// This file is @generated by prost-build.
/// A \[KeyRing\]\[google.cloud.kms.v1.KeyRing\] is a toplevel logical grouping of
/// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct KeyRing {
    /// Output only. The resource name for the
    /// \[KeyRing\]\[google.cloud.kms.v1.KeyRing\] in the format
    /// `projects/*/locations/*/keyRings/*`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Output only. The time at which this \[KeyRing\]\[google.cloud.kms.v1.KeyRing\]
    /// was created.
    #[prost(message, optional, tag = "2")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
}
/// A \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] represents a logical key that
/// can be used for cryptographic operations.
///
/// A \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] is made up of zero or more
/// \[versions\]\[google.cloud.kms.v1.CryptoKeyVersion\], which represent the actual
/// key material used in cryptographic operations.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CryptoKey {
    /// Output only. The resource name for this
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] in the format
    /// `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Output only. A copy of the "primary"
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] that will be used
    /// by \[Encrypt\]\[google.cloud.kms.v1.KeyManagementService.Encrypt\] when this
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] is given in
    /// \[EncryptRequest.name\]\[google.cloud.kms.v1.EncryptRequest.name\].
    ///
    /// The \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\]'s primary version can be
    /// updated via
    /// \[UpdateCryptoKeyPrimaryVersion\]\[google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion\].
    ///
    /// Keys with \[purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
    /// \[ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT\]
    /// may have a primary. For other keys, this field will be omitted.
    #[prost(message, optional, tag = "2")]
    pub primary: ::core::option::Option<CryptoKeyVersion>,
    /// Immutable. The immutable purpose of this
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
    #[prost(enumeration = "crypto_key::CryptoKeyPurpose", tag = "3")]
    pub purpose: i32,
    /// Output only. The time at which this
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] was created.
    #[prost(message, optional, tag = "5")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
    /// At \[next_rotation_time\]\[google.cloud.kms.v1.CryptoKey.next_rotation_time\],
    /// the Key Management Service will automatically:
    ///
    /// 1. Create a new version of this \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
    /// 1. Mark the new version as primary.
    ///
    /// Key rotations performed manually via
    /// \[CreateCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion\]
    /// and
    /// \[UpdateCryptoKeyPrimaryVersion\]\[google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion\]
    /// do not affect
    /// \[next_rotation_time\]\[google.cloud.kms.v1.CryptoKey.next_rotation_time\].
    ///
    /// Keys with \[purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
    /// \[ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT\]
    /// support automatic rotation. For other keys, this field must be omitted.
    #[prost(message, optional, tag = "7")]
    pub next_rotation_time: ::core::option::Option<::prost_types::Timestamp>,
    /// A template describing settings for new
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] instances. The
    /// properties of new \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]
    /// instances created by either
    /// \[CreateCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion\]
    /// or auto-rotation are controlled by this template.
    #[prost(message, optional, tag = "11")]
    pub version_template: ::core::option::Option<CryptoKeyVersionTemplate>,
    /// Labels with user-defined metadata. For more information, see
    /// [Labeling Keys](<https://cloud.google.com/kms/docs/labeling-keys>).
    #[prost(map = "string, string", tag = "10")]
    pub labels: ::std::collections::HashMap<
        ::prost::alloc::string::String,
        ::prost::alloc::string::String,
    >,
    /// Immutable. Whether this key may contain imported versions only.
    #[prost(bool, tag = "13")]
    pub import_only: bool,
    /// Immutable. The period of time that versions of this key spend in the
    /// \[DESTROY_SCHEDULED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED\]
    /// state before transitioning to
    /// \[DESTROYED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED\].
    /// If not specified at creation time, the default duration is 30 days.
    #[prost(message, optional, tag = "14")]
    pub destroy_scheduled_duration: ::core::option::Option<::prost_types::Duration>,
    /// Immutable. The resource name of the backend environment where the key
    /// material for all \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\]
    /// associated with this \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] reside and
    /// where all related cryptographic operations are performed. Only applicable
    /// if \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\] have a
    /// \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of
    /// \[EXTERNAL_VPC\]\[google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC\], with the
    /// resource name in the format `projects/*/locations/*/ekmConnections/*`.
    /// Note, this list is non-exhaustive and may apply to additional
    /// \[ProtectionLevels\]\[google.cloud.kms.v1.ProtectionLevel\] in the future.
    #[prost(string, tag = "15")]
    pub crypto_key_backend: ::prost::alloc::string::String,
    /// Optional. The policy used for Key Access Justifications Policy Enforcement.
    /// If this field is present and this key is enrolled in Key Access
    /// Justifications Policy Enforcement, the policy will be evaluated in encrypt,
    /// decrypt, and sign operations, and the operation will fail if rejected by
    /// the policy. The policy is defined by specifying zero or more allowed
    /// justification codes.
    /// <https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes>
    /// By default, this field is absent, and all justification codes are allowed.
    #[prost(message, optional, tag = "17")]
    pub key_access_justifications_policy: ::core::option::Option<
        KeyAccessJustificationsPolicy,
    >,
    /// Controls the rate of automatic rotation.
    #[prost(oneof = "crypto_key::RotationSchedule", tags = "8")]
    pub rotation_schedule: ::core::option::Option<crypto_key::RotationSchedule>,
}
/// Nested message and enum types in `CryptoKey`.
pub mod crypto_key {
    /// \[CryptoKeyPurpose\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose\]
    /// describes the cryptographic capabilities of a
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\]. A given key can only be used
    /// for the operations allowed by its purpose. For more information, see [Key
    /// purposes](<https://cloud.google.com/kms/docs/algorithms#key_purposes>).
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum CryptoKeyPurpose {
        /// Not specified.
        Unspecified = 0,
        /// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] with this purpose may be used
        /// with \[Encrypt\]\[google.cloud.kms.v1.KeyManagementService.Encrypt\] and
        /// \[Decrypt\]\[google.cloud.kms.v1.KeyManagementService.Decrypt\].
        EncryptDecrypt = 1,
        /// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] with this purpose may be used
        /// with
        /// \[AsymmetricSign\]\[google.cloud.kms.v1.KeyManagementService.AsymmetricSign\]
        /// and
        /// \[GetPublicKey\]\[google.cloud.kms.v1.KeyManagementService.GetPublicKey\].
        AsymmetricSign = 5,
        /// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] with this purpose may be used
        /// with
        /// \[AsymmetricDecrypt\]\[google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt\]
        /// and
        /// \[GetPublicKey\]\[google.cloud.kms.v1.KeyManagementService.GetPublicKey\].
        AsymmetricDecrypt = 6,
        /// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] with this purpose may be used
        /// with \[RawEncrypt\]\[google.cloud.kms.v1.KeyManagementService.RawEncrypt\]
        /// and \[RawDecrypt\]\[google.cloud.kms.v1.KeyManagementService.RawDecrypt\].
        /// This purpose is meant to be used for interoperable symmetric
        /// encryption and does not support automatic CryptoKey rotation.
        RawEncryptDecrypt = 7,
        /// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] with this purpose may be used
        /// with \[MacSign\]\[google.cloud.kms.v1.KeyManagementService.MacSign\].
        Mac = 9,
    }
    impl CryptoKeyPurpose {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "CRYPTO_KEY_PURPOSE_UNSPECIFIED",
                Self::EncryptDecrypt => "ENCRYPT_DECRYPT",
                Self::AsymmetricSign => "ASYMMETRIC_SIGN",
                Self::AsymmetricDecrypt => "ASYMMETRIC_DECRYPT",
                Self::RawEncryptDecrypt => "RAW_ENCRYPT_DECRYPT",
                Self::Mac => "MAC",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "CRYPTO_KEY_PURPOSE_UNSPECIFIED" => Some(Self::Unspecified),
                "ENCRYPT_DECRYPT" => Some(Self::EncryptDecrypt),
                "ASYMMETRIC_SIGN" => Some(Self::AsymmetricSign),
                "ASYMMETRIC_DECRYPT" => Some(Self::AsymmetricDecrypt),
                "RAW_ENCRYPT_DECRYPT" => Some(Self::RawEncryptDecrypt),
                "MAC" => Some(Self::Mac),
                _ => None,
            }
        }
    }
    /// Controls the rate of automatic rotation.
    #[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Oneof)]
    pub enum RotationSchedule {
        /// \[next_rotation_time\]\[google.cloud.kms.v1.CryptoKey.next_rotation_time\]
        /// will be advanced by this period when the service automatically rotates a
        /// key. Must be at least 24 hours and at most 876,000 hours.
        ///
        /// If \[rotation_period\]\[google.cloud.kms.v1.CryptoKey.rotation_period\] is
        /// set,
        /// \[next_rotation_time\]\[google.cloud.kms.v1.CryptoKey.next_rotation_time\]
        /// must also be set.
        ///
        /// Keys with \[purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
        /// \[ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT\]
        /// support automatic rotation. For other keys, this field must be omitted.
        #[prost(message, tag = "8")]
        RotationPeriod(::prost_types::Duration),
    }
}
/// A \[CryptoKeyVersionTemplate\]\[google.cloud.kms.v1.CryptoKeyVersionTemplate\]
/// specifies the properties to use when creating a new
/// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\], either manually
/// with
/// \[CreateCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion\]
/// or automatically as a result of auto-rotation.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CryptoKeyVersionTemplate {
    /// \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] to use when creating
    /// a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] based on this
    /// template. Immutable. Defaults to
    /// \[SOFTWARE\]\[google.cloud.kms.v1.ProtectionLevel.SOFTWARE\].
    #[prost(enumeration = "ProtectionLevel", tag = "1")]
    pub protection_level: i32,
    /// Required.
    /// \[Algorithm\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm\]
    /// to use when creating a
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] based on this
    /// template.
    ///
    /// For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both
    /// this field is omitted and
    /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\] is
    /// \[ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT\].
    #[prost(enumeration = "crypto_key_version::CryptoKeyVersionAlgorithm", tag = "3")]
    pub algorithm: i32,
}
/// Contains an HSM-generated attestation about a key operation. For more
/// information, see \[Verifying attestations\]
/// (<https://cloud.google.com/kms/docs/attest-key>).
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct KeyOperationAttestation {
    /// Output only. The format of the attestation data.
    #[prost(enumeration = "key_operation_attestation::AttestationFormat", tag = "4")]
    pub format: i32,
    /// Output only. The attestation data provided by the HSM when the key
    /// operation was performed.
    #[prost(bytes = "vec", tag = "5")]
    pub content: ::prost::alloc::vec::Vec<u8>,
    /// Output only. The certificate chains needed to validate the attestation
    #[prost(message, optional, tag = "6")]
    pub cert_chains: ::core::option::Option<
        key_operation_attestation::CertificateChains,
    >,
}
/// Nested message and enum types in `KeyOperationAttestation`.
pub mod key_operation_attestation {
    /// Certificate chains needed to verify the attestation.
    /// Certificates in chains are PEM-encoded and are ordered based on
    /// <https://tools.ietf.org/html/rfc5246#section-7.4.2.>
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct CertificateChains {
        /// Cavium certificate chain corresponding to the attestation.
        #[prost(string, repeated, tag = "1")]
        pub cavium_certs: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
        /// Google card certificate chain corresponding to the attestation.
        #[prost(string, repeated, tag = "2")]
        pub google_card_certs: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
        /// Google partition certificate chain corresponding to the attestation.
        #[prost(string, repeated, tag = "3")]
        pub google_partition_certs: ::prost::alloc::vec::Vec<
            ::prost::alloc::string::String,
        >,
    }
    /// Attestation formats provided by the HSM.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum AttestationFormat {
        /// Not specified.
        Unspecified = 0,
        /// Cavium HSM attestation compressed with gzip. Note that this format is
        /// defined by Cavium and subject to change at any time.
        ///
        /// See
        /// <https://www.marvell.com/products/security-solutions/nitrox-hs-adapters/software-key-attestation.html.>
        CaviumV1Compressed = 3,
        /// Cavium HSM attestation V2 compressed with gzip. This is a new format
        /// introduced in Cavium's version 3.2-08.
        CaviumV2Compressed = 4,
    }
    impl AttestationFormat {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "ATTESTATION_FORMAT_UNSPECIFIED",
                Self::CaviumV1Compressed => "CAVIUM_V1_COMPRESSED",
                Self::CaviumV2Compressed => "CAVIUM_V2_COMPRESSED",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "ATTESTATION_FORMAT_UNSPECIFIED" => Some(Self::Unspecified),
                "CAVIUM_V1_COMPRESSED" => Some(Self::CaviumV1Compressed),
                "CAVIUM_V2_COMPRESSED" => Some(Self::CaviumV2Compressed),
                _ => None,
            }
        }
    }
}
/// A \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] represents an
/// individual cryptographic key, and the associated key material.
///
/// An
/// \[ENABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED\]
/// version can be used for cryptographic operations.
///
/// For security reasons, the raw cryptographic key material represented by a
/// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] can never be viewed
/// or exported. It can only be used to encrypt, decrypt, or sign data when an
/// authorized user or application invokes Cloud KMS.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CryptoKeyVersion {
    /// Output only. The resource name for this
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] in the format
    /// `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// The current state of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\].
    #[prost(enumeration = "crypto_key_version::CryptoKeyVersionState", tag = "3")]
    pub state: i32,
    /// Output only. The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\]
    /// describing how crypto operations are performed with this
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\].
    #[prost(enumeration = "ProtectionLevel", tag = "7")]
    pub protection_level: i32,
    /// Output only. The
    /// \[CryptoKeyVersionAlgorithm\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm\]
    /// that this \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]
    /// supports.
    #[prost(enumeration = "crypto_key_version::CryptoKeyVersionAlgorithm", tag = "10")]
    pub algorithm: i32,
    /// Output only. Statement that was generated and signed by the HSM at key
    /// creation time. Use this statement to verify attributes of the key as stored
    /// on the HSM, independently of Google. Only provided for key versions with
    /// \[protection_level\]\[google.cloud.kms.v1.CryptoKeyVersion.protection_level\]
    /// \[HSM\]\[google.cloud.kms.v1.ProtectionLevel.HSM\].
    #[prost(message, optional, tag = "8")]
    pub attestation: ::core::option::Option<KeyOperationAttestation>,
    /// Output only. The time at which this
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] was created.
    #[prost(message, optional, tag = "4")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The time this
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]'s key material was
    /// generated.
    #[prost(message, optional, tag = "11")]
    pub generate_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The time this
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]'s key material is
    /// scheduled for destruction. Only present if
    /// \[state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] is
    /// \[DESTROY_SCHEDULED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED\].
    #[prost(message, optional, tag = "5")]
    pub destroy_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The time this CryptoKeyVersion's key material was
    /// destroyed. Only present if
    /// \[state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] is
    /// \[DESTROYED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED\].
    #[prost(message, optional, tag = "6")]
    pub destroy_event_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The name of the \[ImportJob\]\[google.cloud.kms.v1.ImportJob\]
    /// used in the most recent import of this
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]. Only present if
    /// the underlying key material was imported.
    #[prost(string, tag = "14")]
    pub import_job: ::prost::alloc::string::String,
    /// Output only. The time at which this
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]'s key material was
    /// most recently imported.
    #[prost(message, optional, tag = "15")]
    pub import_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The root cause of the most recent import failure. Only present
    /// if \[state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] is
    /// \[IMPORT_FAILED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.IMPORT_FAILED\].
    #[prost(string, tag = "16")]
    pub import_failure_reason: ::prost::alloc::string::String,
    /// Output only. The root cause of the most recent generation failure. Only
    /// present if \[state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] is
    /// \[GENERATION_FAILED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.GENERATION_FAILED\].
    #[prost(string, tag = "19")]
    pub generation_failure_reason: ::prost::alloc::string::String,
    /// Output only. The root cause of the most recent external destruction
    /// failure. Only present if
    /// \[state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] is
    /// \[EXTERNAL_DESTRUCTION_FAILED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.EXTERNAL_DESTRUCTION_FAILED\].
    #[prost(string, tag = "20")]
    pub external_destruction_failure_reason: ::prost::alloc::string::String,
    /// ExternalProtectionLevelOptions stores a group of additional fields for
    /// configuring a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] that
    /// are specific to the
    /// \[EXTERNAL\]\[google.cloud.kms.v1.ProtectionLevel.EXTERNAL\] protection level
    /// and \[EXTERNAL_VPC\]\[google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC\]
    /// protection levels.
    #[prost(message, optional, tag = "17")]
    pub external_protection_level_options: ::core::option::Option<
        ExternalProtectionLevelOptions,
    >,
    /// Output only. Whether or not this key version is eligible for reimport, by
    /// being specified as a target in
    /// \[ImportCryptoKeyVersionRequest.crypto_key_version\]\[google.cloud.kms.v1.ImportCryptoKeyVersionRequest.crypto_key_version\].
    #[prost(bool, tag = "18")]
    pub reimport_eligible: bool,
}
/// Nested message and enum types in `CryptoKeyVersion`.
pub mod crypto_key_version {
    /// The algorithm of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\], indicating what
    /// parameters must be used for each cryptographic operation.
    ///
    /// The
    /// \[GOOGLE_SYMMETRIC_ENCRYPTION\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION\]
    /// algorithm is usable with
    /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
    /// \[ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT\].
    ///
    /// Algorithms beginning with `RSA_SIGN_` are usable with
    /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
    /// \[ASYMMETRIC_SIGN\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN\].
    ///
    /// The fields in the name after `RSA_SIGN_` correspond to the following
    /// parameters: padding algorithm, modulus bit length, and digest algorithm.
    ///
    /// For PSS, the salt length used is equal to the length of digest
    /// algorithm. For example,
    /// \[RSA_SIGN_PSS_2048_SHA256\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_2048_SHA256\]
    /// will use PSS with a salt length of 256 bits or 32 bytes.
    ///
    /// Algorithms beginning with `RSA_DECRYPT_` are usable with
    /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
    /// \[ASYMMETRIC_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT\].
    ///
    /// The fields in the name after `RSA_DECRYPT_` correspond to the following
    /// parameters: padding algorithm, modulus bit length, and digest algorithm.
    ///
    /// Algorithms beginning with `EC_SIGN_` are usable with
    /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
    /// \[ASYMMETRIC_SIGN\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN\].
    ///
    /// The fields in the name after `EC_SIGN_` correspond to the following
    /// parameters: elliptic curve, digest algorithm.
    ///
    /// Algorithms beginning with `HMAC_` are usable with
    /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
    /// \[MAC\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.MAC\].
    ///
    /// The suffix following `HMAC_` corresponds to the hash algorithm being used
    /// (eg. SHA256).
    ///
    /// Algorithms beginning with `PQ_` are post-quantum.
    ///
    /// For more information, see \[Key purposes and algorithms\]
    /// (<https://cloud.google.com/kms/docs/algorithms>).
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum CryptoKeyVersionAlgorithm {
        /// Not specified.
        Unspecified = 0,
        /// Creates symmetric encryption keys.
        GoogleSymmetricEncryption = 1,
        /// AES-GCM (Galois Counter Mode) using 128-bit keys.
        Aes128Gcm = 41,
        /// AES-GCM (Galois Counter Mode) using 256-bit keys.
        Aes256Gcm = 19,
        /// AES-CBC (Cipher Block Chaining Mode) using 128-bit keys.
        Aes128Cbc = 42,
        /// AES-CBC (Cipher Block Chaining Mode) using 256-bit keys.
        Aes256Cbc = 43,
        /// AES-CTR (Counter Mode) using 128-bit keys.
        Aes128Ctr = 44,
        /// AES-CTR (Counter Mode) using 256-bit keys.
        Aes256Ctr = 45,
        /// RSASSA-PSS 2048 bit key with a SHA256 digest.
        RsaSignPss2048Sha256 = 2,
        /// RSASSA-PSS 3072 bit key with a SHA256 digest.
        RsaSignPss3072Sha256 = 3,
        /// RSASSA-PSS 4096 bit key with a SHA256 digest.
        RsaSignPss4096Sha256 = 4,
        /// RSASSA-PSS 4096 bit key with a SHA512 digest.
        RsaSignPss4096Sha512 = 15,
        /// RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
        RsaSignPkcs12048Sha256 = 5,
        /// RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
        RsaSignPkcs13072Sha256 = 6,
        /// RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
        RsaSignPkcs14096Sha256 = 7,
        /// RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
        RsaSignPkcs14096Sha512 = 16,
        /// RSASSA-PKCS1-v1_5 signing without encoding, with a 2048 bit key.
        RsaSignRawPkcs12048 = 28,
        /// RSASSA-PKCS1-v1_5 signing without encoding, with a 3072 bit key.
        RsaSignRawPkcs13072 = 29,
        /// RSASSA-PKCS1-v1_5 signing without encoding, with a 4096 bit key.
        RsaSignRawPkcs14096 = 30,
        /// RSAES-OAEP 2048 bit key with a SHA256 digest.
        RsaDecryptOaep2048Sha256 = 8,
        /// RSAES-OAEP 3072 bit key with a SHA256 digest.
        RsaDecryptOaep3072Sha256 = 9,
        /// RSAES-OAEP 4096 bit key with a SHA256 digest.
        RsaDecryptOaep4096Sha256 = 10,
        /// RSAES-OAEP 4096 bit key with a SHA512 digest.
        RsaDecryptOaep4096Sha512 = 17,
        /// RSAES-OAEP 2048 bit key with a SHA1 digest.
        RsaDecryptOaep2048Sha1 = 37,
        /// RSAES-OAEP 3072 bit key with a SHA1 digest.
        RsaDecryptOaep3072Sha1 = 38,
        /// RSAES-OAEP 4096 bit key with a SHA1 digest.
        RsaDecryptOaep4096Sha1 = 39,
        /// ECDSA on the NIST P-256 curve with a SHA256 digest.
        /// Other hash functions can also be used:
        /// <https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms>
        EcSignP256Sha256 = 12,
        /// ECDSA on the NIST P-384 curve with a SHA384 digest.
        /// Other hash functions can also be used:
        /// <https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms>
        EcSignP384Sha384 = 13,
        /// ECDSA on the non-NIST secp256k1 curve. This curve is only supported for
        /// HSM protection level.
