syntax = "proto3";

package tidb_cloud_open_api.nextgen.v1beta2;

import "google/api/annotations.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";
// buf:lint:ignore IMPORT_USED
import "google/rpc/status.proto"; // This is used by `responses.value.schema.json_schema.ref` in the swagger definition.
import "protoc-gen-openapiv2/options/annotations.proto";
import "tidb_cloud_open_api/common/v1beta1/clusterstate.proto";
import "tidb_cloud_open_api/common/v1beta1/region.proto";
import "tidb_cloud_open_api/common/v1beta1/service_plan.proto";
import "tidb_cloud_open_api/common/v1beta1/tag.proto";
import "tidb_cloud_open_api/nextgen/v1beta2/cmek.proto";
import "tidb_cloud_open_api/nextgen/v1beta2/common.proto";

option go_package = "tidb_cloud_open_api/nextgen/v1beta2";
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
  swagger: "2.0"
  host: "cloud.tidbapi.com"
  base_path: "/v1beta2"
  info: {
    version: "v1beta2"
    title: "TiDB Cloud Premium API"
    description: "TiDB Cloud Premium API"
  }
  schemes: HTTPS
  consumes: "application/json"
  produces: "application/json"

  responses: {
    key: "400"
    value: {
      description: "A request field is invalid."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
  responses: {
    key: "401"
    value: {
      description: "The API key cannot be authenticated."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
  responses: {
    key: "403"
    value: {
      description: "The API key does not have permission to access the resource."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
  responses: {
    key: "429"
    value: {
      description: "You have exceeded the rate limit."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
  responses: {
    key: "500"
    value: {
      description: "Internal server error."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
};

service TidbService {
  rpc CreateTidb(CreateTidbRequest) returns (Tidb) {
    option (google.api.http) = {
      post: "/tidbs"
      body: "tidb"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Create a TiDB Cloud Premium instance"
      tags: "public"
      tags: "TiDB Cloud Premium Instance"
      description: "Creates a new TiDB Cloud Premium instance. If the `tidb.cloud/project` label is provided, the instance will be created in the specified project."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Content-Type: application/json' \\\n--header 'Accept: application/json' \\\n--data '{\n  \"displayName\": \"my-tidb\",\n  \"regionId\": \"aws-us-west-2\",\n  \"maxRcu\": 20000,\n  \"servicePlan\": \"Premium\"\n}'"}
                }
              }
            }
          }
        }
      }
    };
  }

  rpc ListTidbs(ListTidbsRequest) returns (ListTidbsResponse) {
    option (google.api.http) = {get: "/tidbs"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "List TiDB Cloud Premium instances"
      tags: "public"
      tags: "TiDB Cloud Premium Instance"
      description: "Lists all TiDB Cloud Premium instances in your organization. You can filter results by service plan, region, name, or ID."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Accept: application/json'"}
                }
              }
            }
          }
        }
      }
    };
  }

  rpc GetTidb(GetTidbRequest) returns (Tidb) {
    option (google.api.http) = {get: "/tidbs/{tidb_id}"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get a TiDB Cloud Premium instance"
      tags: "public"
      tags: "TiDB Cloud Premium Instance"
      description: "Retrieves details of a specific TiDB Cloud Premium instance."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Accept: application/json'"}
                }
              }
            }
          }
        }
      }
    };
  }

  rpc ResumeTidb(ResumeTidbRequest) returns (ResumeTidbResponse) {
    option (google.api.http) = {post: "/tidbs/{tidb_id}:resumeTidb"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Resume a TiDB Cloud Premium instance"
      tags: "public"
      tags: "TiDB Cloud Premium Instance"
      description: "Accepts an asynchronous request to resume a paused TiDB Cloud Premium or Premium Reserved instance. Resuming an instance resumes its underlying resource pool and every instance in that pool. Poll the instance state with GetTidb to observe completion."
    };
  }

  rpc BindTags(BindTagsRequest) returns (BindTagsResponse) {
    option (google.api.http) = {
      post: "/tidbs/{tidb_id}:bindTags"
      body: "*"
    };
  }

  rpc UnbindTags(UnbindTagsRequest) returns (UnbindTagsResponse) {
    option (google.api.http) = {
      post: "/tidbs/{tidb_id}:unbindTags"
      body: "*"
    };
  }

  rpc DeleteTidb(DeleteTidbRequest) returns (Tidb) {
    option (google.api.http) = {delete: "/tidbs/{tidb_id}"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Delete a TiDB Cloud Premium instance"
      tags: "public"
      tags: "TiDB Cloud Premium Instance"
      description: "Deletes a TiDB Cloud Premium instance by `tidbId`."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location --request DELETE 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Accept: application/json'"}
                }
              }
            }
          }
        }
      }
    };
  }

  rpc UpdateTidb(UpdateTidbRequest) returns (Tidb) {
    option (google.api.http) = {
      patch: "/tidbs/{tidb.tidb_id}"
      body: "tidb"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Update a TiDB Cloud Premium instance"
      tags: "public"
      tags: "TiDB Cloud Premium Instance"
      description: "Updates the configuration of a specific TiDB Cloud Premium instance. You can modify the following fields: `displayName` and `maxRcu`."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location --request PATCH 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Content-Type: application/json' \\\n--header 'Accept: application/json' \\\n--data '{\n  \"displayName\": \"my-updated-tidb\",\n  \"maxRcu\": 40000\n}'"}
                }
              }
            }
          }
        }
      }
    };
  }

  rpc ResetRootPassword(ResetRootPasswordRequest) returns (ResetRootPasswordResponse) {
    option (google.api.http) = {
      post: "/tidbs/{tidb_id}:resetRootPassword"
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Reset the root password of a TiDB Cloud Premium instance"
      tags: "public"
      tags: "TiDB Cloud Premium Instance"
      description: "Sets a new password for the TiDB Cloud Premium instance's root user. The new password is not returned in the response for security reasons, so save your password in a secure location."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}:resetRootPassword' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Content-Type: application/json' \\\n--header 'Accept: application/json' \\\n--data '{\n  \"rootPassword\": \"your-new-password\"\n}'"}
                }
              }
            }
          }
        }
      }
    };
  }

