to re-use the source topic name. The alias does not persist if you\nunmount the topic again.","type":"string"},"source_topic_reference":{"description":"The topic name or full reference of the topic to mount. The full reference\nmust be used in case the same topic exists more than once. This may be the case if\nthe same topic has been unmounted multiple times. List all mountable topics to\nfind the full reference (contains topic name, cluster uuid and revision).","type":"string"}},"required":["source_topic_reference"],"type":"object"},"TransformMetadata":{"properties":{"environment_variables":{"description":"The environment variables you want to apply to your transform's environment","items":{"$ref":"#/components/schemas/EnvironmentVariable"},"type":"array"},"input_topic_name":{"description":"Input topic to apply the transform to.","type":"string"},"name":{"description":"Name of transform.","type":"string"},"output_topic_names":{"description":"Output topics to write the transform results to.","items":{"type":"string"},"type":"array"},"statuses":{"items":{"$ref":"#/components/schemas/PartitionTransformStatus"},"type":"array"}},"type":"object"},"UnmountTopicsResponse":{"properties":{"mount_task_id":{"format":"int32","title":"ID of unmount","type":"integer"}},"type":"object"},"UpdateConfiguration":{"properties":{"name":{"description":"A topic-level config key (e.g. `segment.bytes`).","type":"string"},"operation":{"$ref":"#/components/schemas/ConfigAlterOperation"},"value":{"description":"A topic-level config value (e.g. 1073741824).","nullable":true,"type":"string"}},"type":"object"},"UpdateConnectSecretBody":{"description":"UpdateConnectSecretRequest is the request of UpdateConnectSecret.","properties":{"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"secret_data":{"description":"The secret data. Must be Base64-encoded.","format":"byte","type":"string"}},"required":["secret_data"],"type":"object"},"UpdateConnectSecretResponse":{"description":"UpdateConnectSecretResponse is the response of UpdateConnectSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"UpdateMountTaskBody":{"properties":{"action":{"$ref":"#/components/schemas/Action"}},"required":["action"],"type":"object"},"UpdateMountTaskResponse":{"type":"object"},"UpdatePipelineResponse":{"properties":{"pipeline":{"$ref":"#/components/schemas/Pipeline"}},"type":"object"},"UpdateSecretBody":{"description":"UpdateSecretRequest is the request of UpdateSecret.","properties":{"labels":{"additionalProperties":{"type":"string"},"description":"Secret labels.","type":"object"},"scopes":{"items":{"$ref":"#/components/schemas/Scope"},"title":"Secret scopes","type":"array"},"secret_data":{"description":"The secret data. Must be Base64-encoded.","format":"byte","type":"string"}},"required":["secret_data"],"type":"object"},"UpdateSecretResponse":{"description":"UpdateSecretResponse is the response of UpdateSecret.","properties":{"secret":{"$ref":"#/components/schemas/Secret"}},"type":"object"},"UpdateTopicConfigurationsResponse":{"properties":{"configurations":{"description":"Topic's complete set of configurations after applying this partial patch.","items":{"$ref":"#/components/schemas/Configuration"},"type":"array"}},"type":"object"},"UpdateUserRequest.User":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"description":"Username.","type":"string"},"password":{"description":"Password.","type":"string"}},"type":"object"},"UpdateUserResponse":{"properties":{"user":{"$ref":"#/components/schemas/UpdateUserResponse.User"}},"type":"object"},"UpdateUserResponse.User":{"description":"Updated user's name and SASL mechanism.","properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"name":{"type":"string"}},"type":"object"},"UpsertConnectorResponse":{"properties":{"connector":{"$ref":"#/components/schemas/ConnectorSpec"}},"type":"object"},"rpc.Status":{"description":"The `Status` type defines a logical error model that is suitable for\ndifferent programming environments, including REST APIs and RPC APIs. It is\nused by [gRPC](https://github.com/grpc). Each `Status` message contains\nthree pieces of data: error code, error message, and error details.\n\nYou can find out more about this error model and how to work with it in the\n[API Design Guide](https://cloud.google.com/apis/design/errors).","properties":{"code":{"description":"RPC status code, as described [here](https://github.com/googleapis/googleapis/blob/b4c238feaa1097c53798ed77035bbfeb7fc72e96/google/rpc/code.proto#L32).","enum":["OK","CANCELLED","UNKNOWN","INVALID_ARGUMENT","DEADLINE_EXCEEDED","NOT_FOUND","ALREADY_EXISTS","PERMISSION_DENIED","UNAUTHENTICATED","RESOURCE_EXHAUSTED","FAILED_PRECONDITION","ABORTED","OUT_OF_RANGE","UNIMPLEMENTED","INTERNAL","UNAVAILABLE","DATA_LOSS"],"format":"int32","type":"string"},"details":{"items":{"description":"Details of the error.","oneOf":[{"allOf":[{"properties":{"@type":{"description":"Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.","enum":["type.googleapis.com/google.rpc.BadRequest"],"type":"string"}}},{"$ref":"#/components/schemas/BadRequest"}]},{"allOf":[{"properties":{"@type":{"description":"Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.","enum":["type.googleapis.com/google.rpc.ErrorInfo"],"type":"string"}}},{"$ref":"#/components/schemas/ErrorInfo"}]},{"allOf":[{"properties":{"@type":{"description":"Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.","enum":["type.googleapis.com/google.rpc.QuotaFailure"],"type":"string"}}},{"$ref":"#/components/schemas/QuotaFailure"}]},{"allOf":[{"properties":{"@type":{"description":"Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.","enum":["type.googleapis.com/google.rpc.Help"],"type":"string"}}},{"$ref":"#/components/schemas/Help"}]}]},"type":"array"},"message":{"description":"Detailed error message. No compatibility guarantees are given for the text contained in this message.","type":"string"}},"type":"object"}},"securitySchemes":{"auth0":{"description":"RedpandaCloud","flows":{"implicit":{"authorizationUrl":"https://auth.prd.cloud.redpanda.com/oauth/authorize","scopes":{},"x-client-id":"dQjapNIAHhF7EQqQToRla3yEII9sUSap"}},"type":"oauth2"}}},"info":{"title":"Redpanda Cloud Data Plane API","version":"v1alpha2"},"openapi":"3.0.3","paths":{"/v1alpha2/acls":{"delete":{"description":"Delete all ACLs that match the filter criteria. The `filter.