feat: regenerate protos + federation client methods

Regenerate the Dart bindings from the platform protos (now including fai/v1/federation.proto and the IssueBootstrapToken / ListSatellites HubAdmin RPCs + the new primary_ca_pem field). Add HubClient wrappers: listSatellites() and issueBootstrapToken(name, region, ttl), the latter returning the primary CA so callers can bootstrap a satellite in one step. Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
2026-06-13 14:07:30 +02:00 · 2026-06-13 14:07:30 +02:00 · 9c0d461fb7
commit 9c0d461fb7
parent 35a8ee2844
8 changed files with 3807 additions and 0 deletions
--- a/lib/src/generated/fai/v1/federation.pb.dart
+++ b/lib/src/generated/fai/v1/federation.pb.dart
--- a/lib/src/generated/fai/v1/federation.pbenum.dart
+++ b/lib/src/generated/fai/v1/federation.pbenum.dart
@ -0,0 +1,11 @@
+// This is a generated file - do not edit.
+//
+// Generated from fai/v1/federation.proto.
+
+// @dart = 3.3
+
+// ignore_for_file: annotate_overrides, camel_case_types, comment_references
+// ignore_for_file: constant_identifier_names
+// ignore_for_file: curly_braces_in_flow_control_structures
+// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
+// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
--- a/lib/src/generated/fai/v1/federation.pbgrpc.dart
+++ b/lib/src/generated/fai/v1/federation.pbgrpc.dart
@ -0,0 +1,181 @@
+// This is a generated file - do not edit.
+//
+// Generated from fai/v1/federation.proto.
+
+// @dart = 3.3
+
+// ignore_for_file: annotate_overrides, camel_case_types, comment_references
+// ignore_for_file: constant_identifier_names
+// ignore_for_file: curly_braces_in_flow_control_structures
+// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
+// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
+
+import 'dart:async' as $async;
+import 'dart:core' as $core;
+
+import 'package:grpc/service_api.dart' as $grpc;
+import 'package:protobuf/protobuf.dart' as $pb;
+
+import 'federation.pb.dart' as $0;
+
+export 'federation.pb.dart';
+
+/// Hub-to-hub federation. A satellite hub opens one persistent
+/// HTTP/2 connection to a primary hub. Within that connection,
+/// the four streams below multiplex.
+///
+/// Phase 1.0 ships Control + Invoke + Blob + Events. A fifth
+/// stream (`Stream` for bidirectional streaming caps, e.g. live
+/// audio) is reserved for Phase 1.1; the slot stays free in the
+/// service so adding it is purely additive.
+///
+/// See `docs/architecture/federation.md` for the full design,
+/// security model, and threat-model summary.
+@$pb.GrpcServiceName('fai.v1.Federation')
+class FederationClient extends $grpc.Client {
+  /// The hostname for this service.
+  static const $core.String defaultHost = '';
+
+  /// OAuth scopes needed for the client.
+  static const $core.List<$core.String> oauthScopes = [
+    '',
+  ];
+
+  FederationClient(super.channel, {super.options, super.interceptors});
+
+  /// Long-lived bidirectional Control stream. First two messages
+  /// exchanged are always Hello (satellite -> primary) and Accept
+  /// (primary -> satellite). Subsequent messages multiplex over
+  /// the same channel: advertisements, withdrawals, heartbeats,
+  /// renames, and cert renewals.
+  ///
+  /// Disconnect signals shutdown: the primary withdraws every
+  /// capability advertised by this satellite. The satellite is
+  /// expected to reconnect with exponential backoff.
+  $grpc.ResponseStream<$0.ControlMessage> control(
+    $async.Stream<$0.ControlMessage> request, {
+    $grpc.CallOptions? options,
+  }) {
+    return $createStreamingCall(_$control, request, options: options);
+  }
+
+  /// Reserved stub. Cross-hub dispatch does NOT use a unary RPC:
+  /// the satellite dials outbound (NAT-friendly) and is the gRPC
+  /// client, so the primary cannot open a call back into it. Real
+  /// dispatch flows over the Control stream via DispatchCall /
+  /// DispatchResult (FED-06). This RPC stays declared only so the
+  /// service slot is stable; it returns UNIMPLEMENTED.
+  ///
+  /// The satellite resolves `capability_id` against its **local**
+  /// registry; unknown capabilities return CAPABILITY_NOT_SUPPORTED.
+  /// The wire never carries executable content — only inputs.
+  $grpc.ResponseFuture<$0.DispatchResponse> dispatch(
+    $0.DispatchRequest request, {
+    $grpc.CallOptions? options,
+  }) {
+    return $createUnaryCall(_$dispatch, request, options: options);
+  }
+
+  /// Bidirectional chunked binary transfer. Used for `bytes`
+  /// payloads above `federation.blob_threshold` (default 1 MiB).
+  /// The first message on either side is BlobOpen describing the
+  /// operation ("upload" or "download"); subsequent messages
+  /// carry data or end-of-stream / error markers.
+  $grpc.ResponseStream<$0.BlobChunk> blob(
+    $async.Stream<$0.BlobChunk> request, {
+    $grpc.CallOptions? options,
+  }) {
+    return $createStreamingCall(_$blob, request, options: options);
+  }
+
+  /// Server-streaming relay of audit + step events from a
+  /// satellite to the primary. The primary's Studio uses this to
+  /// show live progress of remote flow runs and to surface
+  /// approval-pending notices from remote steps.
+  $grpc.ResponseStream<$0.RelayedEvent> events(
+    $0.EventsRequest request, {
+    $grpc.CallOptions? options,
+  }) {
+    return $createStreamingCall(_$events, $async.Stream.fromIterable([request]),
+        options: options);
+  }
+
+  // method descriptors
+
+  static final _$control =
+      $grpc.ClientMethod<$0.ControlMessage, $0.ControlMessage>(
+          '/fai.v1.Federation/Control',
+          ($0.ControlMessage value) => value.writeToBuffer(),
+          $0.ControlMessage.fromBuffer);
+  static final _$dispatch =
+      $grpc.ClientMethod<$0.DispatchRequest, $0.DispatchResponse>(
+          '/fai.v1.Federation/Dispatch',
+          ($0.DispatchRequest value) => value.writeToBuffer(),
+          $0.DispatchResponse.fromBuffer);
+  static final _$blob = $grpc.ClientMethod<$0.BlobChunk, $0.BlobChunk>(
+      '/fai.v1.Federation/Blob',
+      ($0.BlobChunk value) => value.writeToBuffer(),
+      $0.BlobChunk.fromBuffer);
+  static final _$events = $grpc.ClientMethod<$0.EventsRequest, $0.RelayedEvent>(
+      '/fai.v1.Federation/Events',
+      ($0.EventsRequest value) => value.writeToBuffer(),
+      $0.RelayedEvent.fromBuffer);
+}
+
+@$pb.GrpcServiceName('fai.v1.Federation')
+abstract class FederationServiceBase extends $grpc.Service {
+  $core.String get $name => 'fai.v1.Federation';
+
+  FederationServiceBase() {
+    $addMethod($grpc.ServiceMethod<$0.ControlMessage, $0.ControlMessage>(
+        'Control',
+        control,
+        true,
+        true,
+        ($core.List<$core.int> value) => $0.ControlMessage.fromBuffer(value),
+        ($0.ControlMessage value) => value.writeToBuffer()));
+    $addMethod($grpc.ServiceMethod<$0.DispatchRequest, $0.DispatchResponse>(
+        'Dispatch',
+        dispatch_Pre,
+        false,
+        false,
+        ($core.List<$core.int> value) => $0.DispatchRequest.fromBuffer(value),
+        ($0.DispatchResponse value) => value.writeToBuffer()));
+    $addMethod($grpc.ServiceMethod<$0.BlobChunk, $0.BlobChunk>(
+        'Blob',
+        blob,
+        true,
+        true,
+        ($core.List<$core.int> value) => $0.BlobChunk.fromBuffer(value),
+        ($0.BlobChunk value) => value.writeToBuffer()));
+    $addMethod($grpc.ServiceMethod<$0.EventsRequest, $0.RelayedEvent>(
+        'Events',
+        events_Pre,
+        false,
+        true,
+        ($core.List<$core.int> value) => $0.EventsRequest.fromBuffer(value),
+        ($0.RelayedEvent value) => value.writeToBuffer()));
+  }
+
+  $async.Stream<$0.ControlMessage> control(
+      $grpc.ServiceCall call, $async.Stream<$0.ControlMessage> request);
+
+  $async.Future<$0.DispatchResponse> dispatch_Pre($grpc.ServiceCall $call,
+      $async.Future<$0.DispatchRequest> $request) async {
+    return dispatch($call, await $request);
+  }
+
+  $async.Future<$0.DispatchResponse> dispatch(
+      $grpc.ServiceCall call, $0.DispatchRequest request);
+
+  $async.Stream<$0.BlobChunk> blob(
+      $grpc.ServiceCall call, $async.Stream<$0.BlobChunk> request);
+
+  $async.Stream<$0.RelayedEvent> events_Pre($grpc.ServiceCall $call,
+      $async.Future<$0.EventsRequest> $request) async* {
+    yield* events($call, await $request);
+  }
+
+  $async.Stream<$0.RelayedEvent> events(
+      $grpc.ServiceCall call, $0.EventsRequest request);
+}
--- a/lib/src/generated/fai/v1/federation.pbjson.dart
+++ b/lib/src/generated/fai/v1/federation.pbjson.dart
@ -0,0 +1,674 @@
+// This is a generated file - do not edit.