        /// Other hash functions can also be used:
        /// <https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms>
        EcSignSecp256k1Sha256 = 31,
        /// EdDSA on the Curve25519 in pure mode (taking data as input).
        EcSignEd25519 = 40,
        /// HMAC-SHA256 signing with a 256 bit key.
        HmacSha256 = 32,
        /// HMAC-SHA1 signing with a 160 bit key.
        HmacSha1 = 33,
        /// HMAC-SHA384 signing with a 384 bit key.
        HmacSha384 = 34,
        /// HMAC-SHA512 signing with a 512 bit key.
        HmacSha512 = 35,
        /// HMAC-SHA224 signing with a 224 bit key.
        HmacSha224 = 36,
        /// Algorithm representing symmetric encryption by an external key manager.
        ExternalSymmetricEncryption = 18,
        /// The post-quantum Module-Lattice-Based Digital Signature Algorithm, at
        /// security level 3. Randomized version.
        PqSignMlDsa65 = 56,
        /// The post-quantum stateless hash-based digital signature algorithm, at
        /// security level 1. Randomized version.
        PqSignSlhDsaSha2128s = 57,
    }
    impl CryptoKeyVersionAlgorithm {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED",
                Self::GoogleSymmetricEncryption => "GOOGLE_SYMMETRIC_ENCRYPTION",
                Self::Aes128Gcm => "AES_128_GCM",
                Self::Aes256Gcm => "AES_256_GCM",
                Self::Aes128Cbc => "AES_128_CBC",
                Self::Aes256Cbc => "AES_256_CBC",
                Self::Aes128Ctr => "AES_128_CTR",
                Self::Aes256Ctr => "AES_256_CTR",
                Self::RsaSignPss2048Sha256 => "RSA_SIGN_PSS_2048_SHA256",
                Self::RsaSignPss3072Sha256 => "RSA_SIGN_PSS_3072_SHA256",
                Self::RsaSignPss4096Sha256 => "RSA_SIGN_PSS_4096_SHA256",
                Self::RsaSignPss4096Sha512 => "RSA_SIGN_PSS_4096_SHA512",
                Self::RsaSignPkcs12048Sha256 => "RSA_SIGN_PKCS1_2048_SHA256",
                Self::RsaSignPkcs13072Sha256 => "RSA_SIGN_PKCS1_3072_SHA256",
                Self::RsaSignPkcs14096Sha256 => "RSA_SIGN_PKCS1_4096_SHA256",
                Self::RsaSignPkcs14096Sha512 => "RSA_SIGN_PKCS1_4096_SHA512",
                Self::RsaSignRawPkcs12048 => "RSA_SIGN_RAW_PKCS1_2048",
                Self::RsaSignRawPkcs13072 => "RSA_SIGN_RAW_PKCS1_3072",
                Self::RsaSignRawPkcs14096 => "RSA_SIGN_RAW_PKCS1_4096",
                Self::RsaDecryptOaep2048Sha256 => "RSA_DECRYPT_OAEP_2048_SHA256",
                Self::RsaDecryptOaep3072Sha256 => "RSA_DECRYPT_OAEP_3072_SHA256",
                Self::RsaDecryptOaep4096Sha256 => "RSA_DECRYPT_OAEP_4096_SHA256",
                Self::RsaDecryptOaep4096Sha512 => "RSA_DECRYPT_OAEP_4096_SHA512",
                Self::RsaDecryptOaep2048Sha1 => "RSA_DECRYPT_OAEP_2048_SHA1",
                Self::RsaDecryptOaep3072Sha1 => "RSA_DECRYPT_OAEP_3072_SHA1",
                Self::RsaDecryptOaep4096Sha1 => "RSA_DECRYPT_OAEP_4096_SHA1",
                Self::EcSignP256Sha256 => "EC_SIGN_P256_SHA256",
                Self::EcSignP384Sha384 => "EC_SIGN_P384_SHA384",
                Self::EcSignSecp256k1Sha256 => "EC_SIGN_SECP256K1_SHA256",
                Self::EcSignEd25519 => "EC_SIGN_ED25519",
                Self::HmacSha256 => "HMAC_SHA256",
                Self::HmacSha1 => "HMAC_SHA1",
                Self::HmacSha384 => "HMAC_SHA384",
                Self::HmacSha512 => "HMAC_SHA512",
                Self::HmacSha224 => "HMAC_SHA224",
                Self::ExternalSymmetricEncryption => "EXTERNAL_SYMMETRIC_ENCRYPTION",
                Self::PqSignMlDsa65 => "PQ_SIGN_ML_DSA_65",
                Self::PqSignSlhDsaSha2128s => "PQ_SIGN_SLH_DSA_SHA2_128S",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED" => Some(Self::Unspecified),
                "GOOGLE_SYMMETRIC_ENCRYPTION" => Some(Self::GoogleSymmetricEncryption),
                "AES_128_GCM" => Some(Self::Aes128Gcm),
                "AES_256_GCM" => Some(Self::Aes256Gcm),
                "AES_128_CBC" => Some(Self::Aes128Cbc),
                "AES_256_CBC" => Some(Self::Aes256Cbc),
                "AES_128_CTR" => Some(Self::Aes128Ctr),
                "AES_256_CTR" => Some(Self::Aes256Ctr),
                "RSA_SIGN_PSS_2048_SHA256" => Some(Self::RsaSignPss2048Sha256),
                "RSA_SIGN_PSS_3072_SHA256" => Some(Self::RsaSignPss3072Sha256),
                "RSA_SIGN_PSS_4096_SHA256" => Some(Self::RsaSignPss4096Sha256),
                "RSA_SIGN_PSS_4096_SHA512" => Some(Self::RsaSignPss4096Sha512),
                "RSA_SIGN_PKCS1_2048_SHA256" => Some(Self::RsaSignPkcs12048Sha256),
                "RSA_SIGN_PKCS1_3072_SHA256" => Some(Self::RsaSignPkcs13072Sha256),
                "RSA_SIGN_PKCS1_4096_SHA256" => Some(Self::RsaSignPkcs14096Sha256),
                "RSA_SIGN_PKCS1_4096_SHA512" => Some(Self::RsaSignPkcs14096Sha512),
                "RSA_SIGN_RAW_PKCS1_2048" => Some(Self::RsaSignRawPkcs12048),
                "RSA_SIGN_RAW_PKCS1_3072" => Some(Self::RsaSignRawPkcs13072),
                "RSA_SIGN_RAW_PKCS1_4096" => Some(Self::RsaSignRawPkcs14096),
                "RSA_DECRYPT_OAEP_2048_SHA256" => Some(Self::RsaDecryptOaep2048Sha256),
                "RSA_DECRYPT_OAEP_3072_SHA256" => Some(Self::RsaDecryptOaep3072Sha256),
                "RSA_DECRYPT_OAEP_4096_SHA256" => Some(Self::RsaDecryptOaep4096Sha256),
                "RSA_DECRYPT_OAEP_4096_SHA512" => Some(Self::RsaDecryptOaep4096Sha512),
                "RSA_DECRYPT_OAEP_2048_SHA1" => Some(Self::RsaDecryptOaep2048Sha1),
                "RSA_DECRYPT_OAEP_3072_SHA1" => Some(Self::RsaDecryptOaep3072Sha1),
                "RSA_DECRYPT_OAEP_4096_SHA1" => Some(Self::RsaDecryptOaep4096Sha1),
                "EC_SIGN_P256_SHA256" => Some(Self::EcSignP256Sha256),
                "EC_SIGN_P384_SHA384" => Some(Self::EcSignP384Sha384),
                "EC_SIGN_SECP256K1_SHA256" => Some(Self::EcSignSecp256k1Sha256),
                "EC_SIGN_ED25519" => Some(Self::EcSignEd25519),
                "HMAC_SHA256" => Some(Self::HmacSha256),
                "HMAC_SHA1" => Some(Self::HmacSha1),
                "HMAC_SHA384" => Some(Self::HmacSha384),
                "HMAC_SHA512" => Some(Self::HmacSha512),
                "HMAC_SHA224" => Some(Self::HmacSha224),
                "EXTERNAL_SYMMETRIC_ENCRYPTION" => {
                    Some(Self::ExternalSymmetricEncryption)
                }
                "PQ_SIGN_ML_DSA_65" => Some(Self::PqSignMlDsa65),
                "PQ_SIGN_SLH_DSA_SHA2_128S" => Some(Self::PqSignSlhDsaSha2128s),
                _ => None,
            }
        }
    }
    /// The state of a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\],
    /// indicating if it can be used.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum CryptoKeyVersionState {
        /// Not specified.
        Unspecified = 0,
        /// This version is still being generated. It may not be used, enabled,
        /// disabled, or destroyed yet. Cloud KMS will automatically mark this
        /// version
        /// \[ENABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED\]
        /// as soon as the version is ready.
        PendingGeneration = 5,
        /// This version may be used for cryptographic operations.
        Enabled = 1,
        /// This version may not be used, but the key material is still available,
        /// and the version can be placed back into the
        /// \[ENABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED\]
        /// state.
        Disabled = 2,
        /// The key material of this version is destroyed and no longer stored.
        /// This version may only become
        /// \[ENABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED\]
        /// again if this version is
        /// \[reimport_eligible\]\[google.cloud.kms.v1.CryptoKeyVersion.reimport_eligible\]
        /// and the original key material is reimported with a call to
        /// \[KeyManagementService.ImportCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion\].
        Destroyed = 3,
        /// This version is scheduled for destruction, and will be destroyed soon.
        /// Call
        /// \[RestoreCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion\]
        /// to put it back into the
        /// \[DISABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED\]
        /// state.
        DestroyScheduled = 4,
        /// This version is still being imported. It may not be used, enabled,
        /// disabled, or destroyed yet. Cloud KMS will automatically mark this
        /// version
        /// \[ENABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED\]
        /// as soon as the version is ready.
        PendingImport = 6,
        /// This version was not imported successfully. It may not be used, enabled,
        /// disabled, or destroyed. The submitted key material has been discarded.
        /// Additional details can be found in
        /// \[CryptoKeyVersion.import_failure_reason\]\[google.cloud.kms.v1.CryptoKeyVersion.import_failure_reason\].
        ImportFailed = 7,
        /// This version was not generated successfully. It may not be used, enabled,
        /// disabled, or destroyed. Additional details can be found in
        /// \[CryptoKeyVersion.generation_failure_reason\]\[google.cloud.kms.v1.CryptoKeyVersion.generation_failure_reason\].
        GenerationFailed = 8,
        /// This version was destroyed, and it may not be used or enabled again.
        /// Cloud KMS is waiting for the corresponding key material residing in an
        /// external key manager to be destroyed.
        PendingExternalDestruction = 9,
        /// This version was destroyed, and it may not be used or enabled again.
        /// However, Cloud KMS could not confirm that the corresponding key material
        /// residing in an external key manager was destroyed. Additional details can
        /// be found in
        /// \[CryptoKeyVersion.external_destruction_failure_reason\]\[google.cloud.kms.v1.CryptoKeyVersion.external_destruction_failure_reason\].
        ExternalDestructionFailed = 10,
    }
    impl CryptoKeyVersionState {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "CRYPTO_KEY_VERSION_STATE_UNSPECIFIED",
                Self::PendingGeneration => "PENDING_GENERATION",
                Self::Enabled => "ENABLED",
                Self::Disabled => "DISABLED",
                Self::Destroyed => "DESTROYED",
                Self::DestroyScheduled => "DESTROY_SCHEDULED",
                Self::PendingImport => "PENDING_IMPORT",
                Self::ImportFailed => "IMPORT_FAILED",
                Self::GenerationFailed => "GENERATION_FAILED",
                Self::PendingExternalDestruction => "PENDING_EXTERNAL_DESTRUCTION",
                Self::ExternalDestructionFailed => "EXTERNAL_DESTRUCTION_FAILED",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "CRYPTO_KEY_VERSION_STATE_UNSPECIFIED" => Some(Self::Unspecified),
                "PENDING_GENERATION" => Some(Self::PendingGeneration),
                "ENABLED" => Some(Self::Enabled),
                "DISABLED" => Some(Self::Disabled),
                "DESTROYED" => Some(Self::Destroyed),
                "DESTROY_SCHEDULED" => Some(Self::DestroyScheduled),
                "PENDING_IMPORT" => Some(Self::PendingImport),
                "IMPORT_FAILED" => Some(Self::ImportFailed),
                "GENERATION_FAILED" => Some(Self::GenerationFailed),
                "PENDING_EXTERNAL_DESTRUCTION" => Some(Self::PendingExternalDestruction),
                "EXTERNAL_DESTRUCTION_FAILED" => Some(Self::ExternalDestructionFailed),
                _ => None,
            }
        }
    }
    /// A view for \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]s.
    /// Controls the level of detail returned for
    /// \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\] in
    /// \[KeyManagementService.ListCryptoKeyVersions\]\[google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions\]
    /// and
    /// \[KeyManagementService.ListCryptoKeys\]\[google.cloud.kms.v1.KeyManagementService.ListCryptoKeys\].
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum CryptoKeyVersionView {
        /// Default view for each
        /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]. Does not
        /// include the
        /// \[attestation\]\[google.cloud.kms.v1.CryptoKeyVersion.attestation\] field.
        Unspecified = 0,
        /// Provides all fields in each
        /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\], including the
        /// \[attestation\]\[google.cloud.kms.v1.CryptoKeyVersion.attestation\].
        Full = 1,
    }
    impl CryptoKeyVersionView {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED",
                Self::Full => "FULL",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED" => Some(Self::Unspecified),
                "FULL" => Some(Self::Full),
                _ => None,
            }
        }
    }
}
/// Data with integrity verification field.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ChecksummedData {
    /// Raw Data.
    #[prost(bytes = "vec", tag = "3")]
    pub data: ::prost::alloc::vec::Vec<u8>,
    /// Integrity verification field. A CRC32C
    /// checksum of the returned
    /// \[ChecksummedData.data\]\[google.cloud.kms.v1.ChecksummedData.data\]. An
    /// integrity check of
    /// \[ChecksummedData.data\]\[google.cloud.kms.v1.ChecksummedData.data\] can be
    /// performed by computing the CRC32C checksum of
    /// \[ChecksummedData.data\]\[google.cloud.kms.v1.ChecksummedData.data\] and
    /// comparing your results to this field. Discard the response in case of
    /// non-matching checksum values, and perform a limited number of retries. A
    /// persistent mismatch may indicate an issue in your computation of the CRC32C
    /// checksum. Note: This field is defined as int64 for reasons of compatibility
    /// across different languages. However, it is a non-negative integer, which
    /// will never exceed `2^32-1`, and can be safely downconverted to uint32 in
    /// languages that support this type.
    #[prost(message, optional, tag = "2")]
    pub crc32c_checksum: ::core::option::Option<i64>,
}
/// The public keys for a given
/// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]. Obtained via
/// \[GetPublicKey\]\[google.cloud.kms.v1.KeyManagementService.GetPublicKey\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct PublicKey {
    /// The public key, encoded in PEM format. For more information, see the
    /// [RFC 7468](<https://tools.ietf.org/html/rfc7468>) sections for
    /// [General Considerations](<https://tools.ietf.org/html/rfc7468#section-2>) and
    /// \[Textual Encoding of Subject Public Key Info\]
    /// (<https://tools.ietf.org/html/rfc7468#section-13>).
    #[prost(string, tag = "1")]
    pub pem: ::prost::alloc::string::String,
    /// The
    /// \[Algorithm\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm\]
    /// associated with this key.
    #[prost(enumeration = "crypto_key_version::CryptoKeyVersionAlgorithm", tag = "2")]
    pub algorithm: i32,
    /// Integrity verification field. A CRC32C checksum of the returned
    /// \[PublicKey.pem\]\[google.cloud.kms.v1.PublicKey.pem\]. An integrity check of
    /// \[PublicKey.pem\]\[google.cloud.kms.v1.PublicKey.pem\] can be performed by
    /// computing the CRC32C checksum of
    /// \[PublicKey.pem\]\[google.cloud.kms.v1.PublicKey.pem\] and comparing your
    /// results to this field. Discard the response in case of non-matching
    /// checksum values, and perform a limited number of retries. A persistent
    /// mismatch may indicate an issue in your computation of the CRC32C checksum.
    /// Note: This field is defined as int64 for reasons of compatibility across
    /// different languages. However, it is a non-negative integer, which will
    /// never exceed `2^32-1`, and can be safely downconverted to uint32 in
    /// languages that support this type.
    ///
    /// NOTE: This field is in Beta.
    #[prost(message, optional, tag = "3")]
    pub pem_crc32c: ::core::option::Option<i64>,
    /// The \[name\]\[google.cloud.kms.v1.CryptoKeyVersion.name\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] public key.
    /// Provided here for verification.
    ///
    /// NOTE: This field is in Beta.
    #[prost(string, tag = "4")]
    pub name: ::prost::alloc::string::String,
    /// The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] public key.
    #[prost(enumeration = "ProtectionLevel", tag = "5")]
    pub protection_level: i32,
    /// The \[PublicKey\]\[google.cloud.kms.v1.PublicKey\] format specified by the
    /// customer through the
    /// \[public_key_format\]\[google.cloud.kms.v1.GetPublicKeyRequest.public_key_format\]
    /// field.
    #[prost(enumeration = "public_key::PublicKeyFormat", tag = "7")]
    pub public_key_format: i32,
    /// This field contains the public key (with integrity verification), formatted
    /// according to the
    /// \[public_key_format\]\[google.cloud.kms.v1.PublicKey.public_key_format\] field.
    #[prost(message, optional, tag = "8")]
    pub public_key: ::core::option::Option<ChecksummedData>,
}
/// Nested message and enum types in `PublicKey`.
pub mod public_key {
    /// The supported \[PublicKey\]\[google.cloud.kms.v1.PublicKey\] formats.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum PublicKeyFormat {
        /// If the
        /// \[public_key_format\]\[google.cloud.kms.v1.GetPublicKeyRequest.public_key_format\]
        /// field is not specified:
        ///
        /// * For PQC algorithms, an error will be returned.
        /// * For non-PQC algorithms, the default format is PEM, and the field
        ///   \[pem\]\[google.cloud.kms.v1.PublicKey.pem\] will be populated.
        ///
        /// Otherwise, the public key will be exported through the
        /// \[public_key\]\[google.cloud.kms.v1.PublicKey.public_key\] field in the
        /// requested format.
        Unspecified = 0,
        /// The returned public key will be encoded in PEM format.
        /// See the [RFC7468](<https://tools.ietf.org/html/rfc7468>) sections for
        /// [General Considerations](<https://tools.ietf.org/html/rfc7468#section-2>)
        /// and \[Textual Encoding of Subject Public Key Info\]
        /// (<https://tools.ietf.org/html/rfc7468#section-13>) for more information.
        Pem = 1,
        /// This is supported only for PQC algorithms.
        /// The key material is returned in the format defined by NIST PQC
        /// standards (FIPS 203, FIPS 204, and FIPS 205).
        NistPqc = 3,
    }
    impl PublicKeyFormat {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "PUBLIC_KEY_FORMAT_UNSPECIFIED",
                Self::Pem => "PEM",
                Self::NistPqc => "NIST_PQC",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "PUBLIC_KEY_FORMAT_UNSPECIFIED" => Some(Self::Unspecified),
                "PEM" => Some(Self::Pem),
                "NIST_PQC" => Some(Self::NistPqc),
                _ => None,
            }
        }
    }
}
/// An \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] can be used to create
/// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] and
/// \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\] using pre-existing
/// key material, generated outside of Cloud KMS.
///
/// When an \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] is created, Cloud KMS will
/// generate a "wrapping key", which is a public/private key pair. You use the
/// wrapping key to encrypt (also known as wrap) the pre-existing key material to
/// protect it during the import process. The nature of the wrapping key depends
/// on the choice of
/// \[import_method\]\[google.cloud.kms.v1.ImportJob.import_method\]. When the
/// wrapping key generation is complete, the
/// \[state\]\[google.cloud.kms.v1.ImportJob.state\] will be set to
/// \[ACTIVE\]\[google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE\] and the
/// \[public_key\]\[google.cloud.kms.v1.ImportJob.public_key\] can be fetched. The
/// fetched public key can then be used to wrap your pre-existing key material.
///
/// Once the key material is wrapped, it can be imported into a new
/// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] in an existing
/// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] by calling
/// \[ImportCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion\].
/// Multiple \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\] can be
/// imported with a single \[ImportJob\]\[google.cloud.kms.v1.ImportJob\]. Cloud KMS
/// uses the private key portion of the wrapping key to unwrap the key material.
/// Only Cloud KMS has access to the private key.
///
/// An \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] expires 3 days after it is
/// created. Once expired, Cloud KMS will no longer be able to import or unwrap
/// any key material that was wrapped with the
/// \[ImportJob\]\[google.cloud.kms.v1.ImportJob\]'s public key.
///
/// For more information, see
/// [Importing a key](<https://cloud.google.com/kms/docs/importing-a-key>).
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ImportJob {
    /// Output only. The resource name for this
    /// \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] in the format
    /// `projects/*/locations/*/keyRings/*/importJobs/*`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Required. Immutable. The wrapping method to be used for incoming key
    /// material.
    #[prost(enumeration = "import_job::ImportMethod", tag = "2")]
    pub import_method: i32,
    /// Required. Immutable. The protection level of the
    /// \[ImportJob\]\[google.cloud.kms.v1.ImportJob\]. This must match the
    /// \[protection_level\]\[google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level\]
    /// of the \[version_template\]\[google.cloud.kms.v1.CryptoKey.version_template\]
    /// on the \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] you attempt to import
    /// into.
    #[prost(enumeration = "ProtectionLevel", tag = "9")]
    pub protection_level: i32,
    /// Output only. The time at which this
    /// \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] was created.
    #[prost(message, optional, tag = "3")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The time this \[ImportJob\]\[google.cloud.kms.v1.ImportJob\]'s key
    /// material was generated.
    #[prost(message, optional, tag = "4")]
    pub generate_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The time at which this
    /// \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] is scheduled for expiration and
    /// can no longer be used to import key material.