  rpc GetCloudProviderInfo(GetCloudProviderInfoRequest) returns (CloudProviderInfo) {
    option (google.api.http) = {get: "/tidbs/{tidb_id}/cloudProviderInfo"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get cloud provider information for a TiDB Cloud Premium instance"
      tags: "public"
      tags: "TiDB Cloud Premium Instance"
      description: "Retrieves the TiDB Cloud account ID and external ID for the underlying cloud infrastructure of a specific TiDB Cloud Premium instance."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}/cloudProviderInfo' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Accept: application/json'"}
                }
              }
            }
          }
        }
      }
    };
  }

  rpc EstimatePrice(EstimatePriceRequest) returns (EstimatePriceResponse) {
    option (google.api.http) = {
      post: "/tidbs:estimatePrice"
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Estimate price"
      description: "Estimates the cost for a TiDB Cloud Premium instance with the given configuration, including RCU and storage costs."
    };
  }

  rpc CalculateMinRcu(CalculateMinRcuRequest) returns (CalculateMinRcuResponse) {
    option (google.api.http) = {
      post: "/tidbs:calculateMinRcu"
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Calculate minimum RCU"
      description: "Calculates the minimum number of Request Capacity Units (RCUs) for a TiDB Cloud Premium instance based on maxRcu and server-side quota strategy."
    };
  }

  rpc ListPremiumReservedCapacityOptions(ListPremiumReservedCapacityOptionsRequest) returns (ListPremiumReservedCapacityOptionsResponse) {
    option (google.api.http) = {get: "/capacityOptions"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "List Premium Reserved capacity options"
      description: "Lists visible Premium Reserved capacity options for the current organization."
    };
  }

  rpc ListBackupPolicies(ListBackupPoliciesRequest) returns (ListBackupPoliciesResponse) {
    option (google.api.http) = {get: "/tidbs/{tidb_id}/backupPolicies"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "List backup policies"
      description: "Lists all available backup policies for a specific TiDB Cloud Premium instance."
    };
  }

  rpc GetBackupSetting(GetBackupSettingRequest) returns (BackupSetting) {
    option (google.api.http) = {get: "/tidbs/{tidb_id}/backupSetting"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get backup setting"
      description: "Retrieves the backup setting for a specific TiDB Cloud Premium instance."
    };
  }

  rpc UpdateBackupSetting(UpdateBackupSettingRequest) returns (BackupSetting) {
    option (google.api.http) = {
      patch: "/tidbs/{backup_setting.tidb_id}/backupSetting"
      body: "backup_setting"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Update backup setting"
      description: "Updates the backup setting for a specific TiDB Cloud Premium instance."
    };
  }

  // List the backup list for the tidb
  rpc ListTidbBackups(ListTidbBackupsRequest) returns (ListTidbBackupsResponse) {
    option (google.api.http) = {get: "/tidbs/{tidb_id}/backups"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "List backups for a TiDB Cloud Premium instance"
      tags: "public"
      tags: "Backup"
      description: "Lists all backups for a specific TiDB Cloud Premium instance. You can filter results by state, region, trigger type, or time range."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}/backups' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Accept: application/json'"}
                }
              }
            }
          }
        }
      }
    };
  }

  // Delete a backup for a specific TiDB Cloud Premium instance
  rpc DeleteTidbBackup(DeleteTidbBackupRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {delete: "/tidbs/{tidb_id}/backups/{backup_id}"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Delete a backup for a TiDB Cloud Premium instance"
      tags: "public"
      tags: "Backup"
      description: "Deletes a backup by `backupId`."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location --request DELETE 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}/backups/{backup_id}' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Accept: application/json'"}
                }
              }
            }
          }
        }
      }
    };
  }

  // Create a manual backup for a specific TiDB Cloud Premium instance
  // (-- api-linter: core::0133::http-body=disabled
  //     aip.dev/not-precedent: CreateTidbBackup is a simple action that only requires name field, not a full resource --)
  // (-- api-linter: core::0133::response-message-name=disabled
  //     aip.dev/not-precedent: CreateTidbBackup returns backup_id only, not a full TidbBackup resource --)
  // (-- api-linter: core::0133::request-resource-field=disabled
  //     aip.dev/not-precedent: CreateTidbBackup request only requires tidb_id and name, not a full TidbBackup resource --)
  rpc CreateTidbBackup(CreateTidbBackupRequest) returns (CreateTidbBackupResponse) {
    option (google.api.http) = {
      post: "/tidbs/{tidb_id}/backups"
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Create a backup for a TiDB Cloud Premium instance"
      tags: "Backup"
      description: "Creates a manual backup for a specific TiDB Cloud Premium instance."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}/backups' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Content-Type: application/json' \\\n--header 'Accept: application/json' \\\n--data '{\n  \\\"name\\\": \\\"my-manual-backup\\\"\n}'"}
                }
              }
            }
          }
        }
      }
    };
  }