+//
+// Generated from fai/v1/federation.proto.
+
+// @dart = 3.3
+
+// ignore_for_file: annotate_overrides, camel_case_types, comment_references
+// ignore_for_file: constant_identifier_names
+// ignore_for_file: curly_braces_in_flow_control_structures
+// ignore_for_file: deprecated_member_use_from_same_package, library_prefixes
+// ignore_for_file: non_constant_identifier_names, prefer_relative_imports
+// ignore_for_file: unused_import
+
+import 'dart:convert' as $convert;
+import 'dart:core' as $core;
+import 'dart:typed_data' as $typed_data;
+
+@$core.Deprecated('Use controlMessageDescriptor instead')
+const ControlMessage$json = {
+  '1': 'ControlMessage',
+  '2': [
+    {
+      '1': 'hello',
+      '3': 1,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.HelloMessage',
+      '9': 0,
+      '10': 'hello'
+    },
+    {
+      '1': 'accept',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.AcceptMessage',
+      '9': 0,
+      '10': 'accept'
+    },
+    {
+      '1': 'advertise',
+      '3': 3,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.AdvertiseMessage',
+      '9': 0,
+      '10': 'advertise'
+    },
+    {
+      '1': 'withdraw',
+      '3': 4,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.WithdrawMessage',
+      '9': 0,
+      '10': 'withdraw'
+    },
+    {
+      '1': 'heartbeat',
+      '3': 5,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.HeartbeatMessage',
+      '9': 0,
+      '10': 'heartbeat'
+    },
+    {
+      '1': 'heartbeat_ack',
+      '3': 6,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.HeartbeatAck',
+      '9': 0,
+      '10': 'heartbeatAck'
+    },
+    {
+      '1': 'rename',
+      '3': 7,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.RenameMessage',
+      '9': 0,
+      '10': 'rename'
+    },
+    {
+      '1': 'cert_renew_request',
+      '3': 8,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.CertRenewRequest',
+      '9': 0,
+      '10': 'certRenewRequest'
+    },
+    {
+      '1': 'cert_renew_response',
+      '3': 9,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.CertRenewResponse',
+      '9': 0,
+      '10': 'certRenewResponse'
+    },
+    {
+      '1': 'dispatch_call',
+      '3': 10,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.DispatchCall',
+      '9': 0,
+      '10': 'dispatchCall'
+    },
+    {
+      '1': 'dispatch_result',
+      '3': 11,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.DispatchResult',
+      '9': 0,
+      '10': 'dispatchResult'
+    },
+  ],
+  '8': [
+    {'1': 'kind'},
+  ],
+};
+
+/// Descriptor for `ControlMessage`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List controlMessageDescriptor = $convert.base64Decode(
+    'Cg5Db250cm9sTWVzc2FnZRIsCgVoZWxsbxgBIAEoCzIULmZhaS52MS5IZWxsb01lc3NhZ2VIAF'
+    'IFaGVsbG8SLwoGYWNjZXB0GAIgASgLMhUuZmFpLnYxLkFjY2VwdE1lc3NhZ2VIAFIGYWNjZXB0'
+    'EjgKCWFkdmVydGlzZRgDIAEoCzIYLmZhaS52MS5BZHZlcnRpc2VNZXNzYWdlSABSCWFkdmVydG'
+    'lzZRI1Cgh3aXRoZHJhdxgEIAEoCzIXLmZhaS52MS5XaXRoZHJhd01lc3NhZ2VIAFIId2l0aGRy'
+    'YXcSOAoJaGVhcnRiZWF0GAUgASgLMhguZmFpLnYxLkhlYXJ0YmVhdE1lc3NhZ2VIAFIJaGVhcn'
+    'RiZWF0EjsKDWhlYXJ0YmVhdF9hY2sYBiABKAsyFC5mYWkudjEuSGVhcnRiZWF0QWNrSABSDGhl'
+    'YXJ0YmVhdEFjaxIvCgZyZW5hbWUYByABKAsyFS5mYWkudjEuUmVuYW1lTWVzc2FnZUgAUgZyZW'
+    '5hbWUSSAoSY2VydF9yZW5ld19yZXF1ZXN0GAggASgLMhguZmFpLnYxLkNlcnRSZW5ld1JlcXVl'
+    'c3RIAFIQY2VydFJlbmV3UmVxdWVzdBJLChNjZXJ0X3JlbmV3X3Jlc3BvbnNlGAkgASgLMhkuZm'
+    'FpLnYxLkNlcnRSZW5ld1Jlc3BvbnNlSABSEWNlcnRSZW5ld1Jlc3BvbnNlEjsKDWRpc3BhdGNo'
+    'X2NhbGwYCiABKAsyFC5mYWkudjEuRGlzcGF0Y2hDYWxsSABSDGRpc3BhdGNoQ2FsbBJBCg9kaX'
+    'NwYXRjaF9yZXN1bHQYCyABKAsyFi5mYWkudjEuRGlzcGF0Y2hSZXN1bHRIAFIOZGlzcGF0Y2hS'
+    'ZXN1bHRCBgoEa2luZA==');
+
+@$core.Deprecated('Use dispatchCallDescriptor instead')
+const DispatchCall$json = {
+  '1': 'DispatchCall',
+  '2': [
+    {'1': 'request_id', '3': 1, '4': 1, '5': 9, '10': 'requestId'},
+    {
+      '1': 'request',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.DispatchRequest',
+      '10': 'request'
+    },
+  ],
+};
+
+/// Descriptor for `DispatchCall`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List dispatchCallDescriptor = $convert.base64Decode(
+    'CgxEaXNwYXRjaENhbGwSHQoKcmVxdWVzdF9pZBgBIAEoCVIJcmVxdWVzdElkEjEKB3JlcXVlc3'
+    'QYAiABKAsyFy5mYWkudjEuRGlzcGF0Y2hSZXF1ZXN0UgdyZXF1ZXN0');
+
+@$core.Deprecated('Use dispatchResultDescriptor instead')
+const DispatchResult$json = {
+  '1': 'DispatchResult',
+  '2': [
+    {'1': 'request_id', '3': 1, '4': 1, '5': 9, '10': 'requestId'},
+    {
+      '1': 'response',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.DispatchResponse',
+      '10': 'response'
+    },
+  ],
+};
+
+/// Descriptor for `DispatchResult`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List dispatchResultDescriptor = $convert.base64Decode(
+    'Cg5EaXNwYXRjaFJlc3VsdBIdCgpyZXF1ZXN0X2lkGAEgASgJUglyZXF1ZXN0SWQSNAoIcmVzcG'
+    '9uc2UYAiABKAsyGC5mYWkudjEuRGlzcGF0Y2hSZXNwb25zZVIIcmVzcG9uc2U=');
+
+@$core.Deprecated('Use helloMessageDescriptor instead')
+const HelloMessage$json = {
+  '1': 'HelloMessage',
+  '2': [
+    {'1': 'hub_id', '3': 1, '4': 1, '5': 9, '10': 'hubId'},
+    {'1': 'display_name', '3': 2, '4': 1, '5': 9, '10': 'displayName'},
+    {'1': 'hub_version', '3': 3, '4': 1, '5': 9, '10': 'hubVersion'},
+    {
+      '1': 'wire_versions_supported',
+      '3': 4,
+      '4': 3,
+      '5': 13,
+      '10': 'wireVersionsSupported'
+    },
+    {
+      '1': 'wit_versions_supported',
+      '3': 5,
+      '4': 3,
+      '5': 9,
+      '10': 'witVersionsSupported'
+    },
+    {'1': 'bootstrap_token', '3': 6, '4': 1, '5': 9, '10': 'bootstrapToken'},
+    {'1': 'region', '3': 7, '4': 1, '5': 9, '10': 'region'},
+    {'1': 'csr_pem', '3': 8, '4': 1, '5': 9, '10': 'csrPem'},