    #[prost(message, optional, tag = "5")]
    pub expire_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The time this \[ImportJob\]\[google.cloud.kms.v1.ImportJob\]
    /// expired. Only present if \[state\]\[google.cloud.kms.v1.ImportJob.state\] is
    /// \[EXPIRED\]\[google.cloud.kms.v1.ImportJob.ImportJobState.EXPIRED\].
    #[prost(message, optional, tag = "10")]
    pub expire_event_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The current state of the
    /// \[ImportJob\]\[google.cloud.kms.v1.ImportJob\], indicating if it can be used.
    #[prost(enumeration = "import_job::ImportJobState", tag = "6")]
    pub state: i32,
    /// Output only. The public key with which to wrap key material prior to
    /// import. Only returned if \[state\]\[google.cloud.kms.v1.ImportJob.state\] is
    /// \[ACTIVE\]\[google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE\].
    #[prost(message, optional, tag = "7")]
    pub public_key: ::core::option::Option<import_job::WrappingPublicKey>,
    /// Output only. Statement that was generated and signed by the key creator
    /// (for example, an HSM) at key creation time. Use this statement to verify
    /// attributes of the key as stored on the HSM, independently of Google.
    /// Only present if the chosen
    /// \[ImportMethod\]\[google.cloud.kms.v1.ImportJob.ImportMethod\] is one with a
    /// protection level of \[HSM\]\[google.cloud.kms.v1.ProtectionLevel.HSM\].
    #[prost(message, optional, tag = "8")]
    pub attestation: ::core::option::Option<KeyOperationAttestation>,
}
/// Nested message and enum types in `ImportJob`.
pub mod import_job {
    /// The public key component of the wrapping key. For details of the type of
    /// key this public key corresponds to, see the
    /// \[ImportMethod\]\[google.cloud.kms.v1.ImportJob.ImportMethod\].
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct WrappingPublicKey {
        /// The public key, encoded in PEM format. For more information, see the [RFC
        /// 7468](<https://tools.ietf.org/html/rfc7468>) sections for [General
        /// Considerations](<https://tools.ietf.org/html/rfc7468#section-2>) and
        /// \[Textual Encoding of Subject Public Key Info\]
        /// (<https://tools.ietf.org/html/rfc7468#section-13>).
        #[prost(string, tag = "1")]
        pub pem: ::prost::alloc::string::String,
    }
    /// \[ImportMethod\]\[google.cloud.kms.v1.ImportJob.ImportMethod\] describes the
    /// key wrapping method chosen for this
    /// \[ImportJob\]\[google.cloud.kms.v1.ImportJob\].
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum ImportMethod {
        /// Not specified.
        Unspecified = 0,
        /// This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
        /// scheme defined in the PKCS #11 standard. In summary, this involves
        /// wrapping the raw key with an ephemeral AES key, and wrapping the
        /// ephemeral AES key with a 3072 bit RSA key. For more details, see
        /// [RSA AES key wrap
        /// mechanism](<http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908>).
        RsaOaep3072Sha1Aes256 = 1,
        /// This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
        /// scheme defined in the PKCS #11 standard. In summary, this involves
        /// wrapping the raw key with an ephemeral AES key, and wrapping the
        /// ephemeral AES key with a 4096 bit RSA key. For more details, see
        /// [RSA AES key wrap
        /// mechanism](<http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908>).
        RsaOaep4096Sha1Aes256 = 2,
        /// This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
        /// scheme defined in the PKCS #11 standard. In summary, this involves
        /// wrapping the raw key with an ephemeral AES key, and wrapping the
        /// ephemeral AES key with a 3072 bit RSA key. For more details, see
        /// [RSA AES key wrap
        /// mechanism](<http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908>).
        RsaOaep3072Sha256Aes256 = 3,
        /// This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
        /// scheme defined in the PKCS #11 standard. In summary, this involves
        /// wrapping the raw key with an ephemeral AES key, and wrapping the
        /// ephemeral AES key with a 4096 bit RSA key. For more details, see
        /// [RSA AES key wrap
        /// mechanism](<http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908>).
        RsaOaep4096Sha256Aes256 = 4,
        /// This ImportMethod represents RSAES-OAEP with a 3072 bit RSA key. The
        /// key material to be imported is wrapped directly with the RSA key. Due
        /// to technical limitations of RSA wrapping, this method cannot be used to
        /// wrap RSA keys for import.
        RsaOaep3072Sha256 = 5,
        /// This ImportMethod represents RSAES-OAEP with a 4096 bit RSA key. The
        /// key material to be imported is wrapped directly with the RSA key. Due
        /// to technical limitations of RSA wrapping, this method cannot be used to
        /// wrap RSA keys for import.
        RsaOaep4096Sha256 = 6,
    }
    impl ImportMethod {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "IMPORT_METHOD_UNSPECIFIED",
                Self::RsaOaep3072Sha1Aes256 => "RSA_OAEP_3072_SHA1_AES_256",
                Self::RsaOaep4096Sha1Aes256 => "RSA_OAEP_4096_SHA1_AES_256",
                Self::RsaOaep3072Sha256Aes256 => "RSA_OAEP_3072_SHA256_AES_256",
                Self::RsaOaep4096Sha256Aes256 => "RSA_OAEP_4096_SHA256_AES_256",
                Self::RsaOaep3072Sha256 => "RSA_OAEP_3072_SHA256",
                Self::RsaOaep4096Sha256 => "RSA_OAEP_4096_SHA256",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "IMPORT_METHOD_UNSPECIFIED" => Some(Self::Unspecified),
                "RSA_OAEP_3072_SHA1_AES_256" => Some(Self::RsaOaep3072Sha1Aes256),
                "RSA_OAEP_4096_SHA1_AES_256" => Some(Self::RsaOaep4096Sha1Aes256),
                "RSA_OAEP_3072_SHA256_AES_256" => Some(Self::RsaOaep3072Sha256Aes256),
                "RSA_OAEP_4096_SHA256_AES_256" => Some(Self::RsaOaep4096Sha256Aes256),
                "RSA_OAEP_3072_SHA256" => Some(Self::RsaOaep3072Sha256),
                "RSA_OAEP_4096_SHA256" => Some(Self::RsaOaep4096Sha256),
                _ => None,
            }
        }
    }
    /// The state of the \[ImportJob\]\[google.cloud.kms.v1.ImportJob\], indicating if
    /// it can be used.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum ImportJobState {
        /// Not specified.
        Unspecified = 0,
        /// The wrapping key for this job is still being generated. It may not be
        /// used. Cloud KMS will automatically mark this job as
        /// \[ACTIVE\]\[google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE\] as soon as
        /// the wrapping key is generated.
        PendingGeneration = 1,
        /// This job may be used in
        /// \[CreateCryptoKey\]\[google.cloud.kms.v1.KeyManagementService.CreateCryptoKey\]
        /// and
        /// \[CreateCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion\]
        /// requests.
        Active = 2,
        /// This job can no longer be used and may not leave this state once entered.
        Expired = 3,
    }
    impl ImportJobState {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "IMPORT_JOB_STATE_UNSPECIFIED",
                Self::PendingGeneration => "PENDING_GENERATION",
                Self::Active => "ACTIVE",
                Self::Expired => "EXPIRED",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "IMPORT_JOB_STATE_UNSPECIFIED" => Some(Self::Unspecified),
                "PENDING_GENERATION" => Some(Self::PendingGeneration),
                "ACTIVE" => Some(Self::Active),
                "EXPIRED" => Some(Self::Expired),
                _ => None,
            }
        }
    }
}
/// ExternalProtectionLevelOptions stores a group of additional fields for
/// configuring a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] that
/// are specific to the \[EXTERNAL\]\[google.cloud.kms.v1.ProtectionLevel.EXTERNAL\]
/// protection level and
/// \[EXTERNAL_VPC\]\[google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC\] protection
/// levels.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ExternalProtectionLevelOptions {
    /// The URI for an external resource that this
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] represents.
    #[prost(string, tag = "1")]
    pub external_key_uri: ::prost::alloc::string::String,
    /// The path to the external key material on the EKM when using
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] e.g., "v0/my/key". Set
    /// this field instead of external_key_uri when using an
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\].
    #[prost(string, tag = "2")]
    pub ekm_connection_key_path: ::prost::alloc::string::String,
}
/// A
/// \[KeyAccessJustificationsPolicy\]\[google.cloud.kms.v1.KeyAccessJustificationsPolicy\]
/// specifies zero or more allowed
/// \[AccessReason\]\[google.cloud.kms.v1.AccessReason\] values for encrypt, decrypt,
/// and sign operations on a \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct KeyAccessJustificationsPolicy {
    /// The list of allowed reasons for access to a
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\]. Zero allowed access reasons
    /// means all encrypt, decrypt, and sign operations for the
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] associated with this policy will
    /// fail.
    #[prost(enumeration = "AccessReason", repeated, tag = "1")]
    pub allowed_access_reasons: ::prost::alloc::vec::Vec<i32>,
}
/// \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] specifies how
/// cryptographic operations are performed. For more information, see \[Protection
/// levels\] (<https://cloud.google.com/kms/docs/algorithms#protection_levels>).
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum ProtectionLevel {
    /// Not specified.
    Unspecified = 0,
    /// Crypto operations are performed in software.
    Software = 1,
    /// Crypto operations are performed in a Hardware Security Module.
    Hsm = 2,
    /// Crypto operations are performed by an external key manager.
    External = 3,
    /// Crypto operations are performed in an EKM-over-VPC backend.
    ExternalVpc = 4,
}
impl ProtectionLevel {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "PROTECTION_LEVEL_UNSPECIFIED",
            Self::Software => "SOFTWARE",
            Self::Hsm => "HSM",
            Self::External => "EXTERNAL",
            Self::ExternalVpc => "EXTERNAL_VPC",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "PROTECTION_LEVEL_UNSPECIFIED" => Some(Self::Unspecified),
            "SOFTWARE" => Some(Self::Software),
            "HSM" => Some(Self::Hsm),
            "EXTERNAL" => Some(Self::External),
            "EXTERNAL_VPC" => Some(Self::ExternalVpc),
            _ => None,
        }
    }
}
/// Describes the reason for a data access. Please refer to
/// <https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes>
/// for the detailed semantic meaning of justification reason codes.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum AccessReason {
    /// Unspecified access reason.
    ReasonUnspecified = 0,
    /// Customer-initiated support.
    CustomerInitiatedSupport = 1,
    /// Google-initiated access for system management and troubleshooting.
    GoogleInitiatedService = 2,
    /// Google-initiated access in response to a legal request or legal process.
    ThirdPartyDataRequest = 3,
    /// Google-initiated access for security, fraud, abuse, or compliance purposes.
    GoogleInitiatedReview = 4,
    /// Customer uses their account to perform any access to their own data which
    /// their IAM policy authorizes.
    CustomerInitiatedAccess = 5,
    /// Google systems access customer data to help optimize the structure of the
    /// data or quality for future uses by the customer.
    GoogleInitiatedSystemOperation = 6,
    /// No reason is expected for this key request.
    ReasonNotExpected = 7,
    /// Customer uses their account to perform any access to their own data which
    /// their IAM policy authorizes, and one of the following is true:
    ///
    /// * A Google administrator has reset the root-access account associated with
    ///   the user's organization within the past 7 days.
    /// * A Google-initiated emergency access operation has interacted with a
    ///   resource in the same project or folder as the currently accessed resource
    ///   within the past 7 days.
    ModifiedCustomerInitiatedAccess = 8,
    /// Google systems access customer data to help optimize the structure of the
    /// data or quality for future uses by the customer, and one of the following
    /// is true:
    ///
    /// * A Google administrator has reset the root-access account associated with
    ///   the user's organization within the past 7 days.
    /// * A Google-initiated emergency access operation has interacted with a
    ///   resource in the same project or folder as the currently accessed resource
    ///   within the past 7 days.
    ModifiedGoogleInitiatedSystemOperation = 9,
    /// Google-initiated access to maintain system reliability.
    GoogleResponseToProductionAlert = 10,
    /// One of the following operations is being executed while simultaneously
    /// encountering an internal technical issue which prevented a more precise
    /// justification code from being generated:
    ///
    /// * Your account has been used to perform any access to your own data which
    ///   your IAM policy authorizes.
    /// * An automated Google system operates on encrypted customer data which your
    ///   IAM policy authorizes.
    /// * Customer-initiated Google support access.
    /// * Google-initiated support access to protect system reliability.
    CustomerAuthorizedWorkflowServicing = 11,
}
impl AccessReason {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::ReasonUnspecified => "REASON_UNSPECIFIED",
            Self::CustomerInitiatedSupport => "CUSTOMER_INITIATED_SUPPORT",
            Self::GoogleInitiatedService => "GOOGLE_INITIATED_SERVICE",
            Self::ThirdPartyDataRequest => "THIRD_PARTY_DATA_REQUEST",
            Self::GoogleInitiatedReview => "GOOGLE_INITIATED_REVIEW",
            Self::CustomerInitiatedAccess => "CUSTOMER_INITIATED_ACCESS",
            Self::GoogleInitiatedSystemOperation => "GOOGLE_INITIATED_SYSTEM_OPERATION",
            Self::ReasonNotExpected => "REASON_NOT_EXPECTED",
            Self::ModifiedCustomerInitiatedAccess => "MODIFIED_CUSTOMER_INITIATED_ACCESS",
            Self::ModifiedGoogleInitiatedSystemOperation => {
                "MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION"
            }
            Self::GoogleResponseToProductionAlert => {
                "GOOGLE_RESPONSE_TO_PRODUCTION_ALERT"
            }
            Self::CustomerAuthorizedWorkflowServicing => {
                "CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING"
            }
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "REASON_UNSPECIFIED" => Some(Self::ReasonUnspecified),
            "CUSTOMER_INITIATED_SUPPORT" => Some(Self::CustomerInitiatedSupport),
            "GOOGLE_INITIATED_SERVICE" => Some(Self::GoogleInitiatedService),
            "THIRD_PARTY_DATA_REQUEST" => Some(Self::ThirdPartyDataRequest),
            "GOOGLE_INITIATED_REVIEW" => Some(Self::GoogleInitiatedReview),
            "CUSTOMER_INITIATED_ACCESS" => Some(Self::CustomerInitiatedAccess),
            "GOOGLE_INITIATED_SYSTEM_OPERATION" => {
                Some(Self::GoogleInitiatedSystemOperation)
            }
            "REASON_NOT_EXPECTED" => Some(Self::ReasonNotExpected),
            "MODIFIED_CUSTOMER_INITIATED_ACCESS" => {
                Some(Self::ModifiedCustomerInitiatedAccess)
            }
            "MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION" => {
                Some(Self::ModifiedGoogleInitiatedSystemOperation)
            }
            "GOOGLE_RESPONSE_TO_PRODUCTION_ALERT" => {
                Some(Self::GoogleResponseToProductionAlert)
            }
            "CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING" => {
                Some(Self::CustomerAuthorizedWorkflowServicing)
            }
            _ => None,
        }
    }
}
/// Request message for
/// \[Autokey.CreateKeyHandle\]\[google.cloud.kms.v1.Autokey.CreateKeyHandle\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateKeyHandleRequest {
    /// Required. Name of the resource project and location to create the
    /// \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\] in, e.g.
    /// `projects/{PROJECT_ID}/locations/{LOCATION}`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. Id of the \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\]. Must be
    /// unique to the resource project and location. If not provided by the caller,
    /// a new UUID is used.
    #[prost(string, tag = "2")]
    pub key_handle_id: ::prost::alloc::string::String,
    /// Required. \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\] to create.
    #[prost(message, optional, tag = "3")]
    pub key_handle: ::core::option::Option<KeyHandle>,
}
/// Request message for \[GetKeyHandle\]\[google.cloud.kms.v1.Autokey.GetKeyHandle\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetKeyHandleRequest {
    /// Required. Name of the \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\] resource,
    /// e.g.
    /// `projects/{PROJECT_ID}/locations/{LOCATION}/keyHandles/{KEY_HANDLE_ID}`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Resource-oriented representation of a request to Cloud KMS Autokey and the
/// resulting provisioning of a \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct KeyHandle {
    /// Identifier. Name of the \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\]
    /// resource, e.g.
    /// `projects/{PROJECT_ID}/locations/{LOCATION}/keyHandles/{KEY_HANDLE_ID}`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Output only. Name of a \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] that has
    /// been provisioned for Customer Managed Encryption Key (CMEK) use in the
    /// \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\] project and location for the
    /// requested resource type. The \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\]
    /// project will reflect the value configured in the
    /// \[AutokeyConfig\]\[google.cloud.kms.v1.AutokeyConfig\] on the resource
    /// project's ancestor folder at the time of the
    /// \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\] creation. If more than one
    /// ancestor folder has a configured
    /// \[AutokeyConfig\]\[google.cloud.kms.v1.AutokeyConfig\], the nearest of these
    /// configurations is used.
    #[prost(string, tag = "3")]
    pub kms_key: ::prost::alloc::string::String,
    /// Required. Indicates the resource type that the resulting
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] is meant to protect, e.g.
    /// `{SERVICE}.googleapis.com/{TYPE}`. See documentation for supported resource
    /// types.
    #[prost(string, tag = "4")]
    pub resource_type_selector: ::prost::alloc::string::String,
}
/// Metadata message for
/// \[CreateKeyHandle\]\[google.cloud.kms.v1.Autokey.CreateKeyHandle\] long-running
/// operation response.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateKeyHandleMetadata {}
/// Request message for
/// \[Autokey.ListKeyHandles\]\[google.cloud.kms.v1.Autokey.ListKeyHandles\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListKeyHandlesRequest {
    /// Required. Name of the resource project and location from which to list
    /// \[KeyHandles\]\[google.cloud.kms.v1.KeyHandle\], e.g.
    /// `projects/{PROJECT_ID}/locations/{LOCATION}`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. Optional limit on the number of
    /// \[KeyHandles\]\[google.cloud.kms.v1.KeyHandle\] to include in the response. The
    /// service may return fewer than this value. Further
    /// \[KeyHandles\]\[google.cloud.kms.v1.KeyHandle\] can subsequently be obtained by
    /// including the
    /// \[ListKeyHandlesResponse.next_page_token\]\[google.cloud.kms.v1.ListKeyHandlesResponse.next_page_token\]
    /// in a subsequent request.  If unspecified, at most 100
    /// \[KeyHandles\]\[google.cloud.kms.v1.KeyHandle\] will be returned.
    #[prost(int32, tag = "2")]
    pub page_size: i32,
    /// Optional. Optional pagination token, returned earlier via
    /// \[ListKeyHandlesResponse.next_page_token\]\[google.cloud.kms.v1.ListKeyHandlesResponse.next_page_token\].
    #[prost(string, tag = "3")]
    pub page_token: ::prost::alloc::string::String,
    /// Optional. Filter to apply when listing
    /// \[KeyHandles\]\[google.cloud.kms.v1.KeyHandle\], e.g.
    /// `resource_type_selector="{SERVICE}.googleapis.com/{TYPE}"`.
    #[prost(string, tag = "4")]
    pub filter: ::prost::alloc::string::String,
}
/// Response message for
/// \[Autokey.ListKeyHandles\]\[google.cloud.kms.v1.Autokey.ListKeyHandles\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListKeyHandlesResponse {
    /// Resulting \[KeyHandles\]\[google.cloud.kms.v1.KeyHandle\].
    #[prost(message, repeated, tag = "1")]
    pub key_handles: ::prost::alloc::vec::Vec<KeyHandle>,
    /// A token to retrieve next page of results. Pass this value in
    /// \[ListKeyHandlesRequest.page_token\]\[google.cloud.kms.v1.ListKeyHandlesRequest.page_token\]
    /// to retrieve the next page of results.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
}
/// Generated client implementations.
pub mod autokey_client {
    #![allow(
        unused_variables,
        dead_code,
        missing_docs,
        clippy::wildcard_imports,
        clippy::let_unit_value,
    )]
    use tonic::codegen::*;
    use tonic::codegen::http::Uri;
    /// Provides interfaces for using [Cloud KMS
    /// Autokey](https://cloud.google.com/kms/help/autokey) to provision new
    /// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\], ready for Customer Managed
    /// Encryption Key (CMEK) use, on-demand. To support certain client tooling, this
    /// feature is modeled around a \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\]
    /// resource: creating a \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\] in a resource
    /// project and given location triggers Cloud KMS Autokey to provision a
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] in the configured key project and
    /// the same location.
    ///
    /// Prior to use in a given resource project,
    /// \[UpdateAutokeyConfig\]\[google.cloud.kms.v1.AutokeyAdmin.UpdateAutokeyConfig\]
    /// should have been called on an ancestor folder, setting the key project where
    /// Cloud KMS Autokey should create new
    /// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\]. See documentation for additional
    /// prerequisites. To check what key project, if any, is currently configured on
    /// a resource project's ancestor folder, see
    /// \[ShowEffectiveAutokeyConfig\]\[google.cloud.kms.v1.AutokeyAdmin.ShowEffectiveAutokeyConfig\].
    #[derive(Debug, Clone)]
    pub struct AutokeyClient<T> {
        inner: tonic::client::Grpc<T>,
    }
    impl AutokeyClient<tonic::transport::Channel> {
        /// Attempt to create a new client by connecting to a given endpoint.
        pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
        where
            D: TryInto<tonic::transport::Endpoint>,
            D::Error: Into<StdError>,
        {
            let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
            Ok(Self::new(conn))
        }
    }
    impl<T> AutokeyClient<T>
    where
        T: tonic::client::GrpcService<tonic::body::Body>,
        T::Error: Into<StdError>,
        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
    {
        pub fn new(inner: T) -> Self {
            let inner = tonic::client::Grpc::new(inner);
            Self { inner }
        }
        pub fn with_origin(inner: T, origin: Uri) -> Self {
            let inner = tonic::client::Grpc::with_origin(inner, origin);
            Self { inner }
        }
        pub fn with_interceptor<F>(
            inner: T,
            interceptor: F,
        ) -> AutokeyClient<InterceptedService<T, F>>
        where
            F: tonic::service::Interceptor,
            T::ResponseBody: Default,
            T: tonic::codegen::Service<
                http::Request<tonic::body::Body>,
                Response = http::Response<
                    <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                >,
            >,
            <T as tonic::codegen::Service<
                http::Request<tonic::body::Body>,
            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
        {
            AutokeyClient::new(InterceptedService::new(inner, interceptor))
        }
        /// Compress requests with the given encoding.