  // Restore a TiDB Cloud Premium instance from a backup.
  // (-- api-linter: core::0136::http-uri-suffix=disabled
  //     aip.dev/not-precedent: user RestoreTidb will be duplicated ServiceName tidbs already in path --)
  rpc RestoreTidb(RestoreTidbRequest) returns (RestoreTidbResponse) {
    option (google.api.http) = {
      post: "/tidbs:restore"
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Restore a TiDB Cloud Premium instance from a backup"
      tags: "public"
      tags: "Backup"
      description: "Restores a new TiDB Cloud Premium instance from a backup. Supported restore modes: `SNAPSHOT`, `PITR`, `DEDICATED_SNAPSHOT`, and `CLASSIC_SNAPSHOT`."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl (SNAPSHOT)"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs:restore' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Content-Type: application/json' \\\n--header 'Accept: application/json' \\\n--data '{\n  \"tidb\": {\n    \"displayName\": \"my-restored-tidb\",\n    \"regionId\": \"aws-us-west-2\",\n    \"maxRcu\": 20000,\n    \"servicePlan\": \"Premium\"\n  },\n  \"sourceTidbId\": \"{source_tidb_id}\",\n  \"restoreMode\": \"SNAPSHOT\",\n  \"backupId\": \"{backup_id}\"\n}'"}
                }
              }
            }
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl (PITR)"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs:restore' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Content-Type: application/json' \\\n--header 'Accept: application/json' \\\n--data '{\n  \"tidb\": {\n    \"displayName\": \"my-restored-tidb\",\n    \"regionId\": \"aws-us-west-2\",\n    \"maxRcu\": 20000,\n    \"servicePlan\": \"Premium\"\n  },\n  \"sourceTidbId\": \"{source_tidb_id}\",\n  \"restoreMode\": \"PITR\",\n  \"pointInTime\": \"2023-10-01T12:00:00Z\"\n}'"}
                }
              }
            }
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl (DEDICATED_SNAPSHOT)"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs:restore' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Content-Type: application/json' \\\n--header 'Accept: application/json' \\\n--data '{\n  \"tidb\": {\n    \"displayName\": \"my-restored-tidb\",\n    \"regionId\": \"aws-us-west-2\",\n    \"maxRcu\": 20000,\n    \"servicePlan\": \"Premium\"\n  },\n  \"sourceTidbId\": \"{source_tidb_id}\",\n  \"restoreMode\": \"DEDICATED_SNAPSHOT\",\n  \"backupId\": \"{backup_id}\"\n}'"}
                }
              }
            }
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl (CLASSIC_SNAPSHOT)"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs:restore' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Content-Type: application/json' \\\n--header 'Accept: application/json' \\\n--data '{\n  \"tidb\": {\n    \"displayName\": \"my-restored-tidb\",\n    \"regionId\": \"aws-us-west-2\",\n    \"maxRcu\": 20000,\n    \"servicePlan\": \"Premium\"\n  },\n  \"restoreMode\": \"CLASSIC_SNAPSHOT\",\n  \"classicBackupStorage\": {\n    \"cloudProvider\": \"aws\",\n    \"bucketUri\": \"s3://my-backup-bucket/tidb-backups/\",\n    \"auth\": {\n      \"accessKeyId\": \"AKIAIOSFODNN7EXAMPLE\",\n      \"accessKeySecret\": \"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"\n    }\n  }\n}'"}
                }
              }
            }
          }
        }
      }
    };
  }

  // Get the restore status for a TiDB Cloud Premium instance
  rpc RestoreStatus(RestoreStatusRequest) returns (RestoreStatusResponse) {
    option (google.api.http) = {get: "/tidbs/{tidb_id}:restoreStatus"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get the restore status for a TiDB Cloud Premium instance"
      description: "Retrieves the current restore status for a specific TiDB Cloud Premium instance."
    };
  }

  // Get restore state for a TiDB Cloud Premium instance
  // (-- api-linter: core::0131::response-message-name=disabled
  //     aip.dev/not-precedent: keep legacy response name for backward compatibility --)
  rpc GetRestoreStatus(GetRestoreStatusRequest) returns (GetRestoreStatusResponse) {
    option (google.api.http) = {get: "/tidbs/{tidb_id}:getRestoreStatus"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get the restore status for a TiDB Cloud Premium instance"
      tags: "public"
      tags: "Backup"
      description: "Retrieves the restore progress of a TiDB Cloud Premium instance, including the completion percentage and any error messages."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}:getRestoreStatus' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Accept: application/json'"}
                }
              }
            }
          }
        }
      }
    };
  }

  // Validate classic backup before restore
  rpc ValidateClassicBackup(ValidateClassicBackupRequest) returns (ValidateClassicBackupResponse) {
    option (google.api.http) = {
      post: "/tidbs:validateClassicBackup"
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Validate classic backup"
      description: "Validates a classic backup before restoring from it. Use this to verify the backup is valid and compatible before creating a restore request."
    };
  }

  // Get the CA certificate download URL for a TiDB Cloud Premium instance.
  rpc GetCaCertificateDownloadUrl(GetCaCertificateDownloadUrlRequest) returns (CaCertificateDownloadUrl) {
    option (google.api.http) = {get: "/tidbs/{tidb_id}/caCertificateUrl"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get the CA certificate download URL for a TiDB Cloud Premium instance"
      tags: "public"
      tags: "TiDB Cloud Premium Instance"
      description: "Retrieves the download URL for the CA certificate required to establish TLS (Transport Layer Security) connections to a specific TiDB Cloud Premium instance."
      extensions: {
        key: "x-code-samples"
        value: {
          list_value: {
            values: {
              struct_value: {
                fields: {
                  key: "lang"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "label"
                  value: {string_value: "curl"}
                }
                fields: {
                  key: "source"
                  value: {string_value: "curl --location 'https://cloud.tidbapi.com/v1beta2/tidbs/{tidb_id}/caCertificateUrl' \\\n--digest --user 'YOUR_PUBLIC_KEY:YOUR_PRIVATE_KEY' \\\n--header 'Accept: application/json'"}
                }
              }
            }
          }
        }
      }
    };
  }

  rpc UpdateTidbDualLayerEncryption(UpdateTidbDualLayerEncryptionRequest) returns (TidbDualLayerEncryption) {
    option (google.api.http) = {
      patch: "/tidbs/{tidb_dual_layer_encryption.tidb_id}/dualLayerDataEncryption"
      body: "tidb_dual_layer_encryption"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Update dual-layer data encryption for a TiDB Cloud Premium instance"
      description: "Enable, switch, or disable the dual-layer data encryption configuration for a TiDB Cloud Premium instance."
    };
  }

  rpc GetTidbDualLayerEncryption(GetTidbDualLayerEncryptionRequest) returns (TidbDualLayerEncryption) {
    option (google.api.http) = {get: "/tidbs/{tidb_id}/dualLayerDataEncryption"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get dual-layer data encryption for a TiDB Cloud Premium instance"
      description: "Retrieves the current dual-layer data encryption configuration and status for a TiDB Cloud Premium instance."
    };
  }
}

message Tidb {
  option (google.api.resource) = {
    type: "tidb_cloud_open_api.nextgen.v1beta2/Tidb"
    pattern: "tidbs/{tidb}"
    plural: "tidbs"
    singular: "tidb"
  };
  // The unique identifier for the TiDB Cloud Premium instance, which is generated by the API and follows the format `tidbs/{tidbId}`.
  string name = 1 [
    (google.api.field_behavior) = IDENTIFIER,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // The ID of the TiDB Cloud Premium instance.
  string tidb_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The user-defined name of the TiDB Cloud Premium instance.
  string display_name = 3 [
    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      pattern: "^[A-Za-z0-9][-A-Za-z0-9]{2,62}[A-Za-z0-9]$"
      example: "\"foo-bar\""
      min_length: 4
      max_length: 64
    }
  ];