+  ],
+};
+
+/// Descriptor for `HelloMessage`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List helloMessageDescriptor = $convert.base64Decode(
+    'CgxIZWxsb01lc3NhZ2USFQoGaHViX2lkGAEgASgJUgVodWJJZBIhCgxkaXNwbGF5X25hbWUYAi'
+    'ABKAlSC2Rpc3BsYXlOYW1lEh8KC2h1Yl92ZXJzaW9uGAMgASgJUgpodWJWZXJzaW9uEjYKF3dp'
+    'cmVfdmVyc2lvbnNfc3VwcG9ydGVkGAQgAygNUhV3aXJlVmVyc2lvbnNTdXBwb3J0ZWQSNAoWd2'
+    'l0X3ZlcnNpb25zX3N1cHBvcnRlZBgFIAMoCVIUd2l0VmVyc2lvbnNTdXBwb3J0ZWQSJwoPYm9v'
+    'dHN0cmFwX3Rva2VuGAYgASgJUg5ib290c3RyYXBUb2tlbhIWCgZyZWdpb24YByABKAlSBnJlZ2'
+    'lvbhIXCgdjc3JfcGVtGAggASgJUgZjc3JQZW0=');
+
+@$core.Deprecated('Use acceptMessageDescriptor instead')
+const AcceptMessage$json = {
+  '1': 'AcceptMessage',
+  '2': [
+    {
+      '1': 'wire_version_chosen',
+      '3': 1,
+      '4': 1,
+      '5': 13,
+      '10': 'wireVersionChosen'
+    },
+    {'1': 'primary_hub_id', '3': 2, '4': 1, '5': 9, '10': 'primaryHubId'},
+    {
+      '1': 'primary_display_name',
+      '3': 3,
+      '4': 1,
+      '5': 9,
+      '10': 'primaryDisplayName'
+    },
+    {
+      '1': 'primary_hub_version',
+      '3': 4,
+      '4': 1,
+      '5': 9,
+      '10': 'primaryHubVersion'
+    },
+    {
+      '1': 'primary_wire_versions_supported',
+      '3': 5,
+      '4': 3,
+      '5': 13,
+      '10': 'primaryWireVersionsSupported'
+    },
+    {'1': 'issued_cert_pem', '3': 6, '4': 1, '5': 9, '10': 'issuedCertPem'},
+    {'1': 'cert_expires_at', '3': 7, '4': 1, '5': 9, '10': 'certExpiresAt'},
+  ],
+};
+
+/// Descriptor for `AcceptMessage`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List acceptMessageDescriptor = $convert.base64Decode(
+    'Cg1BY2NlcHRNZXNzYWdlEi4KE3dpcmVfdmVyc2lvbl9jaG9zZW4YASABKA1SEXdpcmVWZXJzaW'
+    '9uQ2hvc2VuEiQKDnByaW1hcnlfaHViX2lkGAIgASgJUgxwcmltYXJ5SHViSWQSMAoUcHJpbWFy'
+    'eV9kaXNwbGF5X25hbWUYAyABKAlSEnByaW1hcnlEaXNwbGF5TmFtZRIuChNwcmltYXJ5X2h1Yl'
+    '92ZXJzaW9uGAQgASgJUhFwcmltYXJ5SHViVmVyc2lvbhJFCh9wcmltYXJ5X3dpcmVfdmVyc2lv'
+    'bnNfc3VwcG9ydGVkGAUgAygNUhxwcmltYXJ5V2lyZVZlcnNpb25zU3VwcG9ydGVkEiYKD2lzc3'
+    'VlZF9jZXJ0X3BlbRgGIAEoCVINaXNzdWVkQ2VydFBlbRImCg9jZXJ0X2V4cGlyZXNfYXQYByAB'
+    'KAlSDWNlcnRFeHBpcmVzQXQ=');
+
+@$core.Deprecated('Use advertiseMessageDescriptor instead')
+const AdvertiseMessage$json = {
+  '1': 'AdvertiseMessage',
+  '2': [
+    {
+      '1': 'capabilities',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.fai.v1.CapabilityAdvertisement',
+      '10': 'capabilities'
+    },
+  ],
+};
+
+/// Descriptor for `AdvertiseMessage`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List advertiseMessageDescriptor = $convert.base64Decode(
+    'ChBBZHZlcnRpc2VNZXNzYWdlEkMKDGNhcGFiaWxpdGllcxgBIAMoCzIfLmZhaS52MS5DYXBhYm'
+    'lsaXR5QWR2ZXJ0aXNlbWVudFIMY2FwYWJpbGl0aWVz');
+
+@$core.Deprecated('Use capabilityAdvertisementDescriptor instead')
+const CapabilityAdvertisement$json = {
+  '1': 'CapabilityAdvertisement',
+  '2': [
+    {'1': 'capability_id', '3': 1, '4': 1, '5': 9, '10': 'capabilityId'},
+    {'1': 'origin_uuid', '3': 2, '4': 1, '5': 9, '10': 'originUuid'},
+    {'1': 'origin_name', '3': 3, '4': 1, '5': 9, '10': 'originName'},
+    {'1': 'route', '3': 4, '4': 3, '5': 9, '10': 'route'},
+    {'1': 'region', '3': 5, '4': 1, '5': 9, '10': 'region'},
+    {
+      '1': 'quality',
+      '3': 6,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.Quality',
+      '10': 'quality'
+    },
+    {'1': 'permissions', '3': 7, '4': 3, '5': 9, '10': 'permissions'},
+    {'1': 'wit_version', '3': 8, '4': 1, '5': 9, '10': 'witVersion'},
+    {'1': 'hub_version', '3': 9, '4': 1, '5': 9, '10': 'hubVersion'},
+  ],
+};
+
+/// Descriptor for `CapabilityAdvertisement`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List capabilityAdvertisementDescriptor = $convert.base64Decode(
+    'ChdDYXBhYmlsaXR5QWR2ZXJ0aXNlbWVudBIjCg1jYXBhYmlsaXR5X2lkGAEgASgJUgxjYXBhYm'
+    'lsaXR5SWQSHwoLb3JpZ2luX3V1aWQYAiABKAlSCm9yaWdpblV1aWQSHwoLb3JpZ2luX25hbWUY'
+    'AyABKAlSCm9yaWdpbk5hbWUSFAoFcm91dGUYBCADKAlSBXJvdXRlEhYKBnJlZ2lvbhgFIAEoCV'
+    'IGcmVnaW9uEikKB3F1YWxpdHkYBiABKAsyDy5mYWkudjEuUXVhbGl0eVIHcXVhbGl0eRIgCgtw'
+    'ZXJtaXNzaW9ucxgHIAMoCVILcGVybWlzc2lvbnMSHwoLd2l0X3ZlcnNpb24YCCABKAlSCndpdF'
+    'ZlcnNpb24SHwoLaHViX3ZlcnNpb24YCSABKAlSCmh1YlZlcnNpb24=');
+
+@$core.Deprecated('Use qualityDescriptor instead')
+const Quality$json = {
+  '1': 'Quality',
+  '2': [
+    {'1': 'rtt_p50_ms', '3': 1, '4': 1, '5': 13, '10': 'rttP50Ms'},
+    {'1': 'rtt_p95_ms', '3': 2, '4': 1, '5': 13, '10': 'rttP95Ms'},
+    {'1': 'success_rate_30m', '3': 3, '4': 1, '5': 2, '10': 'successRate30m'},
+    {'1': 'streams_active', '3': 4, '4': 1, '5': 13, '10': 'streamsActive'},
+    {'1': 'streams_capacity', '3': 5, '4': 1, '5': 13, '10': 'streamsCapacity'},
+  ],
+};
+
+/// Descriptor for `Quality`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List qualityDescriptor = $convert.base64Decode(
+    'CgdRdWFsaXR5EhwKCnJ0dF9wNTBfbXMYASABKA1SCHJ0dFA1ME1zEhwKCnJ0dF9wOTVfbXMYAi'
+    'ABKA1SCHJ0dFA5NU1zEigKEHN1Y2Nlc3NfcmF0ZV8zMG0YAyABKAJSDnN1Y2Nlc3NSYXRlMzBt'
+    'EiUKDnN0cmVhbXNfYWN0aXZlGAQgASgNUg1zdHJlYW1zQWN0aXZlEikKEHN0cmVhbXNfY2FwYW'
+    'NpdHkYBSABKA1SD3N0cmVhbXNDYXBhY2l0eQ==');
+
+@$core.Deprecated('Use withdrawMessageDescriptor instead')
+const WithdrawMessage$json = {
+  '1': 'WithdrawMessage',
+  '2': [
+    {'1': 'capability_ids', '3': 1, '4': 3, '5': 9, '10': 'capabilityIds'},
+    {'1': 'origin_uuid', '3': 2, '4': 1, '5': 9, '10': 'originUuid'},
+  ],
+};
+
+/// Descriptor for `WithdrawMessage`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List withdrawMessageDescriptor = $convert.base64Decode(
+    'Cg9XaXRoZHJhd01lc3NhZ2USJQoOY2FwYWJpbGl0eV9pZHMYASADKAlSDWNhcGFiaWxpdHlJZH'
+    'MSHwoLb3JpZ2luX3V1aWQYAiABKAlSCm9yaWdpblV1aWQ=');
+