` query string parameters find matching ACLs that meet all specified conditions.","operationId":"ACLService_DeleteACLs","parameters":[{"description":"The type of resource (topic, consumer group, etc.) this\nACL targets.","in":"query","name":"filter.resource_type","required":true,"schema":{"enum":["RESOURCE_TYPE_ANY","RESOURCE_TYPE_TOPIC","RESOURCE_TYPE_GROUP","RESOURCE_TYPE_CLUSTER","RESOURCE_TYPE_TRANSACTIONAL_ID","RESOURCE_TYPE_DELEGATION_TOKEN","RESOURCE_TYPE_USER"],"type":"string"}},{"description":"The name of the resource this ACL targets.","in":"query","name":"filter.resource_name","schema":{"type":"string"}},{"description":"The pattern to use for matching the specified resource_name\n(any, exact match, literal, or prefixed).","in":"query","name":"filter.resource_pattern_type","required":true,"schema":{"enum":["RESOURCE_PATTERN_TYPE_ANY","RESOURCE_PATTERN_TYPE_MATCH","RESOURCE_PATTERN_TYPE_LITERAL","RESOURCE_PATTERN_TYPE_PREFIXED"],"type":"string"}},{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","in":"query","name":"filter.principal","schema":{"type":"string"}},{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","in":"query","name":"filter.host","schema":{"type":"string"}},{"description":"The operation that is allowed or denied (e.g. READ).","in":"query","name":"filter.operation","required":true,"schema":{"enum":["OPERATION_ANY","OPERATION_ALL","OPERATION_READ","OPERATION_WRITE","OPERATION_CREATE","OPERATION_DELETE","OPERATION_ALTER","OPERATION_DESCRIBE","OPERATION_CLUSTER_ACTION","OPERATION_DESCRIBE_CONFIGS","OPERATION_ALTER_CONFIGS","OPERATION_IDEMPOTENT_WRITE","OPERATION_CREATE_TOKENS","OPERATION_DESCRIBE_TOKENS"],"type":"string"}},{"description":"Whether the operation should be allowed or denied.","in":"query","name":"filter.permission_type","required":true,"schema":{"enum":["PERMISSION_TYPE_ANY","PERMISSION_TYPE_DENY","PERMISSION_TYPE_ALLOW"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteACLsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete ACLs","tags":["Redpanda ACLs (v1alpha2)"]},"get":{"description":"List all ACLs. The `filter.` query string parameters find matching ACLs that meet all specified conditions.","operationId":"ACLService_ListACLs","parameters":[{"description":"The type of resource (topic, consumer group, etc.) this\nACL targets.","in":"query","name":"filter.resource_type","schema":{"enum":["RESOURCE_TYPE_ANY","RESOURCE_TYPE_TOPIC","RESOURCE_TYPE_GROUP","RESOURCE_TYPE_CLUSTER","RESOURCE_TYPE_TRANSACTIONAL_ID","RESOURCE_TYPE_DELEGATION_TOKEN","RESOURCE_TYPE_USER"],"type":"string"}},{"description":"The name of the resource this ACL targets.","in":"query","name":"filter.resource_name","schema":{"type":"string"}},{"description":"The pattern to use for matching the specified resource_name\n(any, exact match, literal, or prefixed).","in":"query","name":"filter.resource_pattern_type","schema":{"enum":["RESOURCE_PATTERN_TYPE_ANY","RESOURCE_PATTERN_TYPE_MATCH","RESOURCE_PATTERN_TYPE_LITERAL","RESOURCE_PATTERN_TYPE_PREFIXED"],"type":"string"}},{"description":"The user for whom this ACL applies. With the Kafka simple\nauthorizer, you must include the prefix \"User:\" with the user name.","in":"query","name":"filter.principal","schema":{"type":"string"}},{"description":"The host address to use for this ACL. To allow a principal\naccess from multiple hosts, you must create an ACL for each host.","in":"query","name":"filter.host","schema":{"type":"string"}},{"description":"The operation that is allowed or denied (e.g. READ).","in":"query","name":"filter.operation","schema":{"enum":["OPERATION_ANY","OPERATION_ALL","OPERATION_READ","OPERATION_WRITE","OPERATION_CREATE","OPERATION_DELETE","OPERATION_ALTER","OPERATION_DESCRIBE","OPERATION_CLUSTER_ACTION","OPERATION_DESCRIBE_CONFIGS","OPERATION_ALTER_CONFIGS","OPERATION_IDEMPOTENT_WRITE","OPERATION_CREATE_TOKENS","OPERATION_DESCRIBE_TOKENS"],"type":"string"}},{"description":"Whether the operation should be allowed or denied.","in":"query","name":"filter.permission_type","schema":{"enum":["PERMISSION_TYPE_ANY","PERMISSION_TYPE_DENY","PERMISSION_TYPE_ALLOW"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListACLsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List ACLs","tags":["Redpanda ACLs (v1alpha2)"]},"post":{"description":"Create a new ACL.","operationId":"ACLService_CreateACL","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateACLRequest"}}},"required":true,"x-originalParamName":"body"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateACLResponse"}}},"description":"Created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create ACL","tags":["Redpanda ACLs (v1alpha2)"]}},"/v1alpha2/cloud-storage/mount-tasks":{"get":{"description":"This operation retrieves the status of a task responsible for mounting or unmounting topics. It provides details on the task’s type (mount or unmount), its current state, and the topics involved.","operationId":"CloudStorageService_ListMountTasks","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMountTasksResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Retrieve