Always generate hybrid protobuf definitions (#68393)

* Add retag filter for protoc-gen-go * Delete .pb.go and make grpc find . -not -path './e/*' -name '*.pb.go' -delete && make grpc * make gen-resource-docs * Add comment listing the current consumers of open or hybrid api
2026-10-11 22:49:54 +00:00 · 2026-07-10 17:28:28 +00:00
parent 6727614363
commit 78760c283a
431 changed files with 6453 additions and 625 deletions
@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/legacy/client/proto/event.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package proto

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/legacy/client/proto/event.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package proto

@@ -21,7 +21,7 @@
 // buf:lint:ignore PACKAGE_DIRECTORY_MATCH
 // buf:lint:ignore PACKAGE_VERSION_SUFFIX

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package proto

@@ -21,7 +21,7 @@
 // buf:lint:ignore PACKAGE_DIRECTORY_MATCH
 // buf:lint:ignore PACKAGE_VERSION_SUFFIX

-//go:build protoopaque
+//go:build teleport_protoopaque

 package proto

@@ -21,7 +21,7 @@
 // buf:lint:ignore PACKAGE_DIRECTORY_MATCH
 // buf:lint:ignore PACKAGE_VERSION_SUFFIX

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package proto

@@ -21,7 +21,7 @@
 // buf:lint:ignore PACKAGE_DIRECTORY_MATCH
 // buf:lint:ignore PACKAGE_VERSION_SUFFIX

-//go:build protoopaque
+//go:build teleport_protoopaque

 package proto

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/access_graph/v1/authorized_key.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package accessgraphv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/access_graph/v1/authorized_key.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package accessgraphv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/access_graph/v1/private_key.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package accessgraphv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/access_graph/v1/private_key.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package accessgraphv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/access_graph/v1/secrets_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package accessgraphv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/access_graph/v1/secrets_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package accessgraphv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/accesslist/v1/accesslist.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package accesslistv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/accesslist/v1/accesslist.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package accesslistv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/accesslist/v1/accesslist_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package accesslistv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/accesslist/v1/accesslist_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package accesslistv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/accessmonitoringrules/v1/access_monitoring_rules.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package accessmonitoringrulesv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/accessmonitoringrules/v1/access_monitoring_rules.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package accessmonitoringrulesv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/accessmonitoringrules/v1/access_monitoring_rules_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package accessmonitoringrulesv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/accessmonitoringrules/v1/access_monitoring_rules_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package accessmonitoringrulesv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/appauthconfig/v1/appauthconfig.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package appauthconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/appauthconfig/v1/appauthconfig.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package appauthconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/appauthconfig/v1/appauthconfig_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package appauthconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/appauthconfig/v1/appauthconfig_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package appauthconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/appauthconfig/v1/appauthconfig_sessions_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package appauthconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/appauthconfig/v1/appauthconfig_sessions_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package appauthconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/auditlog/v1/auditlog.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package auditlogv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/auditlog/v1/auditlog.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package auditlogv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/autoupdate/v1/autoupdate.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package autoupdate

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/autoupdate/v1/autoupdate.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package autoupdate

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/autoupdate/v1/autoupdate_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package autoupdate

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/autoupdate/v1/autoupdate_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package autoupdate

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/backendinfo/v1/backendinfo.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package backendinfov1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/backendinfo/v1/backendinfo.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package backendinfov1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/beams/v1/beam.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package beamsv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/beams/v1/beam.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package beamsv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/beams/v1/beam_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package beamsv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/beams/v1/beam_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package beamsv1