+@$core.Deprecated('Use heartbeatMessageDescriptor instead')
+const HeartbeatMessage$json = {
+  '1': 'HeartbeatMessage',
+  '2': [
+    {'1': 'nonce', '3': 1, '4': 1, '5': 4, '10': 'nonce'},
+    {'1': 'satellite_time_ms', '3': 2, '4': 1, '5': 3, '10': 'satelliteTimeMs'},
+  ],
+};
+
+/// Descriptor for `HeartbeatMessage`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List heartbeatMessageDescriptor = $convert.base64Decode(
+    'ChBIZWFydGJlYXRNZXNzYWdlEhQKBW5vbmNlGAEgASgEUgVub25jZRIqChFzYXRlbGxpdGVfdG'
+    'ltZV9tcxgCIAEoA1IPc2F0ZWxsaXRlVGltZU1z');
+
+@$core.Deprecated('Use heartbeatAckDescriptor instead')
+const HeartbeatAck$json = {
+  '1': 'HeartbeatAck',
+  '2': [
+    {'1': 'nonce', '3': 1, '4': 1, '5': 4, '10': 'nonce'},
+    {'1': 'primary_time_ms', '3': 2, '4': 1, '5': 3, '10': 'primaryTimeMs'},
+  ],
+};
+
+/// Descriptor for `HeartbeatAck`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List heartbeatAckDescriptor = $convert.base64Decode(
+    'CgxIZWFydGJlYXRBY2sSFAoFbm9uY2UYASABKARSBW5vbmNlEiYKD3ByaW1hcnlfdGltZV9tcx'
+    'gCIAEoA1INcHJpbWFyeVRpbWVNcw==');
+
+@$core.Deprecated('Use renameMessageDescriptor instead')
+const RenameMessage$json = {
+  '1': 'RenameMessage',
+  '2': [
+    {'1': 'new_display_name', '3': 1, '4': 1, '5': 9, '10': 'newDisplayName'},
+  ],
+};
+
+/// Descriptor for `RenameMessage`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List renameMessageDescriptor = $convert.base64Decode(
+    'Cg1SZW5hbWVNZXNzYWdlEigKEG5ld19kaXNwbGF5X25hbWUYASABKAlSDm5ld0Rpc3BsYXlOYW'
+    '1l');
+
+@$core.Deprecated('Use certRenewRequestDescriptor instead')
+const CertRenewRequest$json = {
+  '1': 'CertRenewRequest',
+  '2': [
+    {'1': 'csr_pem', '3': 1, '4': 1, '5': 9, '10': 'csrPem'},
+  ],
+};
+
+/// Descriptor for `CertRenewRequest`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List certRenewRequestDescriptor = $convert.base64Decode(
+    'ChBDZXJ0UmVuZXdSZXF1ZXN0EhcKB2Nzcl9wZW0YASABKAlSBmNzclBlbQ==');
+
+@$core.Deprecated('Use certRenewResponseDescriptor instead')
+const CertRenewResponse$json = {
+  '1': 'CertRenewResponse',
+  '2': [
+    {'1': 'cert_pem', '3': 1, '4': 1, '5': 9, '10': 'certPem'},
+    {'1': 'expires_at', '3': 2, '4': 1, '5': 9, '10': 'expiresAt'},
+    {'1': 'error', '3': 3, '4': 1, '5': 9, '10': 'error'},
+  ],
+};
+
+/// Descriptor for `CertRenewResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List certRenewResponseDescriptor = $convert.base64Decode(
+    'ChFDZXJ0UmVuZXdSZXNwb25zZRIZCghjZXJ0X3BlbRgBIAEoCVIHY2VydFBlbRIdCgpleHBpcm'
+    'VzX2F0GAIgASgJUglleHBpcmVzQXQSFAoFZXJyb3IYAyABKAlSBWVycm9y');
+
+@$core.Deprecated('Use dispatchRequestDescriptor instead')
+const DispatchRequest$json = {
+  '1': 'DispatchRequest',
+  '2': [
+    {'1': 'capability_id', '3': 1, '4': 1, '5': 9, '10': 'capabilityId'},
+    {'1': 'target_hub_id', '3': 2, '4': 1, '5': 9, '10': 'targetHubId'},
+    {
+      '1': 'inputs',
+      '3': 3,
+      '4': 3,
+      '5': 11,
+      '6': '.fai.v1.DispatchRequest.InputsEntry',
+      '10': 'inputs'
+    },
+    {'1': 'trace_id', '3': 4, '4': 1, '5': 9, '10': 'traceId'},
+    {'1': 'nonce', '3': 5, '4': 1, '5': 9, '10': 'nonce'},
+    {'1': 'caller_name', '3': 6, '4': 1, '5': 9, '10': 'callerName'},
+    {'1': 'region_required', '3': 7, '4': 1, '5': 9, '10': 'regionRequired'},
+  ],
+  '3': [DispatchRequest_InputsEntry$json],
+};
+
+@$core.Deprecated('Use dispatchRequestDescriptor instead')
+const DispatchRequest_InputsEntry$json = {
+  '1': 'InputsEntry',
+  '2': [
+    {'1': 'key', '3': 1, '4': 1, '5': 9, '10': 'key'},
+    {
+      '1': 'value',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.Payload',
+      '10': 'value'
+    },
+  ],
+  '7': {'7': true},
+};
+
+/// Descriptor for `DispatchRequest`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List dispatchRequestDescriptor = $convert.base64Decode(
+    'Cg9EaXNwYXRjaFJlcXVlc3QSIwoNY2FwYWJpbGl0eV9pZBgBIAEoCVIMY2FwYWJpbGl0eUlkEi'
+    'IKDXRhcmdldF9odWJfaWQYAiABKAlSC3RhcmdldEh1YklkEjsKBmlucHV0cxgDIAMoCzIjLmZh'
+    'aS52MS5EaXNwYXRjaFJlcXVlc3QuSW5wdXRzRW50cnlSBmlucHV0cxIZCgh0cmFjZV9pZBgEIA'
+    'EoCVIHdHJhY2VJZBIUCgVub25jZRgFIAEoCVIFbm9uY2USHwoLY2FsbGVyX25hbWUYBiABKAlS'
+    'CmNhbGxlck5hbWUSJwoPcmVnaW9uX3JlcXVpcmVkGAcgASgJUg5yZWdpb25SZXF1aXJlZBpKCg'
+    'tJbnB1dHNFbnRyeRIQCgNrZXkYASABKAlSA2tleRIlCgV2YWx1ZRgCIAEoCzIPLmZhaS52MS5Q'
+    'YXlsb2FkUgV2YWx1ZToCOAE=');
+
+@$core.Deprecated('Use dispatchResponseDescriptor instead')
+const DispatchResponse$json = {
+  '1': 'DispatchResponse',
+  '2': [
+    {
+      '1': 'outputs',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.fai.v1.DispatchResponse.OutputsEntry',
+      '10': 'outputs'
+    },
+    {
+      '1': 'error',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.FaiError',
+      '10': 'error'
+    },
+    {'1': 'duration_ms', '3': 3, '4': 1, '5': 13, '10': 'durationMs'},
+    {
+      '1': 'executed_at_hub_id',
+      '3': 4,
+      '4': 1,
+      '5': 9,
+      '10': 'executedAtHubId'
+    },
+  ],
+  '3': [DispatchResponse_OutputsEntry$json],
+};
+
+@$core.Deprecated('Use dispatchResponseDescriptor instead')
+const DispatchResponse_OutputsEntry$json = {
+  '1': 'OutputsEntry',
+  '2': [
+    {'1': 'key', '3': 1, '4': 1, '5': 9, '10': 'key'},
+    {
+      '1': 'value',
+      '3': 2,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.Payload',
+      '10': 'value'
+    },
+  ],
+  '7': {'7': true},
+};
+
+/// Descriptor for `DispatchResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List dispatchResponseDescriptor = $convert.base64Decode(
+    'ChBEaXNwYXRjaFJlc3BvbnNlEj8KB291dHB1dHMYASADKAsyJS5mYWkudjEuRGlzcGF0Y2hSZX'
+    'Nwb25zZS5PdXRwdXRzRW50cnlSB291dHB1dHMSJgoFZXJyb3IYAiABKAsyEC5mYWkudjEuRmFp'
+    'RXJyb3JSBWVycm9yEh8KC2R1cmF0aW9uX21zGAMgASgNUgpkdXJhdGlvbk1zEisKEmV4ZWN1dG'