  // The unique identifier of the region where the TiDB Cloud Premium instance is deployed, in the format of `{cloud_provider}-{region_code}`. For example, `aws-us-west-2`.
  string region_id = 4 [(google.api.field_behavior) = REQUIRED];

  // The cloud provider where the TiDB Cloud Premium instance is deployed.
  common.v1beta1.Region.CloudProvider cloud_provider = 5 [
    (google.api.field_behavior) = OUTPUT_ONLY,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "The cloud provider where the TiDB Cloud Premium instance is deployed.\n\n- `\"aws\"`: Amazon Web Services\n\n- `\"gcp\"`: Google Cloud\n\n- `\"azure\"`: Microsoft Azure\n\n- `\"alicloud\"`: Alibaba Cloud"}
  ];

  // The display name of the region where the TiDB Cloud Premium instance is deployed. For example, `Oregon (us-west-2)`.
  string region_display_name = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The current state of the TiDB Cloud Premium instance.
  common.v1beta1.ClusterState state = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The root password of the TiDB Cloud Premium instance.
  //
  // This field supports two input formats:
  // - Plaintext password (legacy behavior)
  // - RSA-OAEP-SHA256 encrypted payload prefixed with `rsa_oaep_sha256:`
  //
  // If the marker prefix is present, the server parses and decrypts the encrypted payload.
  // Any parse/decrypt failure returns an explicit parameter error without plaintext fallback.
  // If the marker prefix is absent, the value is treated as plaintext for backward compatibility.
  //
  // For plaintext input, the password must be between 8 and 64 characters long and can contain letters,
  // numbers, and special characters.
  string root_password = 8 [
    (google.api.field_behavior) = OPTIONAL,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      example: "\"my-shining-password\""
      // Accept either:
      // - Plaintext: any characters, length 8–64
      // - Encrypted: value prefixed with `rsa_oaep_sha256:`
      pattern: "^(rsa_oaep_sha256:.+|.{8,64})$"
    }
  ];

  // The minimum number of Request Capacity Units (RCUs) for the TiDB Cloud Premium instance.
  //
  // This field is read-only and is automatically calculated as `max(5000, maxRcu / 4)`.
  int64 min_rcu = 9 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The maximum number of Request Capacity Units (RCUs) for the TiDB Cloud Premium instance.
  int64 max_rcu = 10 [(google.api.field_behavior) = REQUIRED];
  common.v1beta1.ServicePlan service_plan = 11 [
    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "The plan of the service.\n\n- `Premium`: [TiDB Cloud Premium](https://docs.pingcap.com/tidbcloud/select-cluster-tier/#tidb-cloud-premium)\n\n- `Premium_Reserved`: TiDB Cloud Premium Reserved"}
  ];

  // The capacity template ID for Premium Reserved. This field is only accepted
  // when `service_plan` is `Premium_Reserved`; it is not returned in responses.
  int64 reserved_capacity_template_id = 24 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = INPUT_ONLY
  ];

  // The current Reserved capacity information. This field is only returned for
  // Premium Reserved instances.
  ReservedCapacity reserved_capacity = 25 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The resource pool selected for this TiDB Cloud instance.
  // Currently, this field is only used for TiDB Cloud BYOC instances.
  optional string resource_pool_id = 26 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // The current display name of the selected resource pool.
  // Currently, this field is only returned for TiDB Cloud BYOC instances.
  optional string resource_pool_display_name = 27 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The high availability configuration for the TiDB Cloud instance.
  // - `REGIONAL`: high availability across multiple availability zones within a region. For more information, see [Regional high availability architecture](https://docs.pingcap.com/tidbcloud/serverless-high-availability/#regional-high-availability-architecture).
  // - `ZONAL`: high availability within a single availability zone. For more information, see [Zonal high availability architecture](https://docs.pingcap.com/tidbcloud/serverless-high-availability/#zonal-high-availability-architecture).
  // TiDB Cloud Premium and Premium Reserved support only `REGIONAL`.
  // If omitted for TiDB Cloud Essential, the selected resource pool determines the value.
  HighAvailabilityType high_availability_type = 12 [(google.api.field_behavior) = IMMUTABLE];

  // The annotations for the TiDB Cloud Premium instance. The following lists some predefined annotations:
  // - `tidb.cloud/has-set-password`: indicates whether the TiDB Cloud Premium instance has a root password set.
  // - `tidb.cloud/available-features`: lists available features of the TiDB Cloud Premium instance.
  map<string, string> annotations = 13 [(google.api.field_behavior) = OPTIONAL];

  // The labels for the TiDB Cloud Premium instance.
  // - `tidb.cloud/organization`: the ID of the organization where the TiDB Cloud Premium instance belongs.
  // - `tidb.cloud/project`: the ID of the project where the TiDB Cloud Premium instance belongs.
  map<string, string> labels = 14 [(google.api.field_behavior) = OPTIONAL];

  // The email address or public API key of the user who created the TiDB Cloud Premium instance.
  string creator = 15 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The timestamp when the TiDB Cloud Premium instance was created, in the [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  google.protobuf.Timestamp create_time = 16 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The timestamp when the TiDB Cloud Premium instance was last updated, in the [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  google.protobuf.Timestamp update_time = 17 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The scheduled time when the Resource Pool will automatically resume this instance's pool.
  // This field is set only while the Resource Pool is paused.
  // (-- api-linter: core::0142::time-field-names=disabled
  //     aip.dev/not-precedent: API review selected `automatic_resume_at` to match the Resource Pool field. --)
  // (-- api-linter: core::0140::prepositions=disabled
  //     aip.dev/not-precedent: API review selected `automatic_resume_at` to match the Resource Pool field. --)
  google.protobuf.Timestamp automatic_resume_at = 28 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The connection endpoints for accessing the TiDB Cloud Premium instance.
  repeated Endpoint endpoints = 18 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The dual-layer data encryption configuration for the TiDB Cloud Premium instance.
  DualLayerDataEncryption dual_layer_data_encryption = 19 [(google.api.field_behavior) = OPTIONAL];

  // The version of the TiDB instance.
  string tidb_version = 21 [(google.api.field_behavior) = OUTPUT_ONLY];

  repeated string tags = 22 [(google.api.field_behavior) = OPTIONAL];

  reserved 20;
  reserved "project_id";