        ///
        /// This requires the server to support it otherwise it might respond with an
        /// error.
        #[must_use]
        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.send_compressed(encoding);
            self
        }
        /// Enable decompressing responses.
        #[must_use]
        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.accept_compressed(encoding);
            self
        }
        /// Limits the maximum size of a decoded message.
        ///
        /// Default: `4MB`
        #[must_use]
        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_decoding_message_size(limit);
            self
        }
        /// Limits the maximum size of an encoded message.
        ///
        /// Default: `usize::MAX`
        #[must_use]
        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_encoding_message_size(limit);
            self
        }
        /// Creates a new \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\], triggering the
        /// provisioning of a new \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] for CMEK
        /// use with the given resource type in the configured key project and the same
        /// location. \[GetOperation\]\[google.longrunning.Operations.GetOperation\] should
        /// be used to resolve the resulting long-running operation and get the
        /// resulting \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\] and
        /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
        pub async fn create_key_handle(
            &mut self,
            request: impl tonic::IntoRequest<super::CreateKeyHandleRequest>,
        ) -> std::result::Result<
            tonic::Response<super::super::super::super::longrunning::Operation>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.Autokey/CreateKeyHandle",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new("google.cloud.kms.v1.Autokey", "CreateKeyHandle"),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns the \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\].
        pub async fn get_key_handle(
            &mut self,
            request: impl tonic::IntoRequest<super::GetKeyHandleRequest>,
        ) -> std::result::Result<tonic::Response<super::KeyHandle>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.Autokey/GetKeyHandle",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(GrpcMethod::new("google.cloud.kms.v1.Autokey", "GetKeyHandle"));
            self.inner.unary(req, path, codec).await
        }
        /// Lists \[KeyHandles\]\[google.cloud.kms.v1.KeyHandle\].
        pub async fn list_key_handles(
            &mut self,
            request: impl tonic::IntoRequest<super::ListKeyHandlesRequest>,
        ) -> std::result::Result<
            tonic::Response<super::ListKeyHandlesResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.Autokey/ListKeyHandles",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new("google.cloud.kms.v1.Autokey", "ListKeyHandles"),
                );
            self.inner.unary(req, path, codec).await
        }
    }
}
/// Request message for
/// \[UpdateAutokeyConfig\]\[google.cloud.kms.v1.AutokeyAdmin.UpdateAutokeyConfig\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateAutokeyConfigRequest {
    /// Required. \[AutokeyConfig\]\[google.cloud.kms.v1.AutokeyConfig\] with values to
    /// update.
    #[prost(message, optional, tag = "1")]
    pub autokey_config: ::core::option::Option<AutokeyConfig>,
    /// Required. Masks which fields of the
    /// \[AutokeyConfig\]\[google.cloud.kms.v1.AutokeyConfig\] to update, e.g.
    /// `keyProject`.
    #[prost(message, optional, tag = "2")]
    pub update_mask: ::core::option::Option<::prost_types::FieldMask>,
}
/// Request message for
/// \[GetAutokeyConfig\]\[google.cloud.kms.v1.AutokeyAdmin.GetAutokeyConfig\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetAutokeyConfigRequest {
    /// Required. Name of the \[AutokeyConfig\]\[google.cloud.kms.v1.AutokeyConfig\]
    /// resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Cloud KMS Autokey configuration for a folder.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AutokeyConfig {
    /// Identifier. Name of the \[AutokeyConfig\]\[google.cloud.kms.v1.AutokeyConfig\]
    /// resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Optional. Name of the key project, e.g. `projects/{PROJECT_ID}` or
    /// `projects/{PROJECT_NUMBER}`, where Cloud KMS Autokey will provision a new
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] when a
    /// \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\] is created. On
    /// \[UpdateAutokeyConfig\]\[google.cloud.kms.v1.AutokeyAdmin.UpdateAutokeyConfig\],
    /// the caller will require `cloudkms.cryptoKeys.setIamPolicy` permission on
    /// this key project. Once configured, for Cloud KMS Autokey to function
    /// properly, this key project must have the Cloud KMS API activated and the
    /// Cloud KMS Service Agent for this key project must be granted the
    /// `cloudkms.admin` role (or pertinent permissions). A request with an empty
    /// key project field will clear the configuration.
    #[prost(string, tag = "2")]
    pub key_project: ::prost::alloc::string::String,
    /// Output only. The state for the AutokeyConfig.
    #[prost(enumeration = "autokey_config::State", tag = "4")]
    pub state: i32,
    /// Optional. A checksum computed by the server based on the value of other
    /// fields. This may be sent on update requests to ensure that the client has
    /// an up-to-date value before proceeding. The request will be rejected with an
    /// ABORTED error on a mismatched etag.
    #[prost(string, tag = "6")]
    pub etag: ::prost::alloc::string::String,
}
/// Nested message and enum types in `AutokeyConfig`.
pub mod autokey_config {
    /// The states AutokeyConfig can be in.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum State {
        /// The state of the AutokeyConfig is unspecified.
        Unspecified = 0,
        /// The AutokeyConfig is currently active.
        Active = 1,
        /// A previously configured key project has been deleted and the current
        /// AutokeyConfig is unusable.
        KeyProjectDeleted = 2,
        /// The AutokeyConfig is not yet initialized or has been reset to its default
        /// uninitialized state.
        Uninitialized = 3,
    }
    impl State {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "STATE_UNSPECIFIED",
                Self::Active => "ACTIVE",
                Self::KeyProjectDeleted => "KEY_PROJECT_DELETED",
                Self::Uninitialized => "UNINITIALIZED",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "STATE_UNSPECIFIED" => Some(Self::Unspecified),
                "ACTIVE" => Some(Self::Active),
                "KEY_PROJECT_DELETED" => Some(Self::KeyProjectDeleted),
                "UNINITIALIZED" => Some(Self::Uninitialized),
                _ => None,
            }
        }
    }
}
/// Request message for
/// \[ShowEffectiveAutokeyConfig\]\[google.cloud.kms.v1.AutokeyAdmin.ShowEffectiveAutokeyConfig\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ShowEffectiveAutokeyConfigRequest {
    /// Required. Name of the resource project to the show effective Cloud KMS
    /// Autokey configuration for. This may be helpful for interrogating the effect
    /// of nested folder configurations on a given resource project.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
}
/// Response message for
/// \[ShowEffectiveAutokeyConfig\]\[google.cloud.kms.v1.AutokeyAdmin.ShowEffectiveAutokeyConfig\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ShowEffectiveAutokeyConfigResponse {
    /// Name of the key project configured in the resource project's folder
    /// ancestry.
    #[prost(string, tag = "1")]
    pub key_project: ::prost::alloc::string::String,
}
/// Generated client implementations.
pub mod autokey_admin_client {
    #![allow(
        unused_variables,
        dead_code,
        missing_docs,
        clippy::wildcard_imports,
        clippy::let_unit_value,
    )]
    use tonic::codegen::*;
    use tonic::codegen::http::Uri;
    /// Provides interfaces for managing [Cloud KMS
    /// Autokey](https://cloud.google.com/kms/help/autokey) folder-level
    /// configurations. A configuration is inherited by all descendent projects. A
    /// configuration at one folder overrides any other configurations in its
    /// ancestry. Setting a configuration on a folder is a prerequisite for Cloud KMS
    /// Autokey, so that users working in a descendant project can request
    /// provisioned \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\], ready for Customer
    /// Managed Encryption Key (CMEK) use, on-demand.
    #[derive(Debug, Clone)]
    pub struct AutokeyAdminClient<T> {
        inner: tonic::client::Grpc<T>,
    }
    impl AutokeyAdminClient<tonic::transport::Channel> {
        /// Attempt to create a new client by connecting to a given endpoint.
        pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
        where
            D: TryInto<tonic::transport::Endpoint>,
            D::Error: Into<StdError>,
        {
            let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
            Ok(Self::new(conn))
        }
    }
    impl<T> AutokeyAdminClient<T>
    where
        T: tonic::client::GrpcService<tonic::body::Body>,
        T::Error: Into<StdError>,
        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
    {
        pub fn new(inner: T) -> Self {
            let inner = tonic::client::Grpc::new(inner);
            Self { inner }
        }
        pub fn with_origin(inner: T, origin: Uri) -> Self {
            let inner = tonic::client::Grpc::with_origin(inner, origin);
            Self { inner }
        }
        pub fn with_interceptor<F>(
            inner: T,
            interceptor: F,
        ) -> AutokeyAdminClient<InterceptedService<T, F>>
        where
            F: tonic::service::Interceptor,
            T::ResponseBody: Default,
            T: tonic::codegen::Service<
                http::Request<tonic::body::Body>,
                Response = http::Response<
                    <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                >,
            >,
            <T as tonic::codegen::Service<
                http::Request<tonic::body::Body>,
            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
        {
            AutokeyAdminClient::new(InterceptedService::new(inner, interceptor))
        }
        /// Compress requests with the given encoding.
        ///
        /// This requires the server to support it otherwise it might respond with an
        /// error.
        #[must_use]
        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.send_compressed(encoding);
            self
        }
        /// Enable decompressing responses.
        #[must_use]
        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.accept_compressed(encoding);
            self
        }
        /// Limits the maximum size of a decoded message.
        ///
        /// Default: `4MB`
        #[must_use]
        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_decoding_message_size(limit);
            self
        }
        /// Limits the maximum size of an encoded message.
        ///
        /// Default: `usize::MAX`
        #[must_use]
        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_encoding_message_size(limit);
            self
        }
        /// Updates the \[AutokeyConfig\]\[google.cloud.kms.v1.AutokeyConfig\] for a
        /// folder. The caller must have both `cloudkms.autokeyConfigs.update`
        /// permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy`
        /// permission on the provided key project. A
        /// \[KeyHandle\]\[google.cloud.kms.v1.KeyHandle\] creation in the folder's
        /// descendant projects will use this configuration to determine where to
        /// create the resulting \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
        pub async fn update_autokey_config(
            &mut self,
            request: impl tonic::IntoRequest<super::UpdateAutokeyConfigRequest>,
        ) -> std::result::Result<tonic::Response<super::AutokeyConfig>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.AutokeyAdmin/UpdateAutokeyConfig",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.AutokeyAdmin",
                        "UpdateAutokeyConfig",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns the \[AutokeyConfig\]\[google.cloud.kms.v1.AutokeyConfig\] for a
        /// folder.
        pub async fn get_autokey_config(
            &mut self,
            request: impl tonic::IntoRequest<super::GetAutokeyConfigRequest>,
        ) -> std::result::Result<tonic::Response<super::AutokeyConfig>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.AutokeyAdmin/GetAutokeyConfig",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.AutokeyAdmin",
                        "GetAutokeyConfig",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns the effective Cloud KMS Autokey configuration for a given project.
        pub async fn show_effective_autokey_config(
            &mut self,
            request: impl tonic::IntoRequest<super::ShowEffectiveAutokeyConfigRequest>,
        ) -> std::result::Result<
            tonic::Response<super::ShowEffectiveAutokeyConfigResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.AutokeyAdmin/ShowEffectiveAutokeyConfig",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.AutokeyAdmin",
                        "ShowEffectiveAutokeyConfig",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
    }
}
/// Request message for
/// \[EkmService.ListEkmConnections\]\[google.cloud.kms.v1.EkmService.ListEkmConnections\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListEkmConnectionsRequest {
    /// Required. The resource name of the location associated with the
    /// \[EkmConnections\]\[google.cloud.kms.v1.EkmConnection\] to list, in the format
    /// `projects/*/locations/*`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. Optional limit on the number of
    /// \[EkmConnections\]\[google.cloud.kms.v1.EkmConnection\] to include in the
    /// response. Further \[EkmConnections\]\[google.cloud.kms.v1.EkmConnection\] can
    /// subsequently be obtained by including the
    /// \[ListEkmConnectionsResponse.next_page_token\]\[google.cloud.kms.v1.ListEkmConnectionsResponse.next_page_token\]
    /// in a subsequent request. If unspecified, the server will pick an
    /// appropriate default.
    #[prost(int32, tag = "2")]
    pub page_size: i32,
    /// Optional. Optional pagination token, returned earlier via
    /// \[ListEkmConnectionsResponse.next_page_token\]\[google.cloud.kms.v1.ListEkmConnectionsResponse.next_page_token\].
    #[prost(string, tag = "3")]
    pub page_token: ::prost::alloc::string::String,
    /// Optional. Only include resources that match the filter in the response. For
    /// more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "4")]
    pub filter: ::prost::alloc::string::String,
    /// Optional. Specify how the results should be sorted. If not specified, the
    /// results will be sorted in the default order.  For more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "5")]
    pub order_by: ::prost::alloc::string::String,
}
/// Response message for
/// \[EkmService.ListEkmConnections\]\[google.cloud.kms.v1.EkmService.ListEkmConnections\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListEkmConnectionsResponse {
    /// The list of \[EkmConnections\]\[google.cloud.kms.v1.EkmConnection\].
    #[prost(message, repeated, tag = "1")]
    pub ekm_connections: ::prost::alloc::vec::Vec<EkmConnection>,
    /// A token to retrieve next page of results. Pass this value in
    /// \[ListEkmConnectionsRequest.page_token\]\[google.cloud.kms.v1.ListEkmConnectionsRequest.page_token\]
    /// to retrieve the next page of results.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
    /// The total number of \[EkmConnections\]\[google.cloud.kms.v1.EkmConnection\]
    /// that matched the query.
    ///
    /// This field is not populated if
    /// \[ListEkmConnectionsRequest.filter\]\[google.cloud.kms.v1.ListEkmConnectionsRequest.filter\]
    /// is applied.
    #[prost(int32, tag = "3")]
    pub total_size: i32,
}
/// Request message for
/// \[EkmService.GetEkmConnection\]\[google.cloud.kms.v1.EkmService.GetEkmConnection\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetEkmConnectionRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.EkmConnection.name\] of the
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] to get.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Request message for
/// \[EkmService.CreateEkmConnection\]\[google.cloud.kms.v1.EkmService.CreateEkmConnection\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateEkmConnectionRequest {
    /// Required. The resource name of the location associated with the
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\], in the format
    /// `projects/*/locations/*`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. It must be unique within a location and match the regular
    /// expression `\[a-zA-Z0-9_-\]{1,63}`.
    #[prost(string, tag = "2")]
    pub ekm_connection_id: ::prost::alloc::string::String,
    /// Required. An \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] with
    /// initial field values.
    #[prost(message, optional, tag = "3")]
    pub ekm_connection: ::core::option::Option<EkmConnection>,
}
/// Request message for
/// \[EkmService.UpdateEkmConnection\]\[google.cloud.kms.v1.EkmService.UpdateEkmConnection\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateEkmConnectionRequest {
    /// Required. \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] with updated
    /// values.
    #[prost(message, optional, tag = "1")]
    pub ekm_connection: ::core::option::Option<EkmConnection>,
    /// Required. List of fields to be updated in this request.
    #[prost(message, optional, tag = "2")]
    pub update_mask: ::core::option::Option<::prost_types::FieldMask>,
}
/// Request message for
/// \[EkmService.GetEkmConfig\]\[google.cloud.kms.v1.EkmService.GetEkmConfig\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetEkmConfigRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.EkmConfig.name\] of the
    /// \[EkmConfig\]\[google.cloud.kms.v1.EkmConfig\] to get.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Request message for
/// \[EkmService.UpdateEkmConfig\]\[google.cloud.kms.v1.EkmService.UpdateEkmConfig\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateEkmConfigRequest {
    /// Required. \[EkmConfig\]\[google.cloud.kms.v1.EkmConfig\] with updated values.
    #[prost(message, optional, tag = "1")]
    pub ekm_config: ::core::option::Option<EkmConfig>,
    /// Required. List of fields to be updated in this request.
    #[prost(message, optional, tag = "2")]
    pub update_mask: ::core::option::Option<::prost_types::FieldMask>,
}
/// A \[Certificate\]\[google.cloud.kms.v1.Certificate\] represents an X.509
/// certificate used to authenticate HTTPS connections to EKM replicas.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Certificate {
    /// Required. The raw certificate bytes in DER format.
    #[prost(bytes = "vec", tag = "1")]
    pub raw_der: ::prost::alloc::vec::Vec<u8>,
    /// Output only. True if the certificate was parsed successfully.
    #[prost(bool, tag = "2")]
    pub parsed: bool,
    /// Output only. The issuer distinguished name in RFC 2253 format. Only present
    /// if \[parsed\]\[google.cloud.kms.v1.Certificate.parsed\] is true.
    #[prost(string, tag = "3")]
    pub issuer: ::prost::alloc::string::String,
    /// Output only. The subject distinguished name in RFC 2253 format. Only
    /// present if \[parsed\]\[google.cloud.kms.v1.Certificate.parsed\] is true.
    #[prost(string, tag = "4")]
    pub subject: ::prost::alloc::string::String,
    /// Output only. The subject Alternative DNS names. Only present if
    /// \[parsed\]\[google.cloud.kms.v1.Certificate.parsed\] is true.
    #[prost(string, repeated, tag = "5")]
    pub subject_alternative_dns_names: ::prost::alloc::vec::Vec<
        ::prost::alloc::string::String,
    >,
    /// Output only. The certificate is not valid before this time. Only present if
    /// \[parsed\]\[google.cloud.kms.v1.Certificate.parsed\] is true.
    #[prost(message, optional, tag = "6")]
    pub not_before_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The certificate is not valid after this time. Only present if
    /// \[parsed\]\[google.cloud.kms.v1.Certificate.parsed\] is true.
    #[prost(message, optional, tag = "7")]
    pub not_after_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The certificate serial number as a hex string. Only present if
    /// \[parsed\]\[google.cloud.kms.v1.Certificate.parsed\] is true.
    #[prost(string, tag = "8")]
    pub serial_number: ::prost::alloc::string::String,
    /// Output only. The SHA-256 certificate fingerprint as a hex string. Only
    /// present if \[parsed\]\[google.cloud.kms.v1.Certificate.parsed\] is true.
    #[prost(string, tag = "9")]
    pub sha256_fingerprint: ::prost::alloc::string::String,
}
/// An \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] represents an
/// individual EKM connection. It can be used for creating
/// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] and
/// \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\] with a
/// \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of
/// \[EXTERNAL_VPC\]\[google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC\], as well as
/// performing cryptographic operations using keys created within the
/// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct EkmConnection {
    /// Output only. The resource name for the
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] in the format
    /// `projects/*/locations/*/ekmConnections/*`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Output only. The time at which the
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] was created.
    #[prost(message, optional, tag = "2")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Optional. A list of
    /// \[ServiceResolvers\]\[google.cloud.kms.v1.EkmConnection.ServiceResolver\] where
    /// the EKM can be reached. There should be one ServiceResolver per EKM
    /// replica. Currently, only a single
    /// \[ServiceResolver\]\[google.cloud.kms.v1.EkmConnection.ServiceResolver\] is
    /// supported.
    #[prost(message, repeated, tag = "3")]
    pub service_resolvers: ::prost::alloc::vec::Vec<ekm_connection::ServiceResolver>,
    /// Optional. Etag of the currently stored
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\].
    #[prost(string, tag = "5")]
    pub etag: ::prost::alloc::string::String,
    /// Optional. Describes who can perform control plane operations on the EKM. If
    /// unset, this defaults to
    /// \[MANUAL\]\[google.cloud.kms.v1.EkmConnection.KeyManagementMode.MANUAL\].
    #[prost(enumeration = "ekm_connection::KeyManagementMode", tag = "6")]
    pub key_management_mode: i32,
    /// Optional. Identifies the EKM Crypto Space that this
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] maps to. Note: This
    /// field is required if
    /// \[KeyManagementMode\]\[google.cloud.kms.v1.EkmConnection.KeyManagementMode\] is
    /// \[CLOUD_KMS\]\[google.cloud.kms.v1.EkmConnection.KeyManagementMode.CLOUD_KMS\].
    #[prost(string, tag = "7")]
    pub crypto_space_path: ::prost::alloc::string::String,
}
/// Nested message and enum types in `EkmConnection`.
pub mod ekm_connection {
    /// A \[ServiceResolver\]\[google.cloud.kms.v1.EkmConnection.ServiceResolver\]
    /// represents an EKM replica that can be reached within an
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\].
    #[derive(Clone, PartialEq, ::prost::Message)]
    pub struct ServiceResolver {
        /// Required. The resource name of the Service Directory service pointing to
        /// an EKM replica, in the format
        /// `projects/*/locations/*/namespaces/*/services/*`.
        #[prost(string, tag = "1")]
        pub service_directory_service: ::prost::alloc::string::String,
        /// Optional. The filter applied to the endpoints of the resolved service. If
        /// no filter is specified, all endpoints will be considered. An endpoint
        /// will be chosen arbitrarily from the filtered list for each request.
        ///
        /// For endpoint filter syntax and examples, see
        /// <https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.>
        #[prost(string, tag = "2")]
        pub endpoint_filter: ::prost::alloc::string::String,
        /// Required. The hostname of the EKM replica used at TLS and HTTP layers.
        #[prost(string, tag = "3")]
        pub hostname: ::prost::alloc::string::String,
        /// Required. A list of leaf server certificates used to authenticate HTTPS
        /// connections to the EKM replica. Currently, a maximum of 10
        /// \[Certificate\]\[google.cloud.kms.v1.Certificate\] is supported.
        #[prost(message, repeated, tag = "4")]
        pub server_certificates: ::prost::alloc::vec::Vec<super::Certificate>,
    }
    /// \[KeyManagementMode\]\[google.cloud.kms.v1.EkmConnection.KeyManagementMode\]
    /// describes who can perform control plane cryptographic operations using this
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\].
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum KeyManagementMode {
        /// Not specified.