the mount task status","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/cloud-storage/mount-tasks/{id}":{"delete":{"description":"Delete a mount or unmount by ID.","operationId":"CloudStorageService_DeleteMountTask","parameters":[{"description":"Unique identifier of the mount or unmount task to delete.","in":"path","name":"id","required":true,"schema":{"format":"int32","type":"integer"}}],"responses":{"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteMountTaskResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete a mount or unmount","tags":["Cloud Storage (v1alpha2)"]},"get":{"description":"Retrieves the status of a mount or unmount by ID. The response provides details on the operation type (mount or unmount), its current state, and the topics involved. Use the ID returned when you start the mount or unmount, or use the ListMountTasks endpoint to retrieve a list of IDs.","operationId":"CloudStorageService_GetMountTask","parameters":[{"description":"Unique identifier of the mount or unmount task to retrieve.","in":"path","name":"id","required":true,"schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetMountTaskResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get the status of a mount or unmount by ID","tags":["Cloud Storage (v1alpha2)"]},"post":{"description":"This operation allows performing an action on an ongoing mount task.","operationId":"CloudStorageService_UpdateMountTask","parameters":[{"description":"ID is the unique identifier of the mount or unmount to update.","in":"path","name":"id","required":true,"schema":{"format":"int32","type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateMountTaskBody"}}},"required":true,"x-originalParamName":"body"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateMountTaskResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update a mount or unmount","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/cloud-storage/topics/mount":{"post":{"description":"Attach mountable topics from object storage to a cluster, making them available for consumption and production again. Mounting a topic reloads its data and state to the local brokers, allowing active use of the topic.","operationId":"CloudStorageService_MountTopics","requestBody":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/TopicMount"},"required":["topics"],"type":"array"}}},"required":true,"x-originalParamName":"topics"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MountTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Mount topics from object storage","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/cloud-storage/topics/mountable":{"get":{"description":"Retrieve all topics that are currently unmounted and available to be mounted to the cluster. These topics reside in object storage and can be mounted for consumption or production within the cluster.","operationId":"CloudStorageService_ListMountableTopics","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMountableTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List mountable topics","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/cloud-storage/topics/unmount":{"post":{"description":"Unmount topics to object storage, freeing up all local cluster resources. Once you unmount a topic, it can no longer be consumed or produced to. It detaches from the active cluster while its data remains safely stored in the external object storage.","operationId":"CloudStorageService_UnmountTopics","requestBody":{"content":{"application/json":{"schema":{"items":{"type":"string"},"required":["topics"],"type":"array"}}},"description":"List of topics to unmount.","required":true,"x-originalParamName":"topics"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnmountTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Unmount topics to object storage","tags":["Cloud Storage (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters":{"get":{"description":"List connect clusters available for being consumed by the console's kafka-connect service.","operationId":"KafkaConnectService_ListConnectClusters","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListConnectClustersResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List connect clusters","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}":{"get":{"description":"Get information about an available Kafka Connect cluster.","operationId":"KafkaConnectService_GetConnectCluster","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectCluster"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Connect cluster not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get connect cluster","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors":{"get":{"description":"List connectors managed by the Kafka Connect service.","operationId":"KafkaConnectService_ListConnectors","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Value of the next_page_token field returned by the previous response. If not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListConnectorsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List connectors","tags":["Kafka Connect (v1alpha2)"]},"post":{"description":"Create a connector with the specified configuration.","operationId":"KafkaConnectService_CreateConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"required":true,"x-originalParamName":"connector"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"description":"Created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}":{"delete":{"description":"Delete a connector. This operation force stops all tasks and also deletes the connector configuration.","operationId":"KafkaConnectService_DeleteConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete connector","tags":["Kafka Connect (v1alpha2)"]},"get":{"description":"Get information about a connector in a specific cluster.","operationId":"KafkaConnectService_GetConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/config":{"get":{"description":"Get the configuration for the connector.","operationId":"KafkaConnectService_GetConnectorConfig","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get connector configuration","tags":["Kafka Connect (v1alpha2)"]},"put":{"description":"Update the configuration for an existing connector with the specified name, or create a new connector using the given configuration. Returns information about the connector after the change has been made.","operationId":"KafkaConnectService_UpsertConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector. If a connector with this name does not already exist, a new connector is created.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"additionalProperties":{"type":"string"},"required":["config"],"type":"object"}}},"description":"Connector configuration property.","required":true,"x-originalParamName":"config"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"description":"Updated"},"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorSpec"}}},"description":"Created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Upsert connector configuration","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/pause":{"put":{"description":"Pause the connector and its tasks, which stops messages from processing until the connector is resumed. This call is asynchronous and may take some time to process.","operationId":"KafkaConnectService_PauseConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"202":{"content":{"application/json":{"schema":{}}},"description":"Pause request accepted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Pause connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/restart":{"post":{"description":"Triggers a connector restart. You must specify whether or not tasks are also restarted, and whether only failed connectors are restarted.","operationId":"KafkaConnectService_RestartConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Options"}}},"required":true,"x-originalParamName":"options"},"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Restart connector request success"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Restart connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/resume":{"put":{"description":"Resume a paused connector and its tasks, and resumes message processing. This call is asynchronous and may take some time to process. If the connector was not paused, this operation does not do anything.","operationId":"KafkaConnectService_ResumeConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"202":{"content":{"application/json":{"schema":{}}},"description":"Resume request accepted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Resume connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/status":{"get":{"description":"Gets the current status of the connector, including the state for each of its tasks, error information, etc.","operationId":"KafkaConnectService_GetConnectorStatus","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorStatus"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get connector status","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/stop":{"put":{"description":"Stops a connector, but does not delete it. All tasks for the connector are shut down completely. This call is asynchronous and may take some time to process.","operationId":"KafkaConnectService_StopConnector","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"202":{"content":{"application/json":{"schema":{}}},"description":"Request accepted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Stop connector","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/topics":{"get":{"description":"Returns a list of connector topic names. If the connector is inactive, this call returns an empty list.","operationId":"KafkaConnectService_ListConnectorTopics","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListConnectorTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List connector topics","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/connectors/{name}/topics/reset":{"put":{"description":"Resets the set of topic names that the connector is using.","operationId":"KafkaConnectService_ResetConnectorTopics","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Name of connector using the topics to be reset.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Reset connector topics","tags":["Kafka Connect (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/secrets":{"get":{"description":"List Kafka Connect cluster secrets. Optional: filter based on secret name and labels.","operationId":"SecretService_ListConnectSecrets","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"Substring match on secret name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"This is a request variable of the map type. The query format is \"map_name[key]=value\", e.g. If the map name is Age, the key type is string, and the value type is integer, the query parameter is expressed as Age[\"bob\"]=18","in":"query","name":"filter.labels[string][string]","schema":{"type":"string"}},{"description":"Secret scopes to search for","in":"query","name":"filter.scopes","schema":{"items":{"enum":["SCOPE_REDPANDA_CONNECT"],"type":"string"},"type":"array"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListSecretsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Connect Cluster Secrets","tags":["Secrets (v1alpha2)"]},"post":{"description":"Create a Kafka Connect cluster secret.","operationId":"SecretService_CreateConnectSecret","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateConnectSecretBody"}}},"required":true,"x-originalParamName":"body"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"Secret created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create Connect Cluster Secret","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/kafka-connect/clusters/{cluster_name}/secrets/{id}":{"delete":{"description":"Delete a Kafka Connect cluster secret.","operationId":"SecretService_DeleteConnectSecret","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"ID of the secret to delete.