@@ -0,0 +1,480 @@
+// Copyright 2026 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: teleport/beams/v1/beams_config.proto
+
+//go:build teleport_protohybrid
+
+package beamsv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// BeamsConfig holds user-provided configuration for Beams.
+type BeamsConfig struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// Kind is the kind of resource represented. This is always `beams_config`.
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// SubKind is the sub_kind of the resource. Always "".
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// Version is the version of the resource. Always "v1".
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	// Metadata about this resource.
+	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Spec defines the user-provided configuration parameters for Beams.
+	Spec          *BeamsConfigSpec `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BeamsConfig) Reset() {
+	*x = BeamsConfig{}
+	mi := &file_teleport_beams_v1_beams_config_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BeamsConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BeamsConfig) ProtoMessage() {}
+
+func (x *BeamsConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *BeamsConfig) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *BeamsConfig) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *BeamsConfig) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *BeamsConfig) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *BeamsConfig) GetSpec() *BeamsConfigSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+func (x *BeamsConfig) SetKind(v string) {
+	x.Kind = v
+}
+
+func (x *BeamsConfig) SetSubKind(v string) {
+	x.SubKind = v
+}
+
+func (x *BeamsConfig) SetVersion(v string) {
+	x.Version = v
+}
+
+func (x *BeamsConfig) SetMetadata(v *v1.Metadata) {
+	x.Metadata = v
+}
+
+func (x *BeamsConfig) SetSpec(v *BeamsConfigSpec) {
+	x.Spec = v
+}
+
+func (x *BeamsConfig) HasMetadata() bool {
+	if x == nil {
+		return false
+	}
+	return x.Metadata != nil
+}
+
+func (x *BeamsConfig) HasSpec() bool {
+	if x == nil {
+		return false
+	}
+	return x.Spec != nil
+}
+
+func (x *BeamsConfig) ClearMetadata() {
+	x.Metadata = nil
+}
+
+func (x *BeamsConfig) ClearSpec() {
+	x.Spec = nil
+}
+
+type BeamsConfig_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Kind is the kind of resource represented. This is always `beams_config`.
+	Kind string
+	// SubKind is the sub_kind of the resource. Always "".
+	SubKind string
+	// Version is the version of the resource. Always "v1".
+	Version string
+	// Metadata about this resource.
+	Metadata *v1.Metadata
+	// Spec defines the user-provided configuration parameters for Beams.
+	Spec *BeamsConfigSpec
+}
+
+func (b0 BeamsConfig_builder) Build() *BeamsConfig {
+	m0 := &BeamsConfig{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.Kind = b.Kind
+	x.SubKind = b.SubKind
+	x.Version = b.Version
+	x.Metadata = b.Metadata
+	x.Spec = b.Spec
+	return m0
+}
+
+// BeamsConfigSpec defines the user-provided configuration parameters for Beams.
+type BeamsConfigSpec struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// Llm carries LLM inference configurations.
+	Llm           *LLMConfig `protobuf:"bytes,1,opt,name=llm,proto3" json:"llm,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BeamsConfigSpec) Reset() {
+	*x = BeamsConfigSpec{}
+	mi := &file_teleport_beams_v1_beams_config_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BeamsConfigSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BeamsConfigSpec) ProtoMessage() {}
+
+func (x *BeamsConfigSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *BeamsConfigSpec) GetLlm() *LLMConfig {
+	if x != nil {
+		return x.Llm
+	}
+	return nil
+}
+
+func (x *BeamsConfigSpec) SetLlm(v *LLMConfig) {
+	x.Llm = v
+}
+
+func (x *BeamsConfigSpec) HasLlm() bool {
+	if x == nil {
+		return false
+	}
+	return x.Llm != nil
+}
+
+func (x *BeamsConfigSpec) ClearLlm() {
+	x.Llm = nil
+}
+
+type BeamsConfigSpec_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Llm carries LLM inference configurations.
+	Llm *LLMConfig
+}
+
+func (b0 BeamsConfigSpec_builder) Build() *BeamsConfigSpec {
+	m0 := &BeamsConfigSpec{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.Llm = b.Llm
+	return m0
+}
+
+// LLMConfig defines the LLM providers available to Beams.
+type LLMConfig struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// Anthropic LLM endpoint configuration.
+	Anthropic *LLMEndpointConfig `protobuf:"bytes,1,opt,name=anthropic,proto3" json:"anthropic,omitempty"`
+	// OpenAI LLM endpoint configuration.
+	Openai        *LLMEndpointConfig `protobuf:"bytes,2,opt,name=openai,proto3" json:"openai,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LLMConfig) Reset() {
+	*x = LLMConfig{}
+	mi := &file_teleport_beams_v1_beams_config_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LLMConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LLMConfig) ProtoMessage() {}
+
+func (x *LLMConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *LLMConfig) GetAnthropic() *LLMEndpointConfig {
+	if x != nil {
+		return x.Anthropic
+	}
+	return nil
+}
+