        Unspecified = 0,
        /// EKM-side key management operations on
        /// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] created with this
        /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] must be initiated from
        /// the EKM directly and cannot be performed from Cloud KMS. This means that:
        ///
        /// * When creating a
        ///   \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] associated with
        ///   this
        ///   \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\], the caller must
        ///   supply the key path of pre-existing external key material that will be
        ///   linked to the \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\].
        /// * Destruction of external key material cannot be requested via the
        ///   Cloud KMS API and must be performed directly in the EKM.
        /// * Automatic rotation of key material is not supported.
        Manual = 1,
        /// All \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] created with this
        /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] use EKM-side key
        /// management operations initiated from Cloud KMS. This means that:
        ///
        /// * When a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]
        ///   associated with this \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\]
        ///   is
        ///   created, the EKM automatically generates new key material and a new
        ///   key path. The caller cannot supply the key path of pre-existing
        ///   external key material.
        /// * Destruction of external key material associated with this
        ///   \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] can be requested by
        ///   calling
        ///   \[DestroyCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion\].
        /// * Automatic rotation of key material is supported.
        CloudKms = 2,
    }
    impl KeyManagementMode {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "KEY_MANAGEMENT_MODE_UNSPECIFIED",
                Self::Manual => "MANUAL",
                Self::CloudKms => "CLOUD_KMS",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "KEY_MANAGEMENT_MODE_UNSPECIFIED" => Some(Self::Unspecified),
                "MANUAL" => Some(Self::Manual),
                "CLOUD_KMS" => Some(Self::CloudKms),
                _ => None,
            }
        }
    }
}
/// An \[EkmConfig\]\[google.cloud.kms.v1.EkmConfig\] is a singleton resource that
/// represents configuration parameters that apply to all
/// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] and
/// \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\] with a
/// \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of
/// \[EXTERNAL_VPC\]\[google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC\] in a given
/// project and location.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct EkmConfig {
    /// Output only. The resource name for the
    /// \[EkmConfig\]\[google.cloud.kms.v1.EkmConfig\] in the format
    /// `projects/*/locations/*/ekmConfig`.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Optional. Resource name of the default
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\]. Setting this field to
    /// the empty string removes the default.
    #[prost(string, tag = "2")]
    pub default_ekm_connection: ::prost::alloc::string::String,
}
/// Request message for
/// \[EkmService.VerifyConnectivity\]\[google.cloud.kms.v1.EkmService.VerifyConnectivity\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct VerifyConnectivityRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.EkmConnection.name\] of the
    /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] to verify.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Response message for
/// \[EkmService.VerifyConnectivity\]\[google.cloud.kms.v1.EkmService.VerifyConnectivity\].
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct VerifyConnectivityResponse {}
/// Generated client implementations.
pub mod ekm_service_client {
    #![allow(
        unused_variables,
        dead_code,
        missing_docs,
        clippy::wildcard_imports,
        clippy::let_unit_value,
    )]
    use tonic::codegen::*;
    use tonic::codegen::http::Uri;
    /// Google Cloud Key Management EKM Service
    ///
    /// Manages external cryptographic keys and operations using those keys.
    /// Implements a REST model with the following objects:
    ///
    /// * \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\]
    #[derive(Debug, Clone)]
    pub struct EkmServiceClient<T> {
        inner: tonic::client::Grpc<T>,
    }
    impl EkmServiceClient<tonic::transport::Channel> {
        /// Attempt to create a new client by connecting to a given endpoint.
        pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
        where
            D: TryInto<tonic::transport::Endpoint>,
            D::Error: Into<StdError>,
        {
            let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
            Ok(Self::new(conn))
        }
    }
    impl<T> EkmServiceClient<T>
    where
        T: tonic::client::GrpcService<tonic::body::Body>,
        T::Error: Into<StdError>,
        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
    {
        pub fn new(inner: T) -> Self {
            let inner = tonic::client::Grpc::new(inner);
            Self { inner }
        }
        pub fn with_origin(inner: T, origin: Uri) -> Self {
            let inner = tonic::client::Grpc::with_origin(inner, origin);
            Self { inner }
        }
        pub fn with_interceptor<F>(
            inner: T,
            interceptor: F,
        ) -> EkmServiceClient<InterceptedService<T, F>>
        where
            F: tonic::service::Interceptor,
            T::ResponseBody: Default,
            T: tonic::codegen::Service<
                http::Request<tonic::body::Body>,
                Response = http::Response<
                    <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                >,
            >,
            <T as tonic::codegen::Service<
                http::Request<tonic::body::Body>,
            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
        {
            EkmServiceClient::new(InterceptedService::new(inner, interceptor))
        }
        /// Compress requests with the given encoding.
        ///
        /// This requires the server to support it otherwise it might respond with an
        /// error.
        #[must_use]
        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.send_compressed(encoding);
            self
        }
        /// Enable decompressing responses.
        #[must_use]
        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.accept_compressed(encoding);
            self
        }
        /// Limits the maximum size of a decoded message.
        ///
        /// Default: `4MB`
        #[must_use]
        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_decoding_message_size(limit);
            self
        }
        /// Limits the maximum size of an encoded message.
        ///
        /// Default: `usize::MAX`
        #[must_use]
        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_encoding_message_size(limit);
            self
        }
        /// Lists \[EkmConnections\]\[google.cloud.kms.v1.EkmConnection\].
        pub async fn list_ekm_connections(
            &mut self,
            request: impl tonic::IntoRequest<super::ListEkmConnectionsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::ListEkmConnectionsResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.EkmService/ListEkmConnections",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.EkmService",
                        "ListEkmConnections",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns metadata for a given
        /// \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\].
        pub async fn get_ekm_connection(
            &mut self,
            request: impl tonic::IntoRequest<super::GetEkmConnectionRequest>,
        ) -> std::result::Result<tonic::Response<super::EkmConnection>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.EkmService/GetEkmConnection",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new("google.cloud.kms.v1.EkmService", "GetEkmConnection"),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Creates a new \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\] in a given
        /// Project and Location.
        pub async fn create_ekm_connection(
            &mut self,
            request: impl tonic::IntoRequest<super::CreateEkmConnectionRequest>,
        ) -> std::result::Result<tonic::Response<super::EkmConnection>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.EkmService/CreateEkmConnection",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.EkmService",
                        "CreateEkmConnection",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Updates an \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\]'s metadata.
        pub async fn update_ekm_connection(
            &mut self,
            request: impl tonic::IntoRequest<super::UpdateEkmConnectionRequest>,
        ) -> std::result::Result<tonic::Response<super::EkmConnection>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.EkmService/UpdateEkmConnection",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.EkmService",
                        "UpdateEkmConnection",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns the \[EkmConfig\]\[google.cloud.kms.v1.EkmConfig\] singleton resource
        /// for a given project and location.
        pub async fn get_ekm_config(
            &mut self,
            request: impl tonic::IntoRequest<super::GetEkmConfigRequest>,
        ) -> std::result::Result<tonic::Response<super::EkmConfig>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.EkmService/GetEkmConfig",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new("google.cloud.kms.v1.EkmService", "GetEkmConfig"),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Updates the \[EkmConfig\]\[google.cloud.kms.v1.EkmConfig\] singleton resource
        /// for a given project and location.
        pub async fn update_ekm_config(
            &mut self,
            request: impl tonic::IntoRequest<super::UpdateEkmConfigRequest>,
        ) -> std::result::Result<tonic::Response<super::EkmConfig>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.EkmService/UpdateEkmConfig",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new("google.cloud.kms.v1.EkmService", "UpdateEkmConfig"),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Verifies that Cloud KMS can successfully connect to the external key
        /// manager specified by an \[EkmConnection\]\[google.cloud.kms.v1.EkmConnection\].
        /// If there is an error connecting to the EKM, this method returns a
        /// FAILED_PRECONDITION status containing structured information as described
        /// at https://cloud.google.com/kms/docs/reference/ekm_errors.
        pub async fn verify_connectivity(
            &mut self,
            request: impl tonic::IntoRequest<super::VerifyConnectivityRequest>,
        ) -> std::result::Result<
            tonic::Response<super::VerifyConnectivityResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.EkmService/VerifyConnectivity",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.EkmService",
                        "VerifyConnectivity",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
    }
}
/// Request message for
/// \[KeyManagementService.ListKeyRings\]\[google.cloud.kms.v1.KeyManagementService.ListKeyRings\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListKeyRingsRequest {
    /// Required. The resource name of the location associated with the
    /// \[KeyRings\]\[google.cloud.kms.v1.KeyRing\], in the format
    /// `projects/*/locations/*`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. Optional limit on the number of
    /// \[KeyRings\]\[google.cloud.kms.v1.KeyRing\] to include in the response. Further
    /// \[KeyRings\]\[google.cloud.kms.v1.KeyRing\] can subsequently be obtained by
    /// including the
    /// \[ListKeyRingsResponse.next_page_token\]\[google.cloud.kms.v1.ListKeyRingsResponse.next_page_token\]
    /// in a subsequent request.  If unspecified, the server will pick an
    /// appropriate default.
    #[prost(int32, tag = "2")]
    pub page_size: i32,
    /// Optional. Optional pagination token, returned earlier via
    /// \[ListKeyRingsResponse.next_page_token\]\[google.cloud.kms.v1.ListKeyRingsResponse.next_page_token\].
    #[prost(string, tag = "3")]
    pub page_token: ::prost::alloc::string::String,
    /// Optional. Only include resources that match the filter in the response. For
    /// more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "4")]
    pub filter: ::prost::alloc::string::String,
    /// Optional. Specify how the results should be sorted. If not specified, the
    /// results will be sorted in the default order.  For more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "5")]
    pub order_by: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.ListCryptoKeys\]\[google.cloud.kms.v1.KeyManagementService.ListCryptoKeys\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListCryptoKeysRequest {
    /// Required. The resource name of the \[KeyRing\]\[google.cloud.kms.v1.KeyRing\]
    /// to list, in the format `projects/*/locations/*/keyRings/*`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. Optional limit on the number of
    /// \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] to include in the response.
    /// Further \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] can subsequently be
    /// obtained by including the
    /// \[ListCryptoKeysResponse.next_page_token\]\[google.cloud.kms.v1.ListCryptoKeysResponse.next_page_token\]
    /// in a subsequent request.  If unspecified, the server will pick an
    /// appropriate default.
    #[prost(int32, tag = "2")]
    pub page_size: i32,
    /// Optional. Optional pagination token, returned earlier via
    /// \[ListCryptoKeysResponse.next_page_token\]\[google.cloud.kms.v1.ListCryptoKeysResponse.next_page_token\].
    #[prost(string, tag = "3")]
    pub page_token: ::prost::alloc::string::String,
    /// The fields of the primary version to include in the response.
    #[prost(enumeration = "crypto_key_version::CryptoKeyVersionView", tag = "4")]
    pub version_view: i32,
    /// Optional. Only include resources that match the filter in the response. For
    /// more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "5")]
    pub filter: ::prost::alloc::string::String,
    /// Optional. Specify how the results should be sorted. If not specified, the
    /// results will be sorted in the default order. For more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "6")]
    pub order_by: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.ListCryptoKeyVersions\]\[google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListCryptoKeyVersionsRequest {
    /// Required. The resource name of the
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] to list, in the format
    /// `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. Optional limit on the number of
    /// \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\] to include in the
    /// response. Further \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\]
    /// can subsequently be obtained by including the
    /// \[ListCryptoKeyVersionsResponse.next_page_token\]\[google.cloud.kms.v1.ListCryptoKeyVersionsResponse.next_page_token\]
    /// in a subsequent request. If unspecified, the server will pick an
    /// appropriate default.
    #[prost(int32, tag = "2")]
    pub page_size: i32,
    /// Optional. Optional pagination token, returned earlier via
    /// \[ListCryptoKeyVersionsResponse.next_page_token\]\[google.cloud.kms.v1.ListCryptoKeyVersionsResponse.next_page_token\].
    #[prost(string, tag = "3")]
    pub page_token: ::prost::alloc::string::String,
    /// The fields to include in the response.
    #[prost(enumeration = "crypto_key_version::CryptoKeyVersionView", tag = "4")]
    pub view: i32,
    /// Optional. Only include resources that match the filter in the response. For
    /// more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "5")]
    pub filter: ::prost::alloc::string::String,
    /// Optional. Specify how the results should be sorted. If not specified, the
    /// results will be sorted in the default order. For more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "6")]
    pub order_by: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.ListImportJobs\]\[google.cloud.kms.v1.KeyManagementService.ListImportJobs\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListImportJobsRequest {
    /// Required. The resource name of the \[KeyRing\]\[google.cloud.kms.v1.KeyRing\]
    /// to list, in the format `projects/*/locations/*/keyRings/*`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. Optional limit on the number of
    /// \[ImportJobs\]\[google.cloud.kms.v1.ImportJob\] to include in the response.
    /// Further \[ImportJobs\]\[google.cloud.kms.v1.ImportJob\] can subsequently be
    /// obtained by including the
    /// \[ListImportJobsResponse.next_page_token\]\[google.cloud.kms.v1.ListImportJobsResponse.next_page_token\]
    /// in a subsequent request. If unspecified, the server will pick an
    /// appropriate default.
    #[prost(int32, tag = "2")]
    pub page_size: i32,
    /// Optional. Optional pagination token, returned earlier via
    /// \[ListImportJobsResponse.next_page_token\]\[google.cloud.kms.v1.ListImportJobsResponse.next_page_token\].
    #[prost(string, tag = "3")]
    pub page_token: ::prost::alloc::string::String,
    /// Optional. Only include resources that match the filter in the response. For
    /// more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "4")]
    pub filter: ::prost::alloc::string::String,
    /// Optional. Specify how the results should be sorted. If not specified, the
    /// results will be sorted in the default order. For more information, see
    /// [Sorting and filtering list
    /// results](<https://cloud.google.com/kms/docs/sorting-and-filtering>).
    #[prost(string, tag = "5")]
    pub order_by: ::prost::alloc::string::String,
}
/// Response message for
/// \[KeyManagementService.ListKeyRings\]\[google.cloud.kms.v1.KeyManagementService.ListKeyRings\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListKeyRingsResponse {
    /// The list of \[KeyRings\]\[google.cloud.kms.v1.KeyRing\].
    #[prost(message, repeated, tag = "1")]
    pub key_rings: ::prost::alloc::vec::Vec<KeyRing>,
    /// A token to retrieve next page of results. Pass this value in
    /// \[ListKeyRingsRequest.page_token\]\[google.cloud.kms.v1.ListKeyRingsRequest.page_token\]
    /// to retrieve the next page of results.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
    /// The total number of \[KeyRings\]\[google.cloud.kms.v1.KeyRing\] that matched
    /// the query.
    ///
    /// This field is not populated if
    /// \[ListKeyRingsRequest.filter\]\[google.cloud.kms.v1.ListKeyRingsRequest.filter\]
    /// is applied.
    #[prost(int32, tag = "3")]
    pub total_size: i32,
}
/// Response message for
/// \[KeyManagementService.ListCryptoKeys\]\[google.cloud.kms.v1.KeyManagementService.ListCryptoKeys\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListCryptoKeysResponse {
    /// The list of \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\].
    #[prost(message, repeated, tag = "1")]
    pub crypto_keys: ::prost::alloc::vec::Vec<CryptoKey>,
    /// A token to retrieve next page of results. Pass this value in
    /// \[ListCryptoKeysRequest.page_token\]\[google.cloud.kms.v1.ListCryptoKeysRequest.page_token\]
    /// to retrieve the next page of results.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
    /// The total number of \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] that
    /// matched the query.
    ///
    /// This field is not populated if
    /// \[ListCryptoKeysRequest.filter\]\[google.cloud.kms.v1.ListCryptoKeysRequest.filter\]
    /// is applied.
    #[prost(int32, tag = "3")]
    pub total_size: i32,
}
/// Response message for
/// \[KeyManagementService.ListCryptoKeyVersions\]\[google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListCryptoKeyVersionsResponse {
    /// The list of \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\].
    #[prost(message, repeated, tag = "1")]
    pub crypto_key_versions: ::prost::alloc::vec::Vec<CryptoKeyVersion>,
    /// A token to retrieve next page of results. Pass this value in
    /// \[ListCryptoKeyVersionsRequest.page_token\]\[google.cloud.kms.v1.ListCryptoKeyVersionsRequest.page_token\]
    /// to retrieve the next page of results.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
    /// The total number of
    /// \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\] that matched the
    /// query.
    ///
    /// This field is not populated if
    /// \[ListCryptoKeyVersionsRequest.filter\]\[google.cloud.kms.v1.ListCryptoKeyVersionsRequest.filter\]
    /// is applied.
    #[prost(int32, tag = "3")]
    pub total_size: i32,
}
/// Response message for
/// \[KeyManagementService.ListImportJobs\]\[google.cloud.kms.v1.KeyManagementService.ListImportJobs\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListImportJobsResponse {
    /// The list of \[ImportJobs\]\[google.cloud.kms.v1.ImportJob\].
    #[prost(message, repeated, tag = "1")]
    pub import_jobs: ::prost::alloc::vec::Vec<ImportJob>,
    /// A token to retrieve next page of results. Pass this value in
    /// \[ListImportJobsRequest.page_token\]\[google.cloud.kms.v1.ListImportJobsRequest.page_token\]
    /// to retrieve the next page of results.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
    /// The total number of \[ImportJobs\]\[google.cloud.kms.v1.ImportJob\] that
    /// matched the query.
    ///
    /// This field is not populated if
    /// \[ListImportJobsRequest.filter\]\[google.cloud.kms.v1.ListImportJobsRequest.filter\]
    /// is applied.
    #[prost(int32, tag = "3")]
    pub total_size: i32,
}
/// Request message for
/// \[KeyManagementService.GetKeyRing\]\[google.cloud.kms.v1.KeyManagementService.GetKeyRing\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetKeyRingRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.KeyRing.name\] of the
    /// \[KeyRing\]\[google.cloud.kms.v1.KeyRing\] to get.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.GetCryptoKey\]\[google.cloud.kms.v1.KeyManagementService.GetCryptoKey\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCryptoKeyRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.CryptoKey.name\] of the
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] to get.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.GetCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.GetCryptoKeyVersion\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetCryptoKeyVersionRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.CryptoKeyVersion.name\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to get.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.GetPublicKey\]\[google.cloud.kms.v1.KeyManagementService.GetPublicKey\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetPublicKeyRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.CryptoKeyVersion.name\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] public key to get.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Optional. The \[PublicKey\]\[google.cloud.kms.v1.PublicKey\] format specified
    /// by the user. This field is required for PQC algorithms. If specified, the
    /// public key will be exported through the
    /// \[public_key\]\[google.cloud.kms.v1.PublicKey.public_key\] field in the
    /// requested format. Otherwise, the \[pem\]\[google.cloud.kms.v1.PublicKey.pem\]
    /// field will be populated for non-PQC algorithms, and an error will be
    /// returned for PQC algorithms.
    #[prost(enumeration = "public_key::PublicKeyFormat", tag = "2")]
    pub public_key_format: i32,
}
/// Request message for
/// \[KeyManagementService.GetImportJob\]\[google.cloud.kms.v1.KeyManagementService.GetImportJob\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetImportJobRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.ImportJob.name\] of the
    /// \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] to get.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.CreateKeyRing\]\[google.cloud.kms.v1.KeyManagementService.CreateKeyRing\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateKeyRingRequest {
    /// Required. The resource name of the location associated with the
    /// \[KeyRings\]\[google.cloud.kms.v1.KeyRing\], in the format
    /// `projects/*/locations/*`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. It must be unique within a location and match the regular
    /// expression `\[a-zA-Z0-9_-\]{1,63}`
    #[prost(string, tag = "2")]
    pub key_ring_id: ::prost::alloc::string::String,
    /// Required. A \[KeyRing\]\[google.cloud.kms.v1.KeyRing\] with initial field
    /// values.
    #[prost(message, optional, tag = "3")]
    pub key_ring: ::core::option::Option<KeyRing>,
}
/// Request message for
/// \[KeyManagementService.CreateCryptoKey\]\[google.cloud.kms.v1.KeyManagementService.CreateCryptoKey\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateCryptoKeyRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.KeyRing.name\] of the KeyRing
    /// associated with the \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\].
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. It must be unique within a KeyRing and match the regular
    /// expression `\[a-zA-Z0-9_-\]{1,63}`
    #[prost(string, tag = "2")]
    pub crypto_key_id: ::prost::alloc::string::String,
    /// Required. A \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] with initial field
    /// values.
    #[prost(message, optional, tag = "3")]
    pub crypto_key: ::core::option::Option<CryptoKey>,
    /// If set to true, the request will create a
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] without any
    /// \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\]. You must
    /// manually call
    /// \[CreateCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion\]
    /// or
    /// \[ImportCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion\]
    /// before you can use this \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
    #[prost(bool, tag = "5")]
    pub skip_initial_version_creation: bool,
}
/// Request message for
/// \[KeyManagementService.CreateCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateCryptoKeyVersionRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.CryptoKey.name\] of the
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] associated with the
    /// \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\].
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. A \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] with
    /// initial field values.
    #[prost(message, optional, tag = "2")]
    pub crypto_key_version: ::core::option::Option<CryptoKeyVersion>,
}
/// Request message for
/// \[KeyManagementService.ImportCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ImportCryptoKeyVersionRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.CryptoKey.name\] of the
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] to be imported into.
    ///
    /// The create permission is only required on this key when creating a new
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\].
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. The optional \[name\]\[google.cloud.kms.v1.CryptoKeyVersion.name\] of
    /// an existing \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to
    /// target for an import operation. If this field is not present, a new
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] containing the
    /// supplied key material is created.
    ///
    /// If this field is present, the supplied key material is imported into
    /// the existing \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]. To
    /// import into an existing
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\], the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] must be a child of
    /// \[ImportCryptoKeyVersionRequest.parent\]\[google.cloud.kms.v1.ImportCryptoKeyVersionRequest.parent\],
    /// have been previously created via
    /// \[ImportCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion\],
    /// and be in
    /// \[DESTROYED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED\]
    /// or
    /// \[IMPORT_FAILED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.IMPORT_FAILED\]
    /// state. The key material and algorithm must match the previous
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] exactly if the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] has ever contained
    /// key material.
