//
// DO NOT MODIFY THIS FILE DIRECTLY!
// IT IS GENERATED BY generate_policy_source.py
// FROM gen/chrome/app/policy/policy_templates.json
//


syntax = "proto2";

option optimize_for = LITE_RUNTIME;

package enterprise_management;

option go_package="chromium/policy/enterprise_management_proto";

// For StringList and PolicyOptions.
import "policy_common_definitions.proto";

// PBs for individual settings.

// Settings for Google's AI Mode integrations in the address bar and New Tab
// page search box.
//
// This policy controls Google's AI Mode integrations in the address bar and the
// New Tab page search box.
//
// To access this feature, Google must be set as the user's default search
// engine.
//
// 0 = The feature will be available to users.
//
// 1 = The feature will not be available to users.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// Valid values:
//   0: Allow AI Mode integrations.
//   1: Do not allow AI Mode integrations.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message AIModeSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 AIModeSettings = 2;
}

// Abusive Experience Intervention Enforce
//
// If SafeBrowsingEnabled is not Disabled, then setting
// AbusiveExperienceInterventionEnforce to Enabled or leaving it unset prevents
// sites with abusive experiences from opening new windows or tabs.
//
// Setting SafeBrowsingEnabled to Disabled or
// AbusiveExperienceInterventionEnforce to Disabled lets sites with abusive
// experiences open new windows or tabs.
//
// Valid values:
//   True: Prevent sites with abusive experiences from opening new windows or
// tabs
//   False: Allow sites with abusive experiences to open new windows or tabs
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AbusiveExperienceInterventionEnforceProto {
  optional PolicyOptions policy_options = 1;
  optional bool AbusiveExperienceInterventionEnforce = 2;
}

// Specifies how long (in seconds) a cast device selected with an access code or
// QR code stays in the Google Cast menu's list of cast devices.
//
// This policy specifies how long (in seconds) a cast device that was previously
// selected via an access code or QR code can be seen within the Google Cast
// menu of cast devices.
// The lifetime of an entry starts at the time the access code was first entered
// or the QR code was first scanned.
// During this period the cast device will appear in the Google Cast menu's list
// of cast devices.
// After this period, in order to use the cast device again the access code must
// be reentered or the QR code must be rescanned.
// By default, the period is zero seconds, so cast devices will not stay in the
// Google Cast menu, and so the access code must be reentered, or the QR code
// rescanned, in order to initiate a new casting session.
// Note that this policy only affects how long a cast devices appears in the
// Google Cast menu, and has no effect on any ongoing cast session which will
// continue even if the period expires.
// This policy has no effect unless the AccessCodeCastEnabled policy is Enabled.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AccessCodeCastDeviceDurationProto {
  optional PolicyOptions policy_options = 1;
  optional int64 AccessCodeCastDeviceDuration = 2;
}

// Allow users to select cast devices with an access code or QR code from within
// the Google Cast menu.
//
// This policy controls whether a user will be presented with an option, within
// the Google Cast menu which allows them to cast to cast devices that do not
// appear in the Google Cast menu, using either the access code or QR code
// displayed on the cast devices's screen.
// By default, a user must reenter the access code or rescan the QR code in
// order to initiate a subsequent casting session, but if the
// AccessCodeCastDeviceDuration policy has been set to a non-zero value (the
// default is zero), then the cast device will remain in the list of available
// cast devices until the specified period of time has expired.
// When this policy is set to Enabled, users will be presented with the option
// to select cast devices by using an access code or by scanning a QR code.
// When this policy is set to Disabled or not set, users will not be given the
// option to select cast devices by using an access code or by scanning a QR
// code.
//
// Valid values:
//   True: User will be given the option in the Google Cast menu to select cast
// devices by using an access code or by scanning a QR code.
//   False: User will not be given the option in the Google Cast menu to select
// cast devices by using an access code or by scanning a QR code.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AccessCodeCastEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AccessCodeCastEnabled = 2;
}

// Make Access-Control-Allow-Methods matching in CORS preflight spec conformant
//
// This policy controls whether request methods are uppercased when matching
// with Access-Control-Allow-Methods response headers in CORS preflight.
//
// If the policy is Disabled, request methods are uppercased.
// This is the behavior on or before Google Chrome 108.
//
// If the policy is Enabled or not set, request methods are not uppercased,
// unless matching case-insensitively with DELETE, GET, HEAD, OPTIONS, POST, or
// PUT.
// This would reject fetch(url, {method: 'Foo'}) + "Access-Control-Allow-
// Methods: FOO" response header,
// and would accept fetch(url, {method: 'Foo'}) + "Access-Control-Allow-Methods:
// Foo" response header.
//
// Note: request methods "post" and "put" are not affected, while "patch" is
// affected.
//
// This policy is intended to be temporary and will be removed in the future.
//
// Valid values:
//   True: Do not uppercase request methods except for
// DELETE/GET/HEAD/OPTIONS/POST/PUT
//   False: Always uppercase request methods
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AccessControlAllowMethodsInCORSPreflightSpecConformantProto {
  optional PolicyOptions policy_options = 1;
  optional bool AccessControlAllowMethodsInCORSPreflightSpecConformant = 2;
}

// Enable Get Image Descriptions from Google.
//
// The Get Image Descriptions from Google
// accessibility feature enables visually-impaired screen reader users to
// get descriptions of unlabeled images on the web. Users who choose to enable
// it
// will have the option of using an anonymous Google service to provide
// automatic descriptions for unlabeled images they encounter on the web.
//
// If this feature is enabled, the content of images will be sent to Google
// servers in order to generate a description. No cookies or other user
// data is sent, and Google does not save or log any image content.
//
// If this policy is set to Enabled, the
// Get Image Descriptions from Google
// feature will be enabled, though it will only affect users who are using a
// screen reader or other similar assistive technology.
//
// If this policy is set to Disabled, users will not have the option of enabling
// the feature.
//
// If this policy is not set, user can choose to use this feature or not.
//
// Valid values:
//   True: Use an anonymous Google service to provide automatic descriptions for
// unlabeled images
//   False: Do not use Google services to provide automatic image descriptions
//   None: Let users choose to use an anonymous Google service to provide
// automatic descriptions for unlabeled images
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AccessibilityImageLabelsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AccessibilityImageLabelsEnabled = 2;
}

// Allow Accessibility Performance Filtering.
//
// A policy to control whether the accessibility engine is allowed to
// dynamically compute a filter for the accessibility tree in Google Chrome to
// improve performance.
// When the policy is either set to Enabled or not set, the accessibility engine
// is allowed to dynamically compute filter modes for the accessibility tree in
// Google Chrome, which may lead to a performance improvement.
// When the policy is set to Disabled, the accessibility engine is not allowed
// to dynamically compute filter modes for the accessibility tree.
//
// Valid values:
//   True: Allow Accessibility Performance Filtering to be used.
//   False: Disallow Accessibility Performance Filtering to be used.
//
// Supported on: android
message AccessibilityPerformanceFilteringAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool AccessibilityPerformanceFilteringAllowed = 2;
}

// Enable accessibility features shortcuts
//
// Enable accessibility features shortcuts.
//
// If this policy is set to true, accessibility features shortcuts will always
// be enabled.
//
// If this policy is set to false, accessibility features shortcuts will always
// be disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, accessibility features shortcuts will be
// enabled by default.
//
// Valid values:
//   True: Enable accessibility shortcuts
//   False: Disable accessibility shortcuts
//   None: Allow the user to decide
//
// Supported on: chrome_os
message AccessibilityShortcutsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AccessibilityShortcutsEnabled = 2;
}

// Native application signing during Progressive Web Application installation
//
// This policy will be deprecated in M153 and will be unsupported (have no
// effect) in a future release. Ad-hoc signatures for native applications
// created when installing a Progressive Web Application (PWA) are now
// permanently enabled on macOS. This ensures that each installed application
// has a unique identity to macOS system components.
//
// Setting the policy to Enabled or leaving it unset enables the use of ad-hoc
// signatures for the native application that is created when installing a
// Progressive Web Application (PWA). This ensures that each installed
// application has a unique identity to macOS system components.
//
// Setting the policy to Disabled will result in every native application
// created when installing Progressive Web Applications having the same
// identity. This can interfere with macOS functionality.
//
// Only turn off the policy if you are using an endpoint security solution that
// blocks applications with an ad-hoc signature.
//
// Valid values:
//   True: Use ad-hoc code signatures.
//   False: Do not use ad-hoc code signatures.
//   None: Depend on feature launch process.
//
// Supported on: mac
message AdHocCodeSigningForPWAsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AdHocCodeSigningForPWAsEnabled = 2;
}

// Allow DNS queries for additional DNS record types
//
// This policy controls whether Google Chrome may query additional DNS record
// types when making insecure DNS requests. This policy has no effect on DNS
// queries made via Secure DNS, which may always query additional DNS types.
//
// If this policy is unset or set to Enabled, additional types such as HTTPS
// (DNS type 65) may be queried in addition to A (DNS type 1) and AAAA (DNS type
// 28).
//
// If this policy is set to Disabled, DNS will only be queried for A (DNS type
// 1) and/or AAAA (DNS type 28).
//
// This policy is a temporary measure and will be removed in future versions of
// Google Chrome. After removal of the policy, Google Chrome will always be able
// to query additional DNS types.
//
// Valid values:
//   True: Allow additional DNS query types
//   False: Prevent additional DNS query types
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AdditionalDnsQueryTypesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AdditionalDnsQueryTypesEnabled = 2;
}

// Ads setting for sites with intrusive ads
//
// Unless SafeBrowsingEnabled is set to False, then setting
// AdsSettingForIntrusiveAdsSites to 1 or leaving it unset allows ads on all
// sites.
//
// Setting the policy to 2 blocks ads on sites with intrusive ads.
//
// Valid values:
//   1: Allow ads on all sites
//   2: Do not allow ads on sites with intrusive ads
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AdsSettingForIntrusiveAdsSitesProto {
  optional PolicyOptions policy_options = 1;
  optional int64 AdsSettingForIntrusiveAdsSites = 2;
}

// Enable additional protections for users enrolled in the Advanced Protection
// program
//
// This policy controls whether users enrolled in the Advanced Protection
// program receive extra protections. Some of these features may involve the
// sharing of data with Google (for example, Advanced Protection users will be
// able to send their downloads to Google for malware scanning). If set to True
// or not set, enrolled users will receive extra protections. If set to False,
// Advanced Protection users will receive only the standard consumer features.
//
// Valid values:
//   True: Users enrolled in the Advanced Protection program will receive extra
// protections
//   False: Users enrolled in the Advanced Protection program will only receive
// standard consumer protections
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AdvancedProtectionAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool AdvancedProtectionAllowed = 2;
}

// Enable sending downloads to Google for deep scanning for users enrolled in
// the Advanced Protection program
//
// This policy is deprecated, and has been replaced with
// AdvancedProtectionAllowed.
//
// This policy controls whether users enrolled in the Advanced Protection
// program are allowed to send their downloads to Google for malware scanning.
// If set to True or not set, enrolled users will be be prompted to send their
// files to Google for deep scanning. If the user selects 'Scan', their download
// will be sent to Google. If set to False, users will not be prompted and their
// downloads will not be sent to Google.
//
// Supported on:
message AdvancedProtectionDeepScanningEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AdvancedProtectionDeepScanningEnabled = 2;
}

// List of origins allowing all HTTP authentication
//
// Setting the policy specifies for which origins to allow all the HTTP
// authentication schemes Google Chrome supports regardless of the AuthSchemes
// policy.
//
// Format the origin pattern according to this format
// (https://support.google.com/chrome/a?p=url_blocklist_filter_format). Up to
// 1,000 exceptions can be defined in AllHttpAuthSchemesAllowedForOrigins.
// Wildcards are allowed for the host component (e.g., '*:8000' matches all
// hosts on port 8000). To match all schemes or all ports, omit the component
// entirely (e.g., 'example.com' matches any scheme and any port). A hostname
// (e.g., 'example.com') also matches its subdomains. To match a host exactly
// and exclude its subdomains, prepend it with a dot (e.g., '.example.com'). To
// match all origins, use a single asterisk ('*').
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AllHttpAuthSchemesAllowedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AllHttpAuthSchemesAllowedForOrigins = 2;
}

// Allow pages with Cache-Control: no-store header to enter back/forward cache
//
// This policy controls if a page with Cache-Control: no-store header can be
// stored in back/forward cache. The website setting this header may not expect
// the page to be restored from back/forward cache since some sensitive
// information could still be displayed after the restoration even if it is no
// longer accessible.
//
// If the policy is enabled or unset, the page with Cache-Control: no-store
// header might be restored from back/forward cache unless the cache eviction is
// triggered (e.g. when there is HTTP-only cookie change to the site).
//
// If the policy is disabled, the page with Cache-Control: no-store header will
// not be stored in back/forward cache.
//
// Valid values:
//   True: Allow pages with Cache-Control: no-store header to be stored in
// back/forward cache.
//   False: Disallow pages with Cache-Control: no-store header to be stored in
// back/forward cache.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AllowBackForwardCacheForCacheControlNoStorePageEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowBackForwardCacheForCacheControlNoStorePageEnabled = 2;
}

// Allow backup of Google Chrome data
//
// If this policy is set to False, Google Chrome data, including cookies and
// website local storage, will be excluded from iCloud and local backups on iOS.
// If this policy is set to True or unset, Google Chrome may be included in
// backups.
//
// Valid values:
//   True: Allow Google Chrome data to be included in backups
//   False: Prevent Google Chrome data from being included in backups
//
// Supported on: ios
message AllowChromeDataInBackupsProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowChromeDataInBackups = 2;
}

// Cross-origin HTTP Authentication prompts
//
// Setting the policy to Enabled allows third-party images on a page to show an
// authentication prompt.
//
// Setting the policy to Disabled or leaving it unset renders third-party images
// unable to show an authentication prompt.
//
// Typically, this policy is Disabled as a phishing defense.
//
// Valid values:
//   True: Allow third-party images to show an authentication prompt
//   False: Prevent third-party images from showing an authentication prompt
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AllowCrossOriginAuthPromptProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowCrossOriginAuthPrompt = 2;
}

// Enable deleting browser and download history
//
// Setting the policy to Enabled or leaving it unset means browser history and
// download history can be deleted in Chrome, and users can't change this
// setting.
//
// Setting the policy to Disabled means browser history and download history
// can't be deleted. Even with this policy off, the browsing and download
// history are not guaranteed to be retained. Users may be able to edit or
// delete the history database files directly, and the browser itself may expire
// or archive any or all history items at any time.
//
// Valid values:
//   True: Enable deleting browser and download history
//   False: Disable deleting browser and download history
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AllowDeletingBrowserHistoryProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowDeletingBrowserHistory = 2;
}

// Allow Dinosaur Easter Egg Game
//
// Setting the policy to True allows users to play the dinosaur game. Setting
// the policy to False means users can't play the dinosaur easter egg game when
// device is offline.
//
// Leaving the policy unset means users can't play the game on enrolled Google
// ChromeOS, but can under other circumstances.
//
// Valid values:
//   True: Enable dinosaur easter egg game
//   False: Disable dinosaur easter egg game
//   None: Disable dinosaur easter egg game on enrolled Google ChromeOS devices,
// enable under other circumstances
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AllowDinosaurEasterEggProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowDinosaurEasterEgg = 2;
}

// Show a UI toggle to exclude a display in mirror mode.
//
// Setting this policy shows a new UI toggle under each display in display
// settings. Normal mirror mode turns all displays into one display, but the new
// toggle allows users to exclude one display from mirroring and appear as an
// extended display.
//
// If the policy is set to Enabled, the toggle will appear for each display to
// exclude it from mirror mode, and users can choose one to enable.
//
// If the policy is unset or Disabled, the toggle will be hidden.
//
// Note: This policy will only affect UI, and ChromeOS will keep the existing
// settings when UI is hidden.
//
// Valid values:
//   True: Make Exclude Display in Mirror Mode available to the user
//   False: Do not make Exclude Display in Mirror Mode available to the user
//
// Supported on: chrome_os
message AllowExcludeDisplayInMirrorModeProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowExcludeDisplayInMirrorMode = 2;
}

// Allow invocation of file selection dialogs
//
// Setting the policy to Enabled or leaving it unset means Chrome can display,
// and users can open, file selection dialogs.
//
// Setting the policy to Disabled means that whenever users perform actions
// provoking a file selection dialog, such as importing bookmarks, uploading
// files, and saving links, a message appears instead. The user is assumed to
// have clicked Cancel on the file selection dialog.
//
// Valid values:
//   True: Allow file selection dialogs
//   False: Prevent file selection dialogs
//
// Supported on: fuchsia, linux, mac, win
message AllowFileSelectionDialogsProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowFileSelectionDialogs = 2;
}

// Allows native notifications
//
// This policy is deprecated, please use the 'AllowSystemNotifications' policy
// instead.
//
// Configures whether Google Chrome on Linux will use native notifications.
//
// If set to True or not set, Google Chrome is allowed to use native
// notifications.
//
// If set to False, Google Chrome will not use native notifications. Google
// Chrome's Message Center will be used as a fallback.
//
// Supported on:
message AllowNativeNotificationsProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowNativeNotifications = 2;
}

// Allow running plugins that are outdated
//
// This policy is deprecated in M88, Flash is no longer supported by Chrome.
// Setting the policy to Enabled means outdated plugins are used as normal
// plugins. Setting the policy to Disabled means outdated plugins aren't used.
//
// Leaving the policy unset means users will be asked for permission to run
// outdated plugins.
//
// Valid values:
//   True: Allow outdated Flash to be used as normal Flash
//   False: Disallow outdated Flash
//   None: Ask user for permission to run outdated Flash
//
// Supported on:
message AllowOutdatedPluginsProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowOutdatedPlugins = 2;
}

// Allows a page to show pop-ups during its unloading
//
// Setting the policy to True allows pages to show pop-ups while the pages
// unload.
//
// Setting the policy to False or leaving it unset prevents pages from showing
// pop-ups while the pages unload.
//
// This policy was removed in Chrome 88 and is ignored if set.
//
// See https://www.chromestatus.com/feature/5989473649164288.
//
// Valid values:
//   True: Allow pages to show pop-ups during unloading
//   False: Prevent pages from showing pop-ups during unloading
//
// Supported on:
message AllowPopupsDuringPageUnloadProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowPopupsDuringPageUnload = 2;
}

// Permit locking the screen
//
// Setting the policy to Enabled or leaving it unset lets users who authenticate
// with a password lock the screen.
//
// Setting the policy to Disabled means users can't lock the screen. (They can
// only sign out from the user session.)
//
// Valid values:
//   True: Allow locking the screen
//   False: Do not allow locking the screen
//
// Supported on: chrome_os
message AllowScreenLockProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowScreenLock = 2;
}

// Allow screen wake locks
//
// Unless AllowWakeLocks is set to Disabled, setting AllowScreenWakeLocks to
// Enabled or leaving it unset allows screen wake locks for power management.
// Extensions can request screen wake locks through the power management
// extension API and ARC apps.
//
// Setting the policy to Disabled demotes screen wake lock requests to system
// wake lock requests.
//
// Valid values:
//   True: Allow screen wake locks for power management
//   False: Demote screen wake lock requests to system wake lock requests
//
// Supported on: chrome_os
message AllowScreenWakeLocksProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowScreenWakeLocks = 2;
}

// Allow socket pool size randomization for proxies
//
// Socket pool size randomization is a security mechanism that prevents
// attackers from exploiting deterministic capacity limits to learn cross-site
// information.
// If the capacity for a pool is normally 128 sockets, this mechanism randomly
// caps the pool between 128 and 256.
// This can allow up to 2x as many connections to the proxy, but in practice the
// expected value is more like 1.2x.
//
// This impacts the settings from MaxConnectionsPerProxy and
// MaxConnectionsPerProxyForWebSocket.
// Instead of them defining the upper limit, the upper limit is 2x their values
// (though again, the expected value in practice is more like 1.2x them).
//
// This is enabled by default for all pools, but this policy allows the feature
// to be disabled for proxy pools specifically.
//
// Valid values:
//   True: Allow socket pool randomization for proxies
//   False: Prevent socket pool randomization for proxies
//
// Supported on: android, chrome_os, linux, mac, win
message AllowSocketPoolSizeRandomizationForProxiesProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowSocketPoolSizeRandomizationForProxies = 2;
}

// Allows a page to perform synchronous XHR requests during page dismissal.
//
// This policy allows an admin to specify that a page may send synchronous XHR
// requests during page dismissal.
//
// When the policy is set to enabled, pages are allowed to send synchronous XHR
// requests during page dismissal.
//
// When the policy is set to disabled or not set, pages are not allowed to send
// synchronous XHR requests during page dismissal.
//
// This policy was removed in Chrome 99.
//
// See https://www.chromestatus.com/feature/4664843055398912 .
//
// Valid values:
//   True: Allow pages to send synchronous XHR requests during page dismissal
//   False: Do not allow pages to send synchronous XHR requests during page
// dismissal
//
// Supported on:
message AllowSyncXHRInPageDismissalProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowSyncXHRInPageDismissal = 2;
}

// Allows system notifications
//
// Configures whether Google Chrome on Linux will use system notifications.
//
// If set to True or not set, Google Chrome is allowed to use system
// notifications.
//
// If set to False, Google Chrome will not use system notifications. Google
// Chrome's Message Center will be used as a fallback.
//
// Valid values:
//   True: Allow system notifications to be used
//   False: Do not allow system notifications to be used
//
// Supported on: linux
message AllowSystemNotificationsProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowSystemNotifications = 2;
}

// Allow wake locks
//
// Setting the policy to Enabled or leaving it unset allows wake locks for power
// management. Extensions can request wake locks through the power management
// extension API and ARC apps.
//
// Setting the policy to Disabled means wake lock requests are ignored.
//
// Valid values:
//   True: Allow wake locks for power management
//   False: Ignore requests for wake locks for power management
//
// Supported on: chrome_os
message AllowWakeLocksProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowWakeLocks = 2;
}

// Allow Web Authentication requests on sites with broken TLS certificates.
//
// If set to Enabled, Google Chrome will
// allow Web Authentication requests on websites that have TLS certificates with
// errors (i.e. websites considered not secure).
//
// If the policy is set to Disabled or left unset, the default behavior of
// blocking such requests will apply.
//
// Valid values:
//   True: Allow WebAuthn API requests on sites with broken TLS certificates.
//   False: Do not allow WebAuthn API requests on sites with broken TLS
// certificates.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AllowWebAuthnWithBrokenTlsCertsProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowWebAuthnWithBrokenTlsCerts = 2;
}

// Define domains allowed to access Google Workspace
//
// Setting the policy turns on Chrome's restricted sign-in feature in Google
// Workspace and prevents users from changing this setting. Users can only
// access Google tools using accounts from the specified domains (to allow gmail
// or googlemail accounts, add consumer_accounts to the list of domains). This
// setting prevents users from signing in and adding a Secondary Account on a
// managed device that requires Google authentication, if that account doesn't
// belong to one of the explicitly allowed domains.
//
// Leaving this setting empty or unset means users can access Google Workspace
// with any account.
//
// Users cannot change or override this setting.
//
// Note: This policy causes the X-GoogApps-Allowed-Domains header to be appended
// to all HTTP and HTTPS requests to all google.com domains, as described in
// https://support.google.com/a/answer/1668854.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AllowedDomainsForAppsProto {
  optional PolicyOptions policy_options = 1;
  optional string AllowedDomainsForApps = 2;
}

// Define domains allowed to access Google Workspace
//
// Setting the policy turns on Chrome's restricted sign-in feature in Google
// Workspace and prevents users from changing this setting. Users can only
// access Google tools using accounts from the specified domains (to allow gmail
// or googlemail accounts, add consumer_accounts to the list of domains). This
// setting prevents users from signing in and adding a Secondary Account on a
// managed device that requires Google authentication, if that account doesn't
// belong to one of the explicitly allowed domains.
//
// Leaving this setting empty or unset means users can access Google Workspace
// with any account.
//
// Users cannot change or override this setting.
//
// Note: This policy causes the X-GoogApps-Allowed-Domains header to be appended
// to all HTTP and HTTPS requests to all google.com domains, as described in
// https://support.google.com/a/answer/1668854.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AllowedDomainsForAppsListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AllowedDomainsForAppsList = 2;
}

// Configure the allowed input methods in a user session
//
// Setting the policy lets users choose one of the input methods for Google
// ChromeOS sessions that you specify.
//
// If you leave it unset or set to an empty list, users can select all supported
// input methods.
//
// Starting with version M106 allowed input methods are automatically enabled in
// kiosk session.
//
// Note: If the current input method is unsupported, it switches to the hardware
// keyboard layout (if allowed) or the first valid entry in this list. Invalid
// or unsupported methods are ignored.
//
// Supported on: chrome_os
message AllowedInputMethodsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AllowedInputMethods = 2;
}

// Enforce all allowed input methods to be enabled in a user session
//
// Setting the policy to true enforces all input methods from
// AllowedInputMethods policy to be enabled in Google ChromeOS sessions.
// No other input methods can be enabled in the user sessions.
// Setting the policy to false or not setting it doesn't enforce any enabled
// input methods and AllowedInputMethods policy only configures which input
// methods are available to the user.
//
// If AllowedInputMethods policy is unset or set to an empty list, this policy
// is ignored and users can enable any input methods.
//
// Valid values:
//   True: Enforce all allowed input methods to be enabled
//   False: Do not enforce enabled input methods
//
// Supported on: chrome_os
message AllowedInputMethodsForceEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AllowedInputMethodsForceEnabled = 2;
}

// Configure the allowed languages in a user session
//
// Setting the policy lets users add only one of the languages listed in this
// policy to the list of preferred languages.
//
// If not set or set to an empty list, users can specify languages as preferred.
//
// If set to a list with invalid values, those values are ignored. If users
// added languages not allowed by this policy to the list of preferred
// languages, they're removed. If they had Google ChromeOS displayed in a
// language not allowed by this policy, the next time they sign in, the display
// language switches to an allowed UI language. Otherwise, if this policy only
// has invalid entries, Google ChromeOS switches to the first valid value
// specified by this policy or a fallback locale such as en-US.
//
// Supported on: chrome_os
message AllowedLanguagesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AllowedLanguages = 2;
}

// Configure allowed local authentication factors
//
// Setting the policy controls which local authentication factors can be used
// for both login and reauthentication on Google ChromeOS.
//
// To allow:
//
// * Every local authentication factor, use ["ALL"] (includes factors added in
// the future).
//
// * Only PIN, use ["PIN"].
//
// * Only Local Passwords, use ["LOCAL_PASSWORD"].
//
// If the policy is unset or set to an empty list, no local auth factors are
// available for managed users.
//
// Valid values:
//   ALL: All
//   PIN: PIN
//   LOCAL_PASSWORD: Local Password
//
// Supported on: chrome_os
message AllowedLocalAuthFactorsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AllowedLocalAuthFactors = 2;
}

// Enable alternate error pages
//
// Setting the policy to True means Google Chrome uses alternate error pages
// built into (such as "page not found"). Setting the policy to False means
// Google Chrome never uses alternate error pages.
//
// If you set the policy, users can't change it. If not set, the policy is on,
// but users can change this setting.
//
// Valid values:
//   True: Enable alternate error pages
//   False: Disable alternate error pages
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AlternateErrorPagesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AlternateErrorPagesEnabled = 2;
}

// Command-line parameters for the alternative browser.
//
// Setting the policy to a list of strings means each string is passed to the
// alternative browser as separate command-line parameters. On Microsoft®
// Windows®, the parameters are joined with spaces. On macOS and Linux®, a
// parameter can have spaces and still be treated as a single parameter.
//
// If a parameter contains ${url}, ${url} is replaced with the URL of the page
// to open. If no parameter contains ${url}, the URL is appended at the end of
// the command line.
//
// Environment variables are expanded. On Microsoft® Windows®, %ABC% is replaced
// with the value of the ABC environment variable. On macOS and Linux®, ${ABC}
// is replaced with the value of the ABC environment variable.
//
// Leaving the policy unset means only the URL is passed as a command-line
// parameter.
//
// Supported on: linux, mac, win
message AlternativeBrowserParametersProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AlternativeBrowserParameters = 2;
}

// Alternative browser to launch for configured websites.
//
// Setting the policy controls which command to use to open URLs in an
// alternative browser. The policy can be set to one of ${ie}, ${firefox},
// ${safari}, ${opera}, ${edge} or a file path. When this policy is set to a
// file path, that file is used as an executable file. ${ie} is only available
// on Microsoft® Windows®. ${safari} and ${edge} are only available on
// Microsoft® Windows® and macOS.
//
// Leaving the policy unset puts a platform-specific default in use: Internet
// Explorer® for Microsoft® Windows®, or Safari® for macOS. On Linux®, launching
// an alternative browser will fail.
//
// Supported on: linux, mac, win
message AlternativeBrowserPathProto {
  optional PolicyOptions policy_options = 1;
  optional string AlternativeBrowserPath = 2;
}

// Always runs plugins that require authorization (deprecated)
//
// If you enable this setting, plugins that are not outdated always run.
//
// If this setting is disabled or not set, users will be asked for permission to
// run plugins that require authorization. These are plugins that can compromise
// security.
//
// Valid values:
//   True: Always run plugins that are not outdated
//   False: Ask user for permission to run plugins that require authorization
//
// Supported on:
message AlwaysAuthorizePluginsProto {
  optional PolicyOptions policy_options = 1;
  optional bool AlwaysAuthorizePlugins = 2;
}

// Allow user browser access to a list of URLs while Always-on VPN is active in
// strict mode with lockdown enabled and the VPN is not connected
//
// Warning: Configuring this policy relaxes the Always-on VPN lockdown before
// the VPN connects. URL-level filtering is only guaranteed for Chrome browser
// traffic and does not apply to internal system applications or other traffic
// types. While this policy is enforced, system traffic can also bypass the
// Always-on VPN to perform tasks like policy fetches and synchronizing the
// system clock.
//
// Use this policy to open exceptions to certain schemes, subdomains of other
// domains, ports, or specific paths, using the format specified at
// https://support.google.com/chrome/a?p=url_blocklist_filter_format. The most
// specific filter determines if a URL is blocked or allowed.
//
// If the AlwaysOnVpnPreConnectUrlAllowlist is set, an Always-on VPN is
// configured and the Always-on VPN is not connected, navigation to all hosts is
// blocked, except for those allowed by the AlwaysOnVpnPreConnectUrlAllowlist
// policy. In this device state, the URLBlocklist and URLAllowlist are ignored.
// When the Always-on VPN connects, the URLBlocklist and URLAllowlist policies
// are applied and the AlwaysOnVpnPreConnectUrlAllowlist policy is ignored.
//
// This policy is limited to 1,000 entries.
//
// Leaving the policy unset prevents any browser navigation while the Always-on
// VPN with strict mode is active and the VPN is not connected.
//
// Supported on: chrome_os
message AlwaysOnVpnPreConnectUrlAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AlwaysOnVpnPreConnectUrlAllowlist = 2;
}

// Always Open PDF files externally
//
// Setting the policy to Enabled turns the internal PDF viewer off in Google
// Chrome, treats PDF files as a download, and lets users open PDFs with the
// default application.
//
// Setting the policy to Disabled means that unless users turns off the PDF
// plugin, it will open PDF files.
//
// If you set the policy, users can't change it in Google Chrome. If not set,
// users can choose whether to open PDF externally or not.
//
// Valid values:
//   True: Always open PDF files using an external PDF viewer
//   False: Always open PDF files using the internal PDF viewer
//   None: Allow the user to decide
//
// Supported on: fuchsia, linux, mac, win
message AlwaysOpenPdfExternallyProto {
  optional PolicyOptions policy_options = 1;
  optional bool AlwaysOpenPdfExternally = 2;
}

// Enable Ambient Authentication for profile types.
//
// Configuring this policy will allow/disallow ambient authentication for
// Incognito and Guest profiles in Google Chrome.
//
// Ambient Authentication is http authentication with default credentials if
// explicit credentials are not provided via NTLM/Kerberos/Negotiate
// challenge/response schemes.
//
// Setting the RegularOnly (value 0), allows ambient authentication for Regular
// sessions only. Incognito and Guest sessions wouldn't be allowed to ambiently
// authenticate.
//
// Setting the IncognitoAndRegular (value 1), allows ambient authentication for
// Incognito and Regular sessions. Guest sessions wouldn't be allowed to
// ambiently authenticate.
//
// Setting the GuestAndRegular (value 2), allows ambient authentication for
// Guest and Regular sessions. Incognito sessions wouldn't be allowed to
// ambiently authenticate.
//
// Setting the  All (value 3), allows ambient authentication for all sessions.
//
// Note that, ambient authentication is always allowed on regular profiles.
//
// In Google Chrome version 81 and later, if the policy is left not set, ambient
// authentication will be enabled in regular sessions only.
//
// Valid values:
//   0: Enable ambient authentication in regular sessions only.
//   1: Enable ambient authentication in incognito and regular sessions.
//   2: Enable ambient authentication in guest and regular sessions.
//   3: Enable ambient authentication in regular, incognito and guest sessions.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AmbientAuthenticationInPrivateModesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional int64 AmbientAuthenticationInPrivateModesEnabled = 2;
}