+func (x *LLMConfig) GetOpenai() *LLMEndpointConfig {
+	if x != nil {
+		return x.Openai
+	}
+	return nil
+}
+
+func (x *LLMConfig) SetAnthropic(v *LLMEndpointConfig) {
+	x.Anthropic = v
+}
+
+func (x *LLMConfig) SetOpenai(v *LLMEndpointConfig) {
+	x.Openai = v
+}
+
+func (x *LLMConfig) HasAnthropic() bool {
+	if x == nil {
+		return false
+	}
+	return x.Anthropic != nil
+}
+
+func (x *LLMConfig) HasOpenai() bool {
+	if x == nil {
+		return false
+	}
+	return x.Openai != nil
+}
+
+func (x *LLMConfig) ClearAnthropic() {
+	x.Anthropic = nil
+}
+
+func (x *LLMConfig) ClearOpenai() {
+	x.Openai = nil
+}
+
+type LLMConfig_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Anthropic LLM endpoint configuration.
+	Anthropic *LLMEndpointConfig
+	// OpenAI LLM endpoint configuration.
+	Openai *LLMEndpointConfig
+}
+
+func (b0 LLMConfig_builder) Build() *LLMConfig {
+	m0 := &LLMConfig{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.Anthropic = b.Anthropic
+	x.Openai = b.Openai
+	return m0
+}
+
+// LLMEndpointConfig defines the configuration for an LLM endpoint backed by a
+// Teleport app.
+type LLMEndpointConfig struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// AppName is the name of the Teleport app that proxies LLM requests. When
+	// empty, defaults to the Cloud-managed LLM app for this endpoint.
+	AppName       string `protobuf:"bytes,1,opt,name=app_name,json=appName,proto3" json:"app_name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LLMEndpointConfig) Reset() {
+	*x = LLMEndpointConfig{}
+	mi := &file_teleport_beams_v1_beams_config_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LLMEndpointConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LLMEndpointConfig) ProtoMessage() {}
+
+func (x *LLMEndpointConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *LLMEndpointConfig) GetAppName() string {
+	if x != nil {
+		return x.AppName
+	}
+	return ""
+}
+
+func (x *LLMEndpointConfig) SetAppName(v string) {
+	x.AppName = v
+}
+
+type LLMEndpointConfig_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// AppName is the name of the Teleport app that proxies LLM requests. When
+	// empty, defaults to the Cloud-managed LLM app for this endpoint.
+	AppName string
+}
+
+func (b0 LLMEndpointConfig_builder) Build() *LLMEndpointConfig {
+	m0 := &LLMEndpointConfig{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.AppName = b.AppName
+	return m0
+}
+
+var File_teleport_beams_v1_beams_config_proto protoreflect.FileDescriptor
+
+const file_teleport_beams_v1_beams_config_proto_rawDesc = "" +
+	"\n" +
+	"$teleport/beams/v1/beams_config.proto\x12\x11teleport.beams.v1\x1a!teleport/header/v1/metadata.proto\"\xc8\x01\n" +
+	"\vBeamsConfig\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x126\n" +
+	"\x04spec\x18\x05 \x01(\v2\".teleport.beams.v1.BeamsConfigSpecR\x04spec\"A\n" +
+	"\x0fBeamsConfigSpec\x12.\n" +
+	"\x03llm\x18\x01 \x01(\v2\x1c.teleport.beams.v1.LLMConfigR\x03llm\"\x8d\x01\n" +
+	"\tLLMConfig\x12B\n" +
+	"\tanthropic\x18\x01 \x01(\v2$.teleport.beams.v1.LLMEndpointConfigR\tanthropic\x12<\n" +
+	"\x06openai\x18\x02 \x01(\v2$.teleport.beams.v1.LLMEndpointConfigR\x06openai\".\n" +
+	"\x11LLMEndpointConfig\x12\x19\n" +
+	"\bapp_name\x18\x01 \x01(\tR\aappNameBNZLgithub.com/gravitational/teleport/api/gen/proto/go/teleport/beams/v1;beamsv1b\x06proto3"
+
+var file_teleport_beams_v1_beams_config_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_teleport_beams_v1_beams_config_proto_goTypes = []any{
+	(*BeamsConfig)(nil),       // 0: teleport.beams.v1.BeamsConfig
+	(*BeamsConfigSpec)(nil),   // 1: teleport.beams.v1.BeamsConfigSpec
+	(*LLMConfig)(nil),         // 2: teleport.beams.v1.LLMConfig
+	(*LLMEndpointConfig)(nil), // 3: teleport.beams.v1.LLMEndpointConfig
+	(*v1.Metadata)(nil),       // 4: teleport.header.v1.Metadata
+}
+var file_teleport_beams_v1_beams_config_proto_depIdxs = []int32{
+	4, // 0: teleport.beams.v1.BeamsConfig.metadata:type_name -> teleport.header.v1.Metadata
+	1, // 1: teleport.beams.v1.BeamsConfig.spec:type_name -> teleport.beams.v1.BeamsConfigSpec
+	2, // 2: teleport.beams.v1.BeamsConfigSpec.llm:type_name -> teleport.beams.v1.LLMConfig
+	3, // 3: teleport.beams.v1.LLMConfig.anthropic:type_name -> teleport.beams.v1.LLMEndpointConfig
+	3, // 4: teleport.beams.v1.LLMConfig.openai:type_name -> teleport.beams.v1.LLMEndpointConfig
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_teleport_beams_v1_beams_config_proto_init() }
+func file_teleport_beams_v1_beams_config_proto_init() {
+	if File_teleport_beams_v1_beams_config_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_beams_v1_beams_config_proto_rawDesc), len(file_teleport_beams_v1_beams_config_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_beams_v1_beams_config_proto_goTypes,
+		DependencyIndexes: file_teleport_beams_v1_beams_config_proto_depIdxs,
+		MessageInfos:      file_teleport_beams_v1_beams_config_proto_msgTypes,
+	}.Build()
+	File_teleport_beams_v1_beams_config_proto = out.File
+	file_teleport_beams_v1_beams_config_proto_goTypes = nil
+	file_teleport_beams_v1_beams_config_proto_depIdxs = nil
+}
@@ -18,6 +18,8 @@
 // 	protoc        (unknown)
 // source: teleport/beams/v1/beams_config.proto