  // The timestamp when the capacity of the TiDB Cloud Premium instance was last updated, in the [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  google.protobuf.Timestamp capacity_update_time = 23 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The high availability configuration for the TiDB Cloud Premium instance.
  enum HighAvailabilityType {
    HIGH_AVAILABILITY_TYPE_UNSPECIFIED = 0;
    // High availability across multiple availability zones within a region.
    REGIONAL = 1;
    // High availability within a single availability zone.
    ZONAL = 2;
  }

  message Endpoint {
    // The hostname of the endpoint.
    //
    // When `connectionType` is `"PRIVATE_ENDPOINT"`, the behavior of the `host` field varies by cloud provider:
    // - For AWS, this field is available after the Private Link service is ready.
    // - For Google Cloud and Azure, this field is available after you create a private endpoint connection.
    string host = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

    // The port number of the endpoint.
    int32 port = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

    // The connection type of the endpoint.
    ConnectionType connection_type = 3 [
      (google.api.field_behavior) = OUTPUT_ONLY,
      (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "The connection type of the endpoint.\n\n- `PUBLIC`: a public endpoint. For more information, see [Network](https://docs.pingcap.com/tidbcloud/connect-to-tidb-instance/#network).\n\n- `PRIVATE_ENDPOINT`: a private endpoint. For more information, see [Network](https://docs.pingcap.com/tidbcloud/connect-to-tidb-instance/#network).\n\n- `VPC_PEERING`: a VPC peering endpoint (not yet supported, planned for a future release)."}
    ];

    // The reachability status of the endpoint connection.
    ConnectionReachability connection_reachability = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

    // The public egress IP addresses used by the TiDB Cloud Premium instance.
    //
    // This field is returned only for public endpoints. You can use these IP addresses
    // to configure allowlists on upstream services when connecting through a public endpoint.
    repeated string egress_ips = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

    enum ConnectionType {
      CONNECTION_TYPE_UNSPECIFIED = 0;
      PUBLIC = 1;
      PRIVATE_ENDPOINT = 2;
      VPC_PEERING = 3;
    }
  }

  // The dual-layer data encryption configuration for a TiDB Cloud Premium instance. Specify exactly one of the following options: `noEncryption`, `defaultKey`, or `cmek`.
  message DualLayerDataEncryption {
    oneof key {
      // Disables dual-layer data encryption. The TiDB Cloud Premium instance uses the default encryption provided by the cloud provider.
      google.protobuf.Empty no_encryption = 1;
      // Enables dual-layer data encryption using the TiDB Cloud default key.
      google.protobuf.Empty default_key = 2;
      // Enables dual-layer data encryption using a customer-managed encryption key (CMEK).
      // Configure the key according to the cloud provider:
      // - AWS: set `awsKms` and `awsPrincipal`.
      // - Alibaba Cloud: set `aliyunKms` and `aliyunPrincipal`.
      tidb_cloud_open_api.nextgen.v1beta2.CustomerManagedEncryptionKey cmek = 3;
    }
  }
}

// (-- api-linter: core::0123::resource-annotation=disabled
//     aip.dev/not-precedent: ReservedCapacity is an embedded summary and selectable option, not a standalone resource. --)
message ReservedCapacity {
  int64 id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  string name = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  string template_code = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  int64 purchased_vcpu = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  int64 peak_qps = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  string workload_type = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  string description = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

  Scope scope = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  enum Scope {
    SCOPE_UNSPECIFIED = 0;
    DEFAULT = 1;
    ORG_PRIVATE = 2;
  }
}

message CloudProviderInfo {
  // The ID of the TiDB Cloud Premium instance.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];

  common.v1beta1.Region.CloudProvider cloud_provider = 5 [
    (google.api.field_behavior) = OUTPUT_ONLY,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "The cloud provider where the TiDB Cloud Premium instance is deployed.\n\n- `\"aws\"`: Amazon Web Services\n\n- `\"gcp\"`: Google Cloud\n\n- `\"azure\"`: Microsoft Azure\n\n- `\"alicloud\"`: Alibaba Cloud"}
  ];
  // The TiDB Cloud account ID for the underlying cloud infrastructure of the TiDB Cloud Premium instance.
  string tidb_cloud_account_id = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The external ID of the TiDB Cloud account, which is used for assuming Identity and Access Management (IAM) roles for cross-account access.
  string tidb_cloud_account_external_id = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The node role or identity used to grant storage access.
  // For Azure, this is the kubelet identity object ID.
  string node_role = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
}

message CreateTidbRequest {
  // The TiDB Cloud Premium instance to create.
  Tidb tidb = 1 [(google.api.field_behavior) = REQUIRED];

  // If set to `true`, the request is validated but not executed. Defaults to `false`.
  bool validate_only = 100 [(google.api.field_behavior) = OPTIONAL];
}

message ListTidbsRequest {
  common.v1beta1.ServicePlan service_plan = 1 [
    (google.api.field_behavior) = OPTIONAL,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      description: "The plan of the service. If specified, only TiDB Cloud Premium instances of the specified plan are returned.\n\n- `Premium`: [TiDB Cloud Premium](https://docs.pingcap.com/tidbcloud/select-cluster-tier/#tidb-cloud-premium)\n\n- `Premium_Reserved`: TiDB Cloud Premium Reserved"
      example: "\"Premium\""
    }
  ];

  // A list of region IDs. If specified, only TiDB Cloud Premium instances in these regions are returned.
  repeated string region_ids = 2 [(google.api.field_behavior) = OPTIONAL];

  // The display name to filter by. If specified, only TiDB Cloud Premium instances whose display name contains this value are returned.
  string name = 3 [(google.api.field_behavior) = OPTIONAL];

  // A list of tags. If specified, only TiDB Cloud Premium instances tagged with any of these values are returned.
  repeated string tags = 5 [(google.api.field_behavior) = OPTIONAL];

  // A list of TiDB Cloud Premium instance IDs. If specified, only the ones matching these IDs are returned.
  repeated string tidb_ids = 4 [(google.api.field_behavior) = OPTIONAL];

  // A list of resource pool IDs. If specified, only TiDB Cloud BYOC instances in these resource pools are returned.
  repeated string resource_pool_ids = 6 [(google.api.field_behavior) = OPTIONAL];