// Allow automatic sign-in to Microsoft® cloud identity providers on Android
//
// Configures automatic user sign-in for accounts backed by a Microsoft® cloud
// identity provider on Android.
//
// By setting this policy to 1 (Enabled), users who have signed into a
// Microsoft® productivity application on their device can be automatically
// signed into Microsoft® web properties within Google Chrome. This
// functionality requires the presence of a Microsoft® authentication broker
// app, such as Microsoft® Authenticator®, Microsoft® Intune Company Portal®, or
// Microsoft® Link to Windows®. To facilitate the single sign-on, necessary
// authentication data is shared with the Microsoft® cloud identity provider.
//
// By setting this policy to 0 (Disabled) or leaving it unset, automatic sign-in
// as described above is disabled, and users must manually provide credentials
// for Microsoft® web properties.
//
// Note: This policy does not apply to Incognito or Guest modes.
//
// Valid values:
//   0: Disable Microsoft® cloud authentication
//   1: Enable Microsoft® cloud authentication
//
// Supported on: android
message AndroidEntraSsoEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional int64 AndroidEntraSsoEnabled = 2;
}

// Allows the AppCache feature to be re-enabled even if it is off by default.
//
// If set to true, this will force AppCache to be enabled, even when AppCache in
// Chrome is not available by default.
//
// If unset or set to false, AppCache will follow Chrome's defaults.
//
// Valid values:
//   True: Force AppCache to be enabled
//   False: Use default AppCache behavior
//
// Supported on:
message AppCacheForceEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AppCacheForceEnabled = 2;
}

// App Launch Automation
//
// Setting this policy allows administrators to configure automation for
// launching apps on Google ChromeOS devices. These apps can be launched on user
// login, or users can launch them together from the launcher.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "auto_launch_on_startup": {
//                 "type": "boolean"
//             },
//             "created_time_usec": {
//                 "type": "string"
//             },
//             "desk": {
//                 "properties": {
//                     "apps": {
//                         "items": {
//                             "properties": {
//                                 "app_type": {
//                                     "enum": [
//                                         "android",
//                                         "browser",
//                                         "chrome_app",
//                                         "isolated_web_app",
//                                         "progressive_web_app"
//                                     ],
//                                     "type": "string"
//                                 },
//                                 "browser_tabs": {
//                                     "items": {
//                                         "properties": {
//                                             "url": {
//                                                 "type": "string"
//                                             }
//                                         },
//                                         "type": "object"
//                                     },
//                                     "type": "array"
//                                 },
//                                 "window_id": {
//                                     "type": "integer"
//                                 }
//                             },
//                             "type": "object"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             },
//             "name": {
//                 "type": "string"
//             },
//             "updated_time_usec": {
//                 "type": "string"
//             },
//             "uuid": {
//                 "type": "string"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on:
message AppLaunchAutomationProto {
  optional PolicyOptions policy_options = 1;
  optional string AppLaunchAutomation = 2;
}

// Enable App Recommendations in Zero State of Search Box
//
// This feature has been removed in Chrome 100.
//
// Setting this policy to Enabled will cause recommendations for apps previously
// installed by the user on other devices. These recommendations will appear in
// the launcher after the local app recommendations, if no search text has been
// entered.
//
// Setting this policy as Disabled or leaving it unset means these
// recommendations do not appear.
//
// If this policy is set, users cannot change it.
//
// Valid values:
//   True: Show app recommendations in the Google ChromeOS launcher
//   False: Do not show app recommendations in the Google ChromeOS launcher
//
// Supported on:
message AppRecommendationZeroStateEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AppRecommendationZeroStateEnabled = 2;
}

// Allows users to be shown the iOS App Store Rating promo
//
// When the policy is not set or set to Enabled, the App Store Rating promo may
// be shown to the user, at most once per year.
// When the policy is set to Disabled, the App Store Rating promo will not be
// shown to the user.
//
// Valid values:
//   True: Allow the App Store Rating promo to be displayed
//   False: Do not allow the App Store Rating promo to be displayed
//
// Supported on: ios
message AppStoreRatingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AppStoreRatingEnabled = 2;
}

// Enable Application Bound Encryption
//
// Setting the policy to Enabled or leaving it unset binds encryption keys used
// for local data storage to Google Chrome whenever that is possible.
//
// Setting the policy to Disabled has a detrimental effect on Google Chrome's
// security as unknown and potentially hostile apps can retrieve encryption keys
// used to secure data.
//
// Only turn off the policy if there are compatibility issues, such as other
// applications that need legitimate access to Google Chrome's data, encrypted
// user data is expected to be fully portable between different computers or the
// integrity and location of Google Chrome's executable files is not consistent.
//
// Valid values:
//   True: Enable Application Bound Encryption
//   False: Disable Application Bound Encryption
//
// Supported on: win
message ApplicationBoundEncryptionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ApplicationBoundEncryptionEnabled = 2;
}

// Application locale
//
// Setting the policy specifies the locale Google Chrome uses.
//
// Turning it off or leaving it unset means the locale will be the first valid
// locale from:
// 1) The user specified locale (if configured).
// 2) The system locale.
// 3) The fallback locale (en-US).
//
// Supported on: win
message ApplicationLocaleValueProto {
  optional PolicyOptions policy_options = 1;
  optional string ApplicationLocaleValue = 2;
}

// Log events for Android app installs
//
// Setting the policy to True sends reports of key, policy-triggered Android app
// installation events to Google.
//
// Setting the policy to False or leaving it unset means no events are captured.
//
// Valid values:
//   True: Android app install event logs are shared with Google
//   False: Android app install event logs are not shared with Google
//
// Supported on: chrome_os
message ArcAppInstallEventLoggingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ArcAppInstallEventLoggingEnabled = 2;
}

// Enable sharing from Android apps to Web apps
//
// Setting the policy to True enables sharing text/files from Android apps to
// supported Web Apps, using the built-in Android sharing system.
// When enabled, this will send metadata for installed Web Apps to Google to
// generate and install a shim Android app.
// Setting the policy to False disables this functionality.
//
// Valid values:
//   True: Enable Android to Web App sharing.
//   False: Disable Android to Web App sharing.
//
// Supported on: chrome_os
message ArcAppToWebAppSharingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ArcAppToWebAppSharingEnabled = 2;
}

// Enable Android Backup Service
//
// This policy was removed in Google ChromeOS 68 and replaced by
// ArcBackupRestoreServiceEnabled.
//
// Supported on:
message ArcBackupRestoreEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ArcBackupRestoreEnabled = 2;
}

// Control Android backup and restore service
//
// Setting the policy to BackupAndRestoreEnabled means Android backup and
// restore is initially on. Setting the policy to BackupAndRestoreDisabled or
// leaving it unset keeps backup and restore off during setup.
//
// Setting the policy to BackupAndRestoreUnderUserControl means users see
// prompts to use backup and restore. If they turn on backup and restore,
// Android app data is uploaded to Android backup servers and restored during
// reinstallations of compatible apps.
//
// After initial setup, users can turn backup and restore on or off.
//
// Valid values:
//   0: Backup and restore disabled
//   1: User decides whether to enable backup and restore
//   2: Backup and restore enabled
//
// Supported on: chrome_os
message ArcBackupRestoreServiceEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ArcBackupRestoreServiceEnabled = 2;
}

// Set certificate availability for ARC-apps
//
// Setting the policy to CopyCaCerts makes all ONC-installed CA certificates
// with Web TrustBit available for ARC-apps.
//
// Setting to None or leaving it unset makes ChromeOS certificates unavailable
// for ARC-apps.
//
// Valid values:
//   0: Disable usage of Google ChromeOS certificates to ARC-apps
//   1: Enable Google ChromeOS CA certificates to ARC-apps
//
// Supported on: chrome_os
message ArcCertificatesSyncModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ArcCertificatesSyncMode = 2;
}

// Enable ARC
//
// Unless Ephemeral mode or multiple sign-in is on during the user's session,
// setting ArcEnabled to True turns ARC on for the user. Setting the policy to
// False or leaving it unset means enterprise users can't use ARC.
//
// Valid values:
//   True: Enable ARC
//   False: Disable ARC
//
// Supported on: chrome_os
message ArcEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ArcEnabled = 2;
}

// Control Android Google location services
//
// Unless the DefaultGeolocationSetting policy is set to BlockGeolocation, then
// setting GoogleLocationServicesEnabled turns Google location services on
// during initial setup. Setting the policy to GoogleLocationServicesDisabled or
// leaving it unset keeps location services off during setup.
//
// Setting policy to BackupAndRestoreUnderUserControl prompts users about
// whether or not to use Google location services. If they turn it on, Android
// apps use the services to search the device location and send anonymous
// location data to Google.
//
// After initial setup, users can turn Google location services on or off.
//
// Valid values:
//   0: Google location services disabled
//   1: User decides whether to enable Google location services
//   2: Google location services enabled
//
// Supported on: chrome_os
message ArcGoogleLocationServicesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ArcGoogleLocationServicesEnabled = 2;
}

// Enable Android Google Location Service
//
// This policy was removed in Google ChromeOS 68 and replaced by
// ArcGoogleLocationServicesEnabled.
//
// Supported on:
message ArcLocationServiceEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ArcLocationServiceEnabled = 2;
}

// Open links in Chrome browser by default
//
// Setting the policy to False allows Android apps to capture supported links by
// default.
// Setting the policy to True make all links open in Chrome browser by default.
// If the policy is not set, links are opened by default in Android apps for
// managed users and in the browser for consumers.
//
// Valid values:
//   True: Open links in Chrome browser by default
//   False: Open links in Android apps by default
//
// Supported on: chrome_os
message ArcOpenLinksInBrowserByDefaultProto {
  optional PolicyOptions policy_options = 1;
  optional bool ArcOpenLinksInBrowserByDefault = 2;
}

// Configure ARC
//
// Setting the policy specifies a set of policies to hand over to the ARC
// runtime. Admins can use it to select the Android apps that autoinstall. Enter
// value in valid JSON format.
//
// To pin apps to the launcher, see PinnedLauncherApps.
//
// Supported on: chrome_os
message ArcPolicyProto {
  optional PolicyOptions policy_options = 1;
  optional string ArcPolicy = 2;
}

// Migration strategy for ARC VM Data Migration
//
// Setting the policy specifies the action to take when the user's ARC data
// directory was created with virtio-fs. Unless virtio-fs data is migrated to
// virtio-blk, Android apps might run slower on ARC VM.
//
// Setting the policy to:
//
// * DoNotPrompt means do not ask the user to go through the migration flow.
// This is the default value when policy is unset.
//
// * Prompt (or an unsupported value) means that, at sign-in, user is prompted
// to go through the data migration flow. This can take up to 10 minutes.
//
// This policy only applies to ARM devices migrating to ARCVM.
//
// Valid values:
//   0: Do not prompt users to migrate.
//   1: Prompt users to migrate.
//
// Supported on: chrome_os
message ArcVmDataMigrationStrategyProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ArcVmDataMigrationStrategy = 2;
}

// Mode of the Assistant onboarding experience
//
// This policy controls the mode of the Assistant onboarding experience.
//
// If the policy is unset or is set to "Default", the default mode of the
// Assistant onboarding experience is used.
// If the policy is set to "Education", the EDU mode of the Assistant onboarding
// experience is used.
//
// Valid values:
//   Default: Use the default mode of the Assistant onboarding experience
//   Education: Use the EDU mode of the Assistant onboarding experience
//
// Supported on:
message AssistantOnboardingModeProto {
  optional PolicyOptions policy_options = 1;
  optional string AssistantOnboardingMode = 2;
}

// Enable Google Assistant voice match flow
//
// Setting the policy to Enabled lets show Google Assistant voice match flow
// during initial setup. Setting the policy to Disabled keeps Google Assistant
// from showing voice match flow during initial setup.
//
// Leaving the policy unset means it is Enabled.
//
// Valid values:
//   True: Show Google Assistant voice match flow during initial setup
//   False: Do not show Google Assistant voice match flow during initial setup
//
// Supported on:
message AssistantVoiceMatchEnabledDuringOobeProto {
  optional PolicyOptions policy_options = 1;
  optional bool AssistantVoiceMatchEnabledDuringOobe = 2;
}

// Allow using Google Assistant on the web, e.g. to enable changing passwords
// automatically
//
// Setting the policy to Enabled allows users to use Google Assistant on the
// web, e.g. for faster checkout and password changes. Using Google Assistant
// requires additional user consent and Google Assistant will only run if users
// choose to give this consent, even if the policy is set to Enabled.
//
// Setting the policy to Disabled means users cannot use Google Assistant on the
// web.
//
// If the policy is not set, the user can turn off Google Assistant.
//
// Valid values:
//   True: Allow using Google Assistant on the web
//   False: Do not allow using Google Assistant on the web
//   None: Allow the user to decide
//
// Supported on:
message AssistantWebEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AssistantWebEnabled = 2;
}

// Enable remote attestation for the user
//
// This policy was removed in M118. It served to enable and disable Remote
// Attestation for the user but Remote Attestation has been enabled by default.
//
// Setting the policy to Enabled lets users use the hardware on Google ChromeOS
// devices to remotely attest its identity to the privacy CA through the
// Enterprise Platform Keys API using
// chrome.enterprise.platformKeys.challengeUserKey().
//
// Setting the policy to Disabled or leaving it unset has calls to the API fail
// with an error code.
//
// Valid values:
//   True: Enable remote attestation for the user
//   False: Disable remote attestation for the user
//
// Supported on:
message AttestationEnabledForUserProto {
  optional PolicyOptions policy_options = 1;
  optional bool AttestationEnabledForUser = 2;
}

// Extensions allowed to to use the remote attestation API
//
// Setting the policy specifies the allowed extensions to use the Enterprise
// Platform Keys API functions for remote attestation. Extensions must be on
// this list to use the API.
//
// If an extension is not in the list, or the list is not set, the call to the
// API fails with an error code.
//
// Supported on: chrome_os
message AttestationExtensionAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AttestationExtensionAllowlist = 2;
}

// Extensions allowed to to use the remote attestation API
//
// This policy is deprecated, please use AttestationExtensionAllowlist instead.
//
// Setting the policy specifies the allowed extensions to use the Enterprise
// Platform Keys API function chrome.enterprise.platformKeys.challengeUserKey()
// for remote attestation. Extensions must be on this list to use the API.
//
// If an extension is not in the list, or the list is not set, the call to the
// API fails with an error code.
//
// Supported on:
message AttestationExtensionWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AttestationExtensionWhitelist = 2;
}

// Allow or deny audio capture
//
// Setting the policy to Enabled or leaving it unset means that, with the
// exception of URLs set in the AudioCaptureAllowedUrls list, users get prompted
// for audio capture access.
//
// Setting the policy to Disabled turns off prompts, and audio capture is only
// available to URLs set in the AudioCaptureAllowedUrls list.
//
// Note: The policy affects all audio input (not just the built-in microphone).
//
// Valid values:
//   True: Enable audio input
//   False: Disable audio input
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AudioCaptureAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool AudioCaptureAllowed = 2;
}

// URLs that will be granted access to audio capture devices without prompt
//
// Setting the policy means you specify the URL list whose patterns get matched
// to the security origin of the requesting URL. A match grants access to audio
// capture devices without prompt
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/. Note, however, that
// the pattern "*", which matches any URL, is not supported by this policy.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AudioCaptureAllowedUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AudioCaptureAllowedUrls = 2;
}

// Allow playing audio
//
// Setting the policy to Enabled or leaving it unset allows all supported audio
// outputs on the users' devices.
//
// Setting the policy to Disabled allows no audio output while users are signed
// in.
//
// Note: The policy affects all audio output, including audio accessibility
// features. Do not turn the policy off if a user requires a screen reader.
//
// Valid values:
//   True: Enable audio output
//   False: Disable audio output
//
// Supported on: chrome_os
message AudioOutputAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool AudioOutputAllowed = 2;
}

// Allow the audio process to run with priority above normal on Windows
//
// This policy controls the priority of the audio process on Windows.
// If this policy is enabled, the audio process will run with above normal
// priority.
// If this policy is disabled, the audio process will run with normal priority.
// If this policy is not set, the default configuration for the audio process
// will be used.
// This policy is intended as a temporary measure to give enterprises the
// ability to
// run audio with higher priority to address certain performance issues with
// audio capture.
// This policy will be removed in the future.
//
// Valid values:
//   True: Use high priority for audio process
//   False: Use normal Priority for audio process
//   None: Use default priority for audio process
//
// Supported on: win
message AudioProcessHighPriorityEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AudioProcessHighPriorityEnabled = 2;
}

// Allow the audio sandbox to run
//
// This policy controls the audio process sandbox.
// If this policy is enabled, the audio process will run sandboxed.
// If this policy is disabled, the audio process will run unsandboxed and the
// WebRTC audio-processing module will run in the renderer process.
// This leaves users open to security risks related to running the audio
// subsystem unsandboxed.
// If this policy is not set, the default configuration for the audio sandbox
// will be used, which may differ per platform.
// This policy is intended to give enterprises flexibility to disable the audio
// sandbox if they use security software setups that interfere with the sandbox.
//
// Valid values:
//   True: Always sandbox the audio process
//   False: Never sandbox the audio process
//   None: Use the default configuration for the audio sandbox
//
// Supported on: linux, mac, win
message AudioSandboxEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AudioSandboxEnabled = 2;
}

// Account type for HTTP Negotiate authentication
//
// Setting the policy specifies the type of accounts provided by the Android
// authentication app that supports HTTP Negotiate authentication (such as
// Kerberos authentication). This information should be available from the
// supplier of the authentication app. For details, see The Chromium Projects (
// https://goo.gl/hajyfN )
//
// Leaving the policy unset turns off HTTP Negotiate authentication on Android.
//
// Supported on: android
message AuthAndroidNegotiateAccountTypeProto {
  optional PolicyOptions policy_options = 1;
  optional string AuthAndroidNegotiateAccountType = 2;
}

// Kerberos delegation server allowlist
//
// Setting the policy assigns servers that Google Chrome may delegate to.
// Separate multiple server names with commas. Wildcards, *, are allowed.
//
// Leaving the policy unset means Google Chrome won't delegate user credentials,
// even if a server is detected as intranet.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AuthNegotiateDelegateAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional string AuthNegotiateDelegateAllowlist = 2;
}

// Use KDC policy to delegate credentials.
//
// Setting the policy to Enabled means HTTP authentication respects approval by
// KDC policy. In other words, Google Chrome delegates user credentials to the
// service being accessed if the KDC sets OK-AS-DELEGATE on the service ticket.
// See RFC 5896 ( https://tools.ietf.org/html/rfc5896.html ). The service should
// also be allowed by AuthNegotiateDelegateAllowlist.
//
// Setting the policy to Disabled or leaving it unset means KDC policy is
// ignored on supported platforms and only AuthNegotiateDelegateAllowlist is
// respected.
//
// On Microsoft® Windows®, KDC policy is always respected.
//
// Valid values:
//   True: Use KDC policy approval during HTTP authentication
//   False: Ignore KDC policy approval during HTTP authentication
//
// Supported on: chrome_os, linux, mac
message AuthNegotiateDelegateByKdcPolicyProto {
  optional PolicyOptions policy_options = 1;
  optional bool AuthNegotiateDelegateByKdcPolicy = 2;
}

// Kerberos delegation server allowlist
//
// This policy is deprecated, please use the 'AuthNegotiateDelegateAllowlist'
// policy instead.
//
// Supported on:
message AuthNegotiateDelegateWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional string AuthNegotiateDelegateWhitelist = 2;
}

// Supported authentication schemes
//
// Setting the policy specifies which HTTP authentication schemes Google Chrome
// supports.
//
// Leaving the policy unset employs all 4 schemes.
//
// Valid values:
//
// * basic
//
// * digest
//
// * ntlm
//
// * negotiate
//
// Note: Separate multiple values with commas.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AuthSchemesProto {
  optional PolicyOptions policy_options = 1;
  optional string AuthSchemes = 2;
}

// Authentication server allowlist
//
// Setting the policy specifies which servers should be allowed for integrated
// authentication. Integrated authentication is only on when Google Chrome gets
// an authentication challenge from a proxy or from a server in this permitted
// list.
//
// Leaving the policy unset means Google Chrome tries to detect if a server is
// on the intranet. Only then will it respond to IWA requests. If a server is
// detected as internet, then Google Chrome ignores IWA requests from it.
//
// Note: Separate multiple server names with commas. Wildcards, *, are allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AuthServerAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional string AuthServerAllowlist = 2;
}

// Authentication server allowlist
//
// This policy is deprecated and unsupported, please use the
// 'AuthServerAllowlist' policy instead.
//
// Supported on:
message AuthServerWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional string AuthServerWhitelist = 2;
}

// Enable AutoFill
//
// This policy is deprecated in M70, please use AutofillAddressEnabled and
// AutofillCreditCardEnabled instead.
//
// Enables Google Chrome's AutoFill feature and allows users to auto complete
// web forms using previously stored information such as address or credit card
// information.
//
// If you disable this setting, AutoFill will be inaccessible to users.
//
// If you enable this setting or do not set a value, AutoFill will remain under
// the control of the user. This will allow them to configure AutoFill profiles
// and to switch AutoFill on or off at their own discretion.
//
// Valid values:
//   True: Enable AutoFill
//   False: Disable AutoFill
//
// Supported on: android, chrome_os, linux, mac, win
message AutoFillEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AutoFillEnabled = 2;
}

// Define a list of protocols that can launch an external application from
// listed origins without prompting the user
//
// Allows you to set a list of protocols, and for each protocol an associated
// list of allowed origin patterns, that can launch an external application
// without prompting the user. The trailing separator should not be included
// when listing the protocol, so list "skype" instead of "skype:" or "skype://".
//
// If this policy is set, a protocol will only be permitted to launch an
// external application without prompting by policy if the protocol is listed,
// and the origin of the site trying to launch the protocol matches one of the
// origin patterns in that protocol's allowed_origins list. If either condition
// is false the external protocol launch prompt will not be omitted by policy.
//
// If this policy is not set, no protocols can launch without a prompt by
// default. Users may opt out of prompts on a per-protocol/per-site basis unless
// the ExternalProtocolDialogShowAlwaysOpenCheckbox policy is set to Disabled.
// This policy has no impact on per-protocol/per-site prompt exemptions set by
// users.
//
// The origin matching patterns use a similar format to those for the
// 'URLBlocklist' policy, which are documented at
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// However, origin matching patterns for this policy cannot contain "/path" or
// "@query" elements. Any pattern that does contain a "/path" or "@query"
// element will be ignored.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "allowed_origins": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "protocol": {
//                 "type": "string"
//             }
//         },
//         "required": [
//             "protocol",
//             "allowed_origins"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: fuchsia, linux, mac, win
message AutoLaunchProtocolsFromOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional string AutoLaunchProtocolsFromOrigins = 2;
}

// URLs where AutoOpenFileTypes can apply
//
// List of URLs specifying which urls AutoOpenFileTypes will apply to. This
// policy has no impact on automatically open values set by users.
//
// If this policy is set, files will only automatically open by policy if the
// url is part of this set and the file type is listed in AutoOpenFileTypes. If
// either condition is false the download won't automatically open by policy.
//
// If this policy isn't set, all downloads where the file type is in
// AutoOpenFileTypes will automatically open.
//
// A URL pattern has to be formatted according to
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AutoOpenAllowedForURLsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AutoOpenAllowedForURLs = 2;
}

// List of file types that should be automatically opened on download
//
// List of file types that should be automatically opened on download. The
// leading separator should not be included when listing the file type, so list
// "txt" instead of ".txt".
//
// Files with types that should be automatically opened will still be subject to
// the enabled safe browsing checks and won't be opened if they fail those
// checks.
//
// If this policy isn't set, only file types that a user has already specified
// to automatically be opened will do so when downloaded.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message AutoOpenFileTypesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AutoOpenFileTypes = 2;
}

// Automatically select client certificates for these sites
//
// Setting the policy lets you make a list of URL patterns that specify sites
// for which Chrome can automatically select a client certificate. The value is
// an array of stringified JSON dictionaries, each with the form { "pattern":
// "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting
// pattern. $FILTER restricts the client certificates the browser automatically
// selects from. Independent of the filter, only certificates that match the
// server's certificate request are selected. On Android and iOS, Chrome can
// only select client certificates that it has provisioned itself; it cannot
// access certificates installed at the operating system level.
//
// Examples for the usage of the $FILTER section:
//
// * When $FILTER is set to { "ISSUER": { "CN": "$ISSUER_CN" } }, only client
// certificates issued by a certificate with the CommonName $ISSUER_CN are
// selected.
//
// * When $FILTER contains both the "ISSUER" and the "SUBJECT" sections, only
// client certificates that satisfy both conditions are selected.
//
// * When $FILTER contains a "SUBJECT" section with the "O" value, a certificate
// needs at least one organization matching the specified value to be selected.
//
// * When $FILTER contains a "SUBJECT" section with a "OU" value, a certificate
// needs at least one organizational unit matching the specified value to be
// selected.
//
// * When $FILTER is set to {}, the selection of client certificates is not
// additionally restricted. Note that filters provided by the web server still
// apply.
//
// Leaving the policy unset means there's no autoselection for any site.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message AutoSelectCertificateForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AutoSelectCertificateForUrls = 2;
}

// Enable Automatic Sign-out Service
//
// This policy controls whether a user is automatically signed out of their
// previous session when they sign in to a new Google ChromeOS device.
//
// Setting the policy to Enabled will sign out the user from their previous
// session upon a successful sign-in to a new Google ChromeOS device.
//
// Setting the policy to Disabled or not set will sign out the user from their
// previous session only if either FloatingSsoEnabled or
// FloatingWorkspaceV2Enabled policies are Enabled.
//
// Valid values:
//   True: Sign out user from previous session upon sign-in to a new device
//   False: Sign out user from previous session upon sign-in to new device only
// if windows or cookies are synced
//
// Supported on: chrome_os
message AutoSignOutEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AutoSignOutEnabled = 2;
}

// Enable the autoclick accessibility feature
//
// Enable the autoclick accessibility feature.
//
// This feature is responsible to click without physically pressing your mouse
// or touchpad, hover over the object you'd like to click.
//
// If this policy is set to enabled, the autoclick will always be enabled.
//
// If this policy is set to disabled, the autoclick will always be disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the autoclick is disabled initially but can be
// enabled by the user anytime.
//
// Valid values:
//   True: Enable auto-click
//   False: Disable auto-click
//   None: Allow the user to decide
//
// Supported on: chrome_os
message AutoclickEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AutoclickEnabled = 2;
}

// Enable AutoFill for addresses
//
// Setting the policy to True or leaving it unset gives users control of
// Autofill for addresses in the UI.
//
// Setting the policy to False means Autofill never suggests or fills address
// information, nor does it save additional address information that users
// submit while browsing the web.
//
// Valid values:
//   True: Enable AutoFill for addresses
//   False: Disable AutoFill for addresses
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message AutofillAddressEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AutofillAddressEnabled = 2;
}

// Enable AutoFill for credit cards
//
// Setting the policy to True or leaving it unset means users can control
// autofill suggestions for credit cards in the UI.
//
// Setting the policy to False means autofill never suggests or fills credit
// card information, nor will it save additional credit card information that
// users might submit while browsing the web.
//
// Valid values:
//   True: Enable AutoFill for credit cards
//   False: Disable AutoFill for credit cards
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message AutofillCreditCardEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool AutofillCreditCardEnabled = 2;
}

// Settings for enhanced autofill
//
// Specifies whether users can let Google Chrome use Generative AI to better
// understand forms and help them fill more fields.
//
// 0 = Has the same effect as 1. Before M153, the setting allowed Google to use
// relevant data to improve its AI models. Relevant data may include prompts,
// inputs, outputs, source materials, and written feedback, depending on the
// feature. 0 is the default value, except when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using relevant data (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow enhanced autofill without improving AI models (improves AI models
// prior to M153).
//   1: Allow enhanced autofill without improving AI models.
//   2: Do not allow enhanced autofill.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message AutofillPredictionSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 AutofillPredictionSettings = 2;
}

// Block Autofill data types for specific sites
//
// Setting this policy allows you to specify which Autofill data types are
// blocked on specific URL patterns.
//
// The policy is structured as a list of dictionaries. Each dictionary must
// contain:
// * "url_pattern": A content setting URL pattern for the main frame (e.g.,
// "https://[*.]example.com").
// * "blocked_types": A list of strings representing the categories of Autofill
// data to block.
//
// The supported values for "blocked_types" are:
// * "contact_info": Blocks filling and saving of contact information.
// * "payments": Blocks filling and saving of credit cards and payment methods.
// * "identity_docs": Blocks filling and saving of identity documents (e.g.
// passport, drivers license, national id).
// * "travel": Blocks filling and saving of travel information (e.g. flight
// reservation, vehicle registration).
// * "shopping": Blocks filling and saving of shopping information (e.g. online
// orders, shipments).
// * "all": Blocks filling and saving of all Autofill data types.
//
// If a data type is blocked for a site, both the generation of suggestions and
// the prompt to save/import new data of that type are disabled on that site.
//
// If a URL matches multiple pattern entries in the list, the blocked types from
// all matching entries are combined (union-merged). Invalid URL patterns in the
// list are ignored.
//
// If this policy is unset, no Autofill data types are blocked by domain.
//
// For detailed information on valid URL patterns, please see:
// https://chromeenterprise.google/policies/url-patterns. Wildcard * is
// supported, this pattern matches any URL, with any scheme, port, and path.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "blocked_types": {
//                 "items": {
//                     "enum": [
//                         "contact_info",
//                         "payments",
//                         "identity_docs",
//                         "travel",
//                         "shopping",
//                         "all"
//                     ],
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "url_pattern": {
//                 "type": "string"
//             }
//         },
//         "required": [
//             "url_pattern",
//             "blocked_types"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message AutofillSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional string AutofillSettings = 2;
}

// Enable automated password change
//
// This policy controls the availability of Google Chrome's automated password
// change feature.
//
// If enabled, a user can trigger a process where the browser attempts to change
// their password on a website automatically. This process is managed by
// Generative AI. The new password is saved in the browser's password manager.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow feature use and improving AI models
//   1: Allow feature use without improving AI models
//   2: Do not allow feature
//
// Supported on: chrome_os, linux, mac, win
message AutomatedPasswordChangeSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 AutomatedPasswordChangeSettings = 2;
}

// Allow automatic downloads on these sites
//
// Allows you to set a list of URL patterns that specify sites which are allowed
// to download multiple files automatically.
//
// For detailed information on valid URL patterns, please see
// https://chromeenterprise.google/policies/url-patterns.
//
// If a URL matches both AutomaticDownloadsAllowedForUrls and
// AutomaticDownloadsBlockedForUrls, AutomaticDownloadsBlockedForUrls takes
// precedence.
//
// If this policy is not set, DefaultAutomaticDownloadsSetting applies for all
// sites, if it is set. If not, the user's personal setting applies.
//
// Supported on: android, chrome_os, linux, mac, win
message AutomaticDownloadsAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AutomaticDownloadsAllowedForUrls = 2;
}

// Block automatic downloads on these sites
//
// Allows you to set a list of URL patterns that specify sites which are not
// allowed to download multiple files automatically.
//
// For detailed information on valid URL patterns, please see
// https://chromeenterprise.google/policies/url-patterns.
//
// If a URL matches both AutomaticDownloadsAllowedForUrls and
// AutomaticDownloadsBlockedForUrls, AutomaticDownloadsBlockedForUrls takes
// precedence.
//
// If this policy is not set, DefaultAutomaticDownloadsSetting applies for all
// sites, if it is set. If not, the user's personal setting applies.
//
// Supported on: android, chrome_os, linux, mac, win
message AutomaticDownloadsBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AutomaticDownloadsBlockedForUrls = 2;
}

// Allow automatic fullscreen on these sites
//
// For security reasons, the
// requestFullscreen() web API
// requires a prior user gesture ("transient activation") to be called or will
// otherwise fail. Users' personal settings may allow certain origins to call
// this API without a prior user gesture, as described in
// https://chromestatus.com/feature/6218822004768768.
//
// This policy supersedes users' personal settings and allows matching origins
// to
// call the API without a prior user gesture.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns.
// Wildcards, *, are allowed.
//
// Origins matching both blocked and allowed policy patterns will be blocked.
// Origins not specified by policy nor user settings will require a prior user
// gesture to call this API.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AutomaticFullscreenAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AutomaticFullscreenAllowedForUrls = 2;
}

// Block automatic fullscreen on these sites
//
// For security reasons, the
// requestFullscreen() web API
// requires a prior user gesture ("transient activation") to be called or will
// otherwise fail. Users' personal settings may allow certain origins to call
// this API without a prior user gesture, as described in
// https://chromestatus.com/feature/6218822004768768.
//
// This policy supersedes users' personal settings and blocks matching origins
// from calling the API without a prior user gesture.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns.
// Wildcards, *, are allowed.
//
// Origins matching both blocked and allowed policy patterns will be blocked.
// Origins not specified by policy nor user settings will require a prior user
// gesture to call this API.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AutomaticFullscreenBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AutomaticFullscreenBlockedForUrls = 2;
}