+//go:build !teleport_protohybrid
+
 package beamsv1

 import (
@@ -0,0 +1,596 @@
+// Copyright 2026 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: teleport/beams/v1/beams_config_service.proto
+
+//go:build teleport_protohybrid
+
+package beamsv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Request for GetBeamsConfig.
+type GetBeamsConfigRequest struct {
+	state         protoimpl.MessageState `protogen:"hybrid.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetBeamsConfigRequest) Reset() {
+	*x = GetBeamsConfigRequest{}
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetBeamsConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetBeamsConfigRequest) ProtoMessage() {}
+
+func (x *GetBeamsConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+type GetBeamsConfigRequest_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+}
+
+func (b0 GetBeamsConfigRequest_builder) Build() *GetBeamsConfigRequest {
+	m0 := &GetBeamsConfigRequest{}
+	b, x := &b0, m0
+	_, _ = b, x
+	return m0
+}
+
+// Response for GetBeamsConfig.
+type GetBeamsConfigResponse struct {
+	state         protoimpl.MessageState `protogen:"hybrid.v1"`
+	BeamsConfig   *BeamsConfig           `protobuf:"bytes,1,opt,name=beams_config,json=beamsConfig,proto3" json:"beams_config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetBeamsConfigResponse) Reset() {
+	*x = GetBeamsConfigResponse{}
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetBeamsConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetBeamsConfigResponse) ProtoMessage() {}
+
+func (x *GetBeamsConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *GetBeamsConfigResponse) GetBeamsConfig() *BeamsConfig {
+	if x != nil {
+		return x.BeamsConfig
+	}
+	return nil
+}
+
+func (x *GetBeamsConfigResponse) SetBeamsConfig(v *BeamsConfig) {
+	x.BeamsConfig = v
+}
+
+func (x *GetBeamsConfigResponse) HasBeamsConfig() bool {
+	if x == nil {
+		return false
+	}
+	return x.BeamsConfig != nil
+}
+
+func (x *GetBeamsConfigResponse) ClearBeamsConfig() {
+	x.BeamsConfig = nil
+}
+
+type GetBeamsConfigResponse_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	BeamsConfig *BeamsConfig
+}
+
+func (b0 GetBeamsConfigResponse_builder) Build() *GetBeamsConfigResponse {
+	m0 := &GetBeamsConfigResponse{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.BeamsConfig = b.BeamsConfig
+	return m0
+}
+
+// Request for CreateBeamsConfig.
+type CreateBeamsConfigRequest struct {
+	state         protoimpl.MessageState `protogen:"hybrid.v1"`
+	BeamsConfig   *BeamsConfig           `protobuf:"bytes,1,opt,name=beams_config,json=beamsConfig,proto3" json:"beams_config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateBeamsConfigRequest) Reset() {
+	*x = CreateBeamsConfigRequest{}
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateBeamsConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateBeamsConfigRequest) ProtoMessage() {}
+
+func (x *CreateBeamsConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *CreateBeamsConfigRequest) GetBeamsConfig() *BeamsConfig {
+	if x != nil {
+		return x.BeamsConfig
+	}
+	return nil
+}
+
+func (x *CreateBeamsConfigRequest) SetBeamsConfig(v *BeamsConfig) {
+	x.BeamsConfig = v
+}
+
+func (x *CreateBeamsConfigRequest) HasBeamsConfig() bool {
+	if x == nil {
+		return false
+	}
+	return x.BeamsConfig != nil
+}
+
+func (x *CreateBeamsConfigRequest) ClearBeamsConfig() {
+	x.BeamsConfig = nil
+}
+
+type CreateBeamsConfigRequest_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	BeamsConfig *BeamsConfig
+}
+
+func (b0 CreateBeamsConfigRequest_builder) Build() *CreateBeamsConfigRequest {
+	m0 := &CreateBeamsConfigRequest{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.BeamsConfig = b.BeamsConfig
+	return m0
+}
+
+// Response for CreateBeamsConfig.
+type CreateBeamsConfigResponse struct {
+	state         protoimpl.MessageState `protogen:"hybrid.v1"`
+	BeamsConfig   *BeamsConfig           `protobuf:"bytes,1,opt,name=beams_config,json=beamsConfig,proto3" json:"beams_config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateBeamsConfigResponse) Reset() {
+	*x = CreateBeamsConfigResponse{}
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateBeamsConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateBeamsConfigResponse) ProtoMessage() {}
+
+func (x *CreateBeamsConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *CreateBeamsConfigResponse) GetBeamsConfig() *BeamsConfig {
+	if x != nil {
+		return x.BeamsConfig
+	}
+	return nil
+}
+
+func (x *CreateBeamsConfigResponse) SetBeamsConfig(v *BeamsConfig) {
+	x.BeamsConfig = v
+}
+
+func (x *CreateBeamsConfigResponse) HasBeamsConfig() bool {
+	if x == nil {
+		return false
+	}
+	return x.BeamsConfig != nil
+}
+
+func (x *CreateBeamsConfigResponse) ClearBeamsConfig() {
+	x.BeamsConfig = nil
+}
+
+type CreateBeamsConfigResponse_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	BeamsConfig *BeamsConfig
+}
+