  // The maximum number of TiDB Cloud Premium instances to return. If not specified, at most 10 will be returned. The maximum value is `100`. Values greater than `100` are set to `100`.
  int32 page_size = 100 [
    (google.api.field_behavior) = OPTIONAL,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      example: "10"
      default: "10"
      minimum: 1
      maximum: 100
    }
  ];

  // The pagination token received from a previous [List TiDB Cloud Premium instances](#tag/TiDB-Instance/operation/TidbService_ListTidbs) request. Use this token to retrieve the next page of results.
  //
  // **Note**: When paginating, all other parameters must match the original request.
  string page_token = 101 [(google.api.field_behavior) = OPTIONAL];

  // The number of TiDB Cloud Premium instances to skip before returning results. If the value exceeds the total number of TiDB Cloud Premium instances, the response is `200` with an empty list and no `nextPageToken`.
  int32 skip = 102 [(.google.api.field_behavior) = OPTIONAL];
}

message ListTidbsResponse {
  // A list of TiDB Cloud Premium instances that match the query.
  repeated Tidb tidbs = 1;

  // The total number of TiDB Cloud Premium instances that match the query.
  int32 total_size = 100;

  // The token to retrieve the next page of results. Use this value as the `pageToken` parameter in the next request. This field is empty when there are no more pages.
  string next_page_token = 101;
}

message ListPremiumReservedCapacityOptionsRequest {
  int32 page_size = 100 [(google.api.field_behavior) = OPTIONAL];

  string page_token = 101 [(google.api.field_behavior) = OPTIONAL];
}

message ListPremiumReservedCapacityOptionsResponse {
  repeated ReservedCapacity reserved_capacities = 1;

  string next_page_token = 101;
}

message GetTidbRequest {
  // The ID of the TiDB Cloud Premium instance to retrieve.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message BindTagsRequest {
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
  repeated string tags = 2 [(google.api.field_behavior) = REQUIRED];
}

message BindTagsResponse {
  repeated common.v1beta1.Tag tags = 1;
}

message UnbindTagsRequest {
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
  repeated string tags = 2 [(google.api.field_behavior) = REQUIRED];
}

message UnbindTagsResponse {
  repeated common.v1beta1.Tag tags = 1;
}

message DeleteTidbRequest {
  // The ID of the TiDB Cloud Premium instance to delete.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];

  // If set to `true`, the request is validated but not executed. Defaults to `false`.
  bool validate_only = 100 [(google.api.field_behavior) = OPTIONAL];
}

message UpdateTidbRequest {
  // The TiDB Cloud Premium instance to update.
  Tidb tidb = 1 [(google.api.field_behavior) = REQUIRED];

  // If set to `true`, the request is validated but not executed. Defaults to `false`.
  bool validate_only = 100 [(google.api.field_behavior) = OPTIONAL];

  message Tidb {
    // The ID of the TiDB Cloud Premium instance to update.
    string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
    string display_name = 2 [
      (google.api.field_behavior) = OPTIONAL,
      (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
        description: "The user-defined name of the TiDB Cloud Premium instance."
        pattern: "^[A-Za-z0-9][-A-Za-z0-9]{2,62}[A-Za-z0-9]$"
        example: "\"foo-bar\""
        min_length: 4
        max_length: 64
      }
    ];
    // Deprecated: min_rcu is now automatically managed.
    // Any value provided here will be ignored in favor of max(5000, max_rcu / 4).
    int64 min_rcu = 3 [
      (google.api.field_behavior) = OUTPUT_ONLY,
      deprecated = true
    ];
    // The maximum number of Request Capacity Units (RCUs) for the TiDB Cloud Premium instance.
    int64 max_rcu = 4 [(google.api.field_behavior) = OPTIONAL];

    // The target capacity template ID for Premium Reserved resize.
    int64 reserved_capacity_template_id = 5 [(google.api.field_behavior) = OPTIONAL];
  }
}

message ResetRootPasswordRequest {
  // The ID of the TiDB Cloud Premium instance for which to reset the root password.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];

  // The new root password.
  //
  // This field supports two input formats:
  // - Plaintext password (legacy behavior)
  // - RSA-OAEP-SHA256 encrypted payload prefixed with `rsa_oaep_sha256:`
  //
  // If the marker prefix is present, the server parses and decrypts the encrypted payload.
  // Any parse/decrypt failure returns an explicit parameter error without plaintext fallback.
  // If the marker prefix is absent, the value is treated as plaintext for backward compatibility.
  //
  // For plaintext input, the password must be between 8 and 64 characters long.
  string root_password = 2 [
    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      example: "\"my-shining-password\""
      pattern: "^(rsa_oaep_sha256:.+|.{8,64})$"
    }
  ];
}

message ResetRootPasswordResponse {}

message GetCloudProviderInfoRequest {
  // The ID of the TiDB Cloud Premium instance for which to retrieve cloud provider information.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message EstimatePriceRequest {
  // Required. Region where the tidb will be created.
  // Format: {cloud_provider}-{region_code}
  string region_id = 1 [(google.api.field_behavior) = REQUIRED];
  // Optional. Required when service_plan is Premium.
  int64 max_rcu = 2 [(google.api.field_behavior) = OPTIONAL];
  common.v1beta1.ServicePlan service_plan = 4 [(google.api.field_behavior) = REQUIRED];
  // Optional. Required when service_plan is Premium_Reserved.
  int64 reserved_capacity_template_id = 7 [(google.api.field_behavior) = OPTIONAL];
}

message EstimatePriceResponse {
  string cloud_provider = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
  string region = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
  int64 rcu = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
  string rcu_cost_hourly = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
  string rcu_cost_monthly = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
}

message CalculateMinRcuRequest {
  // Required. Region where the tidb will be created.
  // Format: {cloud_provider}-{region_code}
  string region_id = 1 [(google.api.field_behavior) = REQUIRED];
  // Required. The maximum number of Request Capacity Units (RCUs) for the TiDB Cloud Premium instance.
  int64 max_rcu = 2 [(google.api.field_behavior) = REQUIRED];
  // Required. Service plan for the TiDB Cloud Premium instance.
  common.v1beta1.ServicePlan service_plan = 3 [(google.api.field_behavior) = REQUIRED];
}

message CalculateMinRcuResponse {
  // The minimum number of Request Capacity Units (RCUs) calculated by server-side strategy.
  int64 min_rcu = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// (-- api-linter: core::0158::request-page-size-field=disabled aip.dev/not-precedent: the number of backup policy is small, paging is no need --)
// (-- api-linter: core::0158::request-page-token-field=disabled aip.dev/not-precedent: the number of backup policy is small, paging is no need --)
message ListBackupPoliciesRequest {
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
}