// Allow media autoplay
//
// Setting the policy to True lets Google Chrome autoplay media. Setting the
// policy to False stops Google Chrome from autoplaying media.
//
// If this policy is left unset, Google Chrome doesn't autoplay media. But, for
// certain URL patterns, you can use the AutoplayAllowlist policy to change this
// setting.
//
// If this policy changes while Google Chrome is running, it only applies to
// newly opened tabs.
//
// Valid values:
//   True: Allow Chrome to autoplay media
//   False: Do not allow Chrome to autoplay media
//   None: Do not allow Chrome to autoplay media unless the URL is specified in
// the AutoplayAllowlist policy
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AutoplayAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool AutoplayAllowed = 2;
}

// Allow media autoplay on a allowlist of URL patterns
//
// Setting the policy lets videos play automatically (without user consent) with
// audio content in Google Chrome. If AutoplayAllowed policy is set to True,
// then this policy has no effect. If AutoplayAllowed is set to False, then any
// URL patterns set in this policy can still play. If this policy changes while
// Google Chrome is running, it only applies to newly opened tabs.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message AutoplayAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AutoplayAllowlist = 2;
}

// Allow media autoplay on a allowlist of URL patterns
//
// This policy is deprecated and unsupported, please use the 'AutoplayAllowlist'
// policy instead.
//
// Supported on:
message AutoplayWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList AutoplayWhitelist = 2;
}

// Control the BackForwardCache feature.
//
// When enabled the BackForwardCache feature allows the use of the back-forward
// cache. When navigating away from a page, its current state (document tree,
// script, etc.) may be preserved in the back-forward cache. If the browser
// navigates back to the page, the page may be restored from the back-forward
// cache and displayed in the state it was in before being cached.
//
// This feature might cause issues for some websites that do not expect this
// caching. In particular, some websites depend on the "unload" event being
// dispatched when the browser navigates away from the page. The "unload" event
// will not be dispatched if the page enters the back-forward cache.
//
// If this policy is set to enabled or not set,
// the BackForwardCache feature will be enabled.
//
// If this policy is set to disabled then the feature will be force disabled.
//
// Valid values:
//   True: Allow the back-forward cache to be used
//   False: Do not allow the back-forward cache to be used
//
// Supported on: android
message BackForwardCacheEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BackForwardCacheEnabled = 2;
}

// Allow Back/Forward Cache for WebSockets
//
// This policy controls whether active WebSocket connections are disconnected
// when a page enters back/forward cache. Active WebSocket connections
// previously prevented a page from being stored in back/forward cache, but
// Google Chrome has changed this behavior to disconnect the WebSockets instead,
// allowing the page to be cached and restoring it in a disconnected state.
//
// If this policy is set to Enabled or left unset, WebSockets are disconnected
// when a page enters back/forward cache.
//
// If this policy is set to Disabled, WebSockets will not be disconnected when a
// page enters back/forward cache. Since back/forward cache does not support
// active WebSockets, this means pages with active WebSockets will not be
// cached.
//
// This policy is intended to be temporary and will be removed in the future.
//
// Valid values:
//   True: Allow Back/Forward Cache for WebSockets (disconnect them when
// entering cache).
//   False: Active WebSocket connections will prevent pages from entering
// Back/Forward Cache.
//
// Supported on: android, chrome_os, linux, mac, win
message BackForwardCacheForWebSocketsAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool BackForwardCacheForWebSocketsAllowed = 2;
}

// Continue running background apps when Google Chrome is closed
//
// Setting the policy to Enabled turns background mode on. In background mode, a
// Google Chrome process is started on OS sign-in and keeps running when the
// last browser window is closed, allowing background apps and the browsing
// session to remain active. The background process displays an icon in the
// system tray and can always be closed from there.
//
// Setting the policy to Disabled turns background mode off.
//
// If you set the policy, users can't change it in the browser settings. If
// unset, background mode is off at first, but users can change it.
//
// Valid values:
//   True: Enable background mode
//   False: Disable background mode
//   None: Allow the user to decide
//
// Supported on: linux, win
message BackgroundModeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BackgroundModeEnabled = 2;
}

// Allow Basic authentication for HTTP
//
// Setting the policy to Enabled or leaving it unset will allow Basic
// authentication challenges received over non-secure HTTP.
//
// Setting the policy to Disabled forbids non-secure HTTP requests from using
// the Basic authentication scheme; only secure HTTPS is allowed.
//
// This policy setting is ignored (and Basic is always forbidden) if the
// AuthSchemes policy is set and does not include Basic.
//
// Valid values:
//   True: Basic authentication is allowed on HTTP connections
//   False: Non-secure HTTP connections are not permitted to use Basic
// authentication; HTTPS is required
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message BasicAuthOverHttpEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BasicAuthOverHttpEnabled = 2;
}

// Enable Battery Saver Mode
//
// This policy enables or disables the Battery Saver Mode setting.
// On Chrome, this setting makes it so that frame rate is throttled to lower
// power consumption. If this policy is unset, the end user can control this
// setting in chrome://settings/performance.
// On ChromeOS, this setting makes it so that frame rate and CPU frequency are
// throttled, backlights are dimmed, and Android is put in Battery Saver Mode.
// On devices with multiple CPUs, some CPUs will be turned off.
// The different levels are:
// Disabled (0): Battery Saver Mode will be disabled.
// EnabledBelowThreshold (1): Battery Saver Mode will be enabled when the device
// is on battery power and battery level is low.
// EnabledOnBattery (2): This value is deprecated as of M121. From M121 onwards,
// values will be      treated as EnabledBelowThreshold.
//
// Valid values:
//   0: Battery Saver Mode will be disabled.
//   1: Battery Saver Mode will be enabled when the device is on battery power
// and battery level is low.
//   2: This value is deprecated as of M121. In M121 and after, values will be
// treated as EnabledBelowThreshold.
//
// Supported on: chrome_os, linux, mac, win
message BatterySaverModeAvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional int64 BatterySaverModeAvailability = 2;
}

// Control new behavior for the cancel dialog produced by the beforeunload event
//
// From M131, this policy is deprecated.This policy provides a temporary opt-out
// for two related fixes to the behavior of the confirmation dialog shown by the
// beforeunload event.
// When this policy is Enabled, the new and correct behavior will be used. When
// this policy is Disabled, the old and legacy behavior will be used. When this
// policy is not set, the default behavior will be used.
// This policy is a temporary workaround and will be removed soon.
//
// New and correct behavior: In `beforeunload`, calling `event.preventDefault()`
// will trigger the confirmation dialog. Setting `event.returnValue` to the
// empty string will not trigger the confirmation dialog.
//
// Old and legacy behavior: In `beforeunload`, calling `event.preventDefault()`
// will not trigger the confirmation dialog. Setting `event.returnValue` to the
// empty string will trigger the confirmation dialog.
//
// Valid values:
//   True: Show cancel dialog when event.preventDefault() is called for
// beforeunload event. Do not show cancel dialog when event.returnValue is the
// empty string for beforeunload event.
//   False: Do not show cancel dialog when event.preventDefault() is called for
// beforeunload event. Show cancel dialog when beforeunload event.returnValue is
// the empty string for beforeunload event.
//   None: Use default behavior of feature rollout plan.
//
// Supported on:
message BeforeunloadEventCancelByPreventDefaultEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BeforeunloadEventCancelByPreventDefaultEnabled = 2;
}

// Blocks external extensions from being installed
//
// Controls external extensions installation.
//
// Setting this policy to Enabled blocks external extensions from being
// installed.
//
// Setting this policy to Disabled or leaving it unset allows external
// extensions to be installed.
//
// External extensions and their installation are documented at
// https://developer.chrome.com/docs/extensions/how-to/distribute/install-
// extensions.
//
// Note: This policy only applies to platforms that support extensions.
//
// Valid values:
//   True: Block installation of external extensions
//   False: Allow installation of external extensions
//
// Supported on: android, linux, mac, win
message BlockExternalExtensionsProto {
  optional PolicyOptions policy_options = 1;
  optional bool BlockExternalExtensions = 2;
}

// Block third party cookies
//
// Setting the policy to Enabled prevents webpage elements that aren't from the
// domain that's in the browser's address bar from setting cookies. Setting the
// policy to Disabled lets those elements set cookies and prevents users from
// changing this setting.
//
// Leaving it unset allows third-party cookies, but users can change this
// setting.
//
// Note: This policy doesn't apply in Incognito mode, where third-party cookies
// are blocked and can only be allowed at the site level. To allow cookies at
// the site level, use the CookiesAllowedForUrls policy.
//
// Valid values:
//   True: Block 3rd party cookies
//   False: Allow 3rd party cookies
//   None: Allow 3rd party cookies, but allow the user to change this setting
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message BlockThirdPartyCookiesProto {
  optional PolicyOptions policy_options = 1;
  optional bool BlockThirdPartyCookies = 2;
}

// Block truncated cookies
//
// Note: No site breakage has been reported since Chrome began blocking these
// cookies by default starting in M118, so this functionality won't be
// configurable (and this policy will have no effect) starting in M127.
//
// This policy provides a temporary opt-out for changes to how Chrome handles
// cookies set via JavaScript that contain certain control characters (NULL,
// carriage return, and line feed).
// Previously, the presence of any of these characters in a cookie string would
// cause it to be truncated but still set.
// Now, the presence of these characters will cause the whole cookie string to
// be ignored.
//
// When this policy is set to True (the default), the new behavior is enabled.
//
// When this policy is set to False, the old behavior is enabled.
//
// Valid values:
//   True: Block truncated cookies
//   False: Allow truncated cookies
//
// Supported on: fuchsia
message BlockTruncatedCookiesProto {
  optional PolicyOptions policy_options = 1;
  optional bool BlockTruncatedCookies = 2;
}

// Enable Bookmark Bar
//
// Setting the policy to True displays a bookmark bar in Google Chrome. Setting
// the policy to False means users never see the bookmark bar.
//
// If you set the policy, users can't change it. If not set, users decide
// whether to use this function.
//
// Valid values:
//   True: Enable bookmark bar
//   False: Disable bookmark bar
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message BookmarkBarEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BookmarkBarEnabled = 2;
}

// Bind Google credentials to a device
//
// Controls the state of the Device Bound Session Credentials feature.
//
// Device Bound Session Credentials protects Google authentication cookies
// against cookie theft by regularly providing a cryptographic proof of device
// possession to Google servers.
//
// If this policy is set to false, Device Bound Session Credentials feature will
// be disabled.
//
// If this policy is set to true, Device Bound Session Credentials feature will
// be enabled.
//
// If this policy is unset, Google Chrome will follow the default rollout
// process for the Device Bound Session Credentials feature, which means that
// the feature will be gradually rolled out to an increasing number of users.
//
// Valid values:
//   True: Enable Device Bound Session Credentials.
//   False: Disable Device Bound Session Credentials.
//   None: Device Bound Session Credentials may be used depending on feature
// launch process.
//
// Supported on: win
message BoundSessionCredentialsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BoundSessionCredentialsEnabled = 2;
}

// Enable add person in user manager
//
// If this policy is set to true or not configured, Google Chrome and Lacros
// will allow to add a new person from the user manager.
//
// If this policy is set to false, Google Chrome and Lacros will not allow
// adding a new person from the user manager.
//
// Valid values:
//   True: Allow adding new profiles
//   False: Disallow adding new profiles
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message BrowserAddPersonEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BrowserAddPersonEnabled = 2;
}

// Enable the Chrome Enterprise Device Trust Connector attestation flow for a
// list of URLs on Managed Browsers
//
// Enable Chrome Enterprise Device Trust Connector for a list of URLs.
//
// Setting this policy specifies for which URLs Google Chrome will offer to
// start the attestation flow for managed browsers. The latter allows those
// websites to get an attested set of context-aware signals from the device.
// This policy can only be configured via the Chrome Enterprise Connectors page
// on the Google Admin console.
//
// Leaving this policy unset or empty means that no website will be able to
// start a browser-level attestation flow and get signals from the device.
// However if the corresponding
// UserContextAwareAccessSignalsAllowlist policy is enabled then the attestation
// flow can be started for the managed profile and device signals can be
// collected.
//
// For detailed information on valid URL patterns, please see
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// Supported on: ios, linux, mac, win
message BrowserContextAwareAccessSignalsAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList BrowserContextAwareAccessSignalsAllowlist = 2;
}

// Enable guest mode in browser
//
// If this policy is set to Enabled or not configured, Google Chrome will enable
// guest logins. Guest logins are Google Chrome profiles where all windows are
// in incognito mode.
//
// If this policy is set to Disabled, Google Chrome will not allow guest
// profiles to be started.
//
// Valid values:
//   True: Allow guest browser logins
//   False: Prevent guest browser logins
//
// Supported on: linux, mac, win
message BrowserGuestModeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BrowserGuestModeEnabled = 2;
}

// Enforce browser guest mode
//
// Setting the policy to Enabled means Google Chrome enforces guest sessions and
// prevents profile sign-ins. Guest sign-ins are Google Chrome profiles where
// windows are in Incognito mode.
//
// Setting the policy to Disabled, leaving it unset, or disabling browser Guest
// mode (through BrowserGuestModeEnabled) allows the use of new and existing
// profiles.
//
// Valid values:
//   True: Only allow guest browser logins
//   False: Allow guest browser logins and profile logins
//
// Supported on: fuchsia, linux, mac, win
message BrowserGuestModeEnforcedProto {
  optional PolicyOptions policy_options = 1;
  optional bool BrowserGuestModeEnforced = 2;
}

// Browser experiments icon in toolbar
//
// Setting the policy to Enabled or leaving the policy unset means that users
// can access browser experimental features through an icon in the toolbar
//
// Setting the policy to Disabled removes the browser experimental features icon
// from the toolbar.
//
// chrome://flags and any other means of turning off and on browser features
// will still behave as expected regardless of whether this policy is Enabled or
// Disabled.
//
// Valid values:
//   True: Enable browser experimental features toolbar entrypoint
//   False: Disable browser experimental features toolbar entrypoint
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message BrowserLabsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BrowserLabsEnabled = 2;
}

// Block Browser Legacy Extension Points
//
// Setting the policy to Enabled or leaving it unset will permit Google Chrome
// to apply the additional extension point security mitigation to block legacy
// extension points in the Browser process.
//
// Setting the policy to Disabled has a detrimental effect on Google Chrome's
// security and stability as unknown and potentially hostile code can load
// inside Google Chrome's browser process. Only turn off the policy if there are
// compatibility issues with third-party software that must run inside Google
// Chrome's browser process.
//
// Note: Read more about Process mitigation policies ( https://chromium.googleso
// urce.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-
// policies ).
//
// Valid values:
//   True: Block legacy extension points in the Browser process
//   False: Do not block legacy extension points in the Browser process
//
// Supported on: win
message BrowserLegacyExtensionPointsBlockedProto {
  optional PolicyOptions policy_options = 1;
  optional bool BrowserLegacyExtensionPointsBlocked = 2;
}

// Allow queries to a Google time service
//
// Setting the policy to Enabled or leaving it unset means Google Chrome send
// occasional queries to a Google server to retrieve an accurate timestamp.
//
// Setting the policy to Disabled stops Google Chrome from sending these
// queries.
//
// Valid values:
//   True: Allow queries to a Google server to retrieve an accurate timestamp
//   False: Do not allow queries to Google servers to retrieve timestamps
//
// Supported on: fuchsia, linux, mac, win
message BrowserNetworkTimeQueriesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BrowserNetworkTimeQueriesEnabled = 2;
}

// Browser sign in settings
//
// This policy controls the sign-in behavior of the browser. It allows you to
// specify if the user can sign in to Google Chrome with their account and use
// account related services like Google Chrome Sync.
//
// If the policy is set to "Disable browser sign-in" then the user cannot sign
// in to the browser and use account-based services. In this case browser-level
// features like Google Chrome Sync cannot be used and will be unavailable. On
// iOS, if the user was signed in and the policy is set to "Disabled" they will
// be signed out immediately. On other platforms, they will be signed out the
// next time they run Google Chrome. On all platforms, their local profile data
// like bookmarks, passwords etc. will be preserved and still usable. The user
// will still be able to sign into and use Google web services like Gmail.
//
// If the policy is set to "Enable browser sign-in," then the user is allowed to
// sign in to the browser. On all platforms except iOS, the user is
// automatically signed in to the browser when signed in to Google web services
// like Gmail. Being signed in to the browser means the user's account
// information will be kept by the browser. However, it does not mean that
// Google Chrome Sync will be turned on by default; the user must separately
// opt-in to use this feature. Enabling this policy will prevent the user from
// turning off the setting that allows browser sign-in. To control the
// availability of Google Chrome Sync, use the SyncDisabled policy.
//
// If the policy is set to "Force browser sign-in" the user is presented with an
// account selection dialog and has to choose and sign in to an account to use
// the browser. This ensures that for managed accounts the policies associated
// with the account are applied and enforced. The default value of
// BrowserGuestModeEnabled will be set to disabled. Note that existing unsigned
// profiles will be locked and inaccessible after enabling this policy. For more
// information, see help center article:
// https://support.google.com/chrome/?p=force_browser_signin . This option is
// not supported on Google ChromeOS nor Android, where it will fall back to
// "Enable browser sign-in" if used.
//
// If this policy is not set then the user can decide if they want to enable
// browser sign-in in the Google Chrome settings and use it as they see fit.
//
// Valid values:
//   0: Disable browser sign-in
//   1: Enable browser sign-in
//   2: Force users to sign-in to use the browser
//
// Supported on: android, fuchsia, ios, linux, mac, win
message BrowserSigninProto {
  optional PolicyOptions policy_options = 1;
  optional int64 BrowserSignin = 2;
}

// Command-line parameters for switching from the alternative browser.
//
// Setting the policy to a list of strings means the strings are joined with
// spaces and passed from Internet Explorer® to Google Chrome as command-line
// parameters. If a parameter contains ${url}, ${url} is replaced with the URL
// of the page to open. If no parameter contains ${url}, the URL is appended at
// the end of the command line.
//
// Environment variables are expanded. On Microsoft® Windows®, %ABC% is replaced
// with the value of the ABC environment variable.
//
// Leaving the policy unset means Internet Explorer® only passes the URL to
// Google Chrome as a command-line parameter.
//
// Note: If the Legacy Browser Support add-in for Internet Explorer® isn't
// installed, this policy has no effect.
//
// Supported on: win
message BrowserSwitcherChromeParametersProto {
  optional PolicyOptions policy_options = 1;
  optional StringList BrowserSwitcherChromeParameters = 2;
}

// Path to Chrome for switching from the alternative browser.
//
// This policy controls the command to use to open URLs in Google Chrome when
// switching from Internet Explorer®. This policy can be set to an executable
// file path or ${chrome} to autodetect the location of Google Chrome.
//
// Leaving the policy unset means Internet Explorer® autodetects Google Chrome's
// own executable path when launching Google Chrome from Internet Explorer.
//
// Note: If the Legacy Browser Support add-in for Internet Explorer® isn't
// installed, this policy has no effect.
//
// Supported on: win
message BrowserSwitcherChromePathProto {
  optional PolicyOptions policy_options = 1;
  optional string BrowserSwitcherChromePath = 2;
}

// Delay before launching alternative browser (milliseconds)
//
// Setting the policy to a number has Google Chrome show a message for that
// number of milliseconds, then it opens an alternative browser.
//
// Leaving the policy unset or set to 0 means navigating to a designated URL
// immediately opens it in an alternative browser.
//
// Supported on: linux, mac, win
message BrowserSwitcherDelayProto {
  optional PolicyOptions policy_options = 1;
  optional int64 BrowserSwitcherDelay = 2;
}

// Enable the Legacy Browser Support feature.
//
// Setting the policy to Enabled means Google Chrome will try to launch some
// URLs in an alternate browser, such as Internet Explorer®. This feature is set
// using the policies in the Legacy Browser support group.
//
// Setting the policy to Disabled or leaving it unset means Google Chrome won't
// try to launch designated URLs in an alternate browser.
//
// Valid values:
//   True: Enable Legacy Browser Support
//   False: Disable Legacy Browser Support
//
// Supported on: linux, mac, win
message BrowserSwitcherEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BrowserSwitcherEnabled = 2;
}

// URL of an XML file that contains URLs that should never trigger a browser
// switch.
//
// Setting the policy to a valid URL has Google Chrome download the site list
// from that URL and apply the rules as if they were set up with the
// BrowserSwitcherUrlGreylist policy. These policies prevent Google Chrome and
// the alternative browser from opening one another.
//
// Leaving it unset (or set to a invalid URL) means Google Chrome doesn't use
// the policy as a source of rules for not switching browsers.
//
// Note: This policy points to an XML file in the same format as Internet
// Explorer®'s SiteList policy. This loads rules from an XML file, without
// sharing those rules with Internet Explorer®. Read more on Internet
// Explorer®'s SiteList policy ( https://docs.microsoft.com/internet-
// explorer/ie11-deploy-guide/what-is-enterprise-mode )
//
// Supported on: linux, mac, win
message BrowserSwitcherExternalGreylistUrlProto {
  optional PolicyOptions policy_options = 1;
  optional string BrowserSwitcherExternalGreylistUrl = 2;
}

// URL of an XML file that contains URLs to load in an alternative browser.
//
// Setting the policy to a valid URL has Google Chrome download the site list
// from that URL and apply the rules as if they were set up with the
// BrowserSwitcherUrlList policy.
//
// Leaving it unset (or set to a invalid URL) means Google Chrome doesn't use
// the policy as a source of rules for switching browsers.
//
// Note: This policy points to an XML file in the same format as Internet
// Explorer®'s SiteList policy. This loads rules from an XML file, without
// sharing those rules with Internet Explorer®. Read more on Internet
// Explorer®'s SiteList policy ( https://docs.microsoft.com/internet-
// explorer/ie11-deploy-guide/what-is-enterprise-mode)
//
// Supported on: fuchsia, linux, mac, win
message BrowserSwitcherExternalSitelistUrlProto {
  optional PolicyOptions policy_options = 1;
  optional string BrowserSwitcherExternalSitelistUrl = 2;
}

// Keep last tab open in Chrome.
//
// Setting the policy to Enabled or leaving it unset has Google Chrome keep at
// least one tab open, after switching to an alternate browser.
//
// Setting the policy to Disabled has Google Chrome close the tab after
// switching to an alternate browser, even if it was the last tab. This causes
// Google Chrome to exit completely.
//
// Valid values:
//   True: Keep at least one Chrome tab open
//   False: Close Chrome completely
//
// Supported on: linux, mac, win
message BrowserSwitcherKeepLastChromeTabProto {
  optional PolicyOptions policy_options = 1;
  optional bool BrowserSwitcherKeepLastChromeTab = 2;
}

// Sitelist parsing mode
//
// This policy controls how Google Chrome interprets sitelist/greylist policies
// for the Legacy Browser Support feature. It affects the following policies:
// BrowserSwitcherUrlList, BrowserSwitcherUrlGreylist,
// BrowserSwitcherUseIeSitelist, BrowserSwitcherExternalSitelistUrl, and
// BrowserSwitcherExternalGreylistUrl.
//
// If 'Default' (0) or unset, URL matching is less strict. Rules that do not
// contain "/" look for a substring anywhere in the URL's hostname. Matching the
// path component of a URL is case-sensitive.
//
// If 'IESiteListMode' (1), URL matching is more strict. Rules that do not
// contain "/" only match at the end of the hostname. They must also be at a
// domain name boundary. Matching the path component of a URL is case-
// insensitive. This is more compatible with Microsoft® Internet Explorer® and
// Microsoft® Edge®.
//
// For example, with the rules "example.com" and "acme.com/abc":
//
// "http://example.com/", "http://subdomain.example.com/" and
// "http://acme.com/abc" match regardless of parsing mode.
//
// "http://notexample.com/", "http://example.com.invalid.com/",
// "http://example.comabc/" only match in 'Default' mode.
//
// "http://acme.com/ABC" only matches in 'IESiteListMode'.
//
// Valid values:
//   0: Default behavior for LBS.
//   1: More compatible with Microsoft IE/Edge enterprise mode sitelists.
//
// Supported on: linux, mac, win
message BrowserSwitcherParsingModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 BrowserSwitcherParsingMode = 2;
}

// Websites that should never trigger a browser switch.
//
// Setting the policy controls the list of websites that will never cause a
// browser switch. Each item is treated as a rule. Those rules that match won't
// open an alternative browser. Unlike the BrowserSwitcherUrlList policy, rules
// apply to both directions. When the Internet Explorer® add-in is on, it also
// controls whether Internet Explorer® should open these URLs in Google Chrome.
//
// Leaving the policy unset adds no websites to the list.
//
// Note: Elements can also be added to this list through the
// BrowserSwitcherExternalGreylistUrl policy.
//
// Supported on: fuchsia, linux, mac, win
message BrowserSwitcherUrlGreylistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList BrowserSwitcherUrlGreylist = 2;
}

// Websites to open in alternative browser
//
// Setting the policy controls the list of websites to open in an alternative
// browser. Each item is treated as a rule for something to open in an
// alternative browser. Google Chrome uses those rules when choosing if a URL
// should open in an alternative browser. When the Internet Explorer® add-in is
// on, Internet Explorer® switches back to Google Chrome when the rules don't
// match. If rules contradict each other, Google Chrome uses the most specific
// rule.
//
// Leaving the policy unset adds no websites to the list.
//
// Note: Elements can also be added to this list through the
// BrowserSwitcherUseIeSitelist and BrowserSwitcherExternalSitelistUrl policies.
//
// Supported on: linux, mac, win
message BrowserSwitcherUrlListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList BrowserSwitcherUrlList = 2;
}

// Use Internet Explorer's SiteList policy for Legacy Browser Support.
//
// This policy controls whether to load rules from Internet Explorer®'s SiteList
// policy.
//
// When this policy is set to true, Google Chrome reads Internet Explorer®'s
// SiteList to obtain the site list's URL. Google Chrome then downloads the site
// list from that URL, and applies the rules as if they had been configured with
// the BrowserSwitcherUrlList policy.
//
// When this policy is false or unset, Google Chrome does not use Internet
// Explorer®'s SiteList policy as a source of rules for switching browsers.
//
// For more information on Internet Explorer's SiteList policy:
// https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/what-is-
// enterprise-mode
//
// Valid values:
//   True: Use the Internet Explorer SiteList policy as a source of rules
//   False: Do not use the Internet Explorer SiteList policy as a source of
// rules
//
// Supported on: win
message BrowserSwitcherUseIeSitelistProto {
  optional PolicyOptions policy_options = 1;
  optional bool BrowserSwitcherUseIeSitelist = 2;
}

// Configure the color of the browser's theme
//
// This policy allows admins to configure the color of Google Chrome's theme.
// The input string should be a valid hex color string matching the format
// "#RRGGBB".
//
// Setting the policy to a valid hex color causes a theme based on that color to
// be automatically generated and applied to the browser. Users won't be able to
// change the theme set by the policy.
//
// Leaving the policy unset lets users change their browser's theme as
// preferred.
//
// Supported on: fuchsia, ios, linux, mac, win
message BrowserThemeColorProto {
  optional PolicyOptions policy_options = 1;
  optional string BrowserThemeColor = 2;
}

// Browsing Data Lifetime Settings
//
// Configures browsing data lifetime settings for Google Chrome. This policy
// allows admins to configure (per data-type) when data is deleted by the
// browser. This is useful for customers that work with sensitive customer data.
//
// Warning: Setting this policy can impact and permanently remove local personal
// data. It is recommended to test your settings before deploying to prevent
// accidental deletion of personal data.
//
// The available data types are 'browsing_history', 'download_history',
// 'cookies_and_other_site_data', 'cached_images_and_files', 'password_signin',
// 'autofill', 'site_settings' and 'hosted_app_data'. 'download_history' and
// 'hosted_app_data' are not supported on Android.
//
// The browser will automatically remove data of selected types that is older
// than 'time_to_live_in_hours'. The minimum value that can be set is 1 hour.
//
// The deletion of expired data will happen 15 seconds after the browser starts
// then every 30 minutes while the browser is running.
//
// The user will stay signed into their Google account when deleting cookies.
//
// Until Chrome 114, this policy required the SyncDisabled policy to be set to
// true. Starting Chrome 115, setting this policy will disable sync for the
// respective data types if neither `Chrome Sync` is disabled by setting the
// SyncDisabled policy nor BrowserSignin is disabled.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "data_types": {
//                 "items": {
//                     "enum": [
//                         "browsing_history",
//                         "download_history",
//                         "cookies_and_other_site_data",
//                         "cached_images_and_files",
//                         "password_signin",
//                         "autofill",
//                         "site_settings",
//                         "hosted_app_data"
//                     ],
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "time_to_live_in_hours": {
//                 "minimum": 1,
//                 "type": "integer"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message BrowsingDataLifetimeProto {
  optional PolicyOptions policy_options = 1;
  optional string BrowsingDataLifetime = 2;
}

// Configure the installer for Bruschetta VMs on Google ChromeOS devices
//
// Sets metadata used by the installer for Bruschetta VMs on Google ChromeOS
// devices, prior to it
// being installed.
//
// Value schema:
// {
//     "description": "Installer metadata",
//     "properties": {
//         "display_name": {
//             "description": "Name to show in the installer UI e.g. Happy VM.
// If unset will show a\nfallback name, either derived from the first (by
// display order) entry in\nthe BruschettaVMConfiguration policy, or failing
// that, a generic name.",
//             "type": "string"
//         },
//         "learn_more_url": {
//             "description": "A URL for users to visit to learn more. If unset
// there will\nbe no \"learn more\" URL in the installer. If present, it must
// use\nthe https scheme.",
//             "type": "string"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message BruschettaInstallerConfigurationProto {
  optional PolicyOptions policy_options = 1;
  optional string BruschettaInstallerConfiguration = 2;
}

// Configure Bruschetta VMs on Google ChromeOS
//
// Configure installation and runtime policies for Bruschetta VMs on
// Google ChromeOS. This allows for
// third-party VMs to be installed by users. This feature is disabled by
// default.
//
// This policy is a map of configuration IDs to VM configurations. When a VM is
// installed from a configuration it is persistently associated with that
// configuration ID, and any runtime policies in that configuration apply to
// that
// VM. Multiple VMs may be installed from the same configuration on the same
// device.
//
// Value schema:
// {
//     "description": "Mapping from persistent IDs to VM configurations",
//     "patternProperties": {
//         "[a-zA-Z0-9-_]+": {
//             "description": "A VM configuration. Denotes a type of VM that the
// user can install, which will be persistently associated with the ID of this
// configuration, and controls that apply to this type of VM.",
//             "properties": {
//                 "display_order": {
//                     "description": "The order in which the VM configuration
// will be displayed in the installer. When multiple VM configurations are
// specified, the one with the smallest display_order value is displayed at the
// top of the list. Defaults to zero.",
//                     "type": "integer"
//                 },
//                 "enabled_state": {
//                     "description": "Controls whether VMs using this
// configuration can be installed and run (<ph
// name=\"INSTALL_ALLOWED\">INSTALL_ALLOWED</ph>), run but not installed (<ph
// name=\"RUN_ALLOWED\">RUN_ALLOWED</ph>), or cannot be run (<ph
// name=\"BLOCKED\">BLOCKED</ph>). Note that to install a VM the
// installer_image_x86_64 key must also be set. Removing a configuration
// entirely implicitly sets this to <ph name=\"BLOCKED\">BLOCKED</ph>,
// preventing VMs from running without a policy.",
//                     "enum": [
//                         "BLOCKED",
//                         "RUN_ALLOWED",
//                         "INSTALL_ALLOWED"
//                     ],
//                     "type": "string"
//                 },
//                 "installer_image_x86_64": {
//                     "description": "The UEFI-bootable disk image used to
// install the VM on x86_64 devices.",
//                     "properties": {
//                         "hash": {
//                             "description": "Hexadecimal encoded SHA-256 hash
// of the disk image.",
//                             "type": "string"
//                         },
//                         "url": {
//                             "description": "URL of the disk image to
// download.",
//                             "type": "string"
//                         }
//                     },
//                     "required": [
//                         "url",
//                         "hash"
//                     ],
//                     "type": "object"
//                 },
//                 "name": {
//                     "description": "User visible name for this
// configuration",
//                     "type": "string"
//                 },
//                 "oem_strings": {
//                     "description": "SMBIOS OEM strings to pass to the VM
// during install. Defaults to the empty list.",
//                     "items": {
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "uefi_pflash_x86_64": {
//                     "description": "The initial non-volatile UEFI data used
// by the VM firmware.",
//                     "properties": {
//                         "hash": {
//                             "description": "Hexadecimal encoded SHA-256 hash
// of the data.",
//                             "type": "string"
//                         },
//                         "url": {
//                             "description": "URL of the data to download.",
//                             "type": "string"
//                         }
//                     },
//                     "required": [
//                         "url",
//                         "hash"
//                     ],
//                     "type": "object"
//                 },
//                 "vtpm": {
//                     "description": "Controls if VMs using this configuration
// have access to a vTPM, defaults to false and <ph name=\"FORCE_SHUTDOWN_IF_MOR
// E_RESTRICTED\">FORCE_SHUTDOWN_IF_MORE_RESTRICTED</ph> if unset.",
//                     "properties": {
//                         "enabled": {
//                             "description": "Controls whether VMs using this
// configuration have access to a vTPM, defaults to false.",
//                             "type": "boolean"
//                         },
//                         "policy_update_action": {
//                             "description": "Controls how to treat running VMs
// that don't match this policy setting, defaults to <ph name=\"FORCE_SHUTDOWN_I
// F_MORE_RESTRICTED\">FORCE_SHUTDOWN_IF_MORE_RESTRICTED</ph>.",
//                             "enum": [
//                                 "NONE",
//                                 "FORCE_SHUTDOWN_IF_MORE_RESTRICTED",
//                                 "FORCE_SHUTDOWN_ALWAYS"
//                             ],
//                             "type": "string"
//                         }
//                     },
//                     "required": [
//                         "enabled"
//                     ],
//                     "type": "object"
//                 }
//             },
//             "required": [
//                 "name",
//                 "enabled_state"
//             ],
//             "type": "object"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message BruschettaVMConfigurationProto {
  optional PolicyOptions policy_options = 1;
  optional string BruschettaVMConfiguration = 2;
}