+func (b0 CreateBeamsConfigResponse_builder) Build() *CreateBeamsConfigResponse {
+	m0 := &CreateBeamsConfigResponse{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.BeamsConfig = b.BeamsConfig
+	return m0
+}
+
+// Request for UpdateBeamsConfig.
+type UpdateBeamsConfigRequest struct {
+	state         protoimpl.MessageState `protogen:"hybrid.v1"`
+	BeamsConfig   *BeamsConfig           `protobuf:"bytes,1,opt,name=beams_config,json=beamsConfig,proto3" json:"beams_config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateBeamsConfigRequest) Reset() {
+	*x = UpdateBeamsConfigRequest{}
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateBeamsConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateBeamsConfigRequest) ProtoMessage() {}
+
+func (x *UpdateBeamsConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *UpdateBeamsConfigRequest) GetBeamsConfig() *BeamsConfig {
+	if x != nil {
+		return x.BeamsConfig
+	}
+	return nil
+}
+
+func (x *UpdateBeamsConfigRequest) SetBeamsConfig(v *BeamsConfig) {
+	x.BeamsConfig = v
+}
+
+func (x *UpdateBeamsConfigRequest) HasBeamsConfig() bool {
+	if x == nil {
+		return false
+	}
+	return x.BeamsConfig != nil
+}
+
+func (x *UpdateBeamsConfigRequest) ClearBeamsConfig() {
+	x.BeamsConfig = nil
+}
+
+type UpdateBeamsConfigRequest_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	BeamsConfig *BeamsConfig
+}
+
+func (b0 UpdateBeamsConfigRequest_builder) Build() *UpdateBeamsConfigRequest {
+	m0 := &UpdateBeamsConfigRequest{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.BeamsConfig = b.BeamsConfig
+	return m0
+}
+
+// Response for UpdateBeamsConfig.
+type UpdateBeamsConfigResponse struct {
+	state         protoimpl.MessageState `protogen:"hybrid.v1"`
+	BeamsConfig   *BeamsConfig           `protobuf:"bytes,1,opt,name=beams_config,json=beamsConfig,proto3" json:"beams_config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateBeamsConfigResponse) Reset() {
+	*x = UpdateBeamsConfigResponse{}
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateBeamsConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateBeamsConfigResponse) ProtoMessage() {}
+
+func (x *UpdateBeamsConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *UpdateBeamsConfigResponse) GetBeamsConfig() *BeamsConfig {
+	if x != nil {
+		return x.BeamsConfig
+	}
+	return nil
+}
+
+func (x *UpdateBeamsConfigResponse) SetBeamsConfig(v *BeamsConfig) {
+	x.BeamsConfig = v
+}
+
+func (x *UpdateBeamsConfigResponse) HasBeamsConfig() bool {
+	if x == nil {
+		return false
+	}
+	return x.BeamsConfig != nil
+}
+
+func (x *UpdateBeamsConfigResponse) ClearBeamsConfig() {
+	x.BeamsConfig = nil
+}
+
+type UpdateBeamsConfigResponse_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	BeamsConfig *BeamsConfig
+}
+
+func (b0 UpdateBeamsConfigResponse_builder) Build() *UpdateBeamsConfigResponse {
+	m0 := &UpdateBeamsConfigResponse{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.BeamsConfig = b.BeamsConfig
+	return m0
+}
+
+// Request for DeleteBeamsConfig.
+type DeleteBeamsConfigRequest struct {
+	state         protoimpl.MessageState `protogen:"hybrid.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteBeamsConfigRequest) Reset() {
+	*x = DeleteBeamsConfigRequest{}
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteBeamsConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteBeamsConfigRequest) ProtoMessage() {}
+
+func (x *DeleteBeamsConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+type DeleteBeamsConfigRequest_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+}
+
+func (b0 DeleteBeamsConfigRequest_builder) Build() *DeleteBeamsConfigRequest {
+	m0 := &DeleteBeamsConfigRequest{}
+	b, x := &b0, m0
+	_, _ = b, x
+	return m0
+}
+
+// Response for DeleteBeamsConfig.
+type DeleteBeamsConfigResponse struct {
+	state         protoimpl.MessageState `protogen:"hybrid.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteBeamsConfigResponse) Reset() {
+	*x = DeleteBeamsConfigResponse{}
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteBeamsConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteBeamsConfigResponse) ProtoMessage() {}
+
+func (x *DeleteBeamsConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_beams_v1_beams_config_service_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+type DeleteBeamsConfigResponse_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+}
+
+func (b0 DeleteBeamsConfigResponse_builder) Build() *DeleteBeamsConfigResponse {
+	m0 := &DeleteBeamsConfigResponse{}
+	b, x := &b0, m0
+	_, _ = b, x
+	return m0
+}
+
+var File_teleport_beams_v1_beams_config_service_proto protoreflect.FileDescriptor
+
+const file_teleport_beams_v1_beams_config_service_proto_rawDesc = "" +
+	"\n" +
+	",teleport/beams/v1/beams_config_service.proto\x12\x11teleport.beams.v1\x1a$teleport/beams/v1/beams_config.proto\"\x17\n" +
+	"\x15GetBeamsConfigRequest\"[\n" +
+	"\x16GetBeamsConfigResponse\x12A\n" +