// (-- api-linter: core::0158::response-next-page-token-field=disabled  aip.dev/not-precedent: the number of backup policy is small, paging is no need --)
message ListBackupPoliciesResponse {
  repeated BackupSetting.BackupPolicy backup_policies = 1;
}

message GetBackupSettingRequest {
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message UpdateBackupSettingRequest {
  BackupSetting backup_setting = 1 [(google.api.field_behavior) = REQUIRED];
  bool validate_only = 100 [(google.api.field_behavior) = OPTIONAL];
}

message BackupSetting {
  enum BackupMode {
    BACKUP_MODE_UNSPECIFIED = 0;
    STANDARD_BUNDLE = 1;
    FLEXIBLE_RETENTION = 2;
  }
  message BackupPolicy {
    enum Tier {
      TIER_UNSPECIFIED = 0;
      TIER1 = 1;
      TIER2 = 2;
      TIER3 = 3;
    }
    message PiTRPolicy {
      int32 retention_days = 1;
    }
    message HourlyPolicy {
      int32 retention_days = 1;
    }
    message DailyPolicy {
      int32 retention_days = 1;
      string start_time_utc = 2;
    }
    Tier name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
    string description = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
    PiTRPolicy pitr = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
    HourlyPolicy hourly_backup = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
    DailyPolicy daily_backup = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
  BackupPolicy.Tier backup_policy = 2 [
    deprecated = true,
    (google.api.field_behavior) = OPTIONAL
  ];
  google.protobuf.Timestamp pitr_start_time = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
  google.protobuf.Timestamp pitr_end_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
  google.protobuf.Timestamp last_modify_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
  BackupMode mode = 6 [(google.api.field_behavior) = OPTIONAL];
  optional int32 retention_days = 7 [(google.api.field_behavior) = OPTIONAL];
  optional string daily_backup_time_utc = 8 [(google.api.field_behavior) = OPTIONAL];
}

message ListTidbBackupsRequest {
  // The ID of the TiDB Cloud Premium instance for which to list backups.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];

  // A list of backup states. If specified, only backups matching these states are returned.
  // (-- api-linter: core::0216::state-field-output-only=disabled
  //     aip.dev/not-precedent: It in a input param --)
  repeated Backup.State states = 2 [(google.api.field_behavior) = OPTIONAL];

  // A list of region IDs. If specified, only backups in these regions are returned.
  repeated string region_ids = 3 [(google.api.field_behavior) = OPTIONAL];

  // A list of backup trigger types. If specified, only backups matching these trigger types are returned.
  repeated Backup.TriggerType trigger_types = 4 [(google.api.field_behavior) = OPTIONAL];

  // The inclusive start of the backup time range, in the [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format. If specified, only backups at or after this time are returned.
  google.protobuf.Timestamp start_time = 5 [(google.api.field_behavior) = OPTIONAL];

  // The inclusive end of the backup time range, in the [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format. If specified, only backups at or before this time are returned.
  google.protobuf.Timestamp end_time = 6 [(google.api.field_behavior) = OPTIONAL];

  // The maximum number of backups to return. If not specified, at most `10` backups are returned.
  int32 page_size = 100 [
    (google.api.field_behavior) = OPTIONAL,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      example: "10"
      default: "10"
      minimum: 1
      maximum: 100
      description: "The maximum number of backups to return. If not specified, at most 10 backups will be returned. The maximum value is `100`. Values greater than `100` are set to `100`."
    }
  ];

  // The pagination token received from a previous `ListTidbBackups` request.
  string page_token = 101 [
    (google.api.field_behavior) = OPTIONAL,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      description: "The pagination token received from a previous [List backups for a TiDB Cloud Premium instance](#tag/Backup/operation/TidbService_ListTidbBackups) request. Use this token to retrieve the next page of results.\n\n**Note**: When paginating, all other parameters must match the original request."
      example: "\"next_page_token\""
    }
  ];

  // The number of backups to skip before returning results. If the value exceeds the total number of backups, the response is `200` with an empty list and no `nextPageToken`.
  int32 skip = 102 [(.google.api.field_behavior) = OPTIONAL];
}

message ListTidbBackupsResponse {
  // A list of backups that match the query.
  repeated Backup backups = 1;

  // The total number of backups that match the query.
  int32 total_size = 2;

  // The token to retrieve the next page of results. Use this value as the `pageToken` parameter in the next request. This field is empty when there are no more pages.
  string next_page_token = 3;
}

message DeleteTidbBackupRequest {
  // The ID of the TiDB Cloud Premium instance.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];

  // The ID of the backup to delete.
  string backup_id = 2 [(google.api.field_behavior) = REQUIRED];
}

// (-- api-linter: core::0133::request-resource-field=disabled
//     aip.dev/not-precedent: CreateTidbBackup request only requires tidb_id and name, not a full TidbBackup resource --)
message CreateTidbBackupRequest {
  // The ID of the TiDB Cloud Premium instance for which to create a backup.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];

  // The name of the manual backup.
  string name = 2 [(google.api.field_behavior) = REQUIRED];
}

message CreateTidbBackupResponse {
  // The ID of the created backup.
  string backup_id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

message RestoreTidbRequest {
  Tidb tidb = 1 [
    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "The configuration of the TiDB Cloud Premium instance to create.\n\n**Note**: Currently, only TiDB Cloud Premium instances with `servicePlan` set to `Premium` are supported."}
  ];

  // The ID of the source TiDB Cloud Premium instance containing the backup data.
  string source_tidb_id = 2 [(google.api.field_behavior) = OPTIONAL];

  RestoreMode restore_mode = 3 [(google.api.field_behavior) = REQUIRED];

  // The ID of the backup to restore from.
  //
  // This field is required when `restoreMode` is `"SNAPSHOT"` or `"DEDICATED_SNAPSHOT"`.
  string backup_id = 4 [(google.api.field_behavior) = OPTIONAL];