// Allow pages to use the built-in AI APIs.
//
// This policy controls if a page can use the built-in AI APIs (such as
// LanguageModel API, Summarization API, Writer API, and Rewriter API).
//
// If the policy is enabled or unset, the APIs are enabled to be used.
//
// If the policy is disabled, attempting using the APIs will result in an error.
//
// Valid values:
//   True: Allow the usage of the built-in AI APIs.
//   False: Disallow the usage of the built-in AI APIs.
//
// Supported on: chrome_os, linux, mac, win
message BuiltInAIAPIsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BuiltInAIAPIsEnabled = 2;
}

// Use built-in DNS client
//
// This policy controls which software stack is used to communicate with the DNS
// server: the Operating System DNS client, or Google Chrome's built-in DNS
// client. This policy does not affect which DNS servers are used: if, for
// example, the operating system is configured to use an enterprise DNS server,
// that same server would be used by the built-in DNS client. It also does not
// control if DNS-over-HTTPS is used; Google Chrome will always use the built-in
// resolver for DNS-over-HTTPS requests. Please see the DnsOverHttpsMode policy
// for information on controlling DNS-over-HTTPS.
//
// If this policy is set to Enabled or is left unset, the built-in DNS client
// will be used.
//
// If this policy is set to Disabled, the built-in DNS client will only be used
// when DNS-over-HTTPS is in use.
//
// Valid values:
//   True: Always use the built-in DNS client
//   False: Never use the built-in DNS client
//   None: Always use the built-in DNS client
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message BuiltInDnsClientEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BuiltInDnsClientEnabled = 2;
}

// Determines whether the built-in certificate verifier will be used to verify
// server certificates
//
// This policy is no longer supported, however the related policy
// ChromeRootStoreEnabled may be supported on certain platforms.
//
// When this setting is enabled, Google Chrome will perform verification of
// server certificates using the built-in certificate verifier.
// When this setting is disabled, Google Chrome will perform verification of
// server certificates using the legacy certificate verifier provided by the
// platform, unless ChromeRootStoreEnabled is enabled.
// When this setting is not set, the built-in or the legacy certificate verifier
// may be used.
//
// Valid values:
//   True: Use the built-in certificate verifier
//   False: Use the legacy platform certificate verifier
//   None: Use any certificate verifier
//
// Supported on:
message BuiltinCertificateVerifierEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool BuiltinCertificateVerifierEnabled = 2;
}

// Allow users to manage installed CA certificates.
//
// Setting the policy to All (0) or leaving it unset lets users edit trust
// settings for all CA certificates, remove user-imported certificates, and
// import certificates using Certificate Manager. Setting the policy to UserOnly
// (1) lets users manage only user-imported certificates, but not change trust
// settings of built-in certificates. Setting it to None (2) lets users view
// (not manage) CA certificates.
//
// Valid values:
//   0: Allow users to manage all certificates
//   1: Allow users to manage user certificates
//   2: Disallow users from managing certificates
//
// Supported on: chrome_os, linux, mac, win
message CACertificateManagementAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional int64 CACertificateManagementAllowed = 2;
}

// TLS certificates that should be trusted by Google Chrome for server
// authentication
//
// A list of TLS certificates that should be trusted by Google Chrome for server
// authentication.
// Certificates should be base64-encoded.
//
// Supported on: android, chrome_os, linux, mac, win
message CACertificatesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CACertificates = 2;
}

// TLS certificates that should be trusted by Google Chrome for server
// authentication with constraints
//
// A list of TLS certificates that should be trusted by Google Chrome for server
// authentication, with constraints added outside the certificate. If no
// constraint of a certain type is present, then any name of that type is
// allowed.
// Certificates should be base64-encoded. At least one constraint must be
// specified for each certificate.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "certificate": {
//                 "type": "string"
//             },
//             "constraints": {
//                 "properties": {
//                     "permitted_cidrs": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "permitted_dns_names": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, linux, mac, win
message CACertificatesWithConstraintsProto {
  optional PolicyOptions policy_options = 1;
  optional string CACertificatesWithConstraints = 2;
}

// TLS certificates that should be distrusted by Google Chrome for server
// authentication
//
// A list of certificate public keys that should be distrusted by Google Chrome
// for TLS server
// authentication.
//
// The policy value is a list of base64-encoded X.509 certificates. Any
// certificate with a matching SPKI (SubjectPublicKeyInfo) will be distrusted.
//
// Supported on: android, chrome_os, linux, mac, win
message CADistrustedCertificatesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CADistrustedCertificates = 2;
}

// TLS certificates that are not trusted or distrusted but can be used in path-
// building for server authentication
//
// A list of certificates that are not trusted or distrusted in Google Chrome
// but can be used as hints for path-building. Certificates should be
// base64-encoded.
//
// Supported on: android, chrome_os, linux, mac, win
message CAHintCertificatesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CAHintCertificates = 2;
}

// Use user-added TLS certificates from platform trust stores for server
// authentication
//
// If enabled(or not set), user-added TLS certificates from platform trust
// stores will be used in path-building for TLS server authentication.
//
// If disabled, user-added TLS certificates from platform trust stores will not
// be used in path-building for TLS server authentication.
//
// Valid values:
//   True: Import user-added TLS server certificates from platform trust stores.
//   False: Do not import user-added TLS server certificates from platform trust
// stores.
//
// Supported on: android, linux, mac, win
message CAPlatformIntegrationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CAPlatformIntegrationEnabled = 2;
}

// Enable ToS during first-run for CCT
//
// This policy is deprecated, please use the ToSDialogBehavior policy instead.
//
// By default the Terms of Service are shown when CCT is first-run. Setting this
// policy to Disabled will cause the Terms of Service dialog to not appear
// during the first-run-experience or subsequent runs. Setting this policy to
// Enabled or leaving it unset will cause the Terms of Service dialog to appear
// during the first-run-experience. The other caveats are:
//
// - This policy only works on fully managed Android devices that can be
// configured by Unified Endpoint Management vendors.
//
// - If this policy is Disabled the BrowserSignin policy will have no effect.
//
// - If this policy is Disabled metrics​ will not be sent to the server.
//
// - If this policy is Disabled the browser will have limited functionality.
//
// - If this policy is Disabled admins must communicate this to end users of the
// device.
//
// Supported on:
message CCTToSDialogEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CCTToSDialogEnabled = 2;
}

// CECPQ2 post-quantum key-agreement enabled for TLS
//
// This policy was removed in M114. It served to disable CECPQ2, but CECPQ2 has
// been disabled by default. A separate policy will be introduced to control the
// rollout of the replacement of CECPQ2. That replacement will be a combination
// of the standard key-agreement X25519 with NIST's chosen post-quantum KEM,
// called "Kyber".
//
// If this policy is not configured, or is set to enabled, then Google Chrome
// will follow the default rollout process for CECPQ2, a post-quantum key-
// agreement algorithm in TLS.
//
// CECPQ2 results in larger TLS messages which, in very rare cases, can trigger
// bugs in some networking hardware. This policy can be set to False to disable
// CECPQ2 while networking issues are resolved.
//
// This policy is a temporary measure and will be removed in future versions of
// Google Chrome.
//
// Valid values:
//   True: Enable default CECPQ2 rollout process
//   False: Disable CECPQ2
//
// Supported on:
message CECPQ2EnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CECPQ2Enabled = 2;
}

// CORS non-wildcard request headers support
//
// Configures support of CORS non-wildcard request headers.
//
// Google Chrome version 97 introduces support for CORS non-wildcard request
// headers. When scripts make a cross-origin network request via fetch() and
// XMLHttpRequest with a script-added Authorization header, the header must be
// explicitly allowed by the Access-Control-Allow-Headers header in the CORS
// preflight response. "Explicitly" here means that the wild card symbol "*"
// doesn't cover the Authorization header. See
// https://chromestatus.com/feature/5742041264816128 for more detail.
//
// If this policy is not set, or set to True, Google Chrome will support the
// CORS non-wildcard request headers and behave as described above.
//
// When this policy is set to False, chrome will allow the wildcard symbol ("*")
// in the Access-Control-Allow-Headers header in the CORS preflight response to
// cover the Authorization header.
//
// This Enterprise policy is temporary; it's intended to be removed in the
// future.
//
// Valid values:
//   True: Support CORS non-wildcard request headers.
//   False: Do not support CORS non-wildcard request headers.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message CORSNonWildcardRequestHeadersSupportProto {
  optional PolicyOptions policy_options = 1;
  optional bool CORSNonWildcardRequestHeadersSupport = 2;
}

// Controls whether the deprecated :--foo syntax for CSS custom state is enabled
//
// The :--foo syntax for the CSS custom state feature is being changed to
// :state(foo) in Google Chrome in order to comply with changes that have been
// made in Firefox and Safari. This policy allows the old deprecated syntax to
// be enabled until M133.
//
// The deprecation may break some Google Chrome-only websites which use the
// deprecated :--foo syntax.
//
// If this policy is enabled, then the old deprecated syntax will be enabled.
//
// If this policy is disabled, then the old deprecated syntax will be disabled.
//
// If this policy is not set, then the old deprecated syntax will be disabled.
//
// Valid values:
//   True: Old deprecated syntax will be enabled.
//   False: Old deprecated syntax will be disabled.
//
// Supported on:
message CSSCustomStateDeprecatedSyntaxEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CSSCustomStateDeprecatedSyntaxEnabled = 2;
}

// This policy allows administrators to encrypt http cache on disk.
//
// This policy allows the administrators to encrypt browser http cache on disk.
//
// When this policy is Enabled, browser cache will be encrypted.
//
// When this policy is Disabled or not set, browser cache will not be encrypted.
//
// Browser cache encryption may result in a performance impact.
//
// Valid values:
//   True: Use the cache encryption.
//   False: Do not use the cache encryption.
//
// Supported on: android, chrome_os, linux, mac, win
message CacheEncryptionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CacheEncryptionEnabled = 2;
}

// Enable Google Calendar Integration
//
// Enable Google Calendar integration which allows Google ChromeOS users to
// fetch events from Google Calendar to populate Google ChromeOS calendar widget
// in system status bar.
//
// If this policy is enabled, Google ChromeOS device can retrieve Google
// Calendar events to populate Google ChromeOS calendar widget in system status
// bar for the logged in user.
//
// If this policy is disabled, Google ChromeOS device cannot retrieve Google
// Calendar events to populate Google ChromeOS calendar widget in system status
// bar for the logged in user.
//
// If this policy is left unset, the Google Calendar feature is enabled by
// default for enterprise users.
//
// Valid values:
//   True: Enable Google Calendar Integration.
//   False: Disable Google Calendar Integration.
//
// Supported on: chrome_os
message CalendarIntegrationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CalendarIntegrationEnabled = 2;
}

// Set location to save Camera app photos.
//
// Sets the directory where pictures and videos captured by the camera are being
// saved.
// The user can't change it and the photos are always saved to the defined
// directory.
//
// The policy uses same format as DownloadDirectory policy.
// The location could be set to either local filesystem or Google Drive (with
// '${google_drive}' prefix) or Microsoft OneDrive (with '${microsoft_onedrive}'
// prefix).
// If the policy is set to empty string, it'll save the photos in the default
// "My files/Camera" directory.
// See a list of variables you can use (
// https://www.chromium.org/administrators/policy-list-3/user-data-directory-
// variables ).
//
// Leaving the policy unset means Google ChromeOS uses the default "My
// files/Camera" directory to save photos.
//
// Supported on: chrome_os
message CameraSaveLocationProto {
  optional PolicyOptions policy_options = 1;
  optional string CameraSaveLocation = 2;
}

// Captive portal authentication ignores proxy
//
// Setting the policy to Enabled lets Google ChromeOS bypass any proxy for
// captive portal authentication. These authentication webpages, starting from
// the captive portal sign-in page until Chrome detects a successful internet
// connection, open in a separate window, ignoring all policy settings and
// restrictions for the current user. This policy only takes effect if a proxy
// is set up (by policy, extension, or the user in chrome://settings).
//
// Setting the policy to Disabled or leaving it unset means any captive portal
// authentication pages are shown in a (regular) new browser tab, using the
// current user's proxy settings.
//
// Valid values:
//   True: Allow captive portal authentication to ignore proxy settings
//   False: Prevent captive portal authentication from ignoring proxy settings
//
// Supported on: chrome_os
message CaptivePortalAuthenticationIgnoresProxyProto {
  optional PolicyOptions policy_options = 1;
  optional bool CaptivePortalAuthenticationIgnoresProxy = 2;
}

// Enable the caret highlight accessibility feature
//
// Enable the caret highlight accessibility feature.
//
// This feature is responsible for highlighting the area that surrounds the
// caret while editing.
//
// If this policy is set to enabled, the caret highlight will always be enabled.
//
// If this policy is set to disabled, the caret highlight will always be
// disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the caret highlight is disabled initially but
// can be enabled by the user anytime.
//
// Valid values:
//   True: Enable caret highlight
//   False: Disable caret highlight
//   None: Allow the user to decide
//
// Supported on: chrome_os
message CaretHighlightEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CaretHighlightEnabled = 2;
}

// Enable casting content to the device
//
// Allow content to be cast to the device using Google Cast.
//
// If this policy is set to False, users will not be able to cast content to
// their device. If this policy is set to True, users are allowed to cast
// content. If this policy is not set, users are not allowed to cast content to
// enrolled ChromeOS devices, but can cast to non enrolled devices.
//
// Valid values:
//   True: Enable casting content to the device
//   False: Disable casting content to the device
//
// Supported on: chrome_os
message CastReceiverEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CastReceiverEnabled = 2;
}

// Disable Certificate Transparency enforcement for a list of
// subjectPublicKeyInfo hashes
//
// Setting the policy turns off enforcement of Certificate Transparency
// disclosure requirements for a list of subjectPublicKeyInfo hashes. Enterprise
// hosts can keep using certificates that otherwise wouldn't be trusted (because
// they weren't properly publicly disclosed). To turn off enforcement, the hash
// must meet one of these conditions:
//
// * It's of the server certificate's subjectPublicKeyInfo.
//
// * It's of a subjectPublicKeyInfo that appears in a Certificate Authority (CA)
// certificate in the certificate chain. That CA certificate is constrained
// through the X.509v3 nameConstraints extension, one or more directoryName
// nameConstraints are present in the permittedSubtrees, and the directoryName
// has an organizationName attribute.
//
// * It's of a subjectPublicKeyInfo that appears in a CA certificate in the
// certificate chain, the CA certificate has one or more organizationName
// attributes in the certificate Subject, and the server's certificate has the
// same number of organizationName attributes, in the same order, and with byte-
// for-byte identical values.
//
// Specify a subjectPublicKeyInfo hash by linking the hash algorithm name, a
// slash, and the Base64 encoding of that hash algorithm applied to the DER-
// encoded subjectPublicKeyInfo of the specified certificate. Base64 encoding
// format matches that of an SPKI Fingerprint. The only recognized hash
// algorithm is sha256; others are ignored.
//
// Leaving the policy unset means that if certificates requiring disclosure
// through Certificate Transparency aren't disclosed, then Google Chrome doesn't
// trust those certificates.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message CertificateTransparencyEnforcementDisabledForCasProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CertificateTransparencyEnforcementDisabledForCas = 2;
}

// Disable Certificate Transparency enforcement for a list of Legacy Certificate
// Authorities
//
// Setting the policy turns off enforcement of Certificate Transparency
// disclosure requirements for a list of Legacy Certificate Authorities (CA) for
// certificate chains with a specified subjectPublicKeyInfo hash. Enterprise
// hosts can keep using certificates that otherwise wouldn't be trusted (because
// they weren't properly publicly disclosed). To turn off enforcement, the
// subjectPublicKeyInfo hash must appear in a CA certificate recognized as a
// Legacy CA. A Legacy CA is publicly trusted by one or more operating systems
// supported by Google Chrome, but not Android Open Source Project or Google
// ChromeOS.
//
// Specify a subjectPublicKeyInfo hash by linking the hash algorithm name, a
// slash and the Base64 encoding of that hash algorithm applied to the DER-
// encoded subjectPublicKeyInfo of the specified certificate. Base64 encoding
// format matches that of an SPKI Fingerprint. The only recognized hash
// algorithm is sha256; others are ignored.
//
// Leaving the policy unset means that if certificates requiring disclosure
// through Certificate Transparency aren't disclosed, then Google Chrome doesn't
// trust those certificates.
//
// This policy was removed in Google Chrome version 128.
//
// Supported on:
message CertificateTransparencyEnforcementDisabledForLegacyCasProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CertificateTransparencyEnforcementDisabledForLegacyCas = 2;
}

// Disable Certificate Transparency enforcement for a list of URLs
//
// Setting the policy turns off Certificate Transparency disclosure requirements
// for the hostnames in the specified URLs. While making it harder to detect
// misissued certificates, hosts can keep using certificates that otherwise
// wouldn't be trusted (because they weren't properly publicly disclosed).
//
// Leaving the policy unset means that if certificates requiring disclosure
// through Certificate Transparency aren't disclosed, then Google Chrome doesn't
// trust those certificates.
//
// A URL pattern follows this format (
// https://support.google.com/chrome/a?p=url_blocklist_filter_format ). However,
// because the validity of certificates for a given hostname is independent of
// the scheme, port, or path, Google Chrome only considers the hostname portion
// of the URL. Wildcard hosts aren't supported.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message CertificateTransparencyEnforcementDisabledForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CertificateTransparencyEnforcementDisabledForUrls = 2;
}

// Extend support for Chrome Apps on Microsoft® Windows®, macOS, and Linux.
//
// Chrome Apps are deprecated on Microsoft® Windows®, macOS, and Linux.
// If this policy is enabled, Google Chrome will continue to allow Chrome Apps
// to be run on these platforms until the final date when Chrome Apps support is
// removed on all platforms, June 2022.
// If this policy is disabled or unset, Chrome Apps may not be allowed to run,
// depending on the status of the deprecation rollout.
// In either case, Chrome Apps that are force installed by policy will continue
// to be allowed.
//
// Valid values:
//   True: Chrome Apps will be allowed to run on these platforms.
//   False: Chrome Apps may not be allowed to run, depending on the status of
// the deprecation rollout.
//
// Supported on:
message ChromeAppsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ChromeAppsEnabled = 2;
}

// Restore permissive Chrome Apps &lt;webview&gt; behavior
//
// Chrome Apps &lt;webview&gt; allows for
// behavior which is in the process of being removed from
// Google Chrome.
//
// The previous behavior allows the
// &lt;webview&gt;
// newwindow event
// (https://developer.chrome.com/docs/extensions/reference/webviewTag/#event-
// newwindow)
// to attach the new window to a &lt;webview&gt;
// element in a separate App window from the originating
// &lt;webview&gt;. With the new behavior, this
// attachment is still allowed, however the window reference returned from the
// call to window.open in the originating
// &lt;webview&gt; is invalidated.
//
// If enabled, the previous behavior is used.
// If disabled or unset, the behavior change takes effect as it is rolled
// out through the Google Chrome
// release process.
//
// This policy is a temporary workaround in the event that enterprises
// experience breakage due to this change. The last supported version of this
// policy was version 121. It was removed in version 122.
//
// Valid values:
//   True: Restore permissive behavior.
//   False: Behavior changes may take effect depending on feature launch
// process.
//
// Supported on:
message ChromeAppsWebViewPermissiveBehaviorAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool ChromeAppsWebViewPermissiveBehaviorAllowed = 2;
}

// Enable Chrome Cleanup on Windows
//
// Setting the policy to Enabled or leaving it unset means Chrome Cleanup
// periodically scans the system for unwanted software and should any be found,
// will ask the user if they wish to remove it. Manually triggering Chrome
// Cleanup from chrome://settings is allowed.
//
// Setting the policy to Disabled means Chrome Cleanup won't periodically scan
// and manual triggering is disabled.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   True: Allow Chrome Cleanup to periodically scan the system and allow manual
// scans
//   False: Prevent Chrome Cleanup from periodically scanning the system and
// disable manual scans
//
// Supported on:
message ChromeCleanupEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ChromeCleanupEnabled = 2;
}

// Control how Chrome Cleanup reports data to Google
//
// Setting the policy to Enabled means if Chrome Cleanup detects unwanted
// software, it may, in line with policy set by
// SafeBrowsingExtendedReportingEnabled, report about the scan to Google. Chrome
// Cleanup asks users if they want the cleanup. It sends results to Google.
//
// Setting the policy to Disabled means if Chrome Cleanup detects unwanted
// software, it won't report about the scan to Google, regardless of the value
// of SafeBrowsingExtendedReportingEnabled. Chrome Cleanup asks users if they
// want the cleanup. The results aren't reported to Google.
//
// Leaving the policy unset means Chrome Cleanup may, in line with policy set by
// SafeBrowsingExtendedReportingEnabled, report about scans for detecting
// unwanted software to Google. Chrome Cleanup asks users if they want the
// cleanup and to share the results with Google to help with future unwanted
// software detection. These results have file metadata, automatically installed
// extensions, and registry keys, as described by the Chrome Privacy Whitepaper.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   True: Results from a Chrome Cleanup cleanup are always shared with Google
//   False: Results from a Chrome Cleanup cleanup are never shared with Google
//   None: Users may choose to share results from a Chrome Cleanup cleanup with
// Google
//
// Supported on:
message ChromeCleanupReportingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ChromeCleanupReportingEnabled = 2;
}

// Set the data regions preference for data storage
//
// Choose to store your users' covered Chrome Enterprise data in a specific
// geographic location.
//
// If this policy is left unset or is set to No preference (value 0), covered
// data may be stored in any geographic location(s).
//
// If this policy is set to United States (value 1), covered data will be stored
// in United States.
//
// If this policy is set to Europe (value 2), covered data will be stored in the
// European Union.
//
// This can only be set in the Google Admin console via Data > Compliance > Data
// regions > Region > Data at rest.
//
// Valid values:
//   0: No preference.
//   1: United States.
//   2: Europe.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message ChromeDataRegionSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ChromeDataRegionSetting = 2;
}

// Allow Chrome for Testing
//
// Controls whether users may use Chrome for Testing.
//
// If this policy is set to Enabled or not set, users may install and run Chrome
// for Testing.
//
// If this policy is set to Disabled, users are not allowed to run Chrome for
// Testing. Users will still be able to install Chrome for Testing, however it
// will not run with the profiles where this policy is set to Disabled.
//
// Valid values:
//   True: Allow use of the Chrome for Testing
//   False: Do not allow use of the Chrome for Testing
//
// Supported on: android, linux, mac, win
message ChromeForTestingAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool ChromeForTestingAllowed = 2;
}

// Enable lock when the device suspends or the lid is closed
//
// Setting the policy to Enabled means Google ChromeOS asks users for a password
// to unlock the device when it suspends or the lid is closed.
//
// Devices will lock when the lid is closed except if they are docked (using an
// external monitor).  In such a case, the device will not lock when the lid
// closes, but will lock if the external monitor is removed and the lid is still
// closed.
//
// Until Google ChromeOS M106, this policy would only lock the device when it
// suspends.  From M106 onwards, this policy will lock the device when it
// suspends or the lid is closed.
//
// By setting this policy to Enabled, and LidCloseAction to
// LidCloseActionDoNothing, a device will lock when the lid is closed, but will
// only suspend if and when configured to do so in PowerManagementIdleSettings.
//
// Note that if this policy is set to Enabled and AllowScreenLock is set to
// Disabled, the device cannot be locked and the user will be logged out
// instead.
//
// Setting the policy to Disabled means users are not asked for a password to
// unlock the device.
//
// Leaving the policy unset lets the user choose whether to be prompted for a
// password to unlock the device.
//
// Valid values:
//   True: Lock the device when it suspends or the lid is closed
//   False: Do not lock the device when it suspends or the lid is closed
//   None: Allow users to decide whether the device should lock when it suspends
// or the lid is closed
//
// Supported on: chrome_os
message ChromeOsLockOnIdleSuspendProto {
  optional PolicyOptions policy_options = 1;
  optional bool ChromeOsLockOnIdleSuspend = 2;
}

// Control the user behavior in a multiprofile session
//
// Control the user behavior in a multiprofile session on Google ChromeOS
// devices.
//
// If this policy is set to 'MultiProfileUserBehaviorUnrestricted', the user can
// be either primary or secondary user in a multiprofile session.
//
// If this policy is set to 'MultiProfileUserBehaviorMustBePrimary', the user
// can only be the primary user in a multiprofile session.
//
// If this policy is set to 'MultiProfileUserBehaviorNotAllowed', the user
// cannot be part of a multiprofile session.
//
// If you set this setting, users cannot change or override it.
//
// If the setting is changed while the user is signed into a multiprofile
// session, all users in the session will be checked against their corresponding
// settings. The session will be closed if any one of the users is no longer
// allowed to be in the session.
//
// If the policy is left not set, the default value
// 'MultiProfileUserBehaviorMustBePrimary' applies for enterprise-managed users
// and 'MultiProfileUserBehaviorUnrestricted' will be used for non-managed
// users.
//
// Valid values:
//   unrestricted: Allow enterprise user to be both primary and secondary
// (Default behavior for non-managed users)
//   primary-only: Allow enterprise user to be primary multiprofile user only
// (Default behavior for enterprise-managed users)
//   not-allowed: Do not allow enterprise user to be part of multiprofile
// (primary or secondary)
//
// Supported on: chrome_os
message ChromeOsMultiProfileUserBehaviorProto {
  optional PolicyOptions policy_options = 1;
  optional string ChromeOsMultiProfileUserBehavior = 2;
}

// Determines whether the Chrome Root Store and built-in certificate verifier
// will be used to verify server certificates
//
// When this policy is set to enabled, Google Chrome
// will perform verification of server certificates using the built-in
// certificate verifier with the Chrome Root Store as the source of public
// trust.
//
// When this policy is set to disabled, Google Chrome
// will use the system certificate verifier and system root certificates.
//
// When this policy is not set, the Chrome Root Store or system provided roots
// may be used.
//
// This policy was removed in Google Chrome version 113
// for Microsoft® Windows® and macOS,
// Google ChromeOS version 120,
// Google Chrome version 120 for
// Linux, and
// Google Chrome version 121 for
// Android when support for using the
// platform supplied certificate verifier and roots was removed.
//
// Valid values:
//   True: Use the Chrome Root Store.
//   False: Do not use the Chrome Root Store.
//   None: Chrome Root Store may be used depending on feature launch process.
//
// Supported on:
message ChromeRootStoreEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ChromeRootStoreEnabled = 2;
}

// Settings for ChromeSuggestions
//
// This setting allows Chrome to suggest AI capabilities at relevant moments.
//
// 0/unset = Chrome suggestions will be enabled for users.
//
// 1 = Chrome suggestions are disabled for users.
//
// For more information, please check the help center article:
// https://support.google.com/chrome/a?p=chrome_suggestions
//
// Valid values:
//   0: Allow Chrome suggestions
//   1: Disable Chrome suggestions
//
// Supported on: chrome_os, linux, mac, win
message ChromeSuggestionsSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ChromeSuggestionsSettings = 2;
}

// Determine the availability of variations
//
// Configuring this policy allows to specify which variations are allowed to be
// applied in Google Chrome.
//
// Variations provide a means for offering modifications to Google Chrome
// without shipping a new version of the browser by selectively enabling or
// disabling already existing features. See
// https://support.google.com/chrome/a?p=Manage_the_Chrome_variations_framework
// for more information.
//
// Setting the VariationsEnabled (value 0), or leaving the policy not set allows
// all variations to be applied to the browser.
//
// Setting the CriticalFixesOnly (value 1), allows only variations considered
// critical security or stability fixes to be applied to Google Chrome.
//
// Setting the VariationsDisabled (value 2), prevent all variations from being
// applied to the browser. Please note that this mode can potentially prevent
// the Google Chrome developers from providing critical security fixes in a
// timely manner and is thus not recommended.
//
// Valid values:
//   0: Enable all variations
//   1: Enable variations concerning critical fixes only
//   2: Disable all variations
//
// Supported on: android, fuchsia, ios, linux, mac, win
message ChromeVariationsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ChromeVariations = 2;
}

// Configure Class Tools caption feature
//
// Setting the policy specifies if teachers can use caption feature.
//
// If value is set to true or unset, selected teachers can caption their voice
// and send the transcription to students.
//
// If set to false they cannot access the feature.
//
// Valid values:
//   True: Allow teachers to send transcription to students.
//   False: Prevent teachers from sending transcription to students.
//
// Supported on: chrome_os
message ClassManagementCaptionsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ClassManagementCaptionsEnabled = 2;
}

// Configure Class Tools Google Classroom integration feature
//
// Setting the policy specifies if teachers can connect to students using a
// Google Classroom class roster. See
// https://support.google.com/edu/classroom/answer/10495270.
//
// If value set to true or unset, they can use Google Classroom class roster.
//
// If set to false they cannot access the feature.
//
// Valid values:
//   True: Allow teachers to use Google Classroom class roster.
//   False: Prevent teachers from using Google Classroom class roster.
//
// Supported on: chrome_os
message ClassManagementClassroomIntegrationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ClassManagementClassroomIntegrationEnabled = 2;
}

// Configure Class Tools
//
// Setting the policy specifies whether users use Class Tools for
// sending/receiving content, sending/receiving caption as students, teachers,
// or if class management tools is disabled for users.
//
// Valid values:
//   disabled: Users are not able to use any of the Class Tools or be added to a
// Class Tools session.
//   students: Users will be able to join and be added to a Class Tools session.
// Teachers will be able to send content to these users.
//   teachers: Users will be able to connect and deploy content to students.
// This includes sending web content and making live captions/translations of
// the teacher’s voice available to the students.
//
// Supported on: chrome_os
message ClassManagementEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional string ClassManagementEnabled = 2;
}

// Configure Class Tools network restriction
//
// Setting the policy specifies if selected users' devices must be on a managed
// network in order to be part of Class Tools class.
//
// If value set to true or unset, they must be on a managed network.
//
// If set to false they can join without being on a managed network.
//
// Valid values:
//   True: Require users' devices to be on a managed network in order to be part
// of Class Tools class
//   False: Do not require users' devices to be on a managed network in order to
// be part of Class Tools class
//
// Supported on: chrome_os
message ClassManagementNetworkRestrictionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ClassManagementNetworkRestrictionEnabled = 2;
}

// Configure Class Tools view screen feature
//
// Setting the policy specifies if the selected teachers can remotely view
// students' screens.
//
// If set to true or unset they can view students' screens.
//
// If set to false they cannot access the feature.
//
// Valid values:
//   True: Allow teachers to remotely view students' screens.
//   False: Prevent teachers from remotely viewing students' screens.
//
// Supported on: chrome_os
message ClassManagementViewScreenEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ClassManagementViewScreenEnabled = 2;
}

// Clear Browsing Data on Exit
//
// Configures a list of browsing data types that should be deleted when the user
// closes all browser windows.
//
// Warning: Setting this policy can impact and permanently remove local personal
// data. It is recommended to test your settings before deploying to prevent
// accidental deletion of personal data.
//
// The available data types are browsing history (browsing_history), download
// history (download_history), cookies (cookies_and_other_site_data), cache
// (cached_images_and_files), autofill (autofill), passwords (password_signin),
// site settings (site_settings) and hosted apps data (hosted_app_data). This
// policy does not take precedence over AllowDeletingBrowserHistory.
//
// The user will stay signed into their Google account when deleting cookies.
//
// Until Chrome 114, this policy required the SyncDisabled policy to be set to
// true. Starting Chrome 115, setting this policy will disable sync for the
// respective data types if neither `Chrome Sync` is disabled by setting the
// SyncDisabled policy nor BrowserSignin is disabled.
//
// If for some reason the data deletion has started and did not complete, the
// browsing data will be cleared the next time the profile is loaded.
//
// If Google Chrome does not exit cleanly (for example, if the browser or the OS
// crashes), the browsing data will not be cleared since the browser closing was
// not a result of the use closing all the browser windows.
//
// Valid values:
//   browsing_history: Browsing history
//   download_history: Download history
//   cookies_and_other_site_data: Cookies and other site data
//   cached_images_and_files: Cached images and files
//   password_signin: Password signin
//   autofill: Autofill
//   site_settings: Site settings
//   hosted_app_data: Hosted apps data
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message ClearBrowsingDataOnExitListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ClearBrowsingDataOnExitList = 2;
}

// Clear site data on browser shutdown (deprecated)
//
// This policy has been retired as of Google Chrome version 29.
//
// Supported on:
message ClearSiteDataOnExitProto {
  optional PolicyOptions policy_options = 1;
  optional bool ClearSiteDataOnExit = 2;
}