+	"\fbeams_config\x18\x01 \x01(\v2\x1e.teleport.beams.v1.BeamsConfigR\vbeamsConfig\"]\n" +
+	"\x18CreateBeamsConfigRequest\x12A\n" +
+	"\fbeams_config\x18\x01 \x01(\v2\x1e.teleport.beams.v1.BeamsConfigR\vbeamsConfig\"^\n" +
+	"\x19CreateBeamsConfigResponse\x12A\n" +
+	"\fbeams_config\x18\x01 \x01(\v2\x1e.teleport.beams.v1.BeamsConfigR\vbeamsConfig\"]\n" +
+	"\x18UpdateBeamsConfigRequest\x12A\n" +
+	"\fbeams_config\x18\x01 \x01(\v2\x1e.teleport.beams.v1.BeamsConfigR\vbeamsConfig\"^\n" +
+	"\x19UpdateBeamsConfigResponse\x12A\n" +
+	"\fbeams_config\x18\x01 \x01(\v2\x1e.teleport.beams.v1.BeamsConfigR\vbeamsConfig\"\x1a\n" +
+	"\x18DeleteBeamsConfigRequest\"\x1b\n" +
+	"\x19DeleteBeamsConfigResponse2\xcb\x03\n" +
+	"\x12BeamsConfigService\x12e\n" +
+	"\x0eGetBeamsConfig\x12(.teleport.beams.v1.GetBeamsConfigRequest\x1a).teleport.beams.v1.GetBeamsConfigResponse\x12n\n" +
+	"\x11CreateBeamsConfig\x12+.teleport.beams.v1.CreateBeamsConfigRequest\x1a,.teleport.beams.v1.CreateBeamsConfigResponse\x12n\n" +
+	"\x11UpdateBeamsConfig\x12+.teleport.beams.v1.UpdateBeamsConfigRequest\x1a,.teleport.beams.v1.UpdateBeamsConfigResponse\x12n\n" +
+	"\x11DeleteBeamsConfig\x12+.teleport.beams.v1.DeleteBeamsConfigRequest\x1a,.teleport.beams.v1.DeleteBeamsConfigResponseBNZLgithub.com/gravitational/teleport/api/gen/proto/go/teleport/beams/v1;beamsv1b\x06proto3"
+
+var file_teleport_beams_v1_beams_config_service_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_teleport_beams_v1_beams_config_service_proto_goTypes = []any{
+	(*GetBeamsConfigRequest)(nil),     // 0: teleport.beams.v1.GetBeamsConfigRequest
+	(*GetBeamsConfigResponse)(nil),    // 1: teleport.beams.v1.GetBeamsConfigResponse
+	(*CreateBeamsConfigRequest)(nil),  // 2: teleport.beams.v1.CreateBeamsConfigRequest
+	(*CreateBeamsConfigResponse)(nil), // 3: teleport.beams.v1.CreateBeamsConfigResponse
+	(*UpdateBeamsConfigRequest)(nil),  // 4: teleport.beams.v1.UpdateBeamsConfigRequest
+	(*UpdateBeamsConfigResponse)(nil), // 5: teleport.beams.v1.UpdateBeamsConfigResponse
+	(*DeleteBeamsConfigRequest)(nil),  // 6: teleport.beams.v1.DeleteBeamsConfigRequest
+	(*DeleteBeamsConfigResponse)(nil), // 7: teleport.beams.v1.DeleteBeamsConfigResponse
+	(*BeamsConfig)(nil),               // 8: teleport.beams.v1.BeamsConfig
+}
+var file_teleport_beams_v1_beams_config_service_proto_depIdxs = []int32{
+	8, // 0: teleport.beams.v1.GetBeamsConfigResponse.beams_config:type_name -> teleport.beams.v1.BeamsConfig
+	8, // 1: teleport.beams.v1.CreateBeamsConfigRequest.beams_config:type_name -> teleport.beams.v1.BeamsConfig
+	8, // 2: teleport.beams.v1.CreateBeamsConfigResponse.beams_config:type_name -> teleport.beams.v1.BeamsConfig
+	8, // 3: teleport.beams.v1.UpdateBeamsConfigRequest.beams_config:type_name -> teleport.beams.v1.BeamsConfig
+	8, // 4: teleport.beams.v1.UpdateBeamsConfigResponse.beams_config:type_name -> teleport.beams.v1.BeamsConfig
+	0, // 5: teleport.beams.v1.BeamsConfigService.GetBeamsConfig:input_type -> teleport.beams.v1.GetBeamsConfigRequest
+	2, // 6: teleport.beams.v1.BeamsConfigService.CreateBeamsConfig:input_type -> teleport.beams.v1.CreateBeamsConfigRequest
+	4, // 7: teleport.beams.v1.BeamsConfigService.UpdateBeamsConfig:input_type -> teleport.beams.v1.UpdateBeamsConfigRequest
+	6, // 8: teleport.beams.v1.BeamsConfigService.DeleteBeamsConfig:input_type -> teleport.beams.v1.DeleteBeamsConfigRequest
+	1, // 9: teleport.beams.v1.BeamsConfigService.GetBeamsConfig:output_type -> teleport.beams.v1.GetBeamsConfigResponse
+	3, // 10: teleport.beams.v1.BeamsConfigService.CreateBeamsConfig:output_type -> teleport.beams.v1.CreateBeamsConfigResponse
+	5, // 11: teleport.beams.v1.BeamsConfigService.UpdateBeamsConfig:output_type -> teleport.beams.v1.UpdateBeamsConfigResponse
+	7, // 12: teleport.beams.v1.BeamsConfigService.DeleteBeamsConfig:output_type -> teleport.beams.v1.DeleteBeamsConfigResponse
+	9, // [9:13] is the sub-list for method output_type
+	5, // [5:9] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_teleport_beams_v1_beams_config_service_proto_init() }
+func file_teleport_beams_v1_beams_config_service_proto_init() {
+	if File_teleport_beams_v1_beams_config_service_proto != nil {
+		return
+	}
+	file_teleport_beams_v1_beams_config_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_beams_v1_beams_config_service_proto_rawDesc), len(file_teleport_beams_v1_beams_config_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_beams_v1_beams_config_service_proto_goTypes,
+		DependencyIndexes: file_teleport_beams_v1_beams_config_service_proto_depIdxs,
+		MessageInfos:      file_teleport_beams_v1_beams_config_service_proto_msgTypes,
+	}.Build()
+	File_teleport_beams_v1_beams_config_service_proto = out.File
+	file_teleport_beams_v1_beams_config_service_proto_goTypes = nil
+	file_teleport_beams_v1_beams_config_service_proto_depIdxs = nil
+}
@@ -18,6 +18,8 @@
 // 	protoc        (unknown)
 // source: teleport/beams/v1/beams_config_service.proto