+    'VkX2F0X2h1Yl9pZBgEIAEoCVIPZXhlY3V0ZWRBdEh1YklkGksKDE91dHB1dHNFbnRyeRIQCgNr'
+    'ZXkYASABKAlSA2tleRIlCgV2YWx1ZRgCIAEoCzIPLmZhaS52MS5QYXlsb2FkUgV2YWx1ZToCOA'
+    'E=');
+
+@$core.Deprecated('Use blobChunkDescriptor instead')
+const BlobChunk$json = {
+  '1': 'BlobChunk',
+  '2': [
+    {
+      '1': 'open',
+      '3': 1,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.BlobOpen',
+      '9': 0,
+      '10': 'open'
+    },
+    {'1': 'data', '3': 2, '4': 1, '5': 12, '9': 0, '10': 'data'},
+    {
+      '1': 'eof',
+      '3': 3,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.BlobEof',
+      '9': 0,
+      '10': 'eof'
+    },
+    {
+      '1': 'error',
+      '3': 4,
+      '4': 1,
+      '5': 11,
+      '6': '.fai.v1.BlobError',
+      '9': 0,
+      '10': 'error'
+    },
+  ],
+  '8': [
+    {'1': 'kind'},
+  ],
+};
+
+/// Descriptor for `BlobChunk`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List blobChunkDescriptor = $convert.base64Decode(
+    'CglCbG9iQ2h1bmsSJgoEb3BlbhgBIAEoCzIQLmZhaS52MS5CbG9iT3BlbkgAUgRvcGVuEhQKBG'
+    'RhdGEYAiABKAxIAFIEZGF0YRIjCgNlb2YYAyABKAsyDy5mYWkudjEuQmxvYkVvZkgAUgNlb2YS'
+    'KQoFZXJyb3IYBCABKAsyES5mYWkudjEuQmxvYkVycm9ySABSBWVycm9yQgYKBGtpbmQ=');
+
+@$core.Deprecated('Use blobOpenDescriptor instead')
+const BlobOpen$json = {
+  '1': 'BlobOpen',
+  '2': [
+    {'1': 'operation', '3': 1, '4': 1, '5': 9, '10': 'operation'},
+    {'1': 'sha256', '3': 2, '4': 1, '5': 9, '10': 'sha256'},
+    {'1': 'size_bytes', '3': 3, '4': 1, '5': 4, '10': 'sizeBytes'},
+    {'1': 'mime_type', '3': 4, '4': 1, '5': 9, '10': 'mimeType'},
+    {'1': 'signed_ref', '3': 5, '4': 1, '5': 9, '10': 'signedRef'},
+  ],
+};
+
+/// Descriptor for `BlobOpen`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List blobOpenDescriptor = $convert.base64Decode(
+    'CghCbG9iT3BlbhIcCglvcGVyYXRpb24YASABKAlSCW9wZXJhdGlvbhIWCgZzaGEyNTYYAiABKA'
+    'lSBnNoYTI1NhIdCgpzaXplX2J5dGVzGAMgASgEUglzaXplQnl0ZXMSGwoJbWltZV90eXBlGAQg'
+    'ASgJUghtaW1lVHlwZRIdCgpzaWduZWRfcmVmGAUgASgJUglzaWduZWRSZWY=');
+
+@$core.Deprecated('Use blobEofDescriptor instead')
+const BlobEof$json = {
+  '1': 'BlobEof',
+  '2': [
+    {'1': 'sha256', '3': 1, '4': 1, '5': 9, '10': 'sha256'},
+    {'1': 'size_bytes', '3': 2, '4': 1, '5': 4, '10': 'sizeBytes'},
+  ],
+};
+
+/// Descriptor for `BlobEof`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List blobEofDescriptor = $convert.base64Decode(
+    'CgdCbG9iRW9mEhYKBnNoYTI1NhgBIAEoCVIGc2hhMjU2Eh0KCnNpemVfYnl0ZXMYAiABKARSCX'
+    'NpemVCeXRlcw==');
+
+@$core.Deprecated('Use blobErrorDescriptor instead')
+const BlobError$json = {
+  '1': 'BlobError',
+  '2': [
+    {'1': 'code', '3': 1, '4': 1, '5': 9, '10': 'code'},
+    {'1': 'message', '3': 2, '4': 1, '5': 9, '10': 'message'},
+  ],
+};
+
+/// Descriptor for `BlobError`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List blobErrorDescriptor = $convert.base64Decode(
+    'CglCbG9iRXJyb3ISEgoEY29kZRgBIAEoCVIEY29kZRIYCgdtZXNzYWdlGAIgASgJUgdtZXNzYW'
+    'dl');
+
+@$core.Deprecated('Use eventsRequestDescriptor instead')
+const EventsRequest$json = {
+  '1': 'EventsRequest',
+  '2': [
+    {'1': 'filter_hub_id', '3': 1, '4': 1, '5': 9, '10': 'filterHubId'},
+    {'1': 'event_types', '3': 2, '4': 3, '5': 9, '10': 'eventTypes'},
+    {'1': 'backfill', '3': 3, '4': 1, '5': 13, '10': 'backfill'},
+  ],
+};
+
+/// Descriptor for `EventsRequest`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List eventsRequestDescriptor = $convert.base64Decode(
+    'Cg1FdmVudHNSZXF1ZXN0EiIKDWZpbHRlcl9odWJfaWQYASABKAlSC2ZpbHRlckh1YklkEh8KC2'
+    'V2ZW50X3R5cGVzGAIgAygJUgpldmVudFR5cGVzEhoKCGJhY2tmaWxsGAMgASgNUghiYWNrZmls'
+    'bA==');
+
+@$core.Deprecated('Use relayedEventDescriptor instead')
+const RelayedEvent$json = {
+  '1': 'RelayedEvent',
+  '2': [
+    {'1': 'origin_hub_id', '3': 1, '4': 1, '5': 9, '10': 'originHubId'},
+    {
+      '1': 'origin_display_name',
+      '3': 2,
+      '4': 1,
+      '5': 9,
+      '10': 'originDisplayName'
+    },
+    {'1': 'event_id', '3': 3, '4': 1, '5': 9, '10': 'eventId'},
+    {'1': 'timestamp', '3': 4, '4': 1, '5': 9, '10': 'timestamp'},
+    {'1': 'event_type', '3': 5, '4': 1, '5': 9, '10': 'eventType'},
+    {'1': 'flow_execution', '3': 6, '4': 1, '5': 9, '10': 'flowExecution'},
+    {'1': 'invocation_id', '3': 7, '4': 1, '5': 9, '10': 'invocationId'},
+    {'1': 'flow_name', '3': 8, '4': 1, '5': 9, '10': 'flowName'},
+    {'1': 'step_id', '3': 9, '4': 1, '5': 9, '10': 'stepId'},
+    {'1': 'module_name', '3': 10, '4': 1, '5': 9, '10': 'moduleName'},
+    {'1': 'module_version', '3': 11, '4': 1, '5': 9, '10': 'moduleVersion'},
+    {'1': 'duration_ms', '3': 12, '4': 1, '5': 3, '10': 'durationMs'},
+    {'1': 'error', '3': 13, '4': 1, '5': 9, '10': 'error'},
+    {'1': 'detail', '3': 14, '4': 1, '5': 9, '10': 'detail'},
+    {'1': 'caller_name', '3': 15, '4': 1, '5': 9, '10': 'callerName'},
+  ],
+};
+
+/// Descriptor for `RelayedEvent`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List relayedEventDescriptor = $convert.base64Decode(
+    'CgxSZWxheWVkRXZlbnQSIgoNb3JpZ2luX2h1Yl9pZBgBIAEoCVILb3JpZ2luSHViSWQSLgoTb3'
+    'JpZ2luX2Rpc3BsYXlfbmFtZRgCIAEoCVIRb3JpZ2luRGlzcGxheU5hbWUSGQoIZXZlbnRfaWQY'
+    'AyABKAlSB2V2ZW50SWQSHAoJdGltZXN0YW1wGAQgASgJUgl0aW1lc3RhbXASHQoKZXZlbnRfdH'
+    'lwZRgFIAEoCVIJZXZlbnRUeXBlEiUKDmZsb3dfZXhlY3V0aW9uGAYgASgJUg1mbG93RXhlY3V0'
+    'aW9uEiMKDWludm9jYXRpb25faWQYByABKAlSDGludm9jYXRpb25JZBIbCglmbG93X25hbWUYCC'
+    'ABKAlSCGZsb3dOYW1lEhcKB3N0ZXBfaWQYCSABKAlSBnN0ZXBJZBIfCgttb2R1bGVfbmFtZRgK'
+    'IAEoCVIKbW9kdWxlTmFtZRIlCg5tb2R1bGVfdmVyc2lvbhgLIAEoCVINbW9kdWxlVmVyc2lvbh'
+    'IfCgtkdXJhdGlvbl9tcxgMIAEoA1IKZHVyYXRpb25NcxIUCgVlcnJvchgNIAEoCVIFZXJyb3IS'
+    'FgoGZGV0YWlsGA4gASgJUgZkZXRhaWwSHwoLY2FsbGVyX25hbWUYDyABKAlSCmNhbGxlck5hbW'