    #[prost(string, tag = "6")]
    pub crypto_key_version: ::prost::alloc::string::String,
    /// Required. The
    /// \[algorithm\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm\]
    /// of the key being imported. This does not need to match the
    /// \[version_template\]\[google.cloud.kms.v1.CryptoKey.version_template\] of the
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] this version imports into.
    #[prost(enumeration = "crypto_key_version::CryptoKeyVersionAlgorithm", tag = "2")]
    pub algorithm: i32,
    /// Required. The \[name\]\[google.cloud.kms.v1.ImportJob.name\] of the
    /// \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] that was used to wrap this key
    /// material.
    #[prost(string, tag = "4")]
    pub import_job: ::prost::alloc::string::String,
    /// Optional. The wrapped key material to import.
    ///
    /// Before wrapping, key material must be formatted. If importing symmetric key
    /// material, the expected key material format is plain bytes. If importing
    /// asymmetric key material, the expected key material format is PKCS#8-encoded
    /// DER (the PrivateKeyInfo structure from RFC 5208).
    ///
    /// When wrapping with import methods
    /// (\[RSA_OAEP_3072_SHA1_AES_256\]\[google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256\]
    /// or
    /// \[RSA_OAEP_4096_SHA1_AES_256\]\[google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA1_AES_256\]
    /// or
    /// \[RSA_OAEP_3072_SHA256_AES_256\]\[google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA256_AES_256\]
    /// or
    /// \[RSA_OAEP_4096_SHA256_AES_256\]\[google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA256_AES_256\]),
    ///
    /// this field must contain the concatenation of:
    ///
    /// <ol>
    ///    <li>An ephemeral AES-256 wrapping key wrapped with the
    ///        [public_key][google.cloud.kms.v1.ImportJob.public_key] using
    ///        RSAES-OAEP with SHA-1/SHA-256, MGF1 with SHA-1/SHA-256, and an empty
    ///        label.
    ///    </li>
    ///    <li>The formatted key to be imported, wrapped with the ephemeral AES-256
    ///        key using AES-KWP (RFC 5649).
    ///    </li>
    /// </ol>
    ///
    /// This format is the same as the format produced by PKCS#11 mechanism
    /// CKM_RSA_AES_KEY_WRAP.
    ///
    /// When wrapping with import methods
    /// (\[RSA_OAEP_3072_SHA256\]\[google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA256\]
    /// or
    /// \[RSA_OAEP_4096_SHA256\]\[google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA256\]),
    ///
    /// this field must contain the formatted key to be imported, wrapped with the
    /// \[public_key\]\[google.cloud.kms.v1.ImportJob.public_key\] using RSAES-OAEP
    /// with SHA-256, MGF1 with SHA-256, and an empty label.
    #[prost(bytes = "vec", tag = "8")]
    pub wrapped_key: ::prost::alloc::vec::Vec<u8>,
    /// This field is legacy. Use the field
    /// \[wrapped_key\]\[google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key\]
    /// instead.
    #[prost(oneof = "import_crypto_key_version_request::WrappedKeyMaterial", tags = "5")]
    pub wrapped_key_material: ::core::option::Option<
        import_crypto_key_version_request::WrappedKeyMaterial,
    >,
}
/// Nested message and enum types in `ImportCryptoKeyVersionRequest`.
pub mod import_crypto_key_version_request {
    /// This field is legacy. Use the field
    /// \[wrapped_key\]\[google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key\]
    /// instead.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
    pub enum WrappedKeyMaterial {
        /// Optional. This field has the same meaning as
        /// \[wrapped_key\]\[google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key\].
        /// Prefer to use that field in new work. Either that field or this field
        /// (but not both) must be specified.
        #[prost(bytes, tag = "5")]
        RsaAesWrappedKey(::prost::alloc::vec::Vec<u8>),
    }
}
/// Request message for
/// \[KeyManagementService.CreateImportJob\]\[google.cloud.kms.v1.KeyManagementService.CreateImportJob\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateImportJobRequest {
    /// Required. The \[name\]\[google.cloud.kms.v1.KeyRing.name\] of the
    /// \[KeyRing\]\[google.cloud.kms.v1.KeyRing\] associated with the
    /// \[ImportJobs\]\[google.cloud.kms.v1.ImportJob\].
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. It must be unique within a KeyRing and match the regular
    /// expression `\[a-zA-Z0-9_-\]{1,63}`
    #[prost(string, tag = "2")]
    pub import_job_id: ::prost::alloc::string::String,
    /// Required. An \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] with initial field
    /// values.
    #[prost(message, optional, tag = "3")]
    pub import_job: ::core::option::Option<ImportJob>,
}
/// Request message for
/// \[KeyManagementService.UpdateCryptoKey\]\[google.cloud.kms.v1.KeyManagementService.UpdateCryptoKey\].
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateCryptoKeyRequest {
    /// Required. \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] with updated values.
    #[prost(message, optional, tag = "1")]
    pub crypto_key: ::core::option::Option<CryptoKey>,
    /// Required. List of fields to be updated in this request.
    #[prost(message, optional, tag = "2")]
    pub update_mask: ::core::option::Option<::prost_types::FieldMask>,
}
/// Request message for
/// \[KeyManagementService.UpdateCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyVersion\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateCryptoKeyVersionRequest {
    /// Required. \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] with
    /// updated values.
    #[prost(message, optional, tag = "1")]
    pub crypto_key_version: ::core::option::Option<CryptoKeyVersion>,
    /// Required. List of fields to be updated in this request.
    #[prost(message, optional, tag = "2")]
    pub update_mask: ::core::option::Option<::prost_types::FieldMask>,
}
/// Request message for
/// \[KeyManagementService.UpdateCryptoKeyPrimaryVersion\]\[google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UpdateCryptoKeyPrimaryVersionRequest {
    /// Required. The resource name of the
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] to update.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Required. The id of the child
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to use as primary.
    #[prost(string, tag = "2")]
    pub crypto_key_version_id: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.DestroyCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DestroyCryptoKeyVersionRequest {
    /// Required. The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to destroy.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.RestoreCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RestoreCryptoKeyVersionRequest {
    /// Required. The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to restore.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Request message for
/// \[KeyManagementService.Decrypt\]\[google.cloud.kms.v1.KeyManagementService.Decrypt\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DecryptRequest {
    /// Required. The resource name of the
    /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] to use for decryption. The
    /// server will choose the appropriate version.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Required. The encrypted data originally returned in
    /// \[EncryptResponse.ciphertext\]\[google.cloud.kms.v1.EncryptResponse.ciphertext\].
    #[prost(bytes = "vec", tag = "2")]
    pub ciphertext: ::prost::alloc::vec::Vec<u8>,
    /// Optional. Optional data that must match the data originally supplied in
    /// \[EncryptRequest.additional_authenticated_data\]\[google.cloud.kms.v1.EncryptRequest.additional_authenticated_data\].
    #[prost(bytes = "vec", tag = "3")]
    pub additional_authenticated_data: ::prost::alloc::vec::Vec<u8>,
    /// Optional. An optional CRC32C checksum of the
    /// \[DecryptRequest.ciphertext\]\[google.cloud.kms.v1.DecryptRequest.ciphertext\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received
    /// \[DecryptRequest.ciphertext\]\[google.cloud.kms.v1.DecryptRequest.ciphertext\]
    /// using this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(\[DecryptRequest.ciphertext\]\[google.cloud.kms.v1.DecryptRequest.ciphertext\])
    /// is equal to
    /// \[DecryptRequest.ciphertext_crc32c\]\[google.cloud.kms.v1.DecryptRequest.ciphertext_crc32c\],
    /// and if so, perform a limited number of retries. A persistent mismatch may
    /// indicate an issue in your computation of the CRC32C checksum. Note: This
    /// field is defined as int64 for reasons of compatibility across different
    /// languages. However, it is a non-negative integer, which will never exceed
    /// 2^32-1, and can be safely downconverted to uint32 in languages that support
    /// this type.
    #[prost(message, optional, tag = "5")]
    pub ciphertext_crc32c: ::core::option::Option<i64>,
    /// Optional. An optional CRC32C checksum of the
    /// \[DecryptRequest.additional_authenticated_data\]\[google.cloud.kms.v1.DecryptRequest.additional_authenticated_data\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received
    /// \[DecryptRequest.additional_authenticated_data\]\[google.cloud.kms.v1.DecryptRequest.additional_authenticated_data\]
    /// using this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(\[DecryptRequest.additional_authenticated_data\]\[google.cloud.kms.v1.DecryptRequest.additional_authenticated_data\])
    /// is equal to
    /// \[DecryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.DecryptRequest.additional_authenticated_data_crc32c\],
    /// and if so, perform a limited number of retries. A persistent mismatch may
    /// indicate an issue in your computation of the CRC32C checksum. Note: This
    /// field is defined as int64 for reasons of compatibility across different
    /// languages. However, it is a non-negative integer, which will never exceed
    /// 2^32-1, and can be safely downconverted to uint32 in languages that support
    /// this type.
    #[prost(message, optional, tag = "6")]
    pub additional_authenticated_data_crc32c: ::core::option::Option<i64>,
}
/// Request message for
/// \[KeyManagementService.RawEncrypt\]\[google.cloud.kms.v1.KeyManagementService.RawEncrypt\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RawEncryptRequest {
    /// Required. The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to use for
    /// encryption.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Required. The data to encrypt. Must be no larger than 64KiB.
    ///
    /// The maximum size depends on the key version's
    /// \[protection_level\]\[google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level\].
    /// For \[SOFTWARE\]\[google.cloud.kms.v1.ProtectionLevel.SOFTWARE\] keys, the
    /// plaintext must be no larger than 64KiB. For
    /// \[HSM\]\[google.cloud.kms.v1.ProtectionLevel.HSM\] keys, the combined length of
    /// the plaintext and additional_authenticated_data fields must be no larger
    /// than 8KiB.
    #[prost(bytes = "vec", tag = "2")]
    pub plaintext: ::prost::alloc::vec::Vec<u8>,
    /// Optional. Optional data that, if specified, must also be provided during
    /// decryption through
    /// \[RawDecryptRequest.additional_authenticated_data\]\[google.cloud.kms.v1.RawDecryptRequest.additional_authenticated_data\].
    ///
    /// This field may only be used in conjunction with an
    /// \[algorithm\]\[google.cloud.kms.v1.CryptoKeyVersion.algorithm\] that accepts
    /// additional authenticated data (for example, AES-GCM).
    ///
    /// The maximum size depends on the key version's
    /// \[protection_level\]\[google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level\].
    /// For \[SOFTWARE\]\[google.cloud.kms.v1.ProtectionLevel.SOFTWARE\] keys, the
    /// plaintext must be no larger than 64KiB. For
    /// \[HSM\]\[google.cloud.kms.v1.ProtectionLevel.HSM\] keys, the combined length of
    /// the plaintext and additional_authenticated_data fields must be no larger
    /// than 8KiB.
    #[prost(bytes = "vec", tag = "3")]
    pub additional_authenticated_data: ::prost::alloc::vec::Vec<u8>,
    /// Optional. An optional CRC32C checksum of the
    /// \[RawEncryptRequest.plaintext\]\[google.cloud.kms.v1.RawEncryptRequest.plaintext\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received plaintext using this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that CRC32C(plaintext) is equal
    /// to plaintext_crc32c, and if so, perform a limited number of retries. A
    /// persistent mismatch may indicate an issue in your computation of the CRC32C
    /// checksum. Note: This field is defined as int64 for reasons of compatibility
    /// across different languages. However, it is a non-negative integer, which
    /// will never exceed 2^32-1, and can be safely downconverted to uint32 in
    /// languages that support this type.
    #[prost(message, optional, tag = "4")]
    pub plaintext_crc32c: ::core::option::Option<i64>,
    /// Optional. An optional CRC32C checksum of the
    /// \[RawEncryptRequest.additional_authenticated_data\]\[google.cloud.kms.v1.RawEncryptRequest.additional_authenticated_data\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received additional_authenticated_data using
    /// this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(additional_authenticated_data) is equal to
    /// additional_authenticated_data_crc32c, and if so, perform
    /// a limited number of retries. A persistent mismatch may indicate an issue in
    /// your computation of the CRC32C checksum.
    /// Note: This field is defined as int64 for reasons of compatibility across
    /// different languages. However, it is a non-negative integer, which will
    /// never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    /// that support this type.
    #[prost(message, optional, tag = "5")]
    pub additional_authenticated_data_crc32c: ::core::option::Option<i64>,
    /// Optional. A customer-supplied initialization vector that will be used for
    /// encryption. If it is not provided for AES-CBC and AES-CTR, one will be
    /// generated. It will be returned in
    /// \[RawEncryptResponse.initialization_vector\]\[google.cloud.kms.v1.RawEncryptResponse.initialization_vector\].
    #[prost(bytes = "vec", tag = "6")]
    pub initialization_vector: ::prost::alloc::vec::Vec<u8>,
    /// Optional. An optional CRC32C checksum of the
    /// \[RawEncryptRequest.initialization_vector\]\[google.cloud.kms.v1.RawEncryptRequest.initialization_vector\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received initialization_vector using this
    /// checksum. \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]
    /// will report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(initialization_vector) is equal to
    /// initialization_vector_crc32c, and if so, perform
    /// a limited number of retries. A persistent mismatch may indicate an issue in
    /// your computation of the CRC32C checksum.
    /// Note: This field is defined as int64 for reasons of compatibility across
    /// different languages. However, it is a non-negative integer, which will
    /// never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    /// that support this type.
    #[prost(message, optional, tag = "7")]
    pub initialization_vector_crc32c: ::core::option::Option<i64>,
}
/// Request message for
/// \[KeyManagementService.RawDecrypt\]\[google.cloud.kms.v1.KeyManagementService.RawDecrypt\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RawDecryptRequest {
    /// Required. The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to use for
    /// decryption.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Required. The encrypted data originally returned in
    /// \[RawEncryptResponse.ciphertext\]\[google.cloud.kms.v1.RawEncryptResponse.ciphertext\].
    #[prost(bytes = "vec", tag = "2")]
    pub ciphertext: ::prost::alloc::vec::Vec<u8>,
    /// Optional. Optional data that must match the data originally supplied in
    /// \[RawEncryptRequest.additional_authenticated_data\]\[google.cloud.kms.v1.RawEncryptRequest.additional_authenticated_data\].
    #[prost(bytes = "vec", tag = "3")]
    pub additional_authenticated_data: ::prost::alloc::vec::Vec<u8>,
    /// Required. The initialization vector (IV) used during encryption, which must
    /// match the data originally provided in
    /// \[RawEncryptResponse.initialization_vector\]\[google.cloud.kms.v1.RawEncryptResponse.initialization_vector\].
    #[prost(bytes = "vec", tag = "4")]
    pub initialization_vector: ::prost::alloc::vec::Vec<u8>,
    /// The length of the authentication tag that is appended to the end of
    /// the ciphertext. If unspecified (0), the default value for the key's
    /// algorithm will be used (for AES-GCM, the default value is 16).
    #[prost(int32, tag = "5")]
    pub tag_length: i32,
    /// Optional. An optional CRC32C checksum of the
    /// \[RawDecryptRequest.ciphertext\]\[google.cloud.kms.v1.RawDecryptRequest.ciphertext\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received ciphertext using this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that CRC32C(ciphertext) is equal
    /// to ciphertext_crc32c, and if so, perform a limited number of retries. A
    /// persistent mismatch may indicate an issue in your computation of the CRC32C
    /// checksum. Note: This field is defined as int64 for reasons of compatibility
    /// across different languages. However, it is a non-negative integer, which
    /// will never exceed 2^32-1, and can be safely downconverted to uint32 in
    /// languages that support this type.
    #[prost(message, optional, tag = "6")]
    pub ciphertext_crc32c: ::core::option::Option<i64>,
    /// Optional. An optional CRC32C checksum of the
    /// \[RawDecryptRequest.additional_authenticated_data\]\[google.cloud.kms.v1.RawDecryptRequest.additional_authenticated_data\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received additional_authenticated_data using
    /// this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(additional_authenticated_data) is equal to
    /// additional_authenticated_data_crc32c, and if so, perform
    /// a limited number of retries. A persistent mismatch may indicate an issue in
    /// your computation of the CRC32C checksum.
    /// Note: This field is defined as int64 for reasons of compatibility across
    /// different languages. However, it is a non-negative integer, which will
    /// never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    /// that support this type.
    #[prost(message, optional, tag = "7")]
    pub additional_authenticated_data_crc32c: ::core::option::Option<i64>,
    /// Optional. An optional CRC32C checksum of the
    /// \[RawDecryptRequest.initialization_vector\]\[google.cloud.kms.v1.RawDecryptRequest.initialization_vector\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received initialization_vector using this
    /// checksum. \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]
    /// will report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(initialization_vector) is equal to initialization_vector_crc32c, and
    /// if so, perform a limited number of retries. A persistent mismatch may
    /// indicate an issue in your computation of the CRC32C checksum.
    /// Note: This field is defined as int64 for reasons of compatibility across
    /// different languages. However, it is a non-negative integer, which will
    /// never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    /// that support this type.
    #[prost(message, optional, tag = "8")]
    pub initialization_vector_crc32c: ::core::option::Option<i64>,
}
/// Request message for
/// \[KeyManagementService.AsymmetricSign\]\[google.cloud.kms.v1.KeyManagementService.AsymmetricSign\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AsymmetricSignRequest {
    /// Required. The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to use for
    /// signing.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Optional. The digest of the data to sign. The digest must be produced with
    /// the same digest algorithm as specified by the key version's
    /// \[algorithm\]\[google.cloud.kms.v1.CryptoKeyVersion.algorithm\].
    ///
    /// This field may not be supplied if
    /// \[AsymmetricSignRequest.data\]\[google.cloud.kms.v1.AsymmetricSignRequest.data\]
    /// is supplied.
    #[prost(message, optional, tag = "3")]
    pub digest: ::core::option::Option<Digest>,
    /// Optional. An optional CRC32C checksum of the
    /// \[AsymmetricSignRequest.digest\]\[google.cloud.kms.v1.AsymmetricSignRequest.digest\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received
    /// \[AsymmetricSignRequest.digest\]\[google.cloud.kms.v1.AsymmetricSignRequest.digest\]
    /// using this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(\[AsymmetricSignRequest.digest\]\[google.cloud.kms.v1.AsymmetricSignRequest.digest\])
    /// is equal to
    /// \[AsymmetricSignRequest.digest_crc32c\]\[google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c\],
    /// and if so, perform a limited number of retries. A persistent mismatch may
    /// indicate an issue in your computation of the CRC32C checksum. Note: This
    /// field is defined as int64 for reasons of compatibility across different
    /// languages. However, it is a non-negative integer, which will never exceed
    /// 2^32-1, and can be safely downconverted to uint32 in languages that support
    /// this type.
    #[prost(message, optional, tag = "4")]
    pub digest_crc32c: ::core::option::Option<i64>,
    /// Optional. The data to sign.
    /// It can't be supplied if
    /// \[AsymmetricSignRequest.digest\]\[google.cloud.kms.v1.AsymmetricSignRequest.digest\]
    /// is supplied.
    #[prost(bytes = "vec", tag = "6")]
    pub data: ::prost::alloc::vec::Vec<u8>,
    /// Optional. An optional CRC32C checksum of the
    /// \[AsymmetricSignRequest.data\]\[google.cloud.kms.v1.AsymmetricSignRequest.data\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received
    /// \[AsymmetricSignRequest.data\]\[google.cloud.kms.v1.AsymmetricSignRequest.data\]
    /// using this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(\[AsymmetricSignRequest.data\]\[google.cloud.kms.v1.AsymmetricSignRequest.data\])
    /// is equal to
    /// \[AsymmetricSignRequest.data_crc32c\]\[google.cloud.kms.v1.AsymmetricSignRequest.data_crc32c\],
    /// and if so, perform a limited number of retries. A persistent mismatch may
    /// indicate an issue in your computation of the CRC32C checksum. Note: This
    /// field is defined as int64 for reasons of compatibility across different
    /// languages. However, it is a non-negative integer, which will never exceed
    /// 2^32-1, and can be safely downconverted to uint32 in languages that support
    /// this type.
    #[prost(message, optional, tag = "7")]
    pub data_crc32c: ::core::option::Option<i64>,
}
/// Request message for
/// \[KeyManagementService.AsymmetricDecrypt\]\[google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AsymmetricDecryptRequest {
    /// Required. The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to use for
    /// decryption.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Required. The data encrypted with the named
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]'s public key using
    /// OAEP.
    #[prost(bytes = "vec", tag = "3")]
    pub ciphertext: ::prost::alloc::vec::Vec<u8>,
    /// Optional. An optional CRC32C checksum of the
    /// \[AsymmetricDecryptRequest.ciphertext\]\[google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext\].
    /// If specified,
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// verify the integrity of the received
    /// \[AsymmetricDecryptRequest.ciphertext\]\[google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext\]
    /// using this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(\[AsymmetricDecryptRequest.ciphertext\]\[google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext\])
    /// is equal to
    /// \[AsymmetricDecryptRequest.ciphertext_crc32c\]\[google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c\],
    /// and if so, perform a limited number of retries. A persistent mismatch may
    /// indicate an issue in your computation of the CRC32C checksum. Note: This
    /// field is defined as int64 for reasons of compatibility across different
    /// languages. However, it is a non-negative integer, which will never exceed
    /// 2^32-1, and can be safely downconverted to uint32 in languages that support
    /// this type.
    #[prost(message, optional, tag = "4")]
    pub ciphertext_crc32c: ::core::option::Option<i64>,
}
/// Request message for
/// \[KeyManagementService.MacSign\]\[google.cloud.kms.v1.KeyManagementService.MacSign\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct MacSignRequest {
    /// Required. The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to use for
    /// signing.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Required. The data to sign. The MAC tag is computed over this data field
    /// based on the specific algorithm.