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Secret deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete Connect Cluster Secret","tags":["Secrets (v1alpha2)"]},"get":{"description":"Get a specific Kafka Connect cluster secret.","operationId":"SecretService_GetConnectSecret","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"The ID of the secret to retrieve.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Connect Cluster Secret","tags":["Secrets (v1alpha2)"]},"put":{"description":"Update a Kafka Connect cluster secret.","operationId":"SecretService_UpdateConnectSecret","parameters":[{"description":"Unique name of target connect cluster. For Redpanda Cloud, use `redpanda`.","in":"path","name":"cluster_name","required":true,"schema":{"type":"string"}},{"description":"ID of the secret to update.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateConnectSecretBody"}}},"required":true,"x-originalParamName":"body"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update Connect Cluster Secret","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/redpanda-connect/config-schema":{"get":{"description":"The configuration schema includes available [components and processors](https://docs.redpanda.com/redpanda-cloud/develop/connect/components/about) in this Redpanda Connect instance.","operationId":"PipelineService_GetPipelineServiceConfigSchema","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetPipelineServiceConfigSchemaResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Retrieve the schema for Redpanda Connect pipeline configurations.","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines":{"get":{"description":"List Redpanda Connect pipelines. Optional: filter based on pipeline name.","operationId":"PipelineService_ListPipelines","parameters":[{"description":"Substring match on pipeline name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListPipelinesResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Redpanda Connect pipelines","tags":["Redpanda Connect Pipeline (v1alpha2)"]},"post":{"description":"Create a new Redpanda Connect pipeline.","operationId":"PipelineService_CreatePipeline","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PipelineCreate"}}},"required":true,"x-originalParamName":"pipeline"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines-by-secrets":{"get":{"description":"Get Redpanda Connect pipelines by secrets.","operationId":"PipelineService_GetPipelinesBySecrets","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetPipelinesBySecretsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Redpanda Connect pipelines by secrets","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines-for-secret":{"get":{"description":"Get Redpanda Connect pipelines for a given secret.","operationId":"PipelineService_GetPipelinesForSecret","parameters":[{"description":"Secret ID.","in":"query","name":"secret_id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetPipelinesForSecretResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Redpanda Connect pipelines for secret","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines/{id}":{"delete":{"description":"Delete a Redpanda Connect pipeline.","operationId":"PipelineService_DeletePipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete a Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]},"get":{"description":"Get a specific Redpanda Connect pipeline.","operationId":"PipelineService_GetPipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]},"put":{"description":"Update the [configuration](https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/about) of a Redpanda Connect pipeline.","operationId":"PipelineService_UpdatePipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PipelineUpdate"}}},"required":true,"x-originalParamName":"pipeline"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update a Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines/{id}/start":{"put":{"description":"Start a stopped Redpanda Connect pipeline.","operationId":"PipelineService_StartPipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"Started"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Start a Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/redpanda-connect/pipelines/{id}/stop":{"put":{"description":"Stop a running Redpanda Connect pipeline.","operationId":"PipelineService_StopPipeline","parameters":[{"description":"Pipeline ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Pipeline"}}},"description":"Stopped"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Stops a Redpanda Connect pipeline","tags":["Redpanda Connect Pipeline (v1alpha2)"]}},"/v1alpha2/secret-scopes":{"get":{"description":"List supported secret scopes.","operationId":"SecretService_ListSecretScopes","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListSecretScopesResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Secret Scopes","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/secrets":{"get":{"description":"List