// Choose whether to allow clearing window.name for cross-site top-level
// navigations resulting in a new browsing context group.
//
// This policy controls whether window.name can be cleared for cross-site
// top-level navigations which result in a new browsing context group being
// created when the ClearCrossSiteCrossBrowsingContextGroupWindowName variation
// is
// enabled.
//
// The ClearCrossSiteCrossBrowsingContextGroupWindowName variation controls
// whether
// window.name will be cleared for cross-site top-level navigations. Examples of
// such navigations include a user navigating to a new site via the omnibox or
// clicking on a link to a new site when the link uses "target='_blank'
// rel='noopener'". Clearing window.name in these cases prevents information
// from
// potentially leaking between sites via the window.name property, improving
// user
// privacy. ClearWindowNameForNewBrowsingContextGroup policy is in place to
// restore the previous behavior. When the
// ClearCrossSiteCrossBrowsingContextGroupWindowName variation is enabled
// window.name will be cleared for qualifying navigations if this policy is set
// to Enabled or not set. If it is disabled, window.name will not be cleared.
//
// If you must use the policy to disable window.name clearing on qualifying
// navigations, please file a bug on
// https://crbug.com/new?component=1456652&amp;template=1937639&amp;cc=ladan@chr
// omium.org,miketaylr@chromium.org&amp;noWizard=true
// explaining your use case. The policy is scheduled to
// be offered through Google Chrome
// version 142.
//
// Valid values:
//   True: Clear window.name when the navigation is top-level, cross-site and
// swaps BrowsingContextGroup.
//   False: Do not clear window.name when the navigation is top-level, cross-
// site and swaps BrowsingContextGroup.
//
// Supported on: android, chrome_os, linux, mac, win
message ClearWindowNameForNewBrowsingContextGroupProto {
  optional PolicyOptions policy_options = 1;
  optional bool ClearWindowNameForNewBrowsingContextGroup = 2;
}

// Enable the Click to Call Feature
//
// This policy is deprecated and has no effect because the Click to Call feature
// has been removed from Chrome.
//
// Original description:
// Enable the Click to Call feature which allows users to send phone numbers
// from Chrome Desktops to an Android device when the user is Signed-in. For
// more information, see help center article:
// https://support.google.com/chrome/answer/9430554?hl=en.
//
// If this policy is set to enabled, the capability of sending phone numbers to
// Android devices will be enabled for the Chrome user.
//
// If this policy is set to disabled, the capability of sending phone numbers to
// Android devices will be disabled for the Chrome user.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the Click to Call feature is enabled by
// default.
//
// Valid values:
//   True: Allow users to send phone numbers from Chrome to their Android device
//   False: Do not allow users to send phone numbers from Chrome to their
// Android device
//   None: Allow the user to decide
//
// Supported on:
message ClickToCallEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ClickToCallEnabled = 2;
}

// Allow users to manage installed client certificates.
//
// Setting the policy to 'All' (value 0) or leaving it unset lets users manage
// certificates. Setting the policy to 'None' (value 2) means users can only
// view (not manage) certificates.
//
// Setting the policy to 'UserOnly' (value 1) lets users manage user
// certificates, but not device-wide certificates.
//
// Valid values:
//   0: Allow users to manage all certificates
//   1: Allow users to manage user certificates
//   2: Disallow users from managing certificates
//
// Supported on: chrome_os
message ClientCertificateManagementAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ClientCertificateManagementAllowed = 2;
}

// Allow clipboard on these sites
//
// Setting the policy lets you set a list of URL patterns that specify sites
// that can use the clipboard site permission. This does not include all
// clipboard operations on origins matching the patterns. For instance, users
// will still be able to paste using keyboard shortcuts as this isn't gated by
// the clipboard site permission.
//
//
// Leaving the policy unset means DefaultClipboardSetting applies for all sites,
// if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ClipboardAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ClipboardAllowedForUrls = 2;
}

// Block clipboard on these sites
//
// Setting the policy lets you set a list of URL patterns that specify sites
// that can't use the clipboard site permission. This does not include all
// clipboard operations on origins matching the patterns. For instance, users
// will still be able to paste using keyboard shortcuts as this isn't gated by
// the clipboard site permission.
//
// Leaving the policy unset means DefaultClipboardSetting applies for all sites,
// if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ClipboardBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ClipboardBlockedForUrls = 2;
}

// Allow automatic sign-in to Microsoft® cloud identity providers
//
// Configures automatic user sign-in for accounts backed by a Microsoft® cloud
// identity provider.
//
// By setting this policy to 1 (Enabled), users who sign into their computer
// with an account backed by a Microsoft® cloud identity provider (i.e.,
// Microsoft® Azure® Active Directory® or the consumer Microsoft® account
// identity provider) or who have added a work or school account to Microsoft®
// Windows® can be signed into web properties using that identity automatically.
// Information pertaining to the user's device and account is transmitted to the
// user's cloud identity provider for each authentication event.
//
// By setting this policy to 0 (Disabled) or leaving it unset, automatic sign-in
// as described above is disabled.
//
// This feature is available starting in Microsoft® Windows® 10.
//
// Note: This policy doesn't apply to Incognito or Guest modes.
//
// Valid values:
//   0: Disable Microsoft® cloud authentication
//   1: Enable Microsoft® cloud authentication
//
// Supported on: win
message CloudAPAuthEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional int64 CloudAPAuthEnabled = 2;
}

// Enables Google Chrome extension installation requests
//
// This policy controls Google Chrome extension installation requests which
// allows users to send the requests to the Google Admin console for approval.
//
// When the policy CloudReportingEnabled is left unset or set to disabled, this
// policy will be ignored, extension installation requests are not created or
// uploaded.
// When this policy is left unset or set to disabled, extension installation
// requests are not created or uploaded.
// When this policy is set to enabled, extension installation requests are
// created and uploaded to Google Admin console.
//
// Extension installation requests are created when users try to install an
// extension that is not allowed by ExtensionInstallAllowlist or
// ExtensionSettings.
//
// This policy is only effective when the machine is enrolled with
// CloudManagementEnrollmentToken for Google Chrome.
// This policy is always effective for Google ChromeOS.
//
// Note: This policy only applies to platforms that support extensions.
//
// Valid values:
//   True: Create and upload extension install requests to the Admin console
//   False: Do not create or upload extension install requests to the Admin
// console
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message CloudExtensionRequestEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudExtensionRequestEnabled = 2;
}

// Enable mandatory cloud management enrollment
//
// Setting the policy to Enabled mandates Chrome Enterprise Core browser
// enrollment and blocks Google Chrome launch process if failed.
//
// Setting the policy to Disabled or leaving it unset renders Chrome Enterprise
// Core browser enrollment optional and doesn't block Google Chrome launch
// process if failed.
//
// Machine scope cloud policy enrollment on desktop uses this policy. See
// https://support.google.com/chrome/a/answer/9301891 for details.
//
// Valid values:
//   True: Prevent Chrome from launching if not enrolled into Chrome Browser
// Cloud Management
//   False: Allow Chrome to launch if not enrolled into Chrome Browser Cloud
// Management
//
// Supported on: fuchsia, linux, mac, win
message CloudManagementEnrollmentMandatoryProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudManagementEnrollmentMandatory = 2;
}

// The enrollment token of cloud policy
//
// Setting the policy means Google Chrome tries to register itself with Chrome
// Enterprise Core browser management. The value of this policy is an enrollment
// token you can retrieve from the Google Admin console.
//
// See https://support.google.com/chrome/a/answer/9301891 for details.
//
// Supported on: android, fuchsia, ios, linux, mac, win
message CloudManagementEnrollmentTokenProto {
  optional PolicyOptions policy_options = 1;
  optional string CloudManagementEnrollmentToken = 2;
}

// Google Chrome cloud policy overrides Platform policy.
//
// Setting the policy to Enabled means cloud policy takes precedence if it
// conflicts with platform policy.
//
// Setting the policy to Disabled or leaving it unset means platform policy
// takes precedence if it conflicts with cloud policy.
//
// This mandatory policy affects machine scope cloud policies.
//
// This policy is specific to Google Chrome and does not affect Google Update
// because they are independent applications.
// Google Update has a separate policy with the same name.
//
// Valid values:
//   True: Cloud machine policies take precedence over platform machine policies
//   False: Platform machine policies take precedence over cloud machine
// policies
//
// Supported on: android, fuchsia, ios, linux, mac, win
message CloudPolicyOverridesPlatformPolicyProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudPolicyOverridesPlatformPolicy = 2;
}

// Enable Google Cloud Print proxy
//
// Setting the policy to Enabled or leaving it unset lets Google Chrome act as a
// proxy between Google Cloud Print and legacy printers connected to the
// machine. Using their Google Account, users may turn on the cloud print proxy
// by authentication.
//
// Setting the policy to Disabled means users can't turn on the proxy, and the
// machine can't share its printers with Google Cloud Print.
//
// Valid values:
//   True: Enable Google Cloud Print proxy
//   False: Disable Google Cloud Print proxy
//
// Supported on: fuchsia
message CloudPrintProxyEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudPrintProxyEnabled = 2;
}

// Enable submission of documents to Google Cloud Print
//
// Setting the policy to Enabled or leaving it unset lets users print to Google
// Cloud Print from the Google Chrome print dialog. Google Chrome can submit
// documents to Google Cloud Print for printing. This doesn't prevent users from
// submitting print jobs on websites.
//
// Setting the policy to Disabled means users can't print to Google Cloud Print
// from the Google Chrome print dialog.
//
// In order to keep Google Cloud Print destinations discoverable, this policy
// must be set to Enabled and cloud must not be included in the
// PrinterTypeDenyList policy.
//
// Valid values:
//   True: Enable submission of documents to Google Cloud Print
//   False: Disable submission of documents to Google Cloud Print
//
// Supported on:
message CloudPrintSubmitEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudPrintSubmitEnabled = 2;
}

// Suppress Google Cloud Print deprecation messages
//
// This policy controls whether Google Cloud Print deprecation warnings are
// shown to users in the print preview dialog or settings pages.
// Setting this policy to True will hide the deprecation warnings.
// Setting this policy to False or leaving it unset will show the deprecation
// warnings.
//
// Valid values:
//   True: Hide Google Cloud Print deprecation warnings
//   False: Show Google Cloud Print deprecation warnings
//
// Supported on:
message CloudPrintWarningsSuppressedProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudPrintWarningsSuppressed = 2;
}

// Enable Google Chrome cloud reporting for managed profile
//
// This policy controls Google Chrome cloud reporting for a particular managed
// profile.
//
// When this policy is left unset or set to Disabled, there is no data collected
// or uploaded.
// When this policy is set to Enabled, the data is collected and uploaded to
// Google Admin console.
//
// The report contains profile state and usage information, including but not
// limited to OS version, browser version, installed extensions and applied
// policies.
//
// This policy can only be set as cloud user policy.
//
// Valid values:
//   True: Enable managed profile cloud reporting
//   False: Disable managed profile cloud reporting
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message CloudProfileReportingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudProfileReportingEnabled = 2;
}

// Enables Google Chrome cloud reporting
//
// This policy controls Google Chrome cloud reporting which uploads information
// about the browser operation to Google Admin console.
//
// When this policy is left unset or set to Disabled, there is no data collected
// or uploaded.
// When this policy is set to Enabled, the data is collected and uploaded to
// Google Admin console.
//
// For Google Chrome, this policy is only effective when the machine is enrolled
// with CloudManagementEnrollmentToken.
// For Google ChromeOS, this policy is always effective.
//
// Valid values:
//   True: Enable managed browser cloud reporting
//   False: Disable managed browser cloud reporting
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message CloudReportingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudReportingEnabled = 2;
}

// Frequency of cloud reporting in hours
//
// Controls the frequency of Chrome status report uploads.
//
// This includes reports that are enabled by CloudReportingEnabled.
//
// When the policy is not set, reports are uploaded every 24 hours.
// When the policy is set, the number of hours between two successive report
// uploads is defined by this policy.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message CloudReportingUploadFrequencyProto {
  optional PolicyOptions policy_options = 1;
  optional int64 CloudReportingUploadFrequency = 2;
}

// Enables merging of user cloud policies into machine-level policies
//
// Setting the policy to Enabled allows policies associated with a managed
// account to be merged into machine-level policies.
//
// Setting the policy to Disabled or leaving it unset prevents user-level cloud
// policies from being merged with policies from any other sources.
//
// Only policies originating from secure users can take precedence. A secure
// user is affiliated with the organization that manages their browser using
// Chrome Enterprise Core. All other user-level policies will have default
// precedence.
//
// Policies that need to be merged also need to be set in either
// PolicyListMultipleSourceMergeList or PolicyDictionaryMultipleSourceMergeList.
// This policy will be ignored if neither of the two aforementioned policies is
// configured.
//
// Valid values:
//   True: Enable merging of user-level cloud policies.
//   False: Disable merging of user-level cloud policies.
//
// Supported on: android, fuchsia, ios, linux, mac, win
message CloudUserPolicyMergeProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudUserPolicyMerge = 2;
}

// Allow user cloud policies to override Chrome Browser Cloud Management
// policies.
//
// Setting the policy to Enabled allows policies associated with a managed
// account to take precedence if they conflict with Chrome Enterprise Core
// browser policies.
//
// Setting the policy to Disabled or leaving it unset causes user-level cloud
// policies to have default priority.
//
// Only policies originating from secure users can take precedence. A secure
// user is affiliated with the organization that manages their browser using
// Chrome Enterprise Core. All other user-level policies will have default
// precedence.
//
// The policy can be combined with CloudPolicyOverridesPlatformPolicy. If both
// policies are enabled, user cloud policies will also take precedence over
// conflicting platform policies.
//
// Valid values:
//   True: Allow user cloud policies to override machine cloud policies.
//   False: Prevent user cloud policies from overriding machine cloud policies.
//
// Supported on: android, fuchsia, ios, linux, mac, win
message CloudUserPolicyOverridesCloudMachinePolicyProto {
  optional PolicyOptions policy_options = 1;
  optional bool CloudUserPolicyOverridesCloudMachinePolicy = 2;
}

// Allow coalescing of HTTP/2 connections for these hosts even when client
// certificates are used
//
// This policy allows HTTP/2 connection coalescing when client certificates are
// in use. In order to coalesce, both the hostname of the potential new
// connection and the hostname of an existing connection must match one or more
// patterns described by this policy. The policy is a list of hosts using the
// URLBlocklist filter format: "example.com" matches "example.com" and all
// subdomains (e.g. "sub.example.com"), while ".example.net" matches exactly
// "example.net".
//
// Coalescing requests to different hosts over connections that use client
// certificates can create security and privacy issues, as the ambient authority
// will be conveyed to all requests, even if the user did not explicitly
// authorize this. This policy is temporary and will be removed in a future
// release. See https://crbug.com/855690.
//
// If this policy is left unset, then the default behavior of not allowing any
// HTTP/2 connection coalescing on connections using client certificates will be
// used.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message CoalesceH2ConnectionsWithClientCertificatesForHostsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CoalesceH2ConnectionsWithClientCertificatesForHosts = 2;
}

// Enable the color correction accessibility feature
//
// Enable the color correction accessibility feature.
//
// This feature enables users to adjust the color correction settings on their
// managed Google ChromeOS devices, which may make it easier for users with
// color vision deficiency to perceive colors on their screen.
//
// If this policy is set to enabled, color correction will always be enabled;
// users will need to go into Settings to pick their specific color correction
// options (e.g. Deuteranomaly/Protanomaly/Tritanamaly/Greyscale filter and
// intensity). Color correction settings are displayed to the user on first use.
//
// If this policy is set to disabled, color correction will always be disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the color correction feature is disabled
// initially but can be enabled by the user anytime.
//
// Valid values:
//   True: Enable color correction
//   False: Disable color correction
//   None: Allow the user to decide
//
// Supported on: chrome_os
message ColorCorrectionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ColorCorrectionEnabled = 2;
}

// Enable security warnings for command-line flags
//
// Setting the policy to Enabled or leaving it unset means security warnings
// appear when potentially dangerous command-line flags are used to launch
// Chrome.
//
// Setting the policy to Disabled prevents security warnings from appearing when
// Chrome is launched with potentially dangerous command-line flags.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   True: Show security warnings when potentially dangerous command-line flags
// are used
//   False: Hide security warnings when potentially dangerous command-line flags
// are used
//
// Supported on: fuchsia, linux, mac, win
message CommandLineFlagSecurityWarningsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CommandLineFlagSecurityWarningsEnabled = 2;
}

// Enable component updates in Google Chrome
//
// Enables component updates for all components in Google Chrome when not set or
// set to enabled.
//
// If set to disabled, updates to components are disabled. However, some
// components are exempt from this policy: updates to any component that does
// not contain executable code and is critical for the security of the browser
// will not be disabled.
// Examples of such components include the certificate revocation lists and
// subresource filters.
//
// Valid values:
//   True: Enable updates for all components
//   False: Disable updates for non-critical components
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message ComponentUpdatesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ComponentUpdatesEnabled = 2;
}

// Enable compression dictionary transport support
//
// This feature enables the use of dictionary-specific content encodings in the
// Accept-Encoding request header ("sbr" and "zst-d") when dictionaries are
// available for use.
//
// Setting the policy to Enabled or leaving it unset means Google Chrome will
// accept web contents using the compression dictionary transport feature.
// Setting the policy to Disabled turns off the compression dictionary transport
// feature.
//
// Valid values:
//   True: Accept web contents use compression dictionary transport feature
//   False: Do not allow using compression dictionary transport feature
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message CompressionDictionaryTransportEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CompressionDictionaryTransportEnabled = 2;
}

// Configure when the Google ChromeOS Content transfer tool is available
//
// This policy enables the Content transfer app for managed users. The Content
// transfer app helps users transfer their data from their managed account to a
// consumer account.
//
// If is_enabled is set to true, the Content transfer app will be shown on and
// between the start and end dates according to the local time.
//
// If is_enabled is set to false or unset, the app will not be shown.
//
// If start_date is unset, then the app is shown until the end date.
//
// If end_date is unset, then the app is shown indefinitely from the start date.
//
// If both start_date and end_date are unset, the app is shown indefinitely. If
// the start and end dates are invalid, then the Content transfer app will not
// be shown. This includes if the provided dates are non-existent or the end
// date is before the start date.
//
// Data transfer with Takeout also needs to be enabled in order for the Content
// transfer app to work properly. See
// https://support.google.com/a/answer/6364687 for additional information.
//
// Value schema:
// {
//     "properties": {
//         "end_date": {
//             "properties": {
//                 "day": {
//                     "maximum": 31,
//                     "minimum": 1,
//                     "type": "integer"
//                 },
//                 "month": {
//                     "maximum": 12,
//                     "minimum": 1,
//                     "type": "integer"
//                 },
//                 "year": {
//                     "minimum": 0,
//                     "type": "integer"
//                 }
//             },
//             "type": "object"
//         },
//         "is_enabled": {
//             "type": "boolean"
//         },
//         "start_date": {
//             "properties": {
//                 "day": {
//                     "maximum": 31,
//                     "minimum": 1,
//                     "type": "integer"
//                 },
//                 "month": {
//                     "maximum": 12,
//                     "minimum": 1,
//                     "type": "integer"
//                 },
//                 "year": {
//                     "minimum": 0,
//                     "type": "integer"
//                 }
//             },
//             "type": "object"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message ContentTransferEnablementStatusProto {
  optional PolicyOptions policy_options = 1;
  optional string ContentTransferEnablementStatus = 2;
}

// Enable the Chrome Enterprise Device Trust Connector attestation flow for a
// list of URLs
//
// This policy is deprecated and has been split into
// BrowserContextAwareAccessSignalsAllowlist,
// UserContextAwareAccessSignalsAllowlist and
// DeviceLoginScreenContextAwareAccessSignalsAllowlist.
//
// Enable Chrome Enterprise Device Trust Connector for a list of URLs.
//
// Setting this policy specifies for which URLs Google Chrome will offer to
// start the attestation flow. The latter allows those websites to get an
// attested set of context-aware signals from the device.
//
// Leaving this policy unset or empty means that no website will be able to
// start the attestation flow nor get signals from the device.
//
// For Google ChromeOS, this policy is related to remote attestation where a
// certificate is automatically generated and uploaded to the server. For usage
// of the attestation flow on the device's login screen, please use the
// DeviceLoginScreenContextAwareAccessSignalsAllowlist policy.
//
// For detailed information on valid URL patterns, please see
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// Supported on:
message ContextAwareAccessSignalsAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ContextAwareAccessSignalsAllowlist = 2;
}

// Allow saving images directly to Google Photos
//
// This policy controls whether the user is allowed to save images to Google
// Photos directly from the context menu.
// Setting the policy to Enabled or leaving it unset allows the user to save
// images to Google Photos from the context menu. Setting the policy to Disabled
// prevent users seeing the option in the context menu.
// This policy does not prevent users from saving images to Google Photos using
// other ways beside the context menu.
//
// Valid values:
//   0: The context menu will have a menu item to share images to Google Photos.
//   1: The context menu will not have a menu item to share images to Google
// Photos.
//
// Supported on: ios
message ContextMenuPhotoSharingSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ContextMenuPhotoSharingSettings = 2;
}

// Contextual integrations of Google services on Google ChromeOS
//
// Improve productivity by allowing information from Google apps and services to
// appear on Google ChromeOS system surfaces.
//
// An integration will be displayed if the associated Google service is turned
// on.
//
// When ContextualGoogleIntegrationsEnabled is Disabled, all services will be
// disabled, regardless the settings of this policy.
//
// When ContextualGoogleIntegrationsEnabled is Enabled or not set, services can
// be selected by this policy.
//
// If this policy is left unset, all services will be enabled.
//
// Otherwise, only selected services will be enabled.
//
// Valid values:
//   GoogleCalendar: Google Calendar
//   GoogleClassroom: Google Classroom
//   GoogleTasks: Google Tasks
//   ChromeSync: Chrome Sync
//   GoogleDrive: Google Drive
//   Weather: Weather
//
// Supported on: chrome_os
message ContextualGoogleIntegrationsConfigurationProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ContextualGoogleIntegrationsConfiguration = 2;
}

// Contextual integrations of Google services on Google ChromeOS
//
// Improve productivity by allowing information from Google apps and services to
// appear on Google ChromeOS system surfaces.
//
// If this policy is Enabled or left unset, the integrations selected in
// ContextualGoogleIntegrationsConfiguration are enabled.
//
// If this policy is Disabled, all integrations are disabled.
//
// Valid values:
//   True: Allow integrations
//   False: Disable integrations
//
// Supported on: chrome_os
message ContextualGoogleIntegrationsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ContextualGoogleIntegrationsEnabled = 2;
}

// Enable Touch to Search
//
// Setting the policy to True or leaving it unset makes Touch to Search
// available to the user, and they can turn the feature on or off.
//
// Setting the policy to False turns Touch to Search off completely.
//
// Valid values:
//   True: Allow users to use Touch to Search
//   False: Prevent users from using Touch to Search
//
// Supported on: android
message ContextualSearchEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ContextualSearchEnabled = 2;
}

// Enable contextual suggestions of related web pages
//
// This feature never launched, therefore the policy is deprecated. If this is
// set to true or unset, Google Chrome will suggest pages related to the current
// page.
// These suggestions are fetched remotely from Google servers.
//
// If this setting is set to false, suggestions will not be fetched or
// displayed.
//
// Supported on:
message ContextualSuggestionsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ContextualSuggestionsEnabled = 2;
}

// Allow Controlled Frame API on these sites
//
// The Controlled Frame API, available to certain isolated contexts such as
// Isolated Web Apps (IWAs), allows an app to embed and manipulate arbitrary
// content.
// Please see https://github.com/WICG/controlled-frame for details.
//
// Setting the policy lets you list the URL patterns that specify which sites
// are allowed to use the Controlled Frame API.
// Valid patterns are limited to Isolated Web Apps.
//
// Leaving the policy unset means DefaultControlledFrameSetting applies for all
// sites, if it's set.
//
// URL patterns must not conflict with ControlledFrameBlockedForUrls. Neither
// policy takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os, linux, mac, win
message ControlledFrameAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ControlledFrameAllowedForUrls = 2;
}

// Block Controlled Frame API on these sites
//
// The Controlled Frame API, available to certain isolated contexts such as
// Isolated Web Apps (IWAs), allows an app to embed and manipulate arbitrary
// content.
// Please see https://github.com/WICG/controlled-frame for details.
//
// Setting the policy lets you list the URL patterns that specify which sites
// are not allowed to use the Controlled Frame API.
// Valid patterns are limited to Isolated Web Apps.
//
// Leaving the policy unset means DefaultControlledFrameSetting applies for all
// sites, if it's set.
//
// URL patterns must not conflict with ControlledFrameAllowedForUrls. Neither
// policy takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os, linux, mac, win
message ControlledFrameBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ControlledFrameBlockedForUrls = 2;
}

// Allow cookies on these sites
//
// Allows you to set a list of url patterns that specify sites which are allowed
// to set cookies.
//
// URL patterns may be a single URL indicating that the site may use cookies on
// all top-level sites.
//
// Patterns may also be two URLs delimited by a comma. The first specifies the
// site that should be allowed to use cookies. The second specifies the top-
// level site that the first value should be applied on.
//
// If you use a pair of URLs, the first value in the pair supports * but the
// second value does not. Using * for the first value indicates that all sites
// may use cookies when the second URL is the top-level site.
//
// If this policy is left not set the global default value will be used for all
// sites either from the DefaultCookiesSetting or BlockThirdPartyCookies
// policies if they are set, or the user's personal configuration otherwise.
//
// See also policies CookiesBlockedForUrls and CookiesSessionOnlyForUrls. Note
// that there must be no conflicting URL patterns between these three policies -
// it is unspecified which policy takes precedence.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message CookiesAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CookiesAllowedForUrls = 2;
}

// Block cookies on these sites
//
// Setting the policy lets you make a list of URL patterns that specify sites
// that can't set cookies.
//
// Leaving the policy unset results in the use of DefaultCookiesSetting for all
// sites, if it's set. If not, the user's personal setting applies.
//
// While no specific policy takes precedence, see CookiesAllowedForUrls and
// CookiesSessionOnlyForUrls. URL patterns among these 3 policies must not
// conflict.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message CookiesBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CookiesBlockedForUrls = 2;
}

// Limit cookies from matching URLs to the current session
//
// Unless the RestoreOnStartup policy is set to permanently restore URLs from
// previous sessions, then setting CookiesSessionOnlyForUrls lets you make a
// list of URL patterns that specify sites that can and can't set cookies for
// one session.
//
// Leaving the policy unset results in the use of DefaultCookiesSetting for all
// sites, if it's set. If not, the user's personal setting applies. URLs not
// covered by the patterns specified also result in the use of defaults.
//
// While no specific policy takes precedence, see CookiesBlockedForUrls and
// CookiesAllowedForUrls. URL patterns among these 3 policies must not conflict.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message CookiesSessionOnlyForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CookiesSessionOnlyForUrls = 2;
}

// Allows blocking copying to the clipboard on specified URLs
//
// This policy is deprecated and will eventually be replaced by
// DataControlsRules.
//
// This policy blocks copying data to the clipboard on specific URLs.
//
// The enable and disable URL lists control which sites are allowed to write to
// the clipboard. A clipboard write is blocked if the URL matches a pattern in
// 'enable' and doesn't match a pattern in 'disable'. A copy is not blocked if
// the URL does not match any pattern.
//
// The origin matching patterns use a similar format to those for the
// 'URLBlocklist' policy, which are documented at
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// The minimum_data_size indicates the minimum amount of data in bytes that
// triggers the pattern check. This means that a clipboard write from a blocked
// URL would be allowed if the size of the copied data is smaller than the value
// specified in this field. The default value is 100 bytes if the field is
// unset.
//
// Value schema:
// {
//     "properties": {
//         "disable": {
//             "items": {
//                 "type": "string"
//             },
//             "type": "array"
//         },
//         "enable": {
//             "items": {
//                 "type": "string"
//             },
//             "type": "array"
//         },
//         "minimum_data_size": {
//             "minimum": 0,
//             "type": "integer"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message CopyPreventionSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional string CopyPreventionSettings = 2;
}

// Use the legacy CORS implementation rather than new CORS
//
// Use the legacy CORS implementation rather than new CORS.
//
// If this setting is set to True, the legacy implementation is used that should
// be compatible with previous versions.
//
// If this setting is set to False, or is not set, the new implementation is
// used that might cause enterprise specific compatibility issues potentially.
//
// This policy will be removed after a couple of milestones.
//
// For details on CORS, visit:
// https://www.chromestatus.com/feature/5768642492891136.
//
// Note that this policy was announced to be removed in Google Chrome version
// 82, but removed in version 84.
//
// Supported on:
message CorsLegacyModeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CorsLegacyModeEnabled = 2;
}

// Enable CORS check mitigations in the new CORS implementation
//
// Enable CORS check mitigations in the new CORS implementation, allowing
// Extensions to keep compatible behavior, and allowing Google Chrome to send
// specified headers without CORS checks.
//
// If this list is set to empty, Google Chrome tries to run Extensions in
// compatible manners, and does not introduce API changes for Google Chrome 79
// as explained at https://developer.chrome.com/extensions/webRequest.
//
// If this list is set to have HTTP request header names, CORS inspection will
// ignore the listed headers in addition to enable the mitigation for
// Extensions.
//
// If this list is not set, both mitigations explained above are not applied.
//
// For details on CORS, visit:
// https://www.chromestatus.com/feature/5768642492891136.
//
// Note that this policy was announced to be removed in Google Chrome version
// 82, but removed in version 84.
//
// Supported on:
message CorsMitigationListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList CorsMitigationList = 2;
}

// Override for the CPU performance tier
//
// Setting this policy allows enterprises to override the value returned by the
// CPU Performance API (i.e.,
// navigator.cpuPerformance,
// please see https://github.com/WICG/cpu-performance for details).
//
// If this policy is set, the value of
// navigator.cpuPerformance
// will be overridden to the specified value. If the policy is not set, then
// the default performance tier calculation is used.
//
// The possible values for this policy are 0 to 4.
//
// Supported on: android, chrome_os, linux, mac, win
message CpuPerformanceTierOverrideProto {
  optional PolicyOptions policy_options = 1;
  optional int64 CpuPerformanceTierOverride = 2;
}

// Control whether passkey creation will default to iCloud Keychain.
//
// Google Chrome may direct
// passkey/WebAuthn creation requests directly to iCloud Keychain on macOS 13.5
// or later. If iCloud Keychain syncing has not been enabled yet, this will
// prompt the user to sign in with iCloud, or may prompt them to enable iCloud
// Keychain syncing.
//
// If this policy is set to false, iCloud Keychain will not be used by default
// and the previous behavior (of creating the credential in the Google Chrome
// profile) may be used
// instead. Users will still be able to select iCloud Keychain as an option, and
// may still see iCloud Keychain credentials when signing in.
//
// If this policy is set to "true" then iCloud Keychain will be the default
// whenever the WebAuthn request is compatible with that choice.
//
// If this policy is not set then the default depends on factors such as
// whether iCloud Drive is enabled, and whether the user has recently used or
// created a credential in their
// Google Chrome profile.
//
// Valid values:
//   True: Default to creating passkeys in iCloud Keychain when possible.
//   False: Default to creating passkeys in other stores such as the Google
// Chrome profile.
//   None: Default is determined by other factors
//
// Supported on: mac
message CreatePasskeysInICloudKeychainProto {
  optional PolicyOptions policy_options = 1;
  optional bool CreatePasskeysInICloudKeychain = 2;
}

// Settings for Create Themes with AI
//
// Create Themes with AI lets users create custom themes/wallpapers by
// preselecting from a list of options.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Create Themes and improve AI models.
//   1: Allow Create Themes without improving AI models.
//   2: Do not allow Create Themes.
//
// Supported on: chrome_os, linux, mac, win
message CreateThemesSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 CreateThemesSettings = 2;
}

// Allows users to be shown the Credential Provider Extension promo
//
// When the policy is not set or set to Enabled, the Credential Provider
// Extension promo may be shown to the user.
// When the policy is set to Disabled, the Credential Provider Extension promo
// will not be shown to the user.
//
// Valid values:
//   True: Allow the Credential Provider Extension promo to be displayed
//   False: Do not allow the Credential Provider Extension promo to be displayed
//
// Supported on: ios
message CredentialProviderPromoEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CredentialProviderPromoEnabled = 2;
}

// Specifies whether WebAssembly modules can be sent cross-origin
//
//
// Specifies whether WebAssembly modules can be sent to another window or worker
// cross-origin. Cross-origin WebAssembly module sharing will be deprecated as
// part of the efforts to deprecate document.domain, see
// https://github.com/mikewest/deprecating-document-domain. This policy allows
// to re-enable cross-origin WebAssembly module sharing to offer a longer
// transition period in the deprecation process.
//
// When set to True, sites can send WebAssembly modules also cross-origin
// without restrictions.
//
// When set to False or not set, sites can only send WebAssembly modules to
// windows and workers in the same origin.
//
// Valid values:
//   True: Allow WebAssembly modules to be sent cross-origin
//   False: Prevent WebAssembly modules to be sent cross-origin
//
// Supported on:
message CrossOriginWebAssemblyModuleSharingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CrossOriginWebAssemblyModuleSharingEnabled = 2;
}