+//go:build !teleport_protohybrid
+
 package beamsv1

 import (
@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clientiprestriction/v1/clientiprestriction.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package clientiprestrictionv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clientiprestriction/v1/clientiprestriction.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package clientiprestrictionv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clientiprestriction/v1/clientiprestriction_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package clientiprestrictionv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clientiprestriction/v1/clientiprestriction_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package clientiprestrictionv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clusterconfig/v1/access_graph.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package clusterconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clusterconfig/v1/access_graph.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package clusterconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clusterconfig/v1/access_graph_settings.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package clusterconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clusterconfig/v1/access_graph_settings.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package clusterconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clusterconfig/v1/clusterconfig_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package clusterconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/clusterconfig/v1/clusterconfig_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package clusterconfigv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/crownjewel/v1/crownjewel.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package crownjewelv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/crownjewel/v1/crownjewel.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package crownjewelv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/crownjewel/v1/crownjewel_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package crownjewelv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/crownjewel/v1/crownjewel_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package crownjewelv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/dbobject/v1/dbobject.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package dbobjectv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/dbobject/v1/dbobject.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package dbobjectv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/dbobject/v1/dbobject_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package dbobjectv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/dbobject/v1/dbobject_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package dbobjectv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/dbobjectimportrule/v1/dbobjectimportrule.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package dbobjectimportrulev1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/dbobjectimportrule/v1/dbobjectimportrule.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package dbobjectimportrulev1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/dbobjectimportrule/v1/dbobjectimportrule_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package dbobjectimportrulev1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/dbobjectimportrule/v1/dbobjectimportrule_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package dbobjectimportrulev1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/database_access.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/database_access.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/decision_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/decision_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/denial_metadata.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/denial_metadata.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/enforcement_feature.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/enforcement_feature.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/permit_metadata.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/permit_metadata.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/request_metadata.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/request_metadata.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/resource.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/resource.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/ssh_access.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/ssh_access.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/ssh_identity.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/ssh_identity.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/ssh_join.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/ssh_join.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/tls_identity.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/decision/v1alpha1/tls_identity.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package decisionpb