secrets. Optional: filter based on secret name and labels.","operationId":"SecretService_ListSecrets","parameters":[{"description":"Substring match on secret name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"This is a request variable of the map type. The query format is \"map_name[key]=value\", e.g. If the map name is Age, the key type is string, and the value type is integer, the query parameter is expressed as Age[\"bob\"]=18","in":"query","name":"filter.labels[string]","schema":{"type":"string"}},{"description":"Secret scopes to search for","in":"query","name":"filter.scopes","schema":{"items":{"enum":["SCOPE_REDPANDA_CONNECT"],"type":"string"},"type":"array"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListSecretsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Secrets","tags":["Secrets (v1alpha2)"]},"post":{"description":"Create a secret.","operationId":"SecretService_CreateSecret","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSecretRequest"}}},"description":"CreateSecretRequest is the request of CreateSecret.","required":true,"x-originalParamName":"body"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"Secret created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create Secret","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/secrets/{id}":{"delete":{"description":"Delete a secret.","operationId":"SecretService_DeleteSecret","parameters":[{"description":"The id of the secret to delete.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Secret deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete Secret","tags":["Secrets (v1alpha2)"]},"get":{"description":"Get a secret.","operationId":"SecretService_GetSecret","parameters":[{"description":"The id of the secret to retrieve.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Secret","tags":["Secrets (v1alpha2)"]},"put":{"description":"Update a secret.","operationId":"SecretService_UpdateSecret","parameters":[{"description":"Secret identifier.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateSecretBody"}}},"required":true,"x-originalParamName":"body"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update Secret","tags":["Secrets (v1alpha2)"]}},"/v1alpha2/topics":{"get":{"description":"List topics, with partition count and replication factor. Optional: filter based on topic name.","operationId":"TopicService_ListTopics","parameters":[{"description":"Substring match on topic name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}},{"description":"Value of the next_page_token field returned by the previous response. If not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListTopicsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Topics","tags":["Topics (v1alpha2)"]},"post":{"description":"Create a [topic](https://docs.redpanda.com/current/deploy/deployment-option/cloud/create-topic/).","operationId":"TopicService_CreateTopic","parameters":[{"description":"If true, makes this request a dry run; everything is validated but\nno topics are actually created.","in":"query","name":"validate_only","schema":{"type":"boolean"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateTopicRequest.Topic"}}},"description":"The topic to create.","required":true,"x-originalParamName":"topic"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateTopicResponse"}}},"description":"Topic created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create Topic","tags":["Topics (v1alpha2)"]}},"/v1alpha2/topics/{name}":{"delete":{"description":"Delete the Kafka topic with the requested name.","operationId":"TopicService_DeleteTopic","parameters":[{"description":"Topic name.","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"schema":{}}},"description":"Topic deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Requested topic does not exist"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete Topic","tags":["Topics (v1alpha2)"]}},"/v1alpha2/topics/{topic_name}/configurations":{"get":{"description":"Get key-value configs for a topic.","operationId":"TopicService_GetTopicConfigurations","parameters":[{"description":"Topic name","in":"path","name":"topic_name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetTopicConfigurationsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Topic Configurations","tags":["Topics (v1alpha2)"]},"patch":{"description":"Update a subset of the topic configurations.","operationId":"TopicService_UpdateTopicConfigurations","parameters":[{"description":"Topic name","in":"path","name":"topic_name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/UpdateConfiguration"},"type":"array"}}},"required":true,"x-originalParamName":"configurations"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateTopicConfigurationsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update Topic Configuration","tags":["Topics (v1alpha2)"]},"put":{"description":"Update the entire set of key-value configurations for a topic. Config entries that are not provided in the request are removed and will fall back to their default values.","operationId":"TopicService_SetTopicConfigurations","parameters":[{"description":"Name of topic.","in":"path","name":"topic_name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/SetConfiguration"},"type":"array"}}},"required":true,"x-originalParamName":"configurations"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetTopicConfigurationsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Set Topic Configurations","tags":["Topics (v1alpha2)"]}},"/v1alpha2/transforms":{"get":{"description":"Retrieve a list of Wasm transforms. Optional: filter based on transform name.","operationId":"TransformService_ListTransforms","parameters":[{"description":"Substring match on transform name. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}}],"responses":{"200":{"content":{"application/json":{"example":{"next_page_token":"","transforms":[{"environment_variables":[],"input_topic_name":"topic1","name":"transform1","output_topic_names":["output-topic11","output-topic12"],"statuses":[{"broker_id":1,"lag":1,"partition_id":1,"status":"PARTITION_STATUS_RUNNING"}]},{"environment_variables":[],"input_topic_name":"topic2","name":"transform2","output_topic_names":["output-topic21","output-topic22"],"statuses":[{"broker_id":2,"lag":2,"partition_id":2,"status":"PARTITION_STATUS_RUNNING"}]}]},"schema":{"$ref":"#/components/schemas/ListTransformsResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Transforms","tags":["WASM Transforms (v1alpha2)"]},"put":{"description":"Initiate deployment of a new Wasm transform. This endpoint uses multipart/form-data encoding. Following deployment, a brief period is required before the Wasm transform becomes operational. Monitor the partition statuses to check whether the transform is active. This usually takes around 3s, but no longer than 10s.","operationId":"TransformService_DeployTransform","requestBody":{"content":{"multipart/form-data":{"schema":{"example":"{\"name\":\"redact-orders\", \"input_topic_name\":\"orders\", \"output_topic_names\":[\"orders-redacted\"], \"environment_variables\":[{\"key\":\"LOGGER_LEVEL\", \"value\":\"DEBUG\"}]}","properties":{"metadata":{"$ref":"#/components/schemas/DeployTransformRequest"},"wasm_binary":{"description":"Binary file containing the compiled WASM transform. The maximum size for this file is 10MiB.","format":"binary","type":"string"}},"type":"object"}}},"description":"Transform metadata as well as the WASM binary","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TransformMetadata"}}},"description":"Created"}},"summary":"Deploy Transform","tags":["WASM Transforms (v1alpha2)"]}},"/v1alpha2/transforms/{name}":{"delete":{"description":"Delete a Wasm transform with the requested name.","operationId":"TransformService_DeleteTransform","parameters":[{"description":"Name of transform.","example":{"name":"transform1"},"in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"example":{},"schema":{}}},"description":"Transform deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete Transform","tags":["WASM Transforms (v1alpha2)"]},"get":{"description":"Get a specific Wasm transform.","operationId":"TransformService_GetTransform","parameters":[{"description":"Name of transform.","example":{"name":"transform1"},"in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"example":{"transform":{"environment_variables":[],"input_topic_name":"topic1","name":"transform1","output_topic_names":["output-topic1","output-topic2"],"statuses":[{"broker_id":1,"lag":1,"partition_id":1,"status":"PARTITION_STATUS_RUNNING"}]}},"schema":{"$ref":"#/components/schemas/GetTransformResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Get Transform","tags":["WASM Transforms (v1alpha2)"]}},"/v1alpha2/users":{"get":{"description":"List users. Optional: filter based on username.","operationId":"UserService_ListUsers","parameters":[{"description":"Username.","in":"query","name":"filter.name","schema":{"type":"string"}},{"description":"Substring match on username. Case-sensitive.","in":"query","name":"filter.name_contains","schema":{"type":"string"}},{"description":"Limit the paginated response to a number of items. Defaults to 100. Use -1 to disable pagination.","in":"query","name":"page_size","schema":{"format":"int32","type":"integer"}},{"description":"Value of the next_page_token field returned by the previous response.\nIf not provided, the system assumes the first page is requested.","in":"query","name":"page_token","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"example":{"next_page_token":"","users":[{"name":"payment-service"},{"name":"jane"}]},"schema":{"$ref":"#/components/schemas/ListUsersResponse"}}},"description":"OK"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"List Users","tags":["Redpanda Users (v1alpha2)"]},"post":{"description":"Create a new user.","operationId":"UserService_CreateUser","requestBody":{"content":{"application/json":{"example":{"mechanism":"SASL_MECHANISM_SCRAM_SHA_256","name":"payment-service","password":"secure-password"},"schema":{"$ref":"#/components/schemas/CreateUserRequest.User"}}},"required":true,"x-originalParamName":"user"},"responses":{"201":{"content":{"application/json":{"example":{"user":{"mechanism":"SASL_MECHANISM_SCRAM_SHA_256","name":"payment-service"}},"schema":{"$ref":"#/components/schemas/CreateUserRequest.User"}}},"description":"User created"},"400":{"content":{"application/json":{"example":{"code":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo","domain":"redpanda.com/dataplane","metadata":{},"reason":"REASON_INVALID_INPUT"},{"@type":"type.googleapis.com/google.rpc.BadRequest","field_violations":[{"description":"value length must be at least 3 characters","field":"user.password","localized_message":null,"reason":""},{"description":"value is required","field":"user.mechanism","localized_message":null,"reason":""}]}],"message":"provided parameters are invalid"},"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Bad request. Check API documentation and update request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Create User","tags":["Redpanda Users (v1alpha2)"]}},"/v1alpha2/users/{name}":{"delete":{"description":"Delete the specified user","operationId":"UserService_DeleteUser","parameters":[{"description":"Username","in":"path","name":"name","required":true,"schema":{"type":"string"}}],"responses":{"204":{"content":{"application/json":{"example":{},"schema":{}}},"description":"User