// User is enabled to run Crostini
//
// Setting the policy to Enabled or leaving it unset lets users run Crostini, as
// long as VirtualMachinesAllowed and CrostiniAllowed are set to Enabled.
// Setting the policy to Disabled turns Crostini off for the user. Changing it
// to Disabled starts applying the policy to starting new Crostini containers,
// not those already running.
//
// Valid values:
//   True: Allow users to use virtual machines needed to support Linux apps
//   False: Do not allow users to use virtual machines needed to support Linux
// apps
//
// Supported on: chrome_os
message CrostiniAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool CrostiniAllowed = 2;
}

// Crostini Ansible playbook
//
// Provides an Ansible playbook that should be executed in the default Crostini
// container.
//
// This policy allows to provide an Ansible playbook to be applied to the
// default Crostini container if it is available on the given device and allowed
// by policies.
//
// The size of the data must not exceed 1MB (1000000 bytes) and must be encoded
// in YAML. The cryptographic hash is used to verify the integrity of the
// download.
//
// The configuration is downloaded and cached. It will be re-downloaded whenever
// the URL or the hash changes.
//
// If you set the policy, users can't change it. If not set, users can continue
// using default Crostini container in its ongoing configuration if Crostini is
// allowed by policies.
//
// Supported on:
message CrostiniAnsiblePlaybookProto {
  optional PolicyOptions policy_options = 1;
  optional string CrostiniAnsiblePlaybook = 2;
}

// Control usage of Android apps from untrusted sources for the user
//
// This policy controls the usage of Android apps from untrusted sources (other
// than Google Play Store) on a per-user basis.
//
// If the value for this policy is not set, then the functionality is treated as
// disallowed.
//
// If the user's device is managed, the availability of this functionality is
// additionally dependant on the corresponding device policy.
//
// If the user's device is not managed, the availability of this functionality
// is additionally dependant on whether the user is the device owner.
//
// Valid values:
//   0: Prevent the user from using Android apps from untrusted sources
//   1: Allow the user to use Android apps from untrusted sources
//
// Supported on: chrome_os
message CrostiniArcAdbSideloadingAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional int64 CrostiniArcAdbSideloadingAllowed = 2;
}

// User is enabled to export / import Crostini containers via the UI
//
// Setting the policy to Enabled or leaving it unset makes the export-import UI
// available to users. Setting the policy to Disabled renders the export-import
// UI unavailable to users.
//
// Valid values:
//   True: Enable Linux virtual machine backup and restore
//   False: Disable Linux virtual machine backup and restore
//
// Supported on: chrome_os
message CrostiniExportImportUIAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool CrostiniExportImportUIAllowed = 2;
}

// Allow users to [enable/configure] Crostini port forwarding
//
// Specifies whether port forwarding into Crostini containers is allowed.
//
// If this policy is set to True or not set, users will be able to configure
// port forwarding into their Crostini containers.
//
// If this policy is set to False, port forwarding into Crostini containers will
// be disabled.
//
// Valid values:
//   True: Allow port forwarding into Linux virtual machines
//   False: Do not allow port forwarding into Linux virtual machines
//
// Supported on: chrome_os
message CrostiniPortForwardingAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool CrostiniPortForwardingAllowed = 2;
}

// User is allowed to have root access to Crostini containers
//
// Allow this user root access to Crostini containers.
//
// If the policy is set to true or left unset root access to Crostini containers
// will be granted to the user.
// If the policy is set to false, root access to both existing and new Crostini
// containers will not be granted to the user.
//
// Valid values:
//   True: Enable root access to Linux virtual machines
//   False: Disable root access to Linux virtual machines
//
// Supported on: chrome_os
message CrostiniRootAccessAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool CrostiniRootAccessAllowed = 2;
}

// Enable the cursor highlight accessibility feature
//
// Enable the cursor highlight accessibility feature.
//
// This feature is responsible for highlighting the area that surrounds the
// mouse cursor while moving it.
//
// If this policy is set to enabled, the cursor highlight will always be
// enabled.
//
// If this policy is set to disabled, the cursor highlight will always be
// disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the cursor highlight is disabled initially but
// can be enabled by the user anytime.
//
// Valid values:
//   True: Enable cursor highlight
//   False: Disable cursor highlight
//   None: Allow the user to decide
//
// Supported on: chrome_os
message CursorHighlightEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool CursorHighlightEnabled = 2;
}

// Enable DHE cipher suites in TLS
//
// This policy was removed in M58 after DHE was removed from Google Chrome.
//
// If the policy is not set, or is set to false, then DHE cipher suites in TLS
// will not be enabled. Otherwise it may be set to true to enable DHE cipher
// suites and retain compatibility with an outdated server. This is a stopgap
// measure and the server should be reconfigured.
//
// Servers are encouraged to migrated to ECDHE cipher suites. If these are
// unavailable, ensure a cipher suite using RSA key exchange is enabled.
//
// Supported on:
message DHEEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DHEEnabled = 2;
}

// DNS interception checks enabled
//
// This policy configures a local switch that can be used to disable DNS
// interception checks. The checks attempt to discover whether the browser is
// behind a proxy that redirects unknown host names.
//
// This detection may not be necessary in an enterprise environment where the
// network configuration is known, since it causes some amount of DNS and HTTP
// traffic on start-up and each DNS configuration change.
//
// When this policy is not set, or is enabled, the DNS interception checks are
// performed. When explicitly disabled, they're not.
//
// Valid values:
//   True: Perform DNS interception checks
//   False: Do not perform DNS interception checks
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DNSInterceptionChecksEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DNSInterceptionChecksEnabled = 2;
}

// Enable the data compression proxy feature
//
// Setting the policy to Enabled allows the data compression proxy. Setting the
// policy to Disabled disallows the proxy.
//
// If you set the policy, users can't change it. If unset, users can choose to
// use the feature.
//
// Supported on:
message DataCompressionProxyEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DataCompressionProxyEnabled = 2;
}

// Sets a list of Data Controls rules.
//
// Configures a list of Data Control rules to prevent data leaks.
//
// Each rule consists of the following:
// - Condition fields to trigger that rule. A rule will only trigger if a user
// action matches all the fields populated in its sources, destinations, and, or
// and not fields. For list sub-fields, only one entry needs to be matched, for
// example only one URL pattern needs to match to trigger the rule.
// - A list of restrictions to be applied. Depending on the restriction, only
// sources or destinations conditions may be available.
//
// Rules can be added to:
// - Control the clipboard data shared between the sources and the destinations.
// - Control blocking screenshots based on the source tabs.
//
// If OnSecurityEventEnterpriseConnector policy is set to True, triggered rules
// are reported to the admin.
// The restriction level can be set to BLOCK, WARN, or REPORT.
// - If the restriction level is set to BLOCK, the action won't be allowed.
// - If the restriction level is set to WARN, a user will be warned and may
// choose to proceed with or cancel the action.
// - If the restriction level is set to REPORT, the user action will not be
// interrupted, but a report will be sent if OnSecurityEventEnterpriseConnector
// policy is enabled.
//
// Notes:
// - Format the URL patterns according to this format (
// https://support.google.com/chrome/a?p=url_blocklist_filter_format ).
// - For data leak prevention rules specific to Google ChromeOS, see also the
// DataLeakPreventionRulesList policy.
//
// If the policy is left not set, no restrictions will be applied.
//
// This policy is available only to users who have an assigned `Chrome
// Enterprise Premium` license.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "and": {
//                 "items": {
//                     "id": "DataControlsCondition",
//                     "properties": {
//                         "and": {
//                             "items": {
//                                 "$ref": "DataControlsCondition"
//                             },
//                             "type": "array"
//                         },
//                         "destinations": {
//                             "properties": {
//                                 "gemini_in_chrome": {
//                                     "type": "boolean"
//                                 },
//                                 "incognito": {
//                                     "type": "boolean"
//                                 },
//                                 "os_clipboard": {
//                                     "type": "boolean"
//                                 },
//                                 "other_profile": {
//                                     "type": "boolean"
//                                 },
//                                 "url_regexprs": {
//                                     "items": {
//                                         "type": "string"
//                                     },
//                                     "type": "array"
//                                 },
//                                 "urls": {
//                                     "items": {
//                                         "type": "string"
//                                     },
//                                     "type": "array"
//                                 }
//                             },
//                             "type": "object"
//                         },
//                         "not": {
//                             "$ref": "DataControlsCondition"
//                         },
//                         "or": {
//                             "items": {
//                                 "$ref": "DataControlsCondition"
//                             },
//                             "type": "array"
//                         },
//                         "sources": {
//                             "properties": {
//                                 "gemini_in_chrome": {
//                                     "type": "boolean"
//                                 },
//                                 "incognito": {
//                                     "type": "boolean"
//                                 },
//                                 "os_clipboard": {
//                                     "type": "boolean"
//                                 },
//                                 "other_profile": {
//                                     "type": "boolean"
//                                 },
//                                 "size_higher_than": {
//                                     "type": "integer"
//                                 },
//                                 "size_lower_than": {
//                                     "type": "integer"
//                                 },
//                                 "url_regexprs": {
//                                     "items": {
//                                         "type": "string"
//                                     },
//                                     "type": "array"
//                                 },
//                                 "urls": {
//                                     "items": {
//                                         "type": "string"
//                                     },
//                                     "type": "array"
//                                 }
//                             },
//                             "type": "object"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "description": {
//                 "type": "string"
//             },
//             "destinations": {
//                 "properties": {
//                     "gemini_in_chrome": {
//                         "type": "boolean"
//                     },
//                     "incognito": {
//                         "type": "boolean"
//                     },
//                     "os_clipboard": {
//                         "type": "boolean"
//                     },
//                     "other_profile": {
//                         "type": "boolean"
//                     },
//                     "url_regexprs": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "urls": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             },
//             "name": {
//                 "type": "string"
//             },
//             "not": {
//                 "properties": {
//                     "and": {
//                         "items": {
//                             "$ref": "DataControlsCondition"
//                         },
//                         "type": "array"
//                     },
//                     "destinations": {
//                         "properties": {
//                             "gemini_in_chrome": {
//                                 "type": "boolean"
//                             },
//                             "incognito": {
//                                 "type": "boolean"
//                             },
//                             "os_clipboard": {
//                                 "type": "boolean"
//                             },
//                             "other_profile": {
//                                 "type": "boolean"
//                             },
//                             "url_regexprs": {
//                                 "items": {
//                                     "type": "string"
//                                 },
//                                 "type": "array"
//                             },
//                             "urls": {
//                                 "items": {
//                                     "type": "string"
//                                 },
//                                 "type": "array"
//                             }
//                         },
//                         "type": "object"
//                     },
//                     "not": {
//                         "$ref": "DataControlsCondition"
//                     },
//                     "or": {
//                         "items": {
//                             "$ref": "DataControlsCondition"
//                         },
//                         "type": "array"
//                     },
//                     "sources": {
//                         "properties": {
//                             "gemini_in_chrome": {
//                                 "type": "boolean"
//                             },
//                             "incognito": {
//                                 "type": "boolean"
//                             },
//                             "os_clipboard": {
//                                 "type": "boolean"
//                             },
//                             "other_profile": {
//                                 "type": "boolean"
//                             },
//                             "size_higher_than": {
//                                 "type": "integer"
//                             },
//                             "size_lower_than": {
//                                 "type": "integer"
//                             },
//                             "url_regexprs": {
//                                 "items": {
//                                     "type": "string"
//                                 },
//                                 "type": "array"
//                             },
//                             "urls": {
//                                 "items": {
//                                     "type": "string"
//                                 },
//                                 "type": "array"
//                             }
//                         },
//                         "type": "object"
//                     }
//                 },
//                 "type": "object"
//             },
//             "or": {
//                 "items": {
//                     "properties": {
//                         "and": {
//                             "items": {
//                                 "$ref": "DataControlsCondition"
//                             },
//                             "type": "array"
//                         },
//                         "destinations": {
//                             "properties": {
//                                 "gemini_in_chrome": {
//                                     "type": "boolean"
//                                 },
//                                 "incognito": {
//                                     "type": "boolean"
//                                 },
//                                 "os_clipboard": {
//                                     "type": "boolean"
//                                 },
//                                 "other_profile": {
//                                     "type": "boolean"
//                                 },
//                                 "url_regexprs": {
//                                     "items": {
//                                         "type": "string"
//                                     },
//                                     "type": "array"
//                                 },
//                                 "urls": {
//                                     "items": {
//                                         "type": "string"
//                                     },
//                                     "type": "array"
//                                 }
//                             },
//                             "type": "object"
//                         },
//                         "not": {
//                             "$ref": "DataControlsCondition"
//                         },
//                         "or": {
//                             "items": {
//                                 "$ref": "DataControlsCondition"
//                             },
//                             "type": "array"
//                         },
//                         "sources": {
//                             "properties": {
//                                 "gemini_in_chrome": {
//                                     "type": "boolean"
//                                 },
//                                 "incognito": {
//                                     "type": "boolean"
//                                 },
//                                 "os_clipboard": {
//                                     "type": "boolean"
//                                 },
//                                 "other_profile": {
//                                     "type": "boolean"
//                                 },
//                                 "size_higher_than": {
//                                     "type": "integer"
//                                 },
//                                 "size_lower_than": {
//                                     "type": "integer"
//                                 },
//                                 "url_regexprs": {
//                                     "items": {
//                                         "type": "string"
//                                     },
//                                     "type": "array"
//                                 },
//                                 "urls": {
//                                     "items": {
//                                         "type": "string"
//                                     },
//                                     "type": "array"
//                                 }
//                             },
//                             "type": "object"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "restrictions": {
//                 "items": {
//                     "properties": {
//                         "class": {
//                             "enum": [
//                                 "CLIPBOARD",
//                                 "SCREENSHOT"
//                             ],
//                             "type": "string"
//                         },
//                         "level": {
//                             "enum": [
//                                 "BLOCK",
//                                 "WARN",
//                                 "REPORT"
//                             ],
//                             "type": "string"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "rule_id": {
//                 "type": "string"
//             },
//             "sources": {
//                 "properties": {
//                     "gemini_in_chrome": {
//                         "type": "boolean"
//                     },
//                     "incognito": {
//                         "type": "boolean"
//                     },
//                     "os_clipboard": {
//                         "type": "boolean"
//                     },
//                     "other_profile": {
//                         "type": "boolean"
//                     },
//                     "size_higher_than": {
//                         "minimum": 0,
//                         "type": "integer"
//                     },
//                     "size_lower_than": {
//                         "minimum": 0,
//                         "type": "integer"
//                     },
//                     "url_regexprs": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "urls": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, ios, linux, mac, win
message DataControlsRulesProto {
  optional PolicyOptions policy_options = 1;
  optional string DataControlsRules = 2;
}

// Set minimal size limit for data leak prevention clipboard restriction
//
// This policy sets the minimal data size (in bytes) of the data in the
// clipboard that will be checked against clipboard restriction rules defined in
// DataLeakPreventionRulesList policy.
// If not set, it defaults to 0 that means that all pastes from the clipboard
// will be checked according to the configured rules.
//
// Supported on: chrome_os
message DataLeakPreventionClipboardCheckSizeLimitProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DataLeakPreventionClipboardCheckSizeLimit = 2;
}

// Enable data leak prevention reporting
//
// This policy is a general switch for all rules defined in the
// DataLeakPreventionRulesList policy.
// Setting this policy to True will switch on real-time reporting of data leak
// prevention events.
// Setting this policy to False or leaving it unset will switch off the
// reporting.
// Rules defined with ALLOW level restrictions in DataLeakPreventionRulesList
// will not report events in both cases.
//
// Valid values:
//   True: Enable reporting of data leak prevention events
//   False: Disable reporting of data leak prevention events
//
// Supported on: chrome_os
message DataLeakPreventionReportingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DataLeakPreventionReportingEnabled = 2;
}

// Sets a list of data leak prevention rules.
//
// Configures a list of rules to prevent data leak on Google ChromeOS.
// Data leak can happen by copying and pasting data, transferring files,
// printing, screensharing, or taking screenshots ...etc.
//
// Each rule consists of the following:
// - A list of sources defined as URLs. Any data in the sources will be
// considered confidential data, to which the restrictions will be applied.
// - A list of destinations defined as URLs or components, to which the
// confidential data is either allowed or disallowed to be shared.
// - A list of restrictions to be applied on the data of the sources.
//
// Rules can be added to:
// - Control the clipboard data shared between the sources and the destinations.
// - Control taking screenshots of any of the sources.
// - Control printing of any of the sources.
// - Control the privacy screen when any of the sources is visible.
// - Control screen sharing of any of the sources.
// - Control files downloaded from any of the sources when they are transferred
// to the destination. Supported on Google ChromeOS version 108 and higher.
//
// The restriction level can be set to BLOCK, ALLOW, REPORT, WARN.
// - If the restriction level is set to BLOCK, the action won't be allowed. If
// DataLeakPreventionReportingEnabled is set to True, the blocked action will be
// reported to the admin.
// - If the restriction level is set to ALLOW, the action will be allowed.
// - If the restriction level is set to REPORT and
// DataLeakPreventionReportingEnabled is set to True, the action will be
// reported to the admin.
// - If the restriction level is set to WARN, a user will be warned and may
// choose to proceed with or cancel the action. If
// DataLeakPreventionReportingEnabled is set to True, showing the warning will
// be reported to the admin; proceeding with the action will also be reported.
//
// Notes:
// - PRIVACY_SCREEN restriction doesn't block the ability to turn on privacy
// screen, but enforces it when the restriction class is set to BLOCK.
// - Destinations cannot be empty in case one of the restrictions is CLIPBOARD
// or FILES, but they don't make any difference for the remaining restrictions.
// - DRIVE and USB destinations are ignored for CLIPBOARD restriction.
// - Format the URL patterns according to this format (
// https://support.google.com/chrome/a?p=url_blocklist_filter_format ).
//
// If the policy is left not set, no restrictions will be applied.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "description": {
//                 "type": "string"
//             },
//             "destinations": {
//                 "properties": {
//                     "components": {
//                         "items": {
//                             "enum": [
//                                 "ARC",
//                                 "CROSTINI",
//                                 "PLUGIN_VM",
//                                 "DRIVE",
//                                 "USB",
//                                 "ONEDRIVE"
//                             ],
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "urls": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             },
//             "name": {
//                 "type": "string"
//             },
//             "restrictions": {
//                 "items": {
//                     "properties": {
//                         "class": {
//                             "enum": [
//                                 "CLIPBOARD",
//                                 "SCREENSHOT",
//                                 "PRINTING",
//                                 "PRIVACY_SCREEN",
//                                 "SCREEN_SHARE",
//                                 "FILES"
//                             ],
//                             "type": "string"
//                         },
//                         "level": {
//                             "enum": [
//                                 "BLOCK",
//                                 "ALLOW",
//                                 "REPORT",
//                                 "WARN"
//                             ],
//                             "type": "string"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "rule_id": {
//                 "type": "string"
//             },
//             "sources": {
//                 "properties": {
//                     "urls": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os
message DataLeakPreventionRulesListProto {
  optional PolicyOptions policy_options = 1;
  optional string DataLeakPreventionRulesList = 2;
}

// DataURL Whitespace Preservation for all media types
//
// This policy provides a temporary opt-out for changes to how Chrome handles
// whitepsace in data URLS.
// Previously, whitespace would be kept only if the top level media type was
// text or contained the media type string xml.
// Now, whitespace will be preserved in all data URLs, regardless of media type.
//
// If this policy is left unset or is set to True, the new behavior is enabled.
//
// When this policy is set to False, the old behavior is enabled.
//
// Valid values:
//   True: Keep whitespace for all mime-types
//   False: Only keep whitespace for text and xml mime-types
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DataURLWhitespacePreservationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DataURLWhitespacePreservationEnabled = 2;
}

// Data URL support for SVGUseElement.
//
// This policy enables Data URL support for SVGUseElement, which will be
// disabled
// by default starting in M119.
// If this policy is set to Enabled, Data URLs will continue to work in
// SVGUseElement.
// If this policy is set to Disabled or not set, Data URLs won't work in
// SVGUseElement.
//
// Valid values:
//   True: Enable Data URL support in SVGUseElement.
//   False: Disable Data URL support in SVGUseElement.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DataUrlInSvgUseEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DataUrlInSvgUseEnabled = 2;
}

// Enable opaque origins for data URLs in Web Workers
//
// Controls whether Web Workers created from data URLs are assigned a unique
// opaque origin.
//
// Web Workers can be created using a data URL containing the worker's script.
// Previously, these workers inherited the origin of the page that created them,
// allowing them to access the same local storage, cookies, and other origin-
// bound data. To improve security and align with the HTML specification, Chrome
// is changing its default behavior in milestone 149 so that workers created
// from data URLs will now have a unique, opaque origin. This isolates them from
// the creator page's data.
//
// If this policy is set to Enabled or left unset, the new default (more secure)
// behavior is used, and Web Workers created from data URLs will have a unique
// opaque origin.
//
// If this policy is set to Disabled, Chrome reverts to the legacy behavior, and
// Web Workers created from data URLs will inherit the origin of their creator.
// This allows administrators to temporarily resolve compatibility issues if
// internal applications break due to the security change.
//
// This policy is intended to be temporary and will be removed in milestone 157.
//
// Valid values:
//   True: Opaque origins for data URLs in Web Workers are enabled (new default
// behavior)
//   False: Opaque origins for data URLs in Web Workers are disabled (deprecated
// legacy behavior)
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DataUrlInWebWorkerOpaqueOriginEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DataUrlInWebWorkerOpaqueOriginEnabled = 2;
}

// Default automatic downloads setting
//
// Setting the policy to 1 lets websites download multiple files automatically.
// Setting the policy to 2 denies this permission. You can set the policy to ask
// whenever a website wants to download multiple files automatically.
//
// Leaving the policy unset means the AskAutomaticDownloads policy applies, but
// users can change this setting.
//
// Valid values:
//   1: Allow sites to download multiple files automatically
//   2: Do not allow any site to download multiple files automatically
//   3: Ask whenever a site wants to download multiple files automatically
//
// Supported on: android, chrome_os, linux, mac, win
message DefaultAutomaticDownloadsSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultAutomaticDownloadsSetting = 2;
}

// Set Google Chrome as Default Browser
//
// Setting the policy to True has Google Chrome always check whether it's the
// default browser on startup and, if possible, automatically register itself.
// Setting the policy to False stops Google Chrome from ever checking if it's
// the default and turns user controls off for this option.
//
// Leaving the policy unset means Google Chrome lets users control whether it's
// the default and, if not, whether user notifications should appear.
//
// Note: For Microsoft®Windows® administrators, turning this setting on only
// works for machines running Windows 7. For later versions, you must deploy a
// "default application associations" file that makes Google Chrome the handler
// for the https and http protocols (and, optionally, the ftp protocol and other
// file formats). See Chrome Help (
// https://support.google.com/chrome?p=make_chrome_default_win ).
//
// Valid values:
//   True: Enable the default browser check on startup
//   False: Disable the default browser check on startup
//   None: Allow the user to decide
//
// Supported on: fuchsia, linux, mac, win
message DefaultBrowserSettingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DefaultBrowserSettingEnabled = 2;
}

// Default clipboard setting
//
// Setting the policy to 2 blocks sites from using the clipboard site
// permission. Setting the policy to 3 or leaving it unset lets the user change
// the setting and decide if the clipboard APIs are available when a site wants
// to use one.
//
// This policy can be overridden for specific URL patterns using the
// ClipboardAllowedForUrls and ClipboardBlockedForUrls policies.
//
// This policy only affects clipboard operations controlled by the clipboard
// site permission, and does not affect sanitized clipboard writes or trusted
// copy and paste operations.
//
// Valid values:
//   2: Do not allow any site to use the clipboard site permission
//   3: Allow sites to ask the user to grant the clipboard site permission
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultClipboardSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultClipboardSetting = 2;
}

// Control use of the Controlled Frame API
//
// The Controlled Frame API, available to certain isolated contexts such as
// Isolated Web Apps (IWAs), allows an app to embed and manipulate arbitrary
// content.
// Please see https://github.com/WICG/controlled-frame for details.
//
// Setting the policy to 1 or leaving it unset allows Isolated Web App origins
// to use the Controlled Frame.
//
// Setting the policy to 2 blocks Isolated Web App origins from using the
// Controlled Frame.
//
// Valid values:
//   1: Allow Isolated Web App origins to use the Controlled Frame
//   2: Do not allow Isolated Web App origins to use the Controlled Frame
//
// Supported on: chrome_os, linux, mac, win
message DefaultControlledFrameSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultControlledFrameSetting = 2;
}

// Default cookies setting
//
// Unless the RestoreOnStartup policy is set to permanently restore URLs from
// previous sessions, then setting CookiesSessionOnlyForUrls lets you make a
// list of URL patterns that specify sites that can and can't set cookies for
// one session.
//
// Leaving the policy unset results in the use of DefaultCookiesSetting for all
// sites, if it's set. If not, the user's personal setting applies. URLs not
// covered by the patterns specified also result in the use of defaults.
//
// While no specific policy takes precedence, see CookiesBlockedForUrls and
// CookiesAllowedForUrls. URL patterns among these 3 policies must not conflict.
//
// Valid values:
//   1: Allow all sites to set local data
//   2: Do not allow any site to set local data
//   4: Keep cookies for the duration of the session
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultCookiesSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultCookiesSetting = 2;
}

// Control use of the Device Attributes API
//
// Setting the policy specifies whether a force-installed Isolated Web App or
// kiosk application has access to the Device Attributes API by default.
// Please see https://wicg.github.io/WebApiDevice/device_attributes for details.
//
// Setting the policy to 1 or leaving it unset allows force-installed Isolated
// Web Apps and kiosk applications to use the API.
//
// Setting the policy to 2 blocks force-installed Isolated Web Apps and kiosk
// applications from using the API.
//
// Valid values:
//   1: Allow force-installed Isolated Web Apps and kiosk applications to use
// the Device Attributes API
//   2: Do not allow force-installed Isolated Web Apps and kiosk applications to
// use the Device Attributes API
//
// Supported on: chrome_os
message DefaultDeviceAttributesSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultDeviceAttributesSetting = 2;
}

// Control access to private network in the Direct Sockets API
//
// The Direct Sockets API allows communication with arbitrary endpoints using
// TCP and UDP.
// Please see https://github.com/WICG/direct-sockets for details.
//
// Private network endpoints are those using IP addresses from private IP
// address space, which is defined in https://wicg.github.io/private-network-
// access/#ip-address-space-private.
//
// Setting the policy to 1 or leaving it unset allows Isolated Web App origins
// to communicate with private network endpoints in the Direct Sockets API.
//
// Setting the policy to 2 blocks Isolated Web App origins from communicating
// with private network endpoints in the Direct Sockets API.
//
// Note that this policy only applies if the origin is allowed to use the Direct
// Sockets API.
// Please consult DefaultDirectSocketsSetting, DirectSocketsAllowedForUrls and
// DirectSocketsBlockedForUrls for more details.
// The default can also be overridden for matching URLs using
// DirectSocketsPrivateNetworkAccessAllowedForUrls and
// DirectSocketsPrivateNetworkAccessBlockedForUrls
//
// This policy applies only to new connection attempts and doesn't invalidate
// existing connections.
//
// Valid values:
//   1: Allow Isolated Web App origins to communicate with private network
// endpoints in the Direct Sockets API
//   2: Do not allow Isolated Web App origins to communicate with private
// network endpoints in the Direct Sockets API
//
// Supported on: chrome_os, linux, mac, win
message DefaultDirectSocketsPrivateNetworkAccessSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultDirectSocketsPrivateNetworkAccessSetting = 2;
}

// Control use of the Direct Sockets API
//
// The Direct Sockets API allows communication with arbitrary endpoints using
// TCP and UDP.
// Please see https://github.com/WICG/direct-sockets for details.
//
// Setting the policy to 1 or leaving it unset allows Isolated Web App origins
// to use Direct Sockets.
//
// Setting the policy to 2 blocks Isolated Web App origins from using Direct
// Sockets.
//
// Valid values:
//   1: Allow Isolated Web App origins to use Direct Sockets
//   2: Do not allow Isolated Web App origins to use Direct Sockets
//
// Supported on: chrome_os, linux, mac, win
message DefaultDirectSocketsSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultDirectSocketsSetting = 2;
}

// Set default download directory
//
// Setting the policy changes the default directory that Chrome downloads files
// to, but users can change the directory.
//
// Leaving the policy unset means Chrome uses its platform-specific default
// directory.
//
// This policy has no effect if the policy DownloadDirectory is set.
//
// Note: See a list of variables you can use (
// https://www.chromium.org/administrators/policy-list-3/user-data-directory-
// variables ).
//
// Supported on: chrome_os, fuchsia, linux, mac, win
//
// Note: this policy must have a RECOMMENDED PolicyMode set in PolicyOptions.
message DefaultDownloadDirectoryProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultDownloadDirectory = 2;
}

// Control use of the File Handling API
//
// Setting the policy to AskFileHandling lets web apps ask for access to file
// types via the File Handling API. Setting the policy to BlockFileHandling
// denies access to file types.
//
// Leaving it unset lets web apps ask for access, but users can change this
// setting.
//
// Valid values:
//   2: Do not allow any web app to access file types via the File Handling API
//   3: Allow web apps to ask the user to grant access to file types via the
// File Handling API
//
// Supported on:
message DefaultFileHandlingGuardSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultFileHandlingGuardSetting = 2;
}

// Control use of the File System API for reading
//
// Setting the policy to 3 lets websites ask for read access to files and
// directories in the host operating system's file system via the File System
// API. Setting the policy to 2 denies access.
//
// Leaving it unset lets websites ask for access, but users can change this
// setting.
//
// Valid values:
//   2: Do not allow any site to request read access to files and directories
// via the File System API
//   3: Allow sites to ask the user to grant read access to files and
// directories via the File System API
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultFileSystemReadGuardSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultFileSystemReadGuardSetting = 2;
}

// Control use of the File System API for writing
//
// Setting the policy to 3 lets websites ask for write access to files and
// directories in the host operating system's file system. Setting the policy to
// 2 denies access.
//
// Leaving it unset lets websites ask for access, but users can change this
// setting.
//
// Valid values:
//   2: Do not allow any site to request write access to files and directories
//   3: Allow sites to ask the user to grant write access to files and
// directories
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultFileSystemWriteGuardSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultFileSystemWriteGuardSetting = 2;
}

// Default geolocation setting
//
// Setting the policy to 1 lets sites track the users' physical location as the
// default state. Setting the policy to 2 denies this tracking by default. You
// can set the policy to ask whenever a site wants to track the users' physical
// location.
//
// Leaving the policy unset means the AskGeolocation policy applies, but users
// can change this setting.
//
// Valid values:
//   1: Allow sites to track the users' physical location
//   2: Do not allow any site to track the users' physical location
//   3: Ask whenever a site wants to track the users' physical location
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultGeolocationSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultGeolocationSetting = 2;
}

// Assigns apps as default handlers for specified file extensions
//
// This policy allows the admins to specify apps that act as default handlers
// for the respective file extensions
// on Google ChromeOS that users can't change.
//
// For all file extensions not specified in the policy, users are free to set
// their own defaults with respect to
// the usual workflow.
//
// Specify Chrome apps by their ID, such as pjkljhegncpnkpknbcohdijeoejaedia;
// Web apps by the URL used in WebAppInstallForceList, such as
// https://google.com/maps;
// Android apps by their package name, such as com.google.android.gm;
// System Web Apps by their snake case name, such as projector;
// Virtual Tasks by their designated name prepended with VirtualTask/, such as
// VirtualTask/microsoft-office.
// Isolated Web Apps by their web bundle ID, such as
// egoxo6biqdjrk62rman4vvr5cbq2ozsyydig7jmdxcmohdob2ecaaaic.
//
// Note that apps MUST declare themselves as file handlers for specified file
// extensions in the manifest in order for
// that policy item to take effect (i.e. the policy does NOT extend existing app
// capabilities).
//
// Leaving the policy unset allows Google ChromeOS to select default handlers
// according to the internal logic.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "file_extensions": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "policy_id": {
//                 "type": "string"
//             }
//         },
//         "required": [
//             "policy_id",
//             "file_extensions"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os
message DefaultHandlersForFileExtensionsProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultHandlersForFileExtensions = 2;
}

// Default idle detection setting
//
// Allows you to set whether websites are allowed to use the Idle Detection API.
//
// When this policy is set to 1 - AllowIdleDetection, websites can use the API
// without asking the user for permission.
//
// When this policy is set to 2 - BlockIdleDetection, websites can't use the
// API, regardless of the user's permission.
//
// When this policy is set to 3 - AskIdleDetection or not set, websites can't
// use the API without the user's permission.
//
// Valid values:
//   1: Allow sites to detect idle state without asking the user
//   2: Do not allow any site to detect the user's idle state
//   3: Ask every time a site wants to detect the user's idle state
//
// Supported on: android, chrome_os, linux, mac, win
message DefaultIdleDetectionSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultIdleDetectionSetting = 2;
}

// Default images setting
//
// Setting the policy to 1 lets all websites display images. Setting the policy
// to 2 denies image display.
//
// Leaving it unset allows images, but users can change this setting.
//
// Valid values:
//   1: Allow all sites to show all images
//   2: Do not allow any site to show images
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultImagesSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultImagesSetting = 2;
}