  // The point in time to restore data to, in the [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  //
  // This field is required when `restoreMode` is `"PITR"`.
  // (-- api-linter: core::0140::prepositions=disabled
  //     aip.dev/not-precedent: this is a common term in PITR --)
  google.protobuf.Timestamp point_in_time = 5 [(google.api.field_behavior) = OPTIONAL];

  // The classic backup storage configuration.
  //
  // This field is required when `restoreMode` is `"CLASSIC_SNAPSHOT"`.
  ClassicBackupStorage classic_backup_storage = 6 [(google.api.field_behavior) = OPTIONAL];

  // If set to `true`, the request is validated but not executed. Defaults to `false`.
  bool validate_only = 100 [(google.api.field_behavior) = OPTIONAL];
}

message RestoreTidbResponse {
  // The restored TiDB Cloud Premium instance.
  Tidb tidb = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

message RestoreStatusRequest {
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message RestoreStatusResponse {
  // The current state of the restore operation.
  RestoreState state = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Error message provided if the restore failed
  string message = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Progress percentage (0-100)
  int32 progress = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
}

message GetRestoreStatusRequest {
  // The ID of the TiDB Cloud Premium instance.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message GetRestoreStatusResponse {
  // The current state of the restore operation.
  RestoreState state = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The detailed error message if the restore operation fails.
  string message = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The restore progress percentage, from `0` to `100`.
  int32 progress = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
}

message ValidateClassicBackupRequest {
  ClassicBackupStorage classic_backup_storage = 1 [(google.api.field_behavior) = REQUIRED];
  common.v1beta1.ServicePlan service_plan = 2 [(google.api.field_behavior) = REQUIRED];
}

message ValidateClassicBackupResponse {
  // only return when validate pass
  ClassicBackupInfo classic_backup_info = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

message GetCaCertificateDownloadUrlRequest {
  // The ID of the TiDB Cloud Premium instance for which to retrieve the CA certificate.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message CaCertificateDownloadUrl {
  // The download URL for the CA certificate of the TiDB Cloud Premium instance.
  string uri = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// The storage configuration for a classic backup.
message ClassicBackupStorage {
  common.v1beta1.Region.CloudProvider cloud_provider = 1 [
    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      description: "The cloud provider where the backup object storage is located.\n\n**Note**: Currently, only `\"aws\"` and `\"alicloud\"` are supported."
      example: "\"aws\""
    }
  ];

  // The region where the backup object storage is located, in the format of `{cloud_provider}-{region_code}`. For example, `alicloud-cn-shanghai`.
  //
  // This field is required when `cloud_provider` is `"alicloud"`.
  string region_id = 2 [(google.api.field_behavior) = OPTIONAL];

  string bucket_uri = 3 [
    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      description: "The URI of the backup bucket.\n\n- For Amazon S3, use the format `s3://{bucket_name}/{path}`. For example, `s3://my-backup-bucket/tidb-backups/`.\n\n- For Alibaba Cloud OSS, use the format `oss://{bucket_name}/{path}`. For example, `oss://my-backup-bucket/tidb-backups/`."
      example: "\"s3://my-backup-bucket/tidb-backups/\""
    }
  ];

  // The authentication credentials for accessing the backup storage.
  BackupStorageAuth auth = 4 [(google.api.field_behavior) = REQUIRED];
}

message BackupStorageAuth {
  // The access key ID used to access the backup storage.
  string access_key_id = 1 [(google.api.field_behavior) = REQUIRED];

  // The access key secret used to access the backup storage.
  string access_key_secret = 2 [(google.api.field_behavior) = REQUIRED];
}

message ClassicBackupInfo {
  // The cloud provider where the backup object storage is located.
  common.v1beta1.Region.CloudProvider cloud_provider = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The region where the backup object storage is located, in the format of `{cloud_provider}-{region_code}`. For example, `aws-us-west-2`.
  string region_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The TiDB version of the backup data.
  string version = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The timestamp when the backup was created, in the [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  google.protobuf.Timestamp backup_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The backup size in bytes.
  int64 size_bytes = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
}

message TidbDualLayerEncryption {
  // The ID of the TiDB Cloud Premium instance.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];

  enum State {
    STATE_UNSPECIFIED = 0;
    MODIFYING = 1;
    ENABLED = 2;
  }

  // The current encryption state.
  State state = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Human-readable status or error detail.
  string message = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The encryption configuration.
  Tidb.DualLayerDataEncryption encryption = 4 [(google.api.field_behavior) = OPTIONAL];
}

message UpdateTidbDualLayerEncryptionRequest {
  // The dual-layer data encryption resource to update.
  TidbDualLayerEncryption tidb_dual_layer_encryption = 1 [(google.api.field_behavior) = REQUIRED];

  // If set to `true`, the request is validated but not executed. Defaults to `false`.
  bool validate_only = 2 [(google.api.field_behavior) = OPTIONAL];
}

message GetTidbDualLayerEncryptionRequest {
  // The ID of the TiDB Cloud Premium instance.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message ResumeTidbRequest {
  // The ID of a paused TiDB Cloud Premium or Premium Reserved instance.
  string tidb_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message ResumeTidbResponse {}

// The current state of the restore operation.
enum RestoreState {
  RESTORE_STATE_UNSPECIFIED = 0;
  // The state of the restore operation is unknown.
  UNKNOWN = 1;
  // The restore operation is pending.
  PENDING = 2;
  // The restore operation is in progress.
  RUNNING = 3;
  // The restore operation completed successfully.
  SUCCEEDED = 4;
  // The restore operation has failed.
  FAILED = 5;
  // The restore operation is cancelled.
  CANCELLED = 6;
}

// The mode used to restore a TiDB Cloud Premium instance.
enum RestoreMode {
  // The restore mode is unspecified.
  RESTORE_MODE_UNSPECIFIED = 0;

  // Restores from native snapshot backup data of a TiDB Cloud Premium instance.
  SNAPSHOT = 1;

  // Restores from native point-in-time recovery (PITR) backup data of a TiDB Cloud Premium instance.
  PITR = 2;

  // Restores from snapshot backup data of a TiDB Cloud Dedicated cluster.
  DEDICATED_SNAPSHOT = 3;

  // Restores from snapshot backup data stored in object storage of a classic TiDB.
  CLASSIC_SNAPSHOT = 4;
}