+    'U=');
--- a/lib/src/generated/fai/v1/hub.pb.dart
+++ b/lib/src/generated/fai/v1/hub.pb.dart
@ -6838,6 +6838,343 @@ class RemoveN8nEndpointRequest extends $pb.GeneratedMessage {
  void clearName() => $_clearField(1);
 }

+class IssueBootstrapTokenRequest extends $pb.GeneratedMessage {
+  factory IssueBootstrapTokenRequest({
+    $core.String? satelliteName,
+    $core.String? region,
+    $fixnum.Int64? ttlSeconds,
+  }) {
+    final result = create();
+    if (satelliteName != null) result.satelliteName = satelliteName;
+    if (region != null) result.region = region;
+    if (ttlSeconds != null) result.ttlSeconds = ttlSeconds;
+    return result;
+  }
+
+  IssueBootstrapTokenRequest._();
+
+  factory IssueBootstrapTokenRequest.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory IssueBootstrapTokenRequest.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'IssueBootstrapTokenRequest',
+      package: const $pb.PackageName(_omitMessageNames ? '' : 'fai.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'satelliteName')
+    ..aOS(2, _omitFieldNames ? '' : 'region')
+    ..a<$fixnum.Int64>(
+        3, _omitFieldNames ? '' : 'ttlSeconds', $pb.PbFieldType.OU6,
+        defaultOrMaker: $fixnum.Int64.ZERO)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IssueBootstrapTokenRequest clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IssueBootstrapTokenRequest copyWith(
+          void Function(IssueBootstrapTokenRequest) updates) =>
+      super.copyWith(
+              (message) => updates(message as IssueBootstrapTokenRequest))
+          as IssueBootstrapTokenRequest;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static IssueBootstrapTokenRequest create() => IssueBootstrapTokenRequest._();
+  @$core.override
+  IssueBootstrapTokenRequest createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static IssueBootstrapTokenRequest getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<IssueBootstrapTokenRequest>(create);
+  static IssueBootstrapTokenRequest? _defaultInstance;
+
+  /// Operator-friendly satellite display name the token enrols.
+  @$pb.TagNumber(1)
+  $core.String get satelliteName => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set satelliteName($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasSatelliteName() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearSatelliteName() => $_clearField(1);
+
+  /// Optional region tag signed into the issued cert at enrollment.
+  @$pb.TagNumber(2)
+  $core.String get region => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set region($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasRegion() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearRegion() => $_clearField(2);
+
+  /// Token lifetime in seconds; 0 defaults to 24h server-side.
+  @$pb.TagNumber(3)
+  $fixnum.Int64 get ttlSeconds => $_getI64(2);
+  @$pb.TagNumber(3)
+  set ttlSeconds($fixnum.Int64 value) => $_setInt64(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasTtlSeconds() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearTtlSeconds() => $_clearField(3);
+}
+
+class IssueBootstrapTokenResponse extends $pb.GeneratedMessage {
+  factory IssueBootstrapTokenResponse({
+    $core.String? token,
+    $core.String? expiresAt,
+    $core.String? primaryCaPem,
+  }) {
+    final result = create();
+    if (token != null) result.token = token;
+    if (expiresAt != null) result.expiresAt = expiresAt;
+    if (primaryCaPem != null) result.primaryCaPem = primaryCaPem;
+    return result;
+  }
+
+  IssueBootstrapTokenResponse._();
+
+  factory IssueBootstrapTokenResponse.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory IssueBootstrapTokenResponse.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'IssueBootstrapTokenResponse',
+      package: const $pb.PackageName(_omitMessageNames ? '' : 'fai.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'token')
+    ..aOS(2, _omitFieldNames ? '' : 'expiresAt')
+    ..aOS(3, _omitFieldNames ? '' : 'primaryCaPem')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IssueBootstrapTokenResponse clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  IssueBootstrapTokenResponse copyWith(
+          void Function(IssueBootstrapTokenResponse) updates) =>
+      super.copyWith(
+              (message) => updates(message as IssueBootstrapTokenResponse))
+          as IssueBootstrapTokenResponse;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static IssueBootstrapTokenResponse create() =>
+      IssueBootstrapTokenResponse._();
+  @$core.override
+  IssueBootstrapTokenResponse createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static IssueBootstrapTokenResponse getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<IssueBootstrapTokenResponse>(create);
+  static IssueBootstrapTokenResponse? _defaultInstance;
+
+  /// The single-use token. Shown once; hand it to the satellite
+  /// operator over a secure channel.
+  @$pb.TagNumber(1)
+  $core.String get token => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set token($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasToken() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearToken() => $_clearField(1);
+
+  /// ISO-8601 expiry of the token.
+  @$pb.TagNumber(2)
+  $core.String get expiresAt => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set expiresAt($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasExpiresAt() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearExpiresAt() => $_clearField(2);
+
+  /// The primary's CA certificate PEM. The operator installs this on
+  /// the satellite (`federation.primary_ca`) alongside the token so
+  /// the satellite verifies the primary on its very first connect —
+  /// closing the first-connect MITM window with no extra lookup.