deleted successfully"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"404":{"content":{"application/json":{"example":{"code":"NOT_FOUND","details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo","domain":"redpanda.com/dataplane","metadata":{},"reason":"REASON_RESOURCE_NOT_FOUND"}],"message":"user not found"},"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Not Found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Delete User","tags":["Redpanda Users (v1alpha2)"]}},"/v1alpha2/users/{user.name}":{"put":{"description":"Update a user's credentials.","operationId":"UserService_UpdateUser","parameters":[{"description":"Username.","in":"path","name":"user.name","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"example":{"user":{"mechanism":"SASL_MECHANISM_SCRAM_SHA_256","password":"new-password"}},"schema":{"properties":{"mechanism":{"$ref":"#/components/schemas/SASLMechanism"},"password":{"description":"Password.","type":"string"}},"type":"object"}}},"required":true,"x-originalParamName":"user"},"responses":{"200":{"content":{"application/json":{"example":{"user":{"mechanism":"SASL_MECHANISM_SCRAM_SHA_256","name":"payment-service"}},"schema":{"$ref":"#/components/schemas/UpdateUserResponse.User"}}},"description":"OK"},"400":{"content":{"application/json":{"example":{"code":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo","domain":"redpanda.com/dataplane","metadata":{},"reason":"REASON_INVALID_INPUT"},{"@type":"type.googleapis.com/google.rpc.BadRequest","field_violations":[{"description":"value length must be at least 3 characters","field":"user.password","localized_message":null,"reason":""},{"description":"value is required","field":"user.mechanism","localized_message":null,"reason":""}]}],"message":"provided parameters are invalid"},"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Bad request. Check API documentation and update request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Unauthenticated."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"Internal Server Error. Reach out to support."},"default":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/rpc.Status"}}},"description":"An unexpected error response."}},"summary":"Update User","tags":["Redpanda Users (v1alpha2)"]}}},"security":[{"auth0":[]}],"servers":[{"description":"Data Plane API","url":"{dataplane_api_url}","variables":{"dataplane_api_url":{"default":"https://{dataplane_api_url}","description":"Find the Data Plane API base URL of a cluster by calling the Get Cluster endpoint of the Control Plane API. The dataplane_api.url field is returned in the response body.\u003cbr\u003e\u003cbr\u003e\n\t\t\t\t\tExample (Dedicated): \"https://api-a4cb21.ck09mi9c4vs17hng9gig.fmc.prd.cloud.redpanda.com\"\u003cbr\u003e\n\t\t\t\t\tExample (BYOC): \"https://api-a4cb21.ck09mi9c4vs17hng9gig.byoc.prd.cloud.redpanda.com\""}}}],"tags":[{"description":"Manage Redpanda access control lists (ACLs). See [Redpanda Cloud Authorization](https://docs.redpanda.com/redpanda-cloud/security/authorization/cloud-authorization/) for more information.","name":"Redpanda ACLs (v1alpha2)"},{"description":"Manage Redpanda topics stored in object storage. See: [Mountable Topics](https://docs.redpanda.com/redpanda-cloud/manage/mountable-topics/)","name":"Cloud Storage (v1alpha2)"},{"description":"Manage Wasm transforms in Redpanda.","name":"WASM Transforms (v1alpha2)"},{"description":"Manage [connectors](https://docs.redpanda.com/redpanda-cloud/develop/managed-connectors/) and interact with the Kafka Connect API.","name":"Kafka Connect (v1alpha2)"},{"description":"Create and manage [Redpanda Connect](https://docs.redpanda.com/redpanda-cloud/develop/connect/about) pipelines and their configurations.","name":"Redpanda Connect Pipeline (v1alpha2)"},{"description":"Manage [secrets](https://docs.redpanda.com/redpanda-cloud/security/secrets) for Redpanda Cloud.","name":"Secrets (v1alpha2)"},{"description":"Manage Redpanda topics.","name":"Topics (v1alpha2)"},{"description":"Manage Redpanda users. To manage access, see the Data Plane [ACL endpoints](https://docs.redpanda.com/api/cloud-dataplane-api/#get-/v1alpha2/acls).","name":"Redpanda Users (v1alpha2)"}]}
\ No newline at end of file
diff --git a/proto/gen/openapi/openapi.v1alpha2.yaml b/proto/gen/openapi/openapi.v1alpha2.yaml
index 9098ca21d7..6d606c892d 100644
--- a/proto/gen/openapi/openapi.v1alpha2.yaml
+++ b/proto/gen/openapi/openapi.v1alpha2.yaml
@@ -4375,7 +4375,7 @@ paths:
         content:
           multipart/form-data:
             schema:
-              example: '{"name":"redact-orders","input_topic_name":"orders","output_topic_names":["orders-redacted"],"environment_variables":[{"key":"LOGGER_LEVEL","value":"DEBUG"}]}'
+              example: '{"name":"redact-orders", "input_topic_name":"orders", "output_topic_names":["orders-redacted"], "environment_variables":[{"key":"LOGGER_LEVEL", "value":"DEBUG"}]}'
               properties:
                 metadata:
                   $ref: '#/components/schemas/DeployTransformRequest'
diff --git a/taskfiles/proto.yaml b/taskfiles/proto.yaml
index 39639312d2..9872e8162f 100644
--- a/taskfiles/proto.yaml
+++ b/taskfiles/proto.yaml
@@ -59,6 +59,7 @@ tasks:
       - for: { var: BUF_INPUTS }
         cmd: "{{ .PATH_PREFIX }} buf generate --template=buf.gen.yaml {{ .ITEM }}"
       - "{{ .PATH_PREFIX }} buf generate --template=buf.gen.yaml buf.build/redpandadata/common"
+      - "{{ .PATH_PREFIX }} buf generate --template=buf.gen.yaml buf.build/redpandadata/ai-gateway"
       - task: :backend:fmt
       - task: generate-openapi3
       - if [[ $CI == "true" ]]; then git diff -w --exit-code; fi