// Control use of insecure content exceptions
//
// Allows you to set whether users can add exceptions to allow mixed content for
// specific sites.
//
// This policy can be overridden for specific URL patterns using the
// 'InsecureContentAllowedForUrls' and 'InsecureContentBlockedForUrls' policies.
//
// If this policy is left not set, users will be allowed to add exceptions to
// allow blockable mixed content and disable autoupgrades for optionally
// blockable mixed content.
//
// Valid values:
//   2: Do not allow any site to load mixed content
//   3: Allow users to add exceptions to allow mixed content
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultInsecureContentSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultInsecureContentSetting = 2;
}

// Control use of JavaScript JIT
//
// Allows you to set whether Google Chrome will run the v8 JavaScript engine
// with JIT (Just In Time) compiler enabled or not.
//
// Disabling the JavaScript JIT will mean that Google Chrome may render web
// content more slowly, and may also disable parts of JavaScript including
// WebAssembly. Disabling the JavaScript JIT may allow Google Chrome to render
// web content in a more secure configuration.
//
// This policy can be overridden for specific URL patterns using the
// JavaScriptJitAllowedForSites and JavaScriptJitBlockedForSites policies.
//
// If this policy is left not set, JavaScript JIT is enabled.
//
// Valid values:
//   1: Allow any site to run JavaScript JIT
//   2: Do not allow any site to run JavaScript JIT
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultJavaScriptJitSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultJavaScriptJitSetting = 2;
}

// Control use of JavaScript optimizers
//
// Allows you to set whether Google Chrome
// will run the v8 JavaScript engine with more advanced JavaScript optimizations
// enabled.
//
// Disabling JavaScript optimizations (by setting this policy's value to 2) will
// mean that Google Chrome may render web
// content more slowly.
//
// This policy can be overridden for specific URL patterns using the
// JavaScriptOptimizerAllowedForSites and
// JavaScriptOptimizerBlockedForSites policies.
//
// If this policy is left not set, JavaScript optimizations are enabled.
//
// Valid values:
//   1: Enable advanced JavaScript optimizations on all sites
//   2: Disable advanced JavaScript optimizations on all sites
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultJavaScriptOptimizerSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultJavaScriptOptimizerSetting = 2;
}

// Default JavaScript setting
//
// Setting the policy to 1 lets websites run JavaScript. Setting the policy to 2
// denies JavaScript.
//
// Leaving it unset allows JavaScript, but users can change this setting.
//
// Valid values:
//   1: Allow all sites to run JavaScript
//   2: Do not allow any site to run JavaScript
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultJavaScriptSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultJavaScriptSetting = 2;
}

// Default key generation setting
//
// Allows you to set whether websites are allowed to use key generation. Using
// key generation can be either allowed for all websites or denied for all
// websites.
//
// If this policy is left not set, 'BlockKeygen' will be used and the user will
// be able to change it.
//
// Valid values:
//   1: Allow all sites to use key generation
//   2: Do not allow any site to use key generation
//
// Supported on:
message DefaultKeygenSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultKeygenSetting = 2;
}

// Default Local Fonts permission setting
//
// Setting the policy to BlockLocalFonts (value 2) automatically denies the
// local fonts permission to sites by default. This will limit the ability of
// sites to see information about local fonts.
//
// Setting the policy to AskLocalFonts (value 3) will prompt the user when the
// local fonts permission is requested by default. If users allow the
// permission, it will extend the ability of sites to see information about
// local fonts.
//
// Leaving the policy unset means the default behavior applies which is to
// prompt the user, but users can change this setting
//
// Valid values:
//   2: Denies the Local Fonts permission on all sites by default
//   3: Ask every time a site wants obtain the Local Fonts permission
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultLocalFontsSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultLocalFontsSetting = 2;
}

// Default mediastream setting
//
// Allows you to set whether websites are allowed to get access to media capture
// devices. Access to media capture devices can be allowed by default, or the
// user can be asked every time a website wants to get access to media capture
// devices.
//
// If this policy is left not set, 'PromptOnAccess' will be used and the user
// will be able to change it.
//
// Valid values:
//   2: Do not allow any site to access the camera and microphone
//   3: Ask every time a site wants to access the camera and/or microphone
//
// Supported on: chrome_os, linux, mac, win
message DefaultMediaStreamSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultMediaStreamSetting = 2;
}

// Default notification setting
//
// Setting the policy to 1 lets websites display desktop notifications. Setting
// the policy to 2 denies desktop notifications.
//
// Leaving it unset means AskNotifications applies, but users can change this
// setting.
//
// Valid values:
//   1: Allow sites to show desktop notifications
//   2: Do not allow any site to show desktop notifications
//   3: Ask every time a site wants to show desktop notifications
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultNotificationsSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultNotificationsSetting = 2;
}

// Default Flash setting
//
// This policy is deprecated in M88, Flash is no longer supported by Chrome.
// Setting the policy to 1 lets you set whether all websites can automatically
// run the Flash plugin. Setting the policy to 2 denies this plugin for all
// websites. Click to play lets the Flash plugin run, but users click on the
// placeholder to start it.
//
// Leaving the policy unset uses BlockPlugins and lets users change this
// setting.
//
// Note: Automatic playback is only for domains explicitly listed in the
// PluginsAllowedForUrls policy. To turn automatic playback on for all sites,
// add http://* and https://* to this list.
//
// Valid values:
//   1: Allow all sites to automatically run the Flash plugin
//   2: Block the Flash plugin
//   3: Click to play
//
// Supported on:
message DefaultPluginsSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultPluginsSetting = 2;
}

// Default pop-ups setting
//
// Setting the policy to 1 lets websites display pop-ups. Setting the policy to
// 2 denies pop-ups.
//
// Leaving it unset means BlockPopups applies, but users can change this
// setting.
//
// Valid values:
//   1: Allow all sites to show pop-ups
//   2: Do not allow any site to show pop-ups
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultPopupsSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultPopupsSetting = 2;
}

// Default printer selection rules
//
// Setting the policy sets the rules for selecting the default printer in Google
// Chrome, overriding the default rules. Printer selection occurs the first time
// users try to print, when Google Chrome seeks a printer matching the specified
// attributes. In case of a less than perfect match, Google Chrome can be set to
// select any matching printer, depending on the order printers are discovered.
//
// Leaving the policy unset or set to attributes for which there's no match
// means the built-in PDF printer is the default. If there's no PDF printer,
// Google Chrome defaults to none.
//
// Currently, all printers are classified as "local". Printers connected to
// Google Cloud Print are considered "cloud", but Google Cloud Print is no
// longer supported.
//
// Note: Omitting a field means all values match for that particular field. For
// example, not specifying idPattern means Print Preview accepts all printer
// IDs. Regular expression patterns must follow the JavaScript RegExp syntax,
// and matches are case sensistive.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultPrinterSelectionProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultPrinterSelection = 2;
}

// List of alternate URLs for the default search provider
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderAlternateURLs specifies a list of alternate URLs for
// extracting search terms from the search engine. The URLs should include the
// string '{searchTerms}'.
//
// Leaving DefaultSearchProviderAlternateURLs unset means no alternate URLs are
// used to extract search terms.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderAlternateURLsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DefaultSearchProviderAlternateURLs = 2;
}

// Allow default search provider context menu search access
//
// Enables the use of a default search provider on the context menu.
//
// If you set this policy to disabled the search context menu item that relies
// on your default search provider will not be available.
//
// If this policy is set to enabled or not set, the context menu item for your
// default search provider will be available.
//
// The policy value is only appled when the DefaultSearchProviderEnabled policy
// is enabled, and is not applicable otherwise.
//
// Valid values:
//   True: Enable access to the default search provider context menu
//   False: Disable access to the default search provider context menu
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultSearchProviderContextMenuAccessAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool DefaultSearchProviderContextMenuAccessAllowed = 2;
}

// Enable the default search provider
//
// Setting the policy to Enabled means a default search is performed when a user
// enters non-URL text in the address bar. To specify the default search
// provider, set the rest of the default search policies. If you leave those
// policies empty, the user can choose the default provider. Setting the policy
// to Disabled means there's no search when the user enters non-URL text in the
// address bar. The Disabled value is not supported by the Google Admin console.
//
// If you set the policy, users can't change it in Google Chrome. If not set,
// the default search provider is on, and users can set the search provider
// list.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   True: Enable the default search provider
//   False: Disable the default search provider
//   None: Enable the default search provider and allow users to modify the
// search provier list
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DefaultSearchProviderEnabled = 2;
}

// Default search provider encodings
//
// If DefaultSearchProviderEnabled is on, setting DefaultSearchProviderEncodings
// specifies the character encodings supported by the search provider. Encodings
// are code page names such as UTF-8, GB2312, and ISO-8859-1. They're tried in
// the order provided.
//
// Leaving DefaultSearchProviderEncodings unset puts UTF-8 in use.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderEncodingsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DefaultSearchProviderEncodings = 2;
}

// Default search provider icon
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderIconURL specifies the default search provider's favorite
// icon URL.
//
// Leaving DefaultSearchProviderIconURL unset means there's no icon for the
// search provider.
//
// Supported on:
message DefaultSearchProviderIconURLProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderIconURL = 2;
}

// Parameter providing search-by-image feature for the default search provider
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderImageURL specifies the URL of the search engine used for
// image search. (If DefaultSearchProviderImageURLPostParams is set, then image
// search requests use the POST method instead.)
//
// Leaving DefaultSearchProviderImageURL unset means no image search is used.
//
// If image search uses the GET method, then the URL must specify image
// parameters using a valid combination of the following placeholders:
// '{google:imageURL}',
// '{google:imageOriginalHeight}',
// '{google:imageOriginalWidth}',
// '{google:processedImageDimensions}',
// '{google:imageSearchSource}',
// '{google:imageThumbnail}',
// '{google:imageThumbnailBase64}'.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderImageURLProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderImageURL = 2;
}

// Parameters for image URL which uses POST
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderImageURLPostParams specifies the parameters during image
// search with POST. It consists of comma-separated, name-value pairs. If a
// value is a template parameter, such as {imageThumbnail}, real image thumbnail
// data replaces it.
//
// Leaving DefaultSearchProviderImageURLPostParams unset means image search
// request is sent using the GET method.
//
// The URL must specify the image parameter using a valid combination of
// the following placeholders depending on what the search provider supports:
// '{google:imageURL}',
// '{google:imageOriginalHeight}',
// '{google:imageOriginalWidth}',
// '{google:processedImageDimensions}',
// '{google:imageSearchSource}',
// '{google:imageThumbnail}',
// '{google:imageThumbnailBase64}'.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderImageURLPostParamsProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderImageURLPostParams = 2;
}

// Default search provider instant URL
//
// Specifies the URL of the search engine used to provide instant results. The
// URL should contain the string '{searchTerms}', which will be replaced at
// query time by the text the user has entered so far.
//
// This policy is optional. If not set, no instant search results will be
// provided.
//
// Google's instant results URL can be specified as:
// '{google:baseURL}suggest?q={searchTerms}'.
//
// This policy is only respected if the 'DefaultSearchProviderEnabled' policy is
// enabled.
//
// Supported on:
message DefaultSearchProviderInstantURLProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderInstantURL = 2;
}

// Parameters for instant URL which uses POST
//
// Specifies the parameters used when doing instant search with POST. It
// consists of comma-separated name/value pairs. If a value is a template
// parameter, like {searchTerms} in above example, it will be replaced with real
// search terms data.
//
// This policy is optional. If not set, instant search request will be sent
// using the GET method.
//
// This policy is only respected if the 'DefaultSearchProviderEnabled' policy is
// enabled.
//
// Supported on:
message DefaultSearchProviderInstantURLPostParamsProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderInstantURLPostParams = 2;
}

// Default search provider keyword
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderKeyword specifies the keyword or shortcut used in the
// address bar to trigger the search for this provider.
//
// Leaving DefaultSearchProviderKeyword unset means no keyword activates the
// search provider.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultSearchProviderKeywordProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderKeyword = 2;
}

// Default search provider name
//
// If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderName
// specifies the default search provider's name.
//
// Leaving DefaultSearchProviderName unset means the hostname specified by the
// search URL is used.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderNameProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderName = 2;
}

// Default search provider new tab page URL
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderNewTabURL specifies the URL of the search engine used to
// provide a New Tab page.
//
// Leaving DefaultSearchProviderNewTabURL unset means no new tab page is
// provided.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultSearchProviderNewTabURLProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderNewTabURL = 2;
}

// Parameter controlling search term placement for the default search provider
//
// If this policy is set and a search URL suggested from the omnibox contains
// this parameter in the query string or in the fragment identifier, then the
// suggestion will show the search terms and search provider instead of the raw
// search URL.
//
// This policy is optional. If not set, no search term replacement will be
// performed.
//
// This policy is only respected if the 'DefaultSearchProviderEnabled' policy is
// enabled.
//
// Supported on:
message DefaultSearchProviderSearchTermsReplacementKeyProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderSearchTermsReplacementKey = 2;
}

// Default search provider search URL
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderSearchURL specifies the URL of the search engine used
// during a default search. The URL should include the string '{searchTerms}',
// replaced in the query by the user's search terms.
//
// You can specify Google's search URL as: '{google:baseURL}search?q={searchTerm
// s}&amp;{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQuerySt
// ats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}i
// e={inputEncoding}'.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderSearchURLProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderSearchURL = 2;
}

// Parameters for search URL which uses POST
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderSearchURLPostParams specifies the parameters when
// searching a URL with POST. It consists of comma-separated, name-value pairs.
// If a value is a template parameter, such as '{searchTerms}', real search
// terms data replaces it.
//
// Leaving DefaultSearchProviderSearchURLPostParams unset means search requests
// are sent using the GET method.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderSearchURLPostParamsProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderSearchURLPostParams = 2;
}

// Default search provider suggest URL
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderSuggestURL specifies the URL of the search engine to
// provide search suggestions. The URL should include the string
// '{searchTerms}', replaced in the query by the user's search terms.
//
// You can specify Google's search URL as:
// '{google:baseURL}complete/search?output=chrome&amp;q={searchTerms}'.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderSuggestURLProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderSuggestURL = 2;
}

// Parameters for suggest URL which uses POST
//
// If DefaultSearchProviderEnabled is on, then setting
// DefaultSearchProviderSuggestURLPostParams specifies the parameters during
// suggestion search with POST. It consists of comma-separated, name-value
// pairs. If a value is a template parameter, such as '{searchTerms}', real
// search terms data replaces it.
//
// Leaving DefaultSearchProviderSuggestURLPostParams unset unset means suggest
// search requests are sent using the GET method.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DefaultSearchProviderSuggestURLPostParamsProto {
  optional PolicyOptions policy_options = 1;
  optional string DefaultSearchProviderSuggestURLPostParams = 2;
}

// Default sensors setting
//
// Setting the policy to 1 lets websites access and use sensors such as motion
// and light. Setting the policy to 2 denies access to sensors. When the policy
// is set to 3 it will ask the user when a site requests access to sensors if
// the tri-state feature flag is enabled, otherwise it will default to allowing
// access to sensors.
//
// Leaving it unset means AllowSensors applies, but users can change this
// setting.
//
// Valid values:
//   1: Allow sites to access sensors
//   2: Do not allow any site to access sensors
//   3: Ask whenever a site wants to access sensors
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultSensorsSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultSensorsSetting = 2;
}

// Control use of the Serial API
//
// Setting the policy to 3 lets websites ask for access to serial ports. Setting
// the policy to 2 denies access to serial ports.
//
// Leaving it unset lets websites ask for access, but users can change this
// setting.
//
// Valid values:
//   2: Do not allow any site to request access to serial ports via the Serial
// API
//   3: Allow sites to ask the user to grant access to a serial port
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultSerialGuardSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultSerialGuardSetting = 2;
}

// Control use of the Web Smart Card API
//
// Setting the policy specifies whether Isolated Web Apps will by default be
// able to connect to smart card readers.
//
// Setting the policy to 3 or leaving it unset allows Isolated Web App origins
// to ask for permission to connect to smart card readers. Leaving it unset also
// allows users to change this setting.
//
// Setting the policy to 2 blocks Isolated Web App origins from connecting to
// smart card readers.
//
// This policy can be overridden for specific Isolated Web App origins using the
// SmartCardConnectAllowedForUrls and SmartCardConnectBlockedForUrls policies.
//
// Valid values:
//   2: Do not allow Isolated Web App origins to connect to smart card readers
//   3: Allow Isolated Web App origins to ask to connect to smart card readers.
//
// Supported on: chrome_os
message DefaultSmartCardConnectSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultSmartCardConnectSetting = 2;
}

// Control use of the Sub Apps Add API
//
// The policy controls whether Isolated Web Apps (IWAs) will by default be able
// to add Sub Apps.
//
// Setting the policy to 1 allows IWA origins to add Sub Apps and bypass user
// gesture or user confirmation requirements.
//
// Setting the policy to 2 blocks IWA origins from adding Sub Apps.
//
// Setting the policy to 3 or leaving it unset allows Isolated Web App origins
// to add Sub Apps upon user confirmation.
//
// This policy can be overridden for specific Isolated Web App origins using the
// SubAppsWithoutPromptsAllowedForOrigins and
// SubAppsWithoutPromptsBlockedorOrigins policies.
//
// Valid values:
//   1: Allow Isolated Web App origins to add Sub Apps without user prompt
//   2: Block Isolated Web App origins from adding Sub Apps
//   3: Allow Isolated Web App origins to add Sub Apps but require user prompt
//
// Supported on: chrome_os, linux, mac, win
message DefaultSubAppsWithoutPromptsSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultSubAppsWithoutPromptsSetting = 2;
}

// Default third-party storage partitioning setting
//
// This policy controls whether third-party storage partitioning is allowed by
// default.
//
// If this policy is set to 1 - AllowPartitioning, or unset, third-party storage
// partitioning will be allowed by default. This default may be overridden for
// specific top-level origins by other means.
//
// If this policy is set to 2 - BlockPartitioning, third-party storage
// partitioning will be disabled for all contexts.
//
// Use ThirdPartyStoragePartitioningBlockedForOrigins to disable third-party
// storage partitioning for specific top-level origins. For detailed information
// on third-party storage partitioning, please see
// https://developers.google.com/privacy-sandbox/cookies/storage-partitioning.
//
// This was removed in Chrome 145, and the requestStorageAccess method is
// recommended for use instead: https://developer.mozilla.org/en-
// US/docs/Web/API/Document/requestStorageAccess. Feedback can be left at
// https://crbug.com/425248669.
//
// Valid values:
//   1: Allow third-party storage partitioning by default.
//   2: Disable third-party storage partitioning.
//
// Supported on: fuchsia
message DefaultThirdPartyStoragePartitioningSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultThirdPartyStoragePartitioningSetting = 2;
}

// Control use of the Web Bluetooth API
//
// Setting the policy to 3 lets websites ask for access to nearby Bluetooth
// devices. Setting the policy to 2 denies access to nearby Bluetooth devices.
//
// Leaving the policy unset lets sites ask for access, but users can change this
// setting.
//
// Valid values:
//   2: Do not allow any site to request access to Bluetooth devices via the Web
// Bluetooth API
//   3: Allow sites to ask the user to grant access to a nearby Bluetooth device
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultWebBluetoothGuardSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultWebBluetoothGuardSetting = 2;
}

// Control use of the WebHID API
//
// Setting the policy to 3 lets websites ask for access to HID devices. Setting
// the policy to 2 denies access to HID devices.
//
// Leaving it unset lets websites ask for access, but users can change this
// setting.
//
// This policy can be overridden for specific url patterns using the
// WebHidAskForUrls and WebHidBlockedForUrls policies.
//
// Valid values:
//   2: Do not allow any site to request access to HID devices via the WebHID
// API
//   3: Allow sites to ask the user to grant access to a HID device
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultWebHidGuardSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultWebHidGuardSetting = 2;
}

// Control use of the WebPrinting API
//
// Setting the policy to 2 automatically blocks Isolated Web App origins from
// using the WebPrinting API.
//
// Setting the policy to 3 will prompt the user when an Isolated Web App origin
// wants to use the WebPrinting API.
//
// Leaving it unset lets Isolated Web App origins ask for local printer access,
// but users can change this setting.
//
// Valid values:
//   2: Do not allow Isolated Web App origins to request access to local
// printers via the WebPrinting API
//   3: Allow Isolated Web App origins to ask the user to grant access to local
// printers via the WebPrinting API
//
// Supported on: chrome_os
message DefaultWebPrintingSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultWebPrintingSetting = 2;
}

// Control use of the WebUSB API
//
// Setting the policy to 3 lets websites ask for access to connected USB
// devices. Setting the policy to 2 denies access to connected USB devices.
//
// Leaving it unset lets websites ask for access, but users can change this
// setting.
//
// Valid values:
//   2: Do not allow any site to request access to USB devices via the WebUSB
// API
//   3: Allow sites to ask the user to grant access to a connected USB device
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DefaultWebUsbGuardSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultWebUsbGuardSetting = 2;
}

// Default Window Management permission setting
//
// Setting the policy to BlockWindowManagement (value 2) automatically denies
// the window management permission to sites by default. This will limit the
// ability of sites to see information about the device's screens and use that
// information to open and place windows or request fullscreen on specific
// screens.
//
// Setting the policy to AskWindowManagement (value 3) will prompt the user when
// the window management permission is requested by default. If users allow the
// permission, it will extend the ability of sites to see information about the
// device's screens and use that information to open and place windows or
// request fullscreen on specific screens.
//
// Leaving the policy unset means the AskWindowManagement policy applies, but
// users can change this setting.
//
// This replaces the deprecated DefaultWindowPlacementSetting policy.
//
// Valid values:
//   2: Denies the Window Management permission on all sites by default
//   3: Ask every time a site wants obtain the Window Management permission
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultWindowManagementSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultWindowManagementSetting = 2;
}

// Default Window Placement permission setting
//
// Setting the policy to BlockWindowPlacement (value 2) automatically denies the
// window placement permission to sites by default. This will limit the ability
// of sites to see information about the device's screens and use that
// information to open and place windows or request fullscreen on specific
// screens.
//
// Setting the policy to AskWindowPlacement (value 3) will prompt the user when
// the window placement permission is requested by default. If users allow the
// permission, it will extend the ability of sites to see information about the
// device's screens and use that information to open and place windows or
// request fullscreen on specific screens.
//
// Leaving the policy unset means the AskWindowPlacement policy applies, but
// users can change this setting.
//
// Valid values:
//   2: Denies the Window Placement permission on all sites by default
//   3: Ask every time a site wants obtain the Window Placement permission
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DefaultWindowPlacementSettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DefaultWindowPlacementSetting = 2;
}

// Control the shortcut used to trigger the Delete "six pack" key
//
// This policy determines the behavior for remapping the Delete key within
// the 'remap keys' subpage. The 'remap keys' subpage allows users to
// customize keyboard keys. If enabled, this policy prevents users from
// customizing these specific remappings. If the policy is not set,
// search-based shortcuts will act as the default and allows users to
// configure the shortcuts.
//
// Valid values:
//   0: Setting a shortcut for the "Delete" action is disabled.
//   1: Delete shortcut setting uses the shortcut that contains the alt modifier
//   2: Delete shortcut setting uses the shortcut that contains the search
// modifier
//
// Supported on: chrome_os
message DeleteKeyModifierProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DeleteKeyModifier = 2;
}

// Allow print job history to be deleted
//
// Controls whether print job history can be deleted.
//
// Locally stored print jobs can be deleted through the print management app or
// through deleting the users's browser history.
//
// When this policy is enabled or unset, the user will be able to delete their
// print job history through the print management app or through deleting their
// browser history.
//
// When this policy is disabled, the user will not be able to delete their print
// job history through the print management app or through deleting their
// browser history.
//
// Valid values:
//   True: Allow print job history to be deleted
//   False: Do not allow print job history to be deleted
//
// Supported on: chrome_os
message DeletePrintJobHistoryAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool DeletePrintJobHistoryAllowed = 2;
}

// Enable deleting undecryptable passwords
//
// This policy controls whether the built-in password manager can delete
// undecryptable passwords from its database. This is required to restore the
// full functionality of the built-in password manager, but it may include a
// permanent data loss. Undecryptable password values will not become
// decryptable on their own and, if fixing them is possible, it usually requires
// complex user actions.
//
// Setting the policy to Enabled or leaving it unset means that users with
// undecryptable passwords saved to the built-in password manager will lose
// them. Passwords that are still in a working state will remain untouched.
//
// Setting the policy to Disabled means users will leave their password manager
// data untouched, but will experience a broken password manager functionality.
//
// If the policy is set, users can't change it in Google Chrome.
//
// Valid values:
//   True: Enable deleting undecryptable passwords
//   False: Disable deleting undecryptable passwords
//
// Supported on: ios, linux, mac, win
message DeletingUndecryptablePasswordsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DeletingUndecryptablePasswordsEnabled = 2;
}

// Enable Save and Share API for third-party Google ChromeOS control.
//
// If the policy is set to Enabled allows third-party web applications to use
// Desk API to save and share Google ChromeOS desks. If the policy is set to
// Disabled the user will not be able to save and share desk data through the
// Desk API. If the policy is unset the behavior will be the same as disabled.
// The policy will only take effect on enrolled devices.
//
// Valid values:
//   True: Enable Save and Share API for third-party Google ChromeOS control.
//   False: Do not enable Save and Share API for third-party Google ChromeOS
// control.
//
// Supported on: chrome_os
message DeskAPIDeskSaveAndShareEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DeskAPIDeskSaveAndShareEnabled = 2;
}

// Enable Desk API for third-party Google ChromeOS control
//
// Setting the policy to Enabled allows third-party web applications to use Desk
// API to control Google ChromeOS desks. If the policy is not set or disabled,
// the  Desk API will be unavailable. The policy will only take effect on
// enrolled devices.
//
// Valid values:
//   True: Enable Desk API for third-party Google ChromeOS control
//   False: Do not enable Desk API for third-party Google ChromeOS control
//
// Supported on: chrome_os
message DeskAPIThirdPartyAccessEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DeskAPIThirdPartyAccessEnabled = 2;
}

// Enable Desk API for a list of third-party domains
//
// Specifies the list of third-party web application domains that are allowed to
// use Desk API to control Google ChromeOS desks. These URL patterns should
// follow the format defined for "matches" property in https://developer.chrome.
// com/docs/extensions/mv3/manifest/externally_connectable/#reference
//
// Supported on: chrome_os
message DeskAPIThirdPartyAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DeskAPIThirdPartyAllowlist = 2;
}

// Allow users to select a desk template layout to load
//
// Setting the policy to Enabled allows users to use desktop layout templates.
// Setting the policy to Disabled or unset means these templates will be
// unavailable.
//
// Valid values:
//   True: Allow users to use desk templates
//   False: Do not allow users to use desk templates
//
// Supported on: chrome_os
message DeskTemplatesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DeskTemplatesEnabled = 2;
}

// Enable desktop sharing in the omnibox and 3-dot menu
//
// Setting the policy to True or leaving it unset lets users share or save the
// current webpage using actions provided by the desktop sharing hub. The
// sharing hub is accessed through either an omnibox icon or the 3-dot menu.
//
// Setting the policy to False removes the sharing icon from the omnibox and the
// entry from the 3-dot menu.
//
// Valid values:
//   True: Enable desktop sharing hub
//   False: Disable desktop sharing hub
//
// Supported on: fuchsia, linux, mac, win
message DesktopSharingHubEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DesktopSharingHubEnabled = 2;
}

// Settings for Chrome DevTools Generative AI Features
//
// These features in Chrome DevTools employ generative AI models to provide
// additional debugging information. To use these features, Google Chrome has to
// collect data such as error messages, stack traces, code snippets, and network
// requests and send them to a server owned by Google, which runs a generative
// AI model. Response body or authentication and cookie headers in network
// requests are not included in the data sent to the server.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// Chrome DevTools Generative AI features include:
//
// - Console Insights: explains console messages and offers suggestions on how
// to fix console errors.
//
// - AI assistance: get help with understanding CSS styles (since version 131),
// network requests, performance, and files (all since version 132).
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Chrome DevTools Generative AI Features and improve AI models.
//   1: Allow Chrome DevTools Generative AI Features without improving AI
// models.
//   2: Do not allow Chrome DevTools Generative AI Features.
//
// Supported on: chrome_os, linux, mac, win
message DevToolsGenAiSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DevToolsGenAiSettings = 2;
}

// Enable Google Developer Program Profiles in Chrome DevTools
//
// This policy controls the integration of the Google Developer Program with
// Chrome DevTools. The user's Google Developer Program profile is shown in
// Chrome DevTools, and users receive badges for performing specific actions
// within Chrome DevTools.
//
// Setting the policy to 0 - 'Enabled', or not setting any policy value, allows
// the integration of the Google Developer Program with Chrome DevTools, and
// allows sharing of Chrome DevTools tool usage in order to be able to award
// badges.
//
// Setting the policy to 1 - 'Enabled without badges', allows the integration of
// the Google Developer Program with Chrome DevTools, but does not allow sharing
// Chrome DevTools tool usage with the Google Developer Program. No badges will
// be awarded.
//
// Setting the policy to 2 - 'Disabled', does not allow the integration of the
// Google Developer Program with Chrome DevTools.
//
// Valid values:
//   0: Enable Google Developer Program integration in Chrome DevTools.
//   1: Enable Google Developer Program integration in Chrome DevTools, but
// without sharing tool usage (for awarding badges).
//   2: Do not enable Google Developer Program integration in Chrome DevTools.
//
// Supported on: chrome_os, linux, mac, win
message DevToolsGoogleDeveloperProgramProfileAvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DevToolsGoogleDeveloperProgramProfileAvailability = 2;
}

// Control where Developer Tools can be used
//
// Setting the policy to 0 (the default) means you can access the developer
// tools and the JavaScript console, but not in the context of extensions
// installed by enterprise policy or, since version 114 and if this is a managed
// user, extensions built into the browser. Setting the policy to 1 means you
// can access the developer tools and the JavaScript console in all contexts,
// including that of extensions installed by enterprise policy. Setting the
// policy to 2 means you can't access developer tools, and you can't inspect
// website elements.
//
// This setting also turns off keyboard shortcuts and menu or context menu
// entries to open developer tools or the JavaScript console.
//
// As of Google Chrome version 99, this setting also controls entry points for
// the 'View page source' feature. If you set this policy to
// 'DeveloperToolsDisallowed' (value 2), users cannot access source viewing via
// keyboard shortcut or the context menu. To fully block source viewing, you
// must also add 'view-source:*' to the URLBlocklist policy.
//
// As of Google Chrome version 119, this setting also controls whether developer
// mode for Isolated Web Apps can be activated and used.
//
// As of Google Chrome version 128, this setting will not control developer mode
// on extensions page if ExtensionDeveloperModeSettings policy is set.
//
// The availability of Developer Tools is determined in the following order of
// precedence:
// 1. If a URL matches a pattern in the DeveloperToolsAvailabilityAllowlist
// policy, Developer Tools are allowed.
// 2. If the DeveloperToolsAvailabilityAllowlist is set and the
// DeveloperToolsAvailabilityBlocklist is not, any URL not on the allowlist is
// blocked.
// 3. If a URL matches a pattern in the DeveloperToolsAvailabilityBlocklist
// policy, Developer Tools are blocked.
// 4. If a URL is not covered by the allowlist or blocklist, this policy
// (DeveloperToolsAvailability) is the fallback.
//
// Valid values:
//   0: Disallow usage of the Developer Tools on apps and extensions installed
// by enterprise policy or, since version 114 and if this is a managed user,
// extensions built into the browser. Allow usage of the Developer Tools in
// other contexts
//   1: Allow usage of the Developer Tools
//   2: Disallow usage of the Developer Tools
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DeveloperToolsAvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DeveloperToolsAvailability = 2;
}

// List of URL patterns for which Chrome DevTools are allowed to be opened
//
// This policy can be used to allow Chrome DevTools on specific URLs.
//
// URL patterns are matched against the URL of every frame on the page being
// inspected. The resulting behavior depends on whether the
// DeveloperToolsAvailabilityBlocklist policy is also set.
//
// If this policy is set and DeveloperToolsAvailabilityBlocklist is not, every
// frame's URL must match a pattern on this allowlist for Chrome DevTools to be
// allowed. If any frame's URL does not match, DevTools will be blocked for the
// entire page. For information on the URL format, see
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// If both this and the DeveloperToolsAvailabilityBlocklist policies are set,
// this allowlist takes precedence. If a frame's URL matches a pattern on this
// allowlist, it will be allowed, even if it also matches a pattern in the
// blocklist. If a URL matches a pattern on the blocklist (but not the
// allowlist), it will be blocked. If a URL matches neither, the
// DeveloperToolsAvailability policy will be used as a fallback.
//
// If this policy is not set, the availability of Chrome DevTools is determined
// by the DeveloperToolsAvailabilityBlocklist and DeveloperToolsAvailability
// policies.
//
// This policy also applies to Chrome DevTools opened for extensions and web
// applications.
//
// Blanket host wildcards (i.e., "*" or "[*]") are not allowed; use the
// DeveloperToolsAvailability policy to enable the feature globally.
//
// This policy is limited to 1,000 entries.
//
// Supported on: android, chrome_os, linux, mac, win
message DeveloperToolsAvailabilityAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DeveloperToolsAvailabilityAllowlist = 2;
}