+  @$pb.TagNumber(3)
+  $core.String get primaryCaPem => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set primaryCaPem($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasPrimaryCaPem() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearPrimaryCaPem() => $_clearField(3);
+}
+
+class SatelliteList extends $pb.GeneratedMessage {
+  factory SatelliteList({
+    $core.Iterable<SatelliteEntry>? satellites,
+  }) {
+    final result = create();
+    if (satellites != null) result.satellites.addAll(satellites);
+    return result;
+  }
+
+  SatelliteList._();
+
+  factory SatelliteList.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory SatelliteList.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'SatelliteList',
+      package: const $pb.PackageName(_omitMessageNames ? '' : 'fai.v1'),
+      createEmptyInstance: create)
+    ..pPM<SatelliteEntry>(1, _omitFieldNames ? '' : 'satellites',
+        subBuilder: SatelliteEntry.create)
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  SatelliteList clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  SatelliteList copyWith(void Function(SatelliteList) updates) =>
+      super.copyWith((message) => updates(message as SatelliteList))
+          as SatelliteList;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static SatelliteList create() => SatelliteList._();
+  @$core.override
+  SatelliteList createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static SatelliteList getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<SatelliteList>(create);
+  static SatelliteList? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $pb.PbList<SatelliteEntry> get satellites => $_getList(0);
+}
+
+class SatelliteEntry extends $pb.GeneratedMessage {
+  factory SatelliteEntry({
+    $core.String? hubId,
+    $core.String? displayName,
+    $core.String? hubVersion,
+    $core.int? wireVersion,
+    $core.String? region,
+    $core.Iterable<$core.String>? capabilities,
+  }) {
+    final result = create();
+    if (hubId != null) result.hubId = hubId;
+    if (displayName != null) result.displayName = displayName;
+    if (hubVersion != null) result.hubVersion = hubVersion;
+    if (wireVersion != null) result.wireVersion = wireVersion;
+    if (region != null) result.region = region;
+    if (capabilities != null) result.capabilities.addAll(capabilities);
+    return result;
+  }
+
+  SatelliteEntry._();
+
+  factory SatelliteEntry.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory SatelliteEntry.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'SatelliteEntry',
+      package: const $pb.PackageName(_omitMessageNames ? '' : 'fai.v1'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'hubId')
+    ..aOS(2, _omitFieldNames ? '' : 'displayName')
+    ..aOS(3, _omitFieldNames ? '' : 'hubVersion')
+    ..aI(4, _omitFieldNames ? '' : 'wireVersion',
+        fieldType: $pb.PbFieldType.OU3)
+    ..aOS(5, _omitFieldNames ? '' : 'region')
+    ..pPS(6, _omitFieldNames ? '' : 'capabilities')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  SatelliteEntry clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  SatelliteEntry copyWith(void Function(SatelliteEntry) updates) =>
+      super.copyWith((message) => updates(message as SatelliteEntry))
+          as SatelliteEntry;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static SatelliteEntry create() => SatelliteEntry._();
+  @$core.override
+  SatelliteEntry createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static SatelliteEntry getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<SatelliteEntry>(create);
+  static SatelliteEntry? _defaultInstance;
+
+  /// Immutable hub UUID of the satellite.
+  @$pb.TagNumber(1)
+  $core.String get hubId => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set hubId($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasHubId() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearHubId() => $_clearField(1);
+
+  /// Operator-chosen display name.
+  @$pb.TagNumber(2)
+  $core.String get displayName => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set displayName($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasDisplayName() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearDisplayName() => $_clearField(2);
+
+  /// F∆I version the satellite reported.
+  @$pb.TagNumber(3)
+  $core.String get hubVersion => $_getSZ(2);
+  @$pb.TagNumber(3)
+  set hubVersion($core.String value) => $_setString(2, value);
+  @$pb.TagNumber(3)
+  $core.bool hasHubVersion() => $_has(2);
+  @$pb.TagNumber(3)
+  void clearHubVersion() => $_clearField(3);
+
+  /// Negotiated federation wire version.
+  @$pb.TagNumber(4)
+  $core.int get wireVersion => $_getIZ(3);
+  @$pb.TagNumber(4)
+  set wireVersion($core.int value) => $_setUnsignedInt32(3, value);
+  @$pb.TagNumber(4)
+  $core.bool hasWireVersion() => $_has(3);
+  @$pb.TagNumber(4)
+  void clearWireVersion() => $_clearField(4);
+
+  /// Region tag, empty when none.
+  @$pb.TagNumber(5)
+  $core.String get region => $_getSZ(4);
+  @$pb.TagNumber(5)
+  set region($core.String value) => $_setString(4, value);
+  @$pb.TagNumber(5)
+  $core.bool hasRegion() => $_has(4);
+  @$pb.TagNumber(5)
+  void clearRegion() => $_clearField(5);
+
+  /// Capability ids the satellite currently advertises.
+  @$pb.TagNumber(6)
+  $pb.PbList<$core.String> get capabilities => $_getList(5);
+}
+
 const $core.bool _omitFieldNames =
    $core.bool.fromEnvironment('protobuf.omit_field_names');
 const $core.bool _omitMessageNames =
--- a/lib/src/generated/fai/v1/hub.pbgrpc.dart
+++ b/lib/src/generated/fai/v1/hub.pbgrpc.dart
@ -619,6 +619,24 @@ class HubAdminClient extends $grpc.Client {
        options: options);
  }

+  /// Federation (primary side). Issue a single-use bootstrap
+  /// token enrolling a named satellite (`fai admin satellites
+  /// peer-add`), and list the satellites currently connected
+  /// (`fai admin satellites list`).
+  $grpc.ResponseFuture<$0.IssueBootstrapTokenResponse> issueBootstrapToken(
+    $0.IssueBootstrapTokenRequest request, {
+    $grpc.CallOptions? options,
+  }) {
+    return $createUnaryCall(_$issueBootstrapToken, request, options: options);
+  }
+
+  $grpc.ResponseFuture<$0.SatelliteList> listSatellites(
+    $1.Empty request, {
+    $grpc.CallOptions? options,
+  }) {
+    return $createUnaryCall(_$listSatellites, request, options: options);
+  }
+
  // method descriptors

  static final _$listCapabilities =
@ -848,6 +866,16 @@ class HubAdminClient extends $grpc.Client {
          '/fai.v1.HubAdmin/ListSystemAiCuratedModels',
          ($1.Empty value) => value.writeToBuffer(),
          $0.ListSystemAiCuratedModelsResponse.fromBuffer);
+  static final _$issueBootstrapToken = $grpc.ClientMethod<
+          $0.IssueBootstrapTokenRequest, $0.IssueBootstrapTokenResponse>(
+      '/fai.v1.HubAdmin/IssueBootstrapToken',
+      ($0.IssueBootstrapTokenRequest value) => value.writeToBuffer(),
+      $0.IssueBootstrapTokenResponse.fromBuffer);