    #[prost(bytes = "vec", tag = "2")]
    pub data: ::prost::alloc::vec::Vec<u8>,
    /// Optional. An optional CRC32C checksum of the
    /// \[MacSignRequest.data\]\[google.cloud.kms.v1.MacSignRequest.data\]. If
    /// specified, \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]
    /// will verify the integrity of the received
    /// \[MacSignRequest.data\]\[google.cloud.kms.v1.MacSignRequest.data\] using this
    /// checksum. \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]
    /// will report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(\[MacSignRequest.data\]\[google.cloud.kms.v1.MacSignRequest.data\]) is
    /// equal to
    /// \[MacSignRequest.data_crc32c\]\[google.cloud.kms.v1.MacSignRequest.data_crc32c\],
    /// and if so, perform a limited number of retries. A persistent mismatch may
    /// indicate an issue in your computation of the CRC32C checksum. Note: This
    /// field is defined as int64 for reasons of compatibility across different
    /// languages. However, it is a non-negative integer, which will never exceed
    /// 2^32-1, and can be safely downconverted to uint32 in languages that support
    /// this type.
    #[prost(message, optional, tag = "3")]
    pub data_crc32c: ::core::option::Option<i64>,
}
/// Request message for
/// \[KeyManagementService.MacVerify\]\[google.cloud.kms.v1.KeyManagementService.MacVerify\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct MacVerifyRequest {
    /// Required. The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] to use for
    /// verification.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Required. The data used previously as a
    /// \[MacSignRequest.data\]\[google.cloud.kms.v1.MacSignRequest.data\] to generate
    /// the MAC tag.
    #[prost(bytes = "vec", tag = "2")]
    pub data: ::prost::alloc::vec::Vec<u8>,
    /// Optional. An optional CRC32C checksum of the
    /// \[MacVerifyRequest.data\]\[google.cloud.kms.v1.MacVerifyRequest.data\]. If
    /// specified, \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]
    /// will verify the integrity of the received
    /// \[MacVerifyRequest.data\]\[google.cloud.kms.v1.MacVerifyRequest.data\] using
    /// this checksum.
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] will
    /// report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(\[MacVerifyRequest.data\]\[google.cloud.kms.v1.MacVerifyRequest.data\])
    /// is equal to
    /// \[MacVerifyRequest.data_crc32c\]\[google.cloud.kms.v1.MacVerifyRequest.data_crc32c\],
    /// and if so, perform a limited number of retries. A persistent mismatch may
    /// indicate an issue in your computation of the CRC32C checksum. Note: This
    /// field is defined as int64 for reasons of compatibility across different
    /// languages. However, it is a non-negative integer, which will never exceed
    /// 2^32-1, and can be safely downconverted to uint32 in languages that support
    /// this type.
    #[prost(message, optional, tag = "3")]
    pub data_crc32c: ::core::option::Option<i64>,
    /// Required. The signature to verify.
    #[prost(bytes = "vec", tag = "4")]
    pub mac: ::prost::alloc::vec::Vec<u8>,
    /// Optional. An optional CRC32C checksum of the
    /// \[MacVerifyRequest.mac\]\[google.cloud.kms.v1.MacVerifyRequest.mac\]. If
    /// specified, \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]
    /// will verify the integrity of the received
    /// \[MacVerifyRequest.mac\]\[google.cloud.kms.v1.MacVerifyRequest.mac\] using this
    /// checksum. \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]
    /// will report an error if the checksum verification fails. If you receive a
    /// checksum error, your client should verify that
    /// CRC32C(\[MacVerifyRequest.mac\]\[google.cloud.kms.v1.MacVerifyRequest.mac\]) is
    /// equal to
    /// \[MacVerifyRequest.mac_crc32c\]\[google.cloud.kms.v1.MacVerifyRequest.mac_crc32c\],
    /// and if so, perform a limited number of retries. A persistent mismatch may
    /// indicate an issue in your computation of the CRC32C checksum. Note: This
    /// field is defined as int64 for reasons of compatibility across different
    /// languages. However, it is a non-negative integer, which will never exceed
    /// 2^32-1, and can be safely downconverted to uint32 in languages that support
    /// this type.
    #[prost(message, optional, tag = "5")]
    pub mac_crc32c: ::core::option::Option<i64>,
}
/// Request message for
/// \[KeyManagementService.GenerateRandomBytes\]\[google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GenerateRandomBytesRequest {
    /// The project-specific location in which to generate random bytes.
    /// For example, "projects/my-project/locations/us-central1".
    #[prost(string, tag = "1")]
    pub location: ::prost::alloc::string::String,
    /// The length in bytes of the amount of randomness to retrieve.  Minimum 8
    /// bytes, maximum 1024 bytes.
    #[prost(int32, tag = "2")]
    pub length_bytes: i32,
    /// The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] to use when
    /// generating the random data. Currently, only
    /// \[HSM\]\[google.cloud.kms.v1.ProtectionLevel.HSM\] protection level is
    /// supported.
    #[prost(enumeration = "ProtectionLevel", tag = "3")]
    pub protection_level: i32,
}
/// Response message for
/// \[KeyManagementService.Encrypt\]\[google.cloud.kms.v1.KeyManagementService.Encrypt\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct EncryptResponse {
    /// The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used in
    /// encryption. Check this field to verify that the intended resource was used
    /// for encryption.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// The encrypted data.
    #[prost(bytes = "vec", tag = "2")]
    pub ciphertext: ::prost::alloc::vec::Vec<u8>,
    /// Integrity verification field. A CRC32C checksum of the returned
    /// \[EncryptResponse.ciphertext\]\[google.cloud.kms.v1.EncryptResponse.ciphertext\].
    /// An integrity check of
    /// \[EncryptResponse.ciphertext\]\[google.cloud.kms.v1.EncryptResponse.ciphertext\]
    /// can be performed by computing the CRC32C checksum of
    /// \[EncryptResponse.ciphertext\]\[google.cloud.kms.v1.EncryptResponse.ciphertext\]
    /// and comparing your results to this field. Discard the response in case of
    /// non-matching checksum values, and perform a limited number of retries. A
    /// persistent mismatch may indicate an issue in your computation of the CRC32C
    /// checksum. Note: This field is defined as int64 for reasons of compatibility
    /// across different languages. However, it is a non-negative integer, which
    /// will never exceed 2^32-1, and can be safely downconverted to uint32 in
    /// languages that support this type.
    #[prost(message, optional, tag = "4")]
    pub ciphertext_crc32c: ::core::option::Option<i64>,
    /// Integrity verification field. A flag indicating whether
    /// \[EncryptRequest.plaintext_crc32c\]\[google.cloud.kms.v1.EncryptRequest.plaintext_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the
    /// \[plaintext\]\[google.cloud.kms.v1.EncryptRequest.plaintext\]. A false value of
    /// this field indicates either that
    /// \[EncryptRequest.plaintext_crc32c\]\[google.cloud.kms.v1.EncryptRequest.plaintext_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[EncryptRequest.plaintext_crc32c\]\[google.cloud.kms.v1.EncryptRequest.plaintext_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "5")]
    pub verified_plaintext_crc32c: bool,
    /// Integrity verification field. A flag indicating whether
    /// \[EncryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.EncryptRequest.additional_authenticated_data_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the
    /// \[AAD\]\[google.cloud.kms.v1.EncryptRequest.additional_authenticated_data\]. A
    /// false value of this field indicates either that
    /// \[EncryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.EncryptRequest.additional_authenticated_data_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[EncryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.EncryptRequest.additional_authenticated_data_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "6")]
    pub verified_additional_authenticated_data_crc32c: bool,
    /// The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used in
    /// encryption.
    #[prost(enumeration = "ProtectionLevel", tag = "7")]
    pub protection_level: i32,
}
/// Response message for
/// \[KeyManagementService.RawEncrypt\]\[google.cloud.kms.v1.KeyManagementService.RawEncrypt\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RawEncryptResponse {
    /// The encrypted data. In the case of AES-GCM, the authentication tag
    /// is the \[tag_length\]\[google.cloud.kms.v1.RawEncryptResponse.tag_length\]
    /// bytes at the end of this field.
    #[prost(bytes = "vec", tag = "1")]
    pub ciphertext: ::prost::alloc::vec::Vec<u8>,
    /// The initialization vector (IV) generated by the service during
    /// encryption. This value must be stored and provided in
    /// \[RawDecryptRequest.initialization_vector\]\[google.cloud.kms.v1.RawDecryptRequest.initialization_vector\]
    /// at decryption time.
    #[prost(bytes = "vec", tag = "2")]
    pub initialization_vector: ::prost::alloc::vec::Vec<u8>,
    /// The length of the authentication tag that is appended to
    /// the end of the ciphertext.
    #[prost(int32, tag = "3")]
    pub tag_length: i32,
    /// Integrity verification field. A CRC32C checksum of the returned
    /// \[RawEncryptResponse.ciphertext\]\[google.cloud.kms.v1.RawEncryptResponse.ciphertext\].
    /// An integrity check of ciphertext can be performed by computing the CRC32C
    /// checksum of ciphertext and comparing your results to this field. Discard
    /// the response in case of non-matching checksum values, and perform a limited
    /// number of retries. A persistent mismatch may indicate an issue in your
    /// computation of the CRC32C checksum. Note: This field is defined as int64
    /// for reasons of compatibility across different languages. However, it is a
    /// non-negative integer, which will never exceed 2^32-1, and can be safely
    /// downconverted to uint32 in languages that support this type.
    #[prost(message, optional, tag = "4")]
    pub ciphertext_crc32c: ::core::option::Option<i64>,
    /// Integrity verification field. A CRC32C checksum of the returned
    /// \[RawEncryptResponse.initialization_vector\]\[google.cloud.kms.v1.RawEncryptResponse.initialization_vector\].
    /// An integrity check of initialization_vector can be performed by computing
    /// the CRC32C checksum of initialization_vector and comparing your results to
    /// this field. Discard the response in case of non-matching checksum values,
    /// and perform a limited number of retries. A persistent mismatch may indicate
    /// an issue in your computation of the CRC32C checksum. Note: This field is
    /// defined as int64 for reasons of compatibility across different languages.
    /// However, it is a non-negative integer, which will never exceed 2^32-1, and
    /// can be safely downconverted to uint32 in languages that support this type.
    #[prost(message, optional, tag = "5")]
    pub initialization_vector_crc32c: ::core::option::Option<i64>,
    /// Integrity verification field. A flag indicating whether
    /// \[RawEncryptRequest.plaintext_crc32c\]\[google.cloud.kms.v1.RawEncryptRequest.plaintext_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the plaintext. A false value of this
    /// field indicates either that
    /// \[RawEncryptRequest.plaintext_crc32c\]\[google.cloud.kms.v1.RawEncryptRequest.plaintext_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[RawEncryptRequest.plaintext_crc32c\]\[google.cloud.kms.v1.RawEncryptRequest.plaintext_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "6")]
    pub verified_plaintext_crc32c: bool,
    /// Integrity verification field. A flag indicating whether
    /// \[RawEncryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.RawEncryptRequest.additional_authenticated_data_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of additional_authenticated_data. A false
    /// value of this field indicates either that //
    /// \[RawEncryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.RawEncryptRequest.additional_authenticated_data_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[RawEncryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.RawEncryptRequest.additional_authenticated_data_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "7")]
    pub verified_additional_authenticated_data_crc32c: bool,
    /// Integrity verification field. A flag indicating whether
    /// \[RawEncryptRequest.initialization_vector_crc32c\]\[google.cloud.kms.v1.RawEncryptRequest.initialization_vector_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of initialization_vector. A false value of
    /// this field indicates either that
    /// \[RawEncryptRequest.initialization_vector_crc32c\]\[google.cloud.kms.v1.RawEncryptRequest.initialization_vector_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[RawEncryptRequest.initialization_vector_crc32c\]\[google.cloud.kms.v1.RawEncryptRequest.initialization_vector_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "10")]
    pub verified_initialization_vector_crc32c: bool,
    /// The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used in
    /// encryption. Check this field to verify that the intended resource was used
    /// for encryption.
    #[prost(string, tag = "8")]
    pub name: ::prost::alloc::string::String,
    /// The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used in
    /// encryption.
    #[prost(enumeration = "ProtectionLevel", tag = "9")]
    pub protection_level: i32,
}
/// Response message for
/// \[KeyManagementService.RawDecrypt\]\[google.cloud.kms.v1.KeyManagementService.RawDecrypt\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RawDecryptResponse {
    /// The decrypted data.
    #[prost(bytes = "vec", tag = "1")]
    pub plaintext: ::prost::alloc::vec::Vec<u8>,
    /// Integrity verification field. A CRC32C checksum of the returned
    /// \[RawDecryptResponse.plaintext\]\[google.cloud.kms.v1.RawDecryptResponse.plaintext\].
    /// An integrity check of plaintext can be performed by computing the CRC32C
    /// checksum of plaintext and comparing your results to this field. Discard the
    /// response in case of non-matching checksum values, and perform a limited
    /// number of retries. A persistent mismatch may indicate an issue in your
    /// computation of the CRC32C checksum. Note: receiving this response message
    /// indicates that
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] is able to
    /// successfully decrypt the
    /// \[ciphertext\]\[google.cloud.kms.v1.RawDecryptRequest.ciphertext\].
    /// Note: This field is defined as int64 for reasons of compatibility across
    /// different languages. However, it is a non-negative integer, which will
    /// never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    /// that support this type.
    #[prost(message, optional, tag = "2")]
    pub plaintext_crc32c: ::core::option::Option<i64>,
    /// The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used in
    /// decryption.
    #[prost(enumeration = "ProtectionLevel", tag = "3")]
    pub protection_level: i32,
    /// Integrity verification field. A flag indicating whether
    /// \[RawDecryptRequest.ciphertext_crc32c\]\[google.cloud.kms.v1.RawDecryptRequest.ciphertext_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the ciphertext. A false value of this
    /// field indicates either that
    /// \[RawDecryptRequest.ciphertext_crc32c\]\[google.cloud.kms.v1.RawDecryptRequest.ciphertext_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[RawDecryptRequest.ciphertext_crc32c\]\[google.cloud.kms.v1.RawDecryptRequest.ciphertext_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "4")]
    pub verified_ciphertext_crc32c: bool,
    /// Integrity verification field. A flag indicating whether
    /// \[RawDecryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.RawDecryptRequest.additional_authenticated_data_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of additional_authenticated_data. A false
    /// value of this field indicates either that //
    /// \[RawDecryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.RawDecryptRequest.additional_authenticated_data_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[RawDecryptRequest.additional_authenticated_data_crc32c\]\[google.cloud.kms.v1.RawDecryptRequest.additional_authenticated_data_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "5")]
    pub verified_additional_authenticated_data_crc32c: bool,
    /// Integrity verification field. A flag indicating whether
    /// \[RawDecryptRequest.initialization_vector_crc32c\]\[google.cloud.kms.v1.RawDecryptRequest.initialization_vector_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of initialization_vector. A false value of
    /// this field indicates either that
    /// \[RawDecryptRequest.initialization_vector_crc32c\]\[google.cloud.kms.v1.RawDecryptRequest.initialization_vector_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[RawDecryptRequest.initialization_vector_crc32c\]\[google.cloud.kms.v1.RawDecryptRequest.initialization_vector_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "6")]
    pub verified_initialization_vector_crc32c: bool,
}
/// Response message for
/// \[KeyManagementService.AsymmetricSign\]\[google.cloud.kms.v1.KeyManagementService.AsymmetricSign\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AsymmetricSignResponse {
    /// The created signature.
    #[prost(bytes = "vec", tag = "1")]
    pub signature: ::prost::alloc::vec::Vec<u8>,
    /// Integrity verification field. A CRC32C checksum of the returned
    /// \[AsymmetricSignResponse.signature\]\[google.cloud.kms.v1.AsymmetricSignResponse.signature\].
    /// An integrity check of
    /// \[AsymmetricSignResponse.signature\]\[google.cloud.kms.v1.AsymmetricSignResponse.signature\]
    /// can be performed by computing the CRC32C checksum of
    /// \[AsymmetricSignResponse.signature\]\[google.cloud.kms.v1.AsymmetricSignResponse.signature\]
    /// and comparing your results to this field. Discard the response in case of
    /// non-matching checksum values, and perform a limited number of retries. A
    /// persistent mismatch may indicate an issue in your computation of the CRC32C
    /// checksum. Note: This field is defined as int64 for reasons of compatibility
    /// across different languages. However, it is a non-negative integer, which
    /// will never exceed 2^32-1, and can be safely downconverted to uint32 in
    /// languages that support this type.
    #[prost(message, optional, tag = "2")]
    pub signature_crc32c: ::core::option::Option<i64>,
    /// Integrity verification field. A flag indicating whether
    /// \[AsymmetricSignRequest.digest_crc32c\]\[google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the
    /// \[digest\]\[google.cloud.kms.v1.AsymmetricSignRequest.digest\]. A false value
    /// of this field indicates either that
    /// \[AsymmetricSignRequest.digest_crc32c\]\[google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[AsymmetricSignRequest.digest_crc32c\]\[google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "3")]
    pub verified_digest_crc32c: bool,
    /// The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used for signing.
    /// Check this field to verify that the intended resource was used for signing.
    #[prost(string, tag = "4")]
    pub name: ::prost::alloc::string::String,
    /// Integrity verification field. A flag indicating whether
    /// \[AsymmetricSignRequest.data_crc32c\]\[google.cloud.kms.v1.AsymmetricSignRequest.data_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the
    /// \[data\]\[google.cloud.kms.v1.AsymmetricSignRequest.data\]. A false value of
    /// this field indicates either that
    /// \[AsymmetricSignRequest.data_crc32c\]\[google.cloud.kms.v1.AsymmetricSignRequest.data_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[AsymmetricSignRequest.data_crc32c\]\[google.cloud.kms.v1.AsymmetricSignRequest.data_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "5")]
    pub verified_data_crc32c: bool,
    /// The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used for signing.
    #[prost(enumeration = "ProtectionLevel", tag = "6")]
    pub protection_level: i32,
}
/// Response message for
/// \[KeyManagementService.AsymmetricDecrypt\]\[google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AsymmetricDecryptResponse {
    /// The decrypted data originally encrypted with the matching public key.
    #[prost(bytes = "vec", tag = "1")]
    pub plaintext: ::prost::alloc::vec::Vec<u8>,
    /// Integrity verification field. A CRC32C checksum of the returned
    /// \[AsymmetricDecryptResponse.plaintext\]\[google.cloud.kms.v1.AsymmetricDecryptResponse.plaintext\].
    /// An integrity check of
    /// \[AsymmetricDecryptResponse.plaintext\]\[google.cloud.kms.v1.AsymmetricDecryptResponse.plaintext\]
    /// can be performed by computing the CRC32C checksum of
    /// \[AsymmetricDecryptResponse.plaintext\]\[google.cloud.kms.v1.AsymmetricDecryptResponse.plaintext\]
    /// and comparing your results to this field. Discard the response in case of
    /// non-matching checksum values, and perform a limited number of retries. A
    /// persistent mismatch may indicate an issue in your computation of the CRC32C
    /// checksum. Note: This field is defined as int64 for reasons of compatibility
    /// across different languages. However, it is a non-negative integer, which
    /// will never exceed 2^32-1, and can be safely downconverted to uint32 in
    /// languages that support this type.
    #[prost(message, optional, tag = "2")]
    pub plaintext_crc32c: ::core::option::Option<i64>,
    /// Integrity verification field. A flag indicating whether
    /// \[AsymmetricDecryptRequest.ciphertext_crc32c\]\[google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the
    /// \[ciphertext\]\[google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext\]. A
    /// false value of this field indicates either that
    /// \[AsymmetricDecryptRequest.ciphertext_crc32c\]\[google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[AsymmetricDecryptRequest.ciphertext_crc32c\]\[google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "3")]
    pub verified_ciphertext_crc32c: bool,
    /// The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used in
    /// decryption.
    #[prost(enumeration = "ProtectionLevel", tag = "4")]
    pub protection_level: i32,
}
/// Response message for
/// \[KeyManagementService.MacSign\]\[google.cloud.kms.v1.KeyManagementService.MacSign\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct MacSignResponse {
    /// The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used for signing.
    /// Check this field to verify that the intended resource was used for signing.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// The created signature.
    #[prost(bytes = "vec", tag = "2")]
    pub mac: ::prost::alloc::vec::Vec<u8>,
    /// Integrity verification field. A CRC32C checksum of the returned
    /// \[MacSignResponse.mac\]\[google.cloud.kms.v1.MacSignResponse.mac\]. An
    /// integrity check of
    /// \[MacSignResponse.mac\]\[google.cloud.kms.v1.MacSignResponse.mac\] can be
    /// performed by computing the CRC32C checksum of
    /// \[MacSignResponse.mac\]\[google.cloud.kms.v1.MacSignResponse.mac\] and
    /// comparing your results to this field. Discard the response in case of
    /// non-matching checksum values, and perform a limited number of retries. A
    /// persistent mismatch may indicate an issue in your computation of the CRC32C
    /// checksum. Note: This field is defined as int64 for reasons of compatibility
    /// across different languages. However, it is a non-negative integer, which
    /// will never exceed 2^32-1, and can be safely downconverted to uint32 in
    /// languages that support this type.
    #[prost(message, optional, tag = "3")]
    pub mac_crc32c: ::core::option::Option<i64>,
    /// Integrity verification field. A flag indicating whether
    /// \[MacSignRequest.data_crc32c\]\[google.cloud.kms.v1.MacSignRequest.data_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the
    /// \[data\]\[google.cloud.kms.v1.MacSignRequest.data\]. A false value of this
    /// field indicates either that
    /// \[MacSignRequest.data_crc32c\]\[google.cloud.kms.v1.MacSignRequest.data_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[MacSignRequest.data_crc32c\]\[google.cloud.kms.v1.MacSignRequest.data_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "4")]
    pub verified_data_crc32c: bool,
    /// The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used for signing.