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/delegation/v1/delegation_session_resource.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package delegationv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/delegation/v1/delegation_session_resource.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package delegationv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/delegation/v1/delegation_session_service.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package delegationv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/delegation/v1/delegation_session_service.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package delegationv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/desktop/v1/tdpb.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package tdpbv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/desktop/v1/tdpb.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package tdpbv1

@@ -0,0 +1,253 @@
+// Copyright 2026 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: teleport/devicetrust/public/v1/devicetrust_service.proto
+
+//go:build teleport_protohybrid
+
+package devicetrustpublicv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Request for CreatePairedDeviceEnrollToken.
+type CreatePairedDeviceEnrollTokenRequest struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// Enroll pairing token passed from the Web UI to the client on the device that's supposed to be enrolled.
+	EnrollPairingToken string `protobuf:"bytes,1,opt,name=enroll_pairing_token,json=enrollPairingToken,proto3" json:"enroll_pairing_token,omitempty"`
+	// Device collected data.
+	// Used to authorize issuance of device enrollment token.
+	DeviceData    *v1.DeviceCollectedData `protobuf:"bytes,2,opt,name=device_data,json=deviceData,proto3" json:"device_data,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreatePairedDeviceEnrollTokenRequest) Reset() {
+	*x = CreatePairedDeviceEnrollTokenRequest{}
+	mi := &file_teleport_devicetrust_public_v1_devicetrust_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreatePairedDeviceEnrollTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreatePairedDeviceEnrollTokenRequest) ProtoMessage() {}
+
+func (x *CreatePairedDeviceEnrollTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_devicetrust_public_v1_devicetrust_service_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *CreatePairedDeviceEnrollTokenRequest) GetEnrollPairingToken() string {
+	if x != nil {
+		return x.EnrollPairingToken
+	}
+	return ""
+}
+
+func (x *CreatePairedDeviceEnrollTokenRequest) GetDeviceData() *v1.DeviceCollectedData {
+	if x != nil {
+		return x.DeviceData
+	}
+	return nil
+}
+
+func (x *CreatePairedDeviceEnrollTokenRequest) SetEnrollPairingToken(v string) {
+	x.EnrollPairingToken = v
+}
+
+func (x *CreatePairedDeviceEnrollTokenRequest) SetDeviceData(v *v1.DeviceCollectedData) {
+	x.DeviceData = v
+}
+
+func (x *CreatePairedDeviceEnrollTokenRequest) HasDeviceData() bool {
+	if x == nil {
+		return false
+	}
+	return x.DeviceData != nil
+}
+
+func (x *CreatePairedDeviceEnrollTokenRequest) ClearDeviceData() {
+	x.DeviceData = nil
+}
+
+type CreatePairedDeviceEnrollTokenRequest_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Enroll pairing token passed from the Web UI to the client on the device that's supposed to be enrolled.
+	EnrollPairingToken string
+	// Device collected data.
+	// Used to authorize issuance of device enrollment token.
+	DeviceData *v1.DeviceCollectedData
+}
+
+func (b0 CreatePairedDeviceEnrollTokenRequest_builder) Build() *CreatePairedDeviceEnrollTokenRequest {
+	m0 := &CreatePairedDeviceEnrollTokenRequest{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.EnrollPairingToken = b.EnrollPairingToken
+	x.DeviceData = b.DeviceData
+	return m0
+}
+
+// Response for CreatePairedDeviceEnrollToken.
+type CreatePairedDeviceEnrollTokenResponse struct {
+	state             protoimpl.MessageState `protogen:"hybrid.v1"`
+	DeviceEnrollToken *v1.DeviceEnrollToken  `protobuf:"bytes,1,opt,name=device_enroll_token,json=deviceEnrollToken,proto3" json:"device_enroll_token,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *CreatePairedDeviceEnrollTokenResponse) Reset() {
+	*x = CreatePairedDeviceEnrollTokenResponse{}
+	mi := &file_teleport_devicetrust_public_v1_devicetrust_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreatePairedDeviceEnrollTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreatePairedDeviceEnrollTokenResponse) ProtoMessage() {}
+
+func (x *CreatePairedDeviceEnrollTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_devicetrust_public_v1_devicetrust_service_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *CreatePairedDeviceEnrollTokenResponse) GetDeviceEnrollToken() *v1.DeviceEnrollToken {
+	if x != nil {
+		return x.DeviceEnrollToken
+	}
+	return nil
+}
+
+func (x *CreatePairedDeviceEnrollTokenResponse) SetDeviceEnrollToken(v *v1.DeviceEnrollToken) {
+	x.DeviceEnrollToken = v
+}
+
+func (x *CreatePairedDeviceEnrollTokenResponse) HasDeviceEnrollToken() bool {
+	if x == nil {
+		return false
+	}
+	return x.DeviceEnrollToken != nil
+}
+
+func (x *CreatePairedDeviceEnrollTokenResponse) ClearDeviceEnrollToken() {
+	x.DeviceEnrollToken = nil
+}
+
+type CreatePairedDeviceEnrollTokenResponse_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	DeviceEnrollToken *v1.DeviceEnrollToken
+}
+
+func (b0 CreatePairedDeviceEnrollTokenResponse_builder) Build() *CreatePairedDeviceEnrollTokenResponse {
+	m0 := &CreatePairedDeviceEnrollTokenResponse{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.DeviceEnrollToken = b.DeviceEnrollToken
+	return m0
+}
+
+var File_teleport_devicetrust_public_v1_devicetrust_service_proto protoreflect.FileDescriptor
+
+const file_teleport_devicetrust_public_v1_devicetrust_service_proto_rawDesc = "" +
+	"\n" +
+	"8teleport/devicetrust/public/v1/devicetrust_service.proto\x12\x1eteleport.devicetrust.public.v1\x1a3teleport/devicetrust/v1/device_collected_data.proto\x1a1teleport/devicetrust/v1/device_enroll_token.proto\"\xa7\x01\n" +
+	"$CreatePairedDeviceEnrollTokenRequest\x120\n" +
+	"\x14enroll_pairing_token\x18\x01 \x01(\tR\x12enrollPairingToken\x12M\n" +
+	"\vdevice_data\x18\x02 \x01(\v2,.teleport.devicetrust.v1.DeviceCollectedDataR\n" +
+	"deviceData\"\x83\x01\n" +
+	"%CreatePairedDeviceEnrollTokenResponse\x12Z\n" +
+	"\x13device_enroll_token\x18\x01 \x01(\v2*.teleport.devicetrust.v1.DeviceEnrollTokenR\x11deviceEnrollToken2\xc3\x01\n" +
+	"\x12DeviceTrustService\x12\xac\x01\n" +
+	"\x1dCreatePairedDeviceEnrollToken\x12D.teleport.devicetrust.public.v1.CreatePairedDeviceEnrollTokenRequest\x1aE.teleport.devicetrust.public.v1.CreatePairedDeviceEnrollTokenResponseBgZegithub.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/public/v1;devicetrustpublicv1b\x06proto3"
+
+var file_teleport_devicetrust_public_v1_devicetrust_service_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_teleport_devicetrust_public_v1_devicetrust_service_proto_goTypes = []any{
+	(*CreatePairedDeviceEnrollTokenRequest)(nil),  // 0: teleport.devicetrust.public.v1.CreatePairedDeviceEnrollTokenRequest
+	(*CreatePairedDeviceEnrollTokenResponse)(nil), // 1: teleport.devicetrust.public.v1.CreatePairedDeviceEnrollTokenResponse
+	(*v1.DeviceCollectedData)(nil),                // 2: teleport.devicetrust.v1.DeviceCollectedData
+	(*v1.DeviceEnrollToken)(nil),                  // 3: teleport.devicetrust.v1.DeviceEnrollToken
+}
+var file_teleport_devicetrust_public_v1_devicetrust_service_proto_depIdxs = []int32{
+	2, // 0: teleport.devicetrust.public.v1.CreatePairedDeviceEnrollTokenRequest.device_data:type_name -> teleport.devicetrust.v1.DeviceCollectedData
+	3, // 1: teleport.devicetrust.public.v1.CreatePairedDeviceEnrollTokenResponse.device_enroll_token:type_name -> teleport.devicetrust.v1.DeviceEnrollToken
+	0, // 2: teleport.devicetrust.public.v1.DeviceTrustService.CreatePairedDeviceEnrollToken:input_type -> teleport.devicetrust.public.v1.CreatePairedDeviceEnrollTokenRequest
+	1, // 3: teleport.devicetrust.public.v1.DeviceTrustService.CreatePairedDeviceEnrollToken:output_type -> teleport.devicetrust.public.v1.CreatePairedDeviceEnrollTokenResponse
+	3, // [3:4] is the sub-list for method output_type
+	2, // [2:3] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_teleport_devicetrust_public_v1_devicetrust_service_proto_init() }
+func file_teleport_devicetrust_public_v1_devicetrust_service_proto_init() {
+	if File_teleport_devicetrust_public_v1_devicetrust_service_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_devicetrust_public_v1_devicetrust_service_proto_rawDesc), len(file_teleport_devicetrust_public_v1_devicetrust_service_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_devicetrust_public_v1_devicetrust_service_proto_goTypes,
+		DependencyIndexes: file_teleport_devicetrust_public_v1_devicetrust_service_proto_depIdxs,
+		MessageInfos:      file_teleport_devicetrust_public_v1_devicetrust_service_proto_msgTypes,
+	}.Build()
+	File_teleport_devicetrust_public_v1_devicetrust_service_proto = out.File
+	file_teleport_devicetrust_public_v1_devicetrust_service_proto_goTypes = nil
+	file_teleport_devicetrust_public_v1_devicetrust_service_proto_depIdxs = nil
+}
@@ -18,6 +18,8 @@
 // 	protoc        (unknown)
 // source: teleport/devicetrust/public/v1/devicetrust_service.proto

+//go:build !teleport_protohybrid
+
 package devicetrustpublicv1

 import (
@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/assert.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package devicetrustv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/assert.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package devicetrustv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/authenticate_challenge.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package devicetrustv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/authenticate_challenge.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package devicetrustv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/device_collected_data.proto

-//go:build !protoopaque
+//go:build !teleport_protoopaque

 package devicetrustv1

@@ -18,7 +18,7 @@
 // 	protoc        (unknown)
 // source: teleport/devicetrust/v1/device_collected_data.proto

-//go:build protoopaque
+//go:build teleport_protoopaque

 package devicetrustv1

--- a/Show More
+++ b/Show More