+  static final _$listSatellites =
+      $grpc.ClientMethod<$1.Empty, $0.SatelliteList>(
+          '/fai.v1.HubAdmin/ListSatellites',
+          ($1.Empty value) => value.writeToBuffer(),
+          $0.SatelliteList.fromBuffer);
 }

@$pb.GrpcServiceName('fai.v1.HubAdmin')
@ -1221,6 +1249,22 @@ abstract class HubAdminServiceBase extends $grpc.Service {
            ($core.List<$core.int> value) => $1.Empty.fromBuffer(value),
            ($0.ListSystemAiCuratedModelsResponse value) =>
                value.writeToBuffer()));
+    $addMethod($grpc.ServiceMethod<$0.IssueBootstrapTokenRequest,
+            $0.IssueBootstrapTokenResponse>(
+        'IssueBootstrapToken',
+        issueBootstrapToken_Pre,
+        false,
+        false,
+        ($core.List<$core.int> value) =>
+            $0.IssueBootstrapTokenRequest.fromBuffer(value),
+        ($0.IssueBootstrapTokenResponse value) => value.writeToBuffer()));
+    $addMethod($grpc.ServiceMethod<$1.Empty, $0.SatelliteList>(
+        'ListSatellites',
+        listSatellites_Pre,
+        false,
+        false,
+        ($core.List<$core.int> value) => $1.Empty.fromBuffer(value),
+        ($0.SatelliteList value) => value.writeToBuffer()));
  }

  $async.Future<$0.CapabilityList> listCapabilities_Pre(
@ -1609,4 +1653,21 @@ abstract class HubAdminServiceBase extends $grpc.Service {

  $async.Future<$0.ListSystemAiCuratedModelsResponse> listSystemAiCuratedModels(
      $grpc.ServiceCall call, $1.Empty request);
+
+  $async.Future<$0.IssueBootstrapTokenResponse> issueBootstrapToken_Pre(
+      $grpc.ServiceCall $call,
+      $async.Future<$0.IssueBootstrapTokenRequest> $request) async {
+    return issueBootstrapToken($call, await $request);
+  }
+
+  $async.Future<$0.IssueBootstrapTokenResponse> issueBootstrapToken(
+      $grpc.ServiceCall call, $0.IssueBootstrapTokenRequest request);
+
+  $async.Future<$0.SatelliteList> listSatellites_Pre(
+      $grpc.ServiceCall $call, $async.Future<$1.Empty> $request) async {
+    return listSatellites($call, await $request);
+  }
+
+  $async.Future<$0.SatelliteList> listSatellites(
+      $grpc.ServiceCall call, $1.Empty request);
 }
--- a/lib/src/generated/fai/v1/hub.pbjson.dart
+++ b/lib/src/generated/fai/v1/hub.pbjson.dart
@ -1632,3 +1632,77 @@ const RemoveN8nEndpointRequest$json = {
 final $typed_data.Uint8List removeN8nEndpointRequestDescriptor =
    $convert.base64Decode(
        'ChhSZW1vdmVOOG5FbmRwb2ludFJlcXVlc3QSEgoEbmFtZRgBIAEoCVIEbmFtZQ==');
+
+@$core.Deprecated('Use issueBootstrapTokenRequestDescriptor instead')
+const IssueBootstrapTokenRequest$json = {
+  '1': 'IssueBootstrapTokenRequest',
+  '2': [
+    {'1': 'satellite_name', '3': 1, '4': 1, '5': 9, '10': 'satelliteName'},
+    {'1': 'region', '3': 2, '4': 1, '5': 9, '10': 'region'},
+    {'1': 'ttl_seconds', '3': 3, '4': 1, '5': 4, '10': 'ttlSeconds'},
+  ],
+};
+
+/// Descriptor for `IssueBootstrapTokenRequest`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List issueBootstrapTokenRequestDescriptor =
+    $convert.base64Decode(
+        'ChpJc3N1ZUJvb3RzdHJhcFRva2VuUmVxdWVzdBIlCg5zYXRlbGxpdGVfbmFtZRgBIAEoCVINc2'
+        'F0ZWxsaXRlTmFtZRIWCgZyZWdpb24YAiABKAlSBnJlZ2lvbhIfCgt0dGxfc2Vjb25kcxgDIAEo'
+        'BFIKdHRsU2Vjb25kcw==');
+
+@$core.Deprecated('Use issueBootstrapTokenResponseDescriptor instead')
+const IssueBootstrapTokenResponse$json = {
+  '1': 'IssueBootstrapTokenResponse',
+  '2': [
+    {'1': 'token', '3': 1, '4': 1, '5': 9, '10': 'token'},
+    {'1': 'expires_at', '3': 2, '4': 1, '5': 9, '10': 'expiresAt'},
+    {'1': 'primary_ca_pem', '3': 3, '4': 1, '5': 9, '10': 'primaryCaPem'},
+  ],
+};
+
+/// Descriptor for `IssueBootstrapTokenResponse`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List issueBootstrapTokenResponseDescriptor =
+    $convert.base64Decode(
+        'ChtJc3N1ZUJvb3RzdHJhcFRva2VuUmVzcG9uc2USFAoFdG9rZW4YASABKAlSBXRva2VuEh0KCm'
+        'V4cGlyZXNfYXQYAiABKAlSCWV4cGlyZXNBdBIkCg5wcmltYXJ5X2NhX3BlbRgDIAEoCVIMcHJp'
+        'bWFyeUNhUGVt');
+
+@$core.Deprecated('Use satelliteListDescriptor instead')
+const SatelliteList$json = {
+  '1': 'SatelliteList',
+  '2': [
+    {
+      '1': 'satellites',
+      '3': 1,
+      '4': 3,
+      '5': 11,
+      '6': '.fai.v1.SatelliteEntry',
+      '10': 'satellites'
+    },
+  ],
+};
+
+/// Descriptor for `SatelliteList`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List satelliteListDescriptor = $convert.base64Decode(
+    'Cg1TYXRlbGxpdGVMaXN0EjYKCnNhdGVsbGl0ZXMYASADKAsyFi5mYWkudjEuU2F0ZWxsaXRlRW'
+    '50cnlSCnNhdGVsbGl0ZXM=');
+
+@$core.Deprecated('Use satelliteEntryDescriptor instead')
+const SatelliteEntry$json = {
+  '1': 'SatelliteEntry',
+  '2': [
+    {'1': 'hub_id', '3': 1, '4': 1, '5': 9, '10': 'hubId'},
+    {'1': 'display_name', '3': 2, '4': 1, '5': 9, '10': 'displayName'},
+    {'1': 'hub_version', '3': 3, '4': 1, '5': 9, '10': 'hubVersion'},
+    {'1': 'wire_version', '3': 4, '4': 1, '5': 13, '10': 'wireVersion'},
+    {'1': 'region', '3': 5, '4': 1, '5': 9, '10': 'region'},
+    {'1': 'capabilities', '3': 6, '4': 3, '5': 9, '10': 'capabilities'},
+  ],
+};
+
+/// Descriptor for `SatelliteEntry`. Decode as a `google.protobuf.DescriptorProto`.
+final $typed_data.Uint8List satelliteEntryDescriptor = $convert.base64Decode(
+    'Cg5TYXRlbGxpdGVFbnRyeRIVCgZodWJfaWQYASABKAlSBWh1YklkEiEKDGRpc3BsYXlfbmFtZR'
+    'gCIAEoCVILZGlzcGxheU5hbWUSHwoLaHViX3ZlcnNpb24YAyABKAlSCmh1YlZlcnNpb24SIQoM'
+    'd2lyZV92ZXJzaW9uGAQgASgNUgt3aXJlVmVyc2lvbhIWCgZyZWdpb24YBSABKAlSBnJlZ2lvbh'
+    'IiCgxjYXBhYmlsaXRpZXMYBiADKAlSDGNhcGFiaWxpdGllcw==');
--- a/lib/src/hub_client.dart
+++ b/lib/src/hub_client.dart
@ -6,6 +6,7 @@

 import 'dart:typed_data';

+import 'package:fixnum/fixnum.dart';
 import 'package:grpc/grpc.dart' as grpc;
 import 'package:grpc/grpc_connection_interface.dart';

@ -139,6 +140,30 @@ class HubClient {
    return r.capabilities;
  }

+  /// Federation satellites currently connected to this hub
+  /// (primary side). Empty when none are connected or this hub does
+  /// not accept satellites.
+  Future<List<pb.SatelliteEntry>> listSatellites() async {
+    final r = await _admin.listSatellites(Empty());
+    return r.satellites;
+  }
+
+  /// Issue a single-use federation bootstrap token enrolling
+  /// `satelliteName`. The response also carries the primary's CA
+  /// certificate so the operator can install token + CA on the
+  /// satellite in one step (secure first connect).
+  Future<pb.IssueBootstrapTokenResponse> issueBootstrapToken(
+    String satelliteName, {
+    String region = '',
+    int ttlSeconds = 0,
+  }) {
+    final req = pb.IssueBootstrapTokenRequest()
+      ..satelliteName = satelliteName
+      ..region = region
+      ..ttlSeconds = Int64(ttlSeconds);
+    return _admin.issueBootstrapToken(req);
+  }
+
  /// Detailed info for one installed module: name, version,
  /// provided capabilities, declared permissions, on-disk path.
  Future<ModuleInfoResponse> moduleInfo(String moduleName) {