    #[prost(enumeration = "ProtectionLevel", tag = "5")]
    pub protection_level: i32,
}
/// Response message for
/// \[KeyManagementService.MacVerify\]\[google.cloud.kms.v1.KeyManagementService.MacVerify\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct MacVerifyResponse {
    /// The resource name of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used for
    /// verification. Check this field to verify that the intended resource was
    /// used for verification.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// This field indicates whether or not the verification operation for
    /// \[MacVerifyRequest.mac\]\[google.cloud.kms.v1.MacVerifyRequest.mac\] over
    /// \[MacVerifyRequest.data\]\[google.cloud.kms.v1.MacVerifyRequest.data\] was
    /// successful.
    #[prost(bool, tag = "2")]
    pub success: bool,
    /// Integrity verification field. A flag indicating whether
    /// \[MacVerifyRequest.data_crc32c\]\[google.cloud.kms.v1.MacVerifyRequest.data_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the
    /// \[data\]\[google.cloud.kms.v1.MacVerifyRequest.data\]. A false value of this
    /// field indicates either that
    /// \[MacVerifyRequest.data_crc32c\]\[google.cloud.kms.v1.MacVerifyRequest.data_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[MacVerifyRequest.data_crc32c\]\[google.cloud.kms.v1.MacVerifyRequest.data_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "3")]
    pub verified_data_crc32c: bool,
    /// Integrity verification field. A flag indicating whether
    /// \[MacVerifyRequest.mac_crc32c\]\[google.cloud.kms.v1.MacVerifyRequest.mac_crc32c\]
    /// was received by
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\] and used
    /// for the integrity verification of the
    /// \[data\]\[google.cloud.kms.v1.MacVerifyRequest.mac\]. A false value of this
    /// field indicates either that
    /// \[MacVerifyRequest.mac_crc32c\]\[google.cloud.kms.v1.MacVerifyRequest.mac_crc32c\]
    /// was left unset or that it was not delivered to
    /// \[KeyManagementService\]\[google.cloud.kms.v1.KeyManagementService\]. If you've
    /// set
    /// \[MacVerifyRequest.mac_crc32c\]\[google.cloud.kms.v1.MacVerifyRequest.mac_crc32c\]
    /// but this field is still false, discard the response and perform a limited
    /// number of retries.
    #[prost(bool, tag = "4")]
    pub verified_mac_crc32c: bool,
    /// Integrity verification field. This value is used for the integrity
    /// verification of \[MacVerifyResponse.success\]. If the value of this field
    /// contradicts the value of \[MacVerifyResponse.success\], discard the response
    /// and perform a limited number of retries.
    #[prost(bool, tag = "5")]
    pub verified_success_integrity: bool,
    /// The \[ProtectionLevel\]\[google.cloud.kms.v1.ProtectionLevel\] of the
    /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] used for
    /// verification.
    #[prost(enumeration = "ProtectionLevel", tag = "6")]
    pub protection_level: i32,
}
/// Response message for
/// \[KeyManagementService.GenerateRandomBytes\]\[google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes\].
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GenerateRandomBytesResponse {
    /// The generated data.
    #[prost(bytes = "vec", tag = "1")]
    pub data: ::prost::alloc::vec::Vec<u8>,
    /// Integrity verification field. A CRC32C checksum of the returned
    /// \[GenerateRandomBytesResponse.data\]\[google.cloud.kms.v1.GenerateRandomBytesResponse.data\].
    /// An integrity check of
    /// \[GenerateRandomBytesResponse.data\]\[google.cloud.kms.v1.GenerateRandomBytesResponse.data\]
    /// can be performed by computing the CRC32C checksum of
    /// \[GenerateRandomBytesResponse.data\]\[google.cloud.kms.v1.GenerateRandomBytesResponse.data\]
    /// and comparing your results to this field. Discard the response in case of
    /// non-matching checksum values, and perform a limited number of retries. A
    /// persistent mismatch may indicate an issue in your computation of the CRC32C
    /// checksum. Note: This field is defined as int64 for reasons of compatibility
    /// across different languages. However, it is a non-negative integer, which
    /// will never exceed 2^32-1, and can be safely downconverted to uint32 in
    /// languages that support this type.
    #[prost(message, optional, tag = "3")]
    pub data_crc32c: ::core::option::Option<i64>,
}
/// A \[Digest\]\[google.cloud.kms.v1.Digest\] holds a cryptographic message digest.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Digest {
    /// Required. The message digest.
    #[prost(oneof = "digest::Digest", tags = "1, 2, 3")]
    pub digest: ::core::option::Option<digest::Digest>,
}
/// Nested message and enum types in `Digest`.
pub mod digest {
    /// Required. The message digest.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
    pub enum Digest {
        /// A message digest produced with the SHA-256 algorithm.
        #[prost(bytes, tag = "1")]
        Sha256(::prost::alloc::vec::Vec<u8>),
        /// A message digest produced with the SHA-384 algorithm.
        #[prost(bytes, tag = "2")]
        Sha384(::prost::alloc::vec::Vec<u8>),
        /// A message digest produced with the SHA-512 algorithm.
        #[prost(bytes, tag = "3")]
        Sha512(::prost::alloc::vec::Vec<u8>),
    }
}
/// Cloud KMS metadata for the given
/// \[google.cloud.location.Location\]\[google.cloud.location.Location\].
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct LocationMetadata {
    /// Indicates whether \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] with
    /// \[protection_level\]\[google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level\]
    /// \[HSM\]\[google.cloud.kms.v1.ProtectionLevel.HSM\] can be created in this
    /// location.
    #[prost(bool, tag = "1")]
    pub hsm_available: bool,
    /// Indicates whether \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\] with
    /// \[protection_level\]\[google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level\]
    /// \[EXTERNAL\]\[google.cloud.kms.v1.ProtectionLevel.EXTERNAL\] can be created in
    /// this location.
    #[prost(bool, tag = "2")]
    pub ekm_available: bool,
}
/// Generated client implementations.
pub mod key_management_service_client {
    #![allow(
        unused_variables,
        dead_code,
        missing_docs,
        clippy::wildcard_imports,
        clippy::let_unit_value,
    )]
    use tonic::codegen::*;
    use tonic::codegen::http::Uri;
    /// Google Cloud Key Management Service
    ///
    /// Manages cryptographic keys and operations using those keys. Implements a REST
    /// model with the following objects:
    ///
    /// * \[KeyRing\]\[google.cloud.kms.v1.KeyRing\]
    /// * \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\]
    /// * \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]
    /// * \[ImportJob\]\[google.cloud.kms.v1.ImportJob\]
    ///
    /// If you are using manual gRPC libraries, see
    /// [Using gRPC with Cloud KMS](https://cloud.google.com/kms/docs/grpc).
    #[derive(Debug, Clone)]
    pub struct KeyManagementServiceClient<T> {
        inner: tonic::client::Grpc<T>,
    }
    impl KeyManagementServiceClient<tonic::transport::Channel> {
        /// Attempt to create a new client by connecting to a given endpoint.
        pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
        where
            D: TryInto<tonic::transport::Endpoint>,
            D::Error: Into<StdError>,
        {
            let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
            Ok(Self::new(conn))
        }
    }
    impl<T> KeyManagementServiceClient<T>
    where
        T: tonic::client::GrpcService<tonic::body::Body>,
        T::Error: Into<StdError>,
        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
    {
        pub fn new(inner: T) -> Self {
            let inner = tonic::client::Grpc::new(inner);
            Self { inner }
        }
        pub fn with_origin(inner: T, origin: Uri) -> Self {
            let inner = tonic::client::Grpc::with_origin(inner, origin);
            Self { inner }
        }
        pub fn with_interceptor<F>(
            inner: T,
            interceptor: F,
        ) -> KeyManagementServiceClient<InterceptedService<T, F>>
        where
            F: tonic::service::Interceptor,
            T::ResponseBody: Default,
            T: tonic::codegen::Service<
                http::Request<tonic::body::Body>,
                Response = http::Response<
                    <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                >,
            >,
            <T as tonic::codegen::Service<
                http::Request<tonic::body::Body>,
            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
        {
            KeyManagementServiceClient::new(InterceptedService::new(inner, interceptor))
        }
        /// Compress requests with the given encoding.
        ///
        /// This requires the server to support it otherwise it might respond with an
        /// error.
        #[must_use]
        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.send_compressed(encoding);
            self
        }
        /// Enable decompressing responses.
        #[must_use]
        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.accept_compressed(encoding);
            self
        }
        /// Limits the maximum size of a decoded message.
        ///
        /// Default: `4MB`
        #[must_use]
        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_decoding_message_size(limit);
            self
        }
        /// Limits the maximum size of an encoded message.
        ///
        /// Default: `usize::MAX`
        #[must_use]
        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_encoding_message_size(limit);
            self
        }
        /// Lists \[KeyRings\]\[google.cloud.kms.v1.KeyRing\].
        pub async fn list_key_rings(
            &mut self,
            request: impl tonic::IntoRequest<super::ListKeyRingsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::ListKeyRingsResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/ListKeyRings",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "ListKeyRings",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Lists \[CryptoKeys\]\[google.cloud.kms.v1.CryptoKey\].
        pub async fn list_crypto_keys(
            &mut self,
            request: impl tonic::IntoRequest<super::ListCryptoKeysRequest>,
        ) -> std::result::Result<
            tonic::Response<super::ListCryptoKeysResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/ListCryptoKeys",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "ListCryptoKeys",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Lists \[CryptoKeyVersions\]\[google.cloud.kms.v1.CryptoKeyVersion\].
        pub async fn list_crypto_key_versions(
            &mut self,
            request: impl tonic::IntoRequest<super::ListCryptoKeyVersionsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::ListCryptoKeyVersionsResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/ListCryptoKeyVersions",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "ListCryptoKeyVersions",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Lists \[ImportJobs\]\[google.cloud.kms.v1.ImportJob\].
        pub async fn list_import_jobs(
            &mut self,
            request: impl tonic::IntoRequest<super::ListImportJobsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::ListImportJobsResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/ListImportJobs",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "ListImportJobs",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns metadata for a given \[KeyRing\]\[google.cloud.kms.v1.KeyRing\].
        pub async fn get_key_ring(
            &mut self,
            request: impl tonic::IntoRequest<super::GetKeyRingRequest>,
        ) -> std::result::Result<tonic::Response<super::KeyRing>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/GetKeyRing",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "GetKeyRing",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns metadata for a given \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\], as
        /// well as its \[primary\]\[google.cloud.kms.v1.CryptoKey.primary\]
        /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\].
        pub async fn get_crypto_key(
            &mut self,
            request: impl tonic::IntoRequest<super::GetCryptoKeyRequest>,
        ) -> std::result::Result<tonic::Response<super::CryptoKey>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/GetCryptoKey",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "GetCryptoKey",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns metadata for a given
        /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\].
        pub async fn get_crypto_key_version(
            &mut self,
            request: impl tonic::IntoRequest<super::GetCryptoKeyVersionRequest>,
        ) -> std::result::Result<
            tonic::Response<super::CryptoKeyVersion>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/GetCryptoKeyVersion",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "GetCryptoKeyVersion",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns the public key for the given
        /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]. The
        /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\] must be
        /// \[ASYMMETRIC_SIGN\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN\]
        /// or
        /// \[ASYMMETRIC_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT\].
        pub async fn get_public_key(
            &mut self,
            request: impl tonic::IntoRequest<super::GetPublicKeyRequest>,
        ) -> std::result::Result<tonic::Response<super::PublicKey>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/GetPublicKey",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "GetPublicKey",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Returns metadata for a given \[ImportJob\]\[google.cloud.kms.v1.ImportJob\].
        pub async fn get_import_job(
            &mut self,
            request: impl tonic::IntoRequest<super::GetImportJobRequest>,
        ) -> std::result::Result<tonic::Response<super::ImportJob>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/GetImportJob",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "GetImportJob",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Create a new \[KeyRing\]\[google.cloud.kms.v1.KeyRing\] in a given Project and
        /// Location.
        pub async fn create_key_ring(
            &mut self,
            request: impl tonic::IntoRequest<super::CreateKeyRingRequest>,
        ) -> std::result::Result<tonic::Response<super::KeyRing>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/CreateKeyRing",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "CreateKeyRing",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Create a new \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] within a
        /// \[KeyRing\]\[google.cloud.kms.v1.KeyRing\].
        ///
        /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\] and
        /// \[CryptoKey.version_template.algorithm\]\[google.cloud.kms.v1.CryptoKeyVersionTemplate.algorithm\]
        /// are required.
        pub async fn create_crypto_key(
            &mut self,
            request: impl tonic::IntoRequest<super::CreateCryptoKeyRequest>,
        ) -> std::result::Result<tonic::Response<super::CryptoKey>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/CreateCryptoKey",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "CreateCryptoKey",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Create a new \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] in a
        /// \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
        ///
        /// The server will assign the next sequential id. If unset,
        /// \[state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] will be set to
        /// \[ENABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED\].
        pub async fn create_crypto_key_version(
            &mut self,
            request: impl tonic::IntoRequest<super::CreateCryptoKeyVersionRequest>,
        ) -> std::result::Result<
            tonic::Response<super::CryptoKeyVersion>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/CreateCryptoKeyVersion",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "CreateCryptoKeyVersion",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Import wrapped key material into a
        /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\].
        ///
        /// All requests must specify a \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\]. If
        /// a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] is additionally
        /// specified in the request, key material will be reimported into that
        /// version. Otherwise, a new version will be created, and will be assigned the
        /// next sequential id within the \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
        pub async fn import_crypto_key_version(
            &mut self,
            request: impl tonic::IntoRequest<super::ImportCryptoKeyVersionRequest>,
        ) -> std::result::Result<
            tonic::Response<super::CryptoKeyVersion>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/ImportCryptoKeyVersion",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "ImportCryptoKeyVersion",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Create a new \[ImportJob\]\[google.cloud.kms.v1.ImportJob\] within a
        /// \[KeyRing\]\[google.cloud.kms.v1.KeyRing\].
        ///
        /// \[ImportJob.import_method\]\[google.cloud.kms.v1.ImportJob.import_method\] is
        /// required.
        pub async fn create_import_job(
            &mut self,
            request: impl tonic::IntoRequest<super::CreateImportJobRequest>,
        ) -> std::result::Result<tonic::Response<super::ImportJob>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/CreateImportJob",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "CreateImportJob",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Update a \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\].
        pub async fn update_crypto_key(
            &mut self,
            request: impl tonic::IntoRequest<super::UpdateCryptoKeyRequest>,
        ) -> std::result::Result<tonic::Response<super::CryptoKey>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/UpdateCryptoKey",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "UpdateCryptoKey",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Update a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]'s
        /// metadata.
        ///
        /// \[state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] may be changed between
        /// \[ENABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED\]
        /// and
        /// \[DISABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED\]
        /// using this method. See
        /// \[DestroyCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion\]
        /// and
        /// \[RestoreCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion\]
        /// to move between other states.
        pub async fn update_crypto_key_version(
            &mut self,
            request: impl tonic::IntoRequest<super::UpdateCryptoKeyVersionRequest>,
        ) -> std::result::Result<
            tonic::Response<super::CryptoKeyVersion>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/UpdateCryptoKeyVersion",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "UpdateCryptoKeyVersion",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Update the version of a \[CryptoKey\]\[google.cloud.kms.v1.CryptoKey\] that
        /// will be used in
        /// \[Encrypt\]\[google.cloud.kms.v1.KeyManagementService.Encrypt\].
        ///
        /// Returns an error if called on a key whose purpose is not
        /// \[ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT\].
        pub async fn update_crypto_key_primary_version(
            &mut self,
            request: impl tonic::IntoRequest<super::UpdateCryptoKeyPrimaryVersionRequest>,
        ) -> std::result::Result<tonic::Response<super::CryptoKey>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/UpdateCryptoKeyPrimaryVersion",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "UpdateCryptoKeyPrimaryVersion",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Schedule a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] for
        /// destruction.
        ///
        /// Upon calling this method,
        /// \[CryptoKeyVersion.state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] will
        /// be set to
        /// \[DESTROY_SCHEDULED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED\],
        /// and \[destroy_time\]\[google.cloud.kms.v1.CryptoKeyVersion.destroy_time\] will
        /// be set to the time
        /// \[destroy_scheduled_duration\]\[google.cloud.kms.v1.CryptoKey.destroy_scheduled_duration\]
        /// in the future. At that time, the
        /// \[state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] will automatically
        /// change to
        /// \[DESTROYED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED\],
        /// and the key material will be irrevocably destroyed.
        ///
        /// Before the
        /// \[destroy_time\]\[google.cloud.kms.v1.CryptoKeyVersion.destroy_time\] is
        /// reached,
        /// \[RestoreCryptoKeyVersion\]\[google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion\]
        /// may be called to reverse the process.
        pub async fn destroy_crypto_key_version(
            &mut self,
            request: impl tonic::IntoRequest<super::DestroyCryptoKeyVersionRequest>,
        ) -> std::result::Result<
            tonic::Response<super::CryptoKeyVersion>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/DestroyCryptoKeyVersion",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "DestroyCryptoKeyVersion",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Restore a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] in the
        /// \[DESTROY_SCHEDULED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED\]
        /// state.
        ///
        /// Upon restoration of the CryptoKeyVersion,
        /// \[state\]\[google.cloud.kms.v1.CryptoKeyVersion.state\] will be set to
        /// \[DISABLED\]\[google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED\],
        /// and \[destroy_time\]\[google.cloud.kms.v1.CryptoKeyVersion.destroy_time\] will
        /// be cleared.
        pub async fn restore_crypto_key_version(
            &mut self,
            request: impl tonic::IntoRequest<super::RestoreCryptoKeyVersionRequest>,
        ) -> std::result::Result<
            tonic::Response<super::CryptoKeyVersion>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/RestoreCryptoKeyVersion",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "RestoreCryptoKeyVersion",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Encrypts data, so that it can only be recovered by a call to
        /// \[Decrypt\]\[google.cloud.kms.v1.KeyManagementService.Decrypt\]. The
        /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\] must be
        /// \[ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT\].
        pub async fn encrypt(
            &mut self,
            request: impl tonic::IntoRequest<crate::proto_ext::kms::EncryptRequest>,
        ) -> std::result::Result<
            tonic::Response<super::EncryptResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/Encrypt",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "Encrypt",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Decrypts data that was protected by
        /// \[Encrypt\]\[google.cloud.kms.v1.KeyManagementService.Encrypt\]. The
        /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\] must be
        /// \[ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT\].
        pub async fn decrypt(
            &mut self,
            request: impl tonic::IntoRequest<super::DecryptRequest>,
        ) -> std::result::Result<
            tonic::Response<crate::proto_ext::kms::DecryptResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/Decrypt",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "Decrypt",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Encrypts data using portable cryptographic primitives. Most users should
        /// choose \[Encrypt\]\[google.cloud.kms.v1.KeyManagementService.Encrypt\] and
        /// \[Decrypt\]\[google.cloud.kms.v1.KeyManagementService.Decrypt\] rather than
        /// their raw counterparts. The
        /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\] must be
        /// \[RAW_ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.RAW_ENCRYPT_DECRYPT\].
        pub async fn raw_encrypt(
            &mut self,
            request: impl tonic::IntoRequest<super::RawEncryptRequest>,
        ) -> std::result::Result<
            tonic::Response<super::RawEncryptResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/RawEncrypt",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "RawEncrypt",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Decrypts data that was originally encrypted using a raw cryptographic
        /// mechanism. The \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
        /// must be
        /// \[RAW_ENCRYPT_DECRYPT\]\[google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.RAW_ENCRYPT_DECRYPT\].
        pub async fn raw_decrypt(
            &mut self,
            request: impl tonic::IntoRequest<super::RawDecryptRequest>,
        ) -> std::result::Result<
            tonic::Response<super::RawDecryptResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/RawDecrypt",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "RawDecrypt",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Signs data using a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]
        /// with \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
        /// ASYMMETRIC_SIGN, producing a signature that can be verified with the public
        /// key retrieved from
        /// \[GetPublicKey\]\[google.cloud.kms.v1.KeyManagementService.GetPublicKey\].
        pub async fn asymmetric_sign(
            &mut self,
            request: impl tonic::IntoRequest<super::AsymmetricSignRequest>,
        ) -> std::result::Result<
            tonic::Response<super::AsymmetricSignResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/AsymmetricSign",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "AsymmetricSign",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Decrypts data that was encrypted with a public key retrieved from
        /// \[GetPublicKey\]\[google.cloud.kms.v1.KeyManagementService.GetPublicKey\]
        /// corresponding to a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]
        /// with \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\]
        /// ASYMMETRIC_DECRYPT.
        pub async fn asymmetric_decrypt(
            &mut self,
            request: impl tonic::IntoRequest<super::AsymmetricDecryptRequest>,
        ) -> std::result::Result<
            tonic::Response<super::AsymmetricDecryptResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/AsymmetricDecrypt",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "AsymmetricDecrypt",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Signs data using a \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\]
        /// with \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\] MAC,
        /// producing a tag that can be verified by another source with the same key.
        pub async fn mac_sign(
            &mut self,
            request: impl tonic::IntoRequest<super::MacSignRequest>,
        ) -> std::result::Result<
            tonic::Response<super::MacSignResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/MacSign",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "MacSign",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Verifies MAC tag using a
        /// \[CryptoKeyVersion\]\[google.cloud.kms.v1.CryptoKeyVersion\] with
        /// \[CryptoKey.purpose\]\[google.cloud.kms.v1.CryptoKey.purpose\] MAC, and returns
        /// a response that indicates whether or not the verification was successful.
        pub async fn mac_verify(
            &mut self,
            request: impl tonic::IntoRequest<super::MacVerifyRequest>,
        ) -> std::result::Result<
            tonic::Response<super::MacVerifyResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/MacVerify",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "MacVerify",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Generate random bytes using the Cloud KMS randomness source in the provided
        /// location.
        pub async fn generate_random_bytes(
            &mut self,
            request: impl tonic::IntoRequest<super::GenerateRandomBytesRequest>,
        ) -> std::result::Result<
            tonic::Response<super::GenerateRandomBytesResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.kms.v1.KeyManagementService/GenerateRandomBytes",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.kms.v1.KeyManagementService",
                        "GenerateRandomBytes",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
    }
}