// List of URL patterns for which Chrome DevTools are blocked
//
// This policy can be used to block Chrome DevTools on specific URLs. For
// information on the URL format, see
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// URL patterns are matched against the URL of every frame on the page being
// inspected. The resulting behavior depends on whether the
// DeveloperToolsAvailabilityAllowlist policy is also set.
//
// If this policy is set and DeveloperToolsAvailabilityAllowlist is not, any
// frame's URL matching a pattern on this blocklist will block Chrome DevTools
// for the entire page. If a frame's URL doesn't match any pattern, the
// availability is determined by the DeveloperToolsAvailability policy.
//
// If both this and the DeveloperToolsAvailabilityAllowlist policies are set,
// the allowlist takes precedence. If a frame's URL matches a pattern on the
// allowlist, it will be allowed, even if it also matches a pattern in this
// blocklist. If a URL matches a pattern on this blocklist (but not the
// allowlist), it will be blocked. If a URL matches neither, the
// DeveloperToolsAvailability policy will be used as a fallback.
//
// If this policy is not set, the availability of Chrome DevTools is determined
// by the DeveloperToolsAvailabilityAllowlist and DeveloperToolsAvailability
// policies.
//
// This policy is limited to 1,000 entries.
//
// Supported on: android, chrome_os, linux, mac, win
message DeveloperToolsAvailabilityBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DeveloperToolsAvailabilityBlocklist = 2;
}

// Disable Developer Tools
//
// This policy is deprecated in M68, please use DeveloperToolsAvailability
// instead.
//
// Disables the Developer Tools and the JavaScript console.
//
// If you enable this setting, the Developer Tools can not be accessed and web-
// site elements can not be inspected anymore. Any keyboard shortcuts and any
// menu or context menu entries to open the Developer Tools or the JavaScript
// Console will be disabled.
//
// Setting this option to disabled or leaving it not set allows the user to use
// the Developer Tools and the JavaScript console.
//
// If the policy DeveloperToolsAvailability is set, the value of the policy
// DeveloperToolsDisabled is ignored.
//
// Valid values:
//   True: Disable Developer Tools
//   False: Enable Developer Tools
//
// Supported on: chrome_os, linux, mac, win
message DeveloperToolsDisabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DeveloperToolsDisabled = 2;
}

// Allow Device Attributes API on these sites
//
// Setting the policy allows listed origins to get device attributes (e.g.
// serial number, hostname) using the Device Attributes API.
//
// Origins must correspond to web applications that are force-installed Isolated
// Web Apps (using IsolatedWebAppInstallForceList policy) (since version 125),
// set up as a kiosk app, or web applications that are force-installed (using
// WebAppInstallForceList) (before version 140). For Device Attributes API
// specification please see
// https://wicg.github.io/WebApiDevice/device_attributes.
//
// For detailed information on valid url patterns (since version 127), please
// see https://chromeenterprise.google/policies/url-patterns. * is not an
// accepted value for this policy.
//
// Supported on: chrome_os
message DeviceAttributesAllowedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DeviceAttributesAllowedForOrigins = 2;
}

// Block Device Attributes API on these sites
//
// Setting the policy blocks listed origins from getting device attributes (e.g.
// serial number, hostname) using the Device Attributes API.
//
// Origins must correspond to web applications that are force-installed Isolated
// Web Apps (using IsolatedWebAppInstallForceList policy) or set up as a kiosk
// app. For Device Attributes API specification please see
// https://wicg.github.io/WebApiDevice/device_attributes.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os
message DeviceAttributesBlockedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DeviceAttributesBlockedForOrigins = 2;
}

// Allow managed session on device
//
// Note that this policy is deprecated and removed in Google ChromeOS version
// 88. Public sessions are no longer supported. Please use DeviceLocalAccounts
// to configure managed-guest sessions instead.
// If this policy is set to false, managed guest session will behave as
// documented in https://support.google.com/chrome/a/answer/3017014 - the
// standard "Public Session".
//
// If this policy is set to true or left unset, managed guest session will take
// on "Managed Session" behaviour which lifts many of the restrictions that are
// in place for regular "Public Sessions".
//
// If this policy is set, the user cannot change or override it.
//
// Supported on:
message DeviceLocalAccountManagedSessionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DeviceLocalAccountManagedSessionEnabled = 2;
}

// Enable adaptive charging model to hold charging process to extend battery
// life
//
// Specifies whether an adaptive charging model is allowed to hold charging
// process to extend battery life.
//
// When the device is on AC, the adaptive charging model evaluates if charging
// process should be hold to extend battery life. If the adaptive charging model
// holds the charging process, it'll keep the battery at a certain level (i.e.
// 80%) and then charge the device to 100% when the user needs it.
//
// If this policy is set to True, the adaptive charging model will be enabled
// and allowed to hold the charging process to extend battery life.
//
// If this policy is set to False or unset, the adaptive charging model will not
// influence the charging process.
//
// Note: This policy has no effect if DevicePowerBatteryChargingOptimization is
// set.
//
// Valid values:
//   True: Enable adaptive charging model on Google ChromeOS
//   False: Disable adaptive charging model on Google ChromeOS
//
// Supported on: chrome_os
message DevicePowerAdaptiveChargingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DevicePowerAdaptiveChargingEnabled = 2;
}

// Enable the dictation accessibility feature
//
// Enable the dictation accessibility feature.
//
// If this policy is set to enabled, the dictation will always be enabled.
//
// If this policy is set to disabled, the dictation will always be disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the dictation is disabled initially but can be
// enabled by the user anytime.
//
// Valid values:
//   True: Enable dictation
//   False: Disable dictation
//   None: Allow the user to decide
//
// Supported on: chrome_os
message DictationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DictationEnabled = 2;
}

// Allow Direct Sockets API on these sites
//
// The Direct Sockets API allows communication with arbitrary endpoints using
// TCP and UDP.
// Please see https://github.com/WICG/direct-sockets for details.
//
// Setting the policy lets you list the URL patterns that specify which sites
// are allowed to use Direct Sockets API.
// Valid patterns are limited to Isolated Web Apps.
//
// Leaving the policy unset means DefaultDirectSocketsSetting applies for all
// sites, if it's set.
//
// URL patterns must not conflict with DirectSocketsBlockedForUrls. Neither
// policy takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os, linux, mac, win
message DirectSocketsAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DirectSocketsAllowedForUrls = 2;
}

// Block Direct Sockets API on these sites
//
// The Direct Sockets API allows communication with arbitrary endpoints using
// TCP and UDP.
// Please see https://github.com/WICG/direct-sockets for details.
//
// Setting the policy lets you list the URL patterns that specify which sites
// are not allowed to communicate using the Direct Sockets API.
// Valid patterns are limited to Isolated Web Apps.
//
// Leaving the policy unset means DefaultDirectSocketsSetting applies for all
// sites, if it's set.
//
// URL patterns must not conflict with DirectSocketsAllowedForUrls. Neither
// policy takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os, linux, mac, win
message DirectSocketsBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DirectSocketsBlockedForUrls = 2;
}

// Allow private network access in the Direct Sockets API on these sites
//
// The Direct Sockets API allows communication with arbitrary endpoints using
// TCP and UDP.
// Please see https://github.com/WICG/direct-sockets for details.
//
// Private network endpoints are those using IP addresses from private IP
// address space, which is defined in https://wicg.github.io/private-network-
// access/#ip-address-space-private.
//
// Setting the policy lets you list the URL patterns that specify which sites
// are allowed to communicate with private network endpoints in the Direct
// Sockets API.
// Valid patterns are limited to Isolated Web Apps.
//
// Leaving the policy unset means
// DefaultDirectSocketsPrivateNetworkAccessSetting applies for all sites, if
// it's set.
//
// URL patterns must not conflict with
// DirectSocketsPrivateNetworkAccessBlockedForUrls. Neither policy takes
// precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Note that this policy only applies if the origin is allowed to use the Direct
// Sockets API.
// Please consult DefaultDirectSocketsSetting, DirectSocketsAllowedForUrls and
// DirectSocketsBlockedForUrls for more details.
//
// Supported on: chrome_os, linux, mac, win
message DirectSocketsPrivateNetworkAccessAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DirectSocketsPrivateNetworkAccessAllowedForUrls = 2;
}

// Block private network access in the Direct Sockets API on these sites
//
// The Direct Sockets API allows communication with arbitrary endpoints using
// TCP and UDP.
// Please see https://github.com/WICG/direct-sockets for details.
//
// Private network endpoints are those using IP addresses from private IP
// address space, which is defined in https://wicg.github.io/private-network-
// access/#ip-address-space-private.
//
// Setting the policy lets you list the URL patterns that specify which sites
// are blocked from accessing private network in the Direct Sockets API.
// Valid patterns are limited to Isolated Web Apps.
//
// Leaving the policy unset means
// DefaultDirectSocketsPrivateNetworkAccessSetting applies for all sites, if
// it's set.
//
// URL patterns must not conflict with
// DirectSocketsPrivateNetworkAccessAllowedForUrls. Neither policy takes
// precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Note that this policy only applies if the origin is allowed to use the Direct
// Sockets API.
// Please consult DefaultDirectSocketsSetting, DirectSocketsAllowedForUrls and
// DirectSocketsBlockedForUrls for more details.
//
// This policy applies only to new connection attempts and doesn't invalidate
// existing connections.
//
// Supported on: chrome_os, linux, mac, win
message DirectSocketsPrivateNetworkAccessBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DirectSocketsPrivateNetworkAccessBlockedForUrls = 2;
}

// Disable support for 3D graphics APIs
//
// Setting the policy to True (or setting HardwareAccelerationModeEnabled to
// False) prevents webpages from accessing the WebGL API.
//
// Setting the policy to False or leaving it unset lets webpages use the WebGL
// API, but the browser's default settings might still require command line
// arguments to use these APIs.
//
// Valid values:
//   True: Disable support for 3D graphics APIs
//   False: Enable support for 3D graphics APIs
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message Disable3DAPIsProto {
  optional PolicyOptions policy_options = 1;
  optional bool Disable3DAPIs = 2;
}

// Disable CNAME lookup when negotiating Kerberos authentication
//
// Setting the policy to Enabled skips CNAME lookup. The server name is used as
// entered when generating the Kerberos SPN.
//
// Setting the policy to Disabled or leaving it unset means CNAME lookup
// determines the canonical name of the server when generating the Kerberos SPN.
//
// Valid values:
//   True: Disable CNAME lookup during Kerberos authentication
//   False: Use CNAME lookup during Kerberos authentication
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DisableAuthNegotiateCnameLookupProto {
  optional PolicyOptions policy_options = 1;
  optional bool DisableAuthNegotiateCnameLookup = 2;
}

// Specify whether the plugin finder should be disabled (deprecated)
//
// This policy has been removed as of Google Chrome 64.
//
// Automatic search and installation of missing plugins is no longer supported.
//
// Valid values:
//   True: Enable the plugin finder
//   False: Disable the plugin finder
//
// Supported on:
message DisablePluginFinderProto {
  optional PolicyOptions policy_options = 1;
  optional bool DisablePluginFinder = 2;
}

// Disable Print Preview
//
// Setting the policy to Enabled has Google Chrome open the system print dialog
// instead of the built-in print preview when users request a printout.
//
// Setting the policy to Disabled or leaving it unset has print commands trigger
// the print preview screen.
//
// Valid values:
//   True: Disable print preview
//   False: Enable print preview
//
// Supported on: fuchsia, linux, mac, win
message DisablePrintPreviewProto {
  optional PolicyOptions policy_options = 1;
  optional bool DisablePrintPreview = 2;
}

// Disable TLS False Start
//
// Specifies whether the TLS False Start optimization should be disabled. For
// historical reasons, this policy is named DisableSSLRecordSplitting.
//
// If the policy is not set, or is set to false, then TLS False Start will be
// enabled. If it is set to true, TLS False Start will be disabled.
//
// Supported on:
message DisableSSLRecordSplittingProto {
  optional PolicyOptions policy_options = 1;
  optional bool DisableSSLRecordSplitting = 2;
}

// Disable proceeding from the Safe Browsing warning page
//
// Setting the policy to Enabled prevents users from proceeding past the warning
// page the Safe Browsing service shows to the malicious site. This policy only
// prevents users from proceeding on Safe Browsing warnings such as malware and
// phishing, not for SSL certificate-related issues such as invalid or expired
// certificates.
//
// Setting the policy to Disabled or leaving it unset means users can choose to
// proceed to the flagged site after the warning appears.
//
// See more about Safe Browsing ( https://developers.google.com/safe-browsing ).
//
// Valid values:
//   True: Do not allow user to bypass Safe Browsing warning
//   False: Allow user to bypass Safe Browsing warning
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DisableSafeBrowsingProceedAnywayProto {
  optional PolicyOptions policy_options = 1;
  optional bool DisableSafeBrowsingProceedAnyway = 2;
}

// Disable taking screenshots
//
// Setting the policy to Enabled disallows screenshots taken with keyboard
// shortcuts
// or extension APIs. Setting the policy to Disabled or not set allows
// screenshots.
//
// Note that on Microsoft® Windows®, macOS and Linux,
// this does not prevent screenshots that are taken with operating system or
// third party applications.
//
// Valid values:
//   True: Do not allow users to take screenshots or video recordings
//   False: Allow users to take screenshots and video recordings
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DisableScreenshotsProto {
  optional PolicyOptions policy_options = 1;
  optional bool DisableScreenshots = 2;
}

// Disable SPDY protocol
//
// This policy is deprecated in M53 and removed in M54, because SPDY/3.1 support
// is removed.
//
// Disables use of the SPDY protocol in Google Chrome.
//
// If this policy is enabled the SPDY protocol will not be available in Google
// Chrome.
//
// Setting this policy to disabled will allow the usage of SPDY.
//
// If this policy is left not set, SPDY will be available.
//
// Supported on:
message DisableSpdyProto {
  optional PolicyOptions policy_options = 1;
  optional bool DisableSpdy = 2;
}

// Specify a list of disabled plugins
//
// This policy is deprecated. Please use the DefaultPluginsSetting to control
// the availability of the Flash plugin and AlwaysOpenPdfExternally to control
// whether the integrated PDF viewer should be used for opening PDF files.
//
// Specifies a list of plugins that are disabled in Google Chrome and prevents
// users from changing this setting.
//
// The wildcard characters '*' and '?' can be used to match sequences of
// arbitrary characters. '*' matches an arbitrary number of characters while '?'
// specifies an optional single character, i.e. matches zero or one characters.
// The escape character is '\', so to match actual '*', '?', or '\' characters,
// you can put a '\' in front of them.
//
// If you enable this setting, the specified list of plugins is never used in
// Google Chrome. The plugins are marked as disabled in 'about:plugins' and
// users cannot enable them.
//
// Note that this policy can be overridden by EnabledPlugins and
// DisabledPluginsExceptions.
//
// If this policy is left not set the user can use any plugin installed on the
// system except for hard-coded incompatible, outdated or dangerous plugins.
//
// Supported on:
message DisabledPluginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DisabledPlugins = 2;
}

// Specify a list of plugins that the user can enable or disable
//
// This policy is deprecated. Please use the DefaultPluginsSetting to control
// the availability of the Flash plugin and AlwaysOpenPdfExternally to control
// whether the integrated PDF viewer should be used for opening PDF files.
//
// Specifies a list of plugins that user can enable or disable in Google Chrome.
//
// The wildcard characters '*' and '?' can be used to match sequences of
// arbitrary characters. '*' matches an arbitrary number of characters while '?'
// specifies an optional single character, i.e. matches zero or one characters.
// The escape character is '\', so to match actual '*', '?', or '\' characters,
// you can put a '\' in front of them.
//
// If you enable this setting, the specified list of plugins can be used in
// Google Chrome. Users can enable or disable them in 'about:plugins', even if
// the plugin also matches a pattern in DisabledPlugins. Users can also enable
// and disable plugins that don't match any patterns in DisabledPlugins,
// DisabledPluginsExceptions and EnabledPlugins.
//
// This policy is meant to allow for strict plugin blocking where the
// 'DisabledPlugins' list contains wildcarded entries like disable all plugins
// '*' or disable all Java plugins '*Java*' but the administrator wishes to
// enable some particular version like 'IcedTea Java 2.3'. This particular
// versions can be specified in this policy.
//
// Note that both the plugin name and the plugin's group name have to be
// exempted. Each plugin group is shown in a separate section in about:plugins;
// each section may have one or more plugins. For example, the "Shockwave Flash"
// plugin belongs to the "Adobe Flash Player" group, and both names have to have
// a match in the exceptions list if that plugin is to be exempted from the
// blocklist.
//
// If this policy is left not set any plugin that matches the patterns in the
// 'DisabledPlugins' will be locked disabled and the user won't be able to
// enable them.
//
// Supported on:
message DisabledPluginsExceptionsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DisabledPluginsExceptions = 2;
}

// Disable URL protocol schemes
//
// This policy is deprecated, please use URLBlocklist instead.
//
// Disables the listed protocol schemes in Google Chrome.
//
// URLs using a scheme from this list will not load and can not be navigated to.
//
// If this policy is left not set or the list is empty all schemes will be
// accessible in Google Chrome.
//
// Supported on: chrome_os, linux, mac, win
message DisabledSchemesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DisabledSchemes = 2;
}

// Set disk cache directory
//
// Setting the policy has Google Chrome use the directory you provide for
// storing cached files on the disk—whether or not users specify the --disk-
// cache-dir flag.
//
// If not set, Google Chrome uses the default cache directory, but users can
// change that setting with the --disk-cache-dir command line flag.
//
// Google Chrome manages the contents of a volume's root directory. So to avoid
// data loss or other errors, do not set this policy to the root directory or
// any directory used for other purposes. See the variables you can use (
// https://www.chromium.org/administrators/policy-list-3/user-data-directory-
// variables ).
//
// Supported on: fuchsia, linux, mac, win
message DiskCacheDirProto {
  optional PolicyOptions policy_options = 1;
  optional string DiskCacheDir = 2;
}

// Set disk cache size in bytes
//
// Setting the policy to None has Google Chrome use the default cache size for
// storing cached files on the disk. Users can't change it.
//
// If you set the policy, Google Chrome uses the cache size you provide—whether
// or not users specify the --disk-cache-size flag. (Values below a few
// megabytes are rounded up.)
//
// If not set, Google Chrome uses the default size. Users can change that
// setting using the --disk-cache-size flag.
//
// Note: The value specified in this policy is used as a hint to various cache
// subsystems in the browser. Therefore the actual total disk consumption of all
// caches will be higher but within the same order of magnitude as the value
// specified.
//
// Supported on: fuchsia, linux, mac, win
message DiskCacheSizeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DiskCacheSize = 2;
}

// Specifies whether the display-capture permissions-policy is checked or
// skipped.
//
//
// The display-capture permissions-policy gates access to getDisplayMedia(), as
// per this spec: https://www.w3.org/TR/screen-capture/#feature-policy-
// integration. However, if this policy is Disabled, this requirement is not
// enforced, and getDisplayMedia() is allowed from contexts that would otherwise
// be forbidden. This Enterprise policy is temporary; it's intended to be
// removed after Google Chrome version 100. It is intended to unblock Enterprise
// users whose application is non-spec compliant, but needs time to be fixed.
//
// When enabled or not set, sites can only call getDisplayMedia() from contexts
// which are allowlisted by the display-capture permissions-policy.
//
// When disabled, sites can call getDisplayMedia() even from contexts which are
// not allowlisted by the display-capture permissions policy. Note that other
// restrictions may still apply.
//
// Valid values:
//   True:
//           Calls to getDisplayMedia originating from non-allowlisted contexts
//           are denied.
//   False:
//           Calls are not denied on account of originating from non-allowlisted
//           contexts. (Calls may still be denied for other reasons.)
//
// Supported on:
message DisplayCapturePermissionsPolicyEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DisplayCapturePermissionsPolicyEnabled = 2;
}

// Specify domains to be excluded from being resolved using DNS-over-HTTPS
//
// List of domains to be excluded from being resolved using DNS-over-HTTPS. This
// policy is ignored when the secure DNS mode is set to off (always use plain-
// text DNS).
//
// If DnsOverHttpsIncludedDomains is also set, a more specific domain is
// preferred. Specificity refers to the number of dots ('.') in the domain. When
// a domain matches both policies, default to use DNS-over-HTTPS for the domain.
//
// The domains are expected to be in the form of a fully qualified domain name
// (FQDN) or as domain suffixes noted using a special wildcard prefix '*'.
//
// Incorrectly formatted domains will be ignored.
//
// Supported on: chrome_os
message DnsOverHttpsExcludedDomainsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DnsOverHttpsExcludedDomains = 2;
}

// Specify domains to be resolved using DNS-over-HTTPS
//
// List of domains to be resolved using DNS-over-HTTPS. Other domains not
// included in the list will not be resolved using DNS-over-HTTPS. This policy
// is ignored when the secure DNS mode is set to off (always use plain-text
// DNS).
//
// If the list is empty or unset, all domains will be resolved using DNS-over-
// HTTPS whenever possible. This is the same behavior with an included domains
// list with the value of ["*"].
//
// If DnsOverHttpsExcludedDomains is also set, a more specific domain is
// preferred. Specificity refers to the number of dots ('.') in the domain. When
// a domain matches both policies, default to use DNS-over-HTTPS for the domain.
//
// The domains are expected to be in the form of a fully qualified domain name
// (FQDN) or as domain suffixes noted using a special wildcard prefix '*'.
//
// Incorrectly formatted domains will be ignored.
//
// Supported on: chrome_os
message DnsOverHttpsIncludedDomainsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DnsOverHttpsIncludedDomains = 2;
}

// Controls the mode of DNS-over-HTTPS
//
// Controls the mode of the DNS-over-HTTPS resolver. Please note that this
// policy will only set the default mode for each query. The mode may be
// overridden for special types of queries such as requests to resolve a
// DNS-over-HTTPS server hostname.
//
// The "off" mode will disable
// DNS-over-HTTPS.
//
// The "automatic" mode will send
// DNS-over-HTTPS queries first if a DNS-over-HTTPS server is available and
// may fallback to sending insecure queries on error.
//
// The "secure" mode will only send
// DNS-over-HTTPS queries and will fail to resolve on error.
//
// On Android Pie and above, if DNS-over-TLS
// is active, Google Chrome will not
// send insecure DNS requests.
//
// If this policy is unset, for managed devices DNS-over-HTTPS queries will not
// be sent. Otherwise, the browser may send DNS-over-HTTPS requests to a
// resolver associated with the user's configured system resolver.
//
// Valid values:
//   off: Disable DNS-over-HTTPS
//   automatic: Enable DNS-over-HTTPS with insecure fallback
//   secure: Enable DNS-over-HTTPS without insecure fallback
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DnsOverHttpsModeProto {
  optional PolicyOptions policy_options = 1;
  optional string DnsOverHttpsMode = 2;
}

// Specify a salt value to be used in DnsOverHttpsTemplatesWithIdentifiers when
// evaluating identity information
//
// This salt is used as a salt value when hashing identity information included
// in the DnsOverHttpsTemplatesWithIdentifiers string.
//
// The salt must be a string between 8 and 32 characters.
//
// In version 114 and later, this policy is optional if the
// DnsOverHttpsTemplatesWithIdentifiers policy is set. If this policy is not
// set, then the identifiers in the template URIs configured via the
// DnsOverHttpsTemplatesWithIdentifiers policy are hashed without a salt.
//
// Supported on: chrome_os
message DnsOverHttpsSaltProto {
  optional PolicyOptions policy_options = 1;
  optional string DnsOverHttpsSalt = 2;
}

// Specify URI template of desired DNS-over-HTTPS resolver
//
// The URI template of the desired DNS-over-HTTPS resolver. To specify multiple
// DNS-over-HTTPS resolvers, separate the corresponding URI templates with
// spaces.
//
// If the DnsOverHttpsMode is set to "secure" then this policy must be set and
// not empty. On Google ChromeOS only, either this policy or the
// DnsOverHttpsTemplatesWithIdentifiers must be set, otherwise the DNS
// resolution will fail.
//
// If the DnsOverHttpsMode is set to "automatic" and this policy is set then the
// URI templates specified will be used; if this policy is unset then hardcoded
// mappings will be used to attempt to upgrade the user's current DNS resolver
// to a DoH resolver operated by the same provider.
//
// If the URI template contains a dns variable, requests to the resolver will
// use GET; otherwise requests will use POST.
//
// Incorrectly formatted templates will be ignored.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DnsOverHttpsTemplatesProto {
  optional PolicyOptions policy_options = 1;
  optional string DnsOverHttpsTemplates = 2;
}

// Specify URI template of desired DNS-over-HTTPS resolver with identity
// information
//
// The URI template of the desired DNS-over-HTTPS resolver. To specify multiple
// DNS-over-HTTPS resolvers, separate the corresponding URI templates with
// spaces. This policy is very similar to DnsOverHttpsTemplates which it will
// override if specified.
// In contrast to the DnsOverHttpsTemplates policy, this policy supports
// specifying identity information.
// Identifiers are specified using variable placeholders which are replaced with
// user or device information in Google Chrome. The identifiers are not sent to
// the DNS server in plain text; instead they are hashed with the SHA-256
// algorithm and uppercase hex encoded.
//
// Identifiers are specified between curly brackets, preceded by the dollar
// sign. For user identification, use the following placeholders USER_EMAIL,
// USER_EMAIL_DOMAIN and USER_EMAIL_NAME. For device identification, use the
// following placeholders DEVICE_DIRECTORY_ID, DEVICE_SERIAL_NUMBER,
// DEVICE_ASSET_ID and DEVICE_ANNOTATED_LOCATION.
//
// Before version 122, device identifiers were not replaced for unaffiliated
// users. Starting version 122, the device placeholders are replaced with the
// value DEVICE_NOT_MANAGED, which is hashed and hex encoded.
//
// Starting version 125, the device ip addresses can be added as template URI
// using the placeholder DEVICE_IP_ADDRESSES. This placeholder will be replaced
// by a hex string representing the network byte order of the IPv4 address
// and/or IPv6 address associated with the current network, if the network is
// managed by policy.
// The IPv4 address is prefixed with the value 0010; the IPv6 address is
// prefixed with 0020. For dual-stack networks, both the IPv4 and IPv6 addresses
// will be used for the placeholder replacement. Multiple addresses are added
// consecutively, without a delimiter. For unaffiliated users, the replacement
// only happens if the network is managed by user policy. If the IP addresses
// placeholder cannot be replaced by the device IP address, it is replaced with
// an empty string.
//
// If the DnsOverHttpsMode is set to "secure" then either this policy or
// DnsOverHttpsTemplates must be set and not empty.
//
// If the DnsOverHttpsMode is set to "automatic" and this policy is set then the
// URI templates specified will be used; if this policy is unset then hardcoded
// mappings will be used to attempt to upgrade the users current DNS resolver to
// a DoH resolver operated by the same provider.
//
// If the URI template contains a dns variable, requests to the resolver will
// use GET; otherwise requests will use POST.
//
// In version 114 and later, DnsOverHttpsSalt is optional if this policy is set.
//
// Supported on: chrome_os
message DnsOverHttpsTemplatesWithIdentifiersProto {
  optional PolicyOptions policy_options = 1;
  optional string DnsOverHttpsTemplatesWithIdentifiers = 2;
}

// Enable network prediction
//
// This policy is deprecated in M48 in favor of NetworkPredictionOptions, and
// removed in M54.
//
// Enables network prediction in Google Chrome and prevents users from changing
// this setting.
//
// This controls not only DNS prefetching but also TCP and SSL preconnection and
// prerendering of web pages. The policy name refers to DNS prefetching for
// historical reasons.
//
// If you enable or disable this setting, users cannot change or override this
// setting in Google Chrome.
//
// If this policy is left not set, this will be enabled but the user will be
// able to change it.
//
// Supported on:
message DnsPrefetchingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DnsPrefetchingEnabled = 2;
}

// Extensions allowed to skip confirmation dialogs when accessing scanners via
// chrome.documentScan API
//
// This policy specifies extensions that are allowed to skip confirmation
// dialogs when they use the Document Scanning API functions
// chrome.documentScan.getScannerList() and chrome.documentScan.startScan().
//
// If the policy is set to a non-empty list and an extension is in the list, the
// scanning confirmation dialogs normally shown to the user when
// chrome.documentScan.getScannerList() or chrome.documentScan.startScan() are
// called will be suppressed for that extension.
//
// If the policy is unset or set to an empty list, scanning confirmation dialogs
// will be shown to the user when chrome.documentScan.getScannerList() or
// chrome.documentScan.startScan() are called.
//
// Supported on: chrome_os
message DocumentScanAPITrustedExtensionsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList DocumentScanAPITrustedExtensions = 2;
}

// Allow reporting of domain reliability related data
//
// If this policy is set false, domain reliability diagnostic data reporting is
// disabled and no data is sent to Google.
// If this policy is set true or not set, domain reliability diagnostic data
// reporting will follow the behavior of MetricsReportingEnabled for Google
// Chrome or DeviceMetricsReportingEnabled for Google ChromeOS.
//
// Valid values:
//   True: Domain Reliability data may be sent to Google depending on Chrome
// User Metrics (UMA) policy
//   False: Never send domain reliability data to Google
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message DomainReliabilityAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool DomainReliabilityAllowed = 2;
}

// Enable download bubble UI
//
// Setting the policy to Enabled or leaving it unset shows the new download
// bubble UI in Google Chrome.
//
// Setting the policy to Disabled means Google Chrome keeps showing the old
// download shelf UI.
//
// This policy was intended to be temporary and was removed after the new
// download bubble UI was fully launched.
//
// Valid values:
//   True: Enable download bubble UI
//   False: Disable download bubble UI
//
// Supported on:
message DownloadBubbleEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DownloadBubbleEnabled = 2;
}

// Set download directory
//
// Setting the policy sets up the directory Chrome uses for downloading files.
// It uses the provided directory, whether or not users specify one or turned on
// the flag to be prompted for download location every time.
//
// This policy overrides the DefaultDownloadDirectory policy.
//
// Leaving the policy unset means Chrome uses the default download directory,
// and users can change it.
//
// On Google ChromeOS it's possible to set it only to Google Drive directories.
//
// Note: See a list of variables you can use (
// https://www.chromium.org/administrators/policy-list-3/user-data-directory-
// variables ).
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message DownloadDirectoryProto {
  optional PolicyOptions policy_options = 1;
  optional string DownloadDirectory = 2;
}

// Allow saving files directly to Google Drive
//
// This policy controls whether the user is allowed to save files to Google
// Drive directly from the download manager.
// Setting the policy to Enabled or leaving it unset allows the user to save
// files to Google Drive from the download manager. Setting the policy to
// Disabled prevent users seeing the option in the download manager.
// This policy does not prevent users from saving files to Google Drive using
// other ways beside the download manager.
//
// Valid values:
//   0: The download manager will have an option to save files to Google Drive.
//   1: The download manager will not have an option to save files to Google
// Drive.
//
// Supported on: ios
message DownloadManagerSaveToDriveSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DownloadManagerSaveToDriveSettings = 2;
}

// Allow download restrictions
//
// Setting the policy means users can't bypass download security decisions.
//
// There are many types of download warnings within Chrome, which roughly break
// down into these categories (learn more about Safe Browsing verdicts
// https://support.google.com/chrome/?p=ib_download_blocked):
//
// * Malicious, as flagged by the Safe Browsing server
// * Uncommon or unwanted, as flagged by the Safe Browsing server
// * A dangerous file type (e.g. all SWF downloads and many EXE downloads)
//
// Setting the policy blocks different subsets of these, depending on it's
// value:
//
// 0: No special restrictions. Default.
//
// 1: Blocks malicious files flagged by the Safe Browsing server AND Blocks all
// dangerous file types. Only recommended for OUs/browsers/users that have a
// high tolerance for False Positives.
//
// 2: Blocks malicious files flagged by the Safe Browsing server AND Blocks
// uncommon or unwanted files flagged by the Safe Browsing server AND Blocks all
// dangerous file types. Only recommended for OUs/browsers/users that have a
// high tolerance for False Positives.
//
// 3: Blocks all downloads. Not recommended, except for special use cases.
//
// 4: Blocks malicious files flagged by the Safe Browsing server, does not block
// dangerous file types. Recommended.
//
// Note: These restrictions apply to downloads triggered from webpage content,
// as well as the Download link… menu option. They don't apply to the download
// of the currently displayed page or to saving as PDF from the printing
// options. Read more about Safe Browsing ( https://developers.google.com/safe-
// browsing ).
//
// Valid values:
//   0: No special restrictions. Default.
//   1: Block malicious downloads and dangerous file types.
//   2: Block malicious downloads, uncommon or unwanted downloads and dangerous
// file types.
//   3: Block all downloads.
//   4: Block malicious downloads. Recommended.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message DownloadRestrictionsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DownloadRestrictions = 2;
}

// Disable Drive in the Google ChromeOS Files app
//
// Setting the policy to Enabled turns off Google Drive syncing in the Google
// ChromeOS Files app. No data is uploaded to Drive.
//
// Setting the policy to Disabled or leaving it unset lets users transfer files
// to Drive.
//
// Valid values:
//   True: Disable Google Drive syncing
//   False: Enable Google Drive syncing
//
// Supported on: chrome_os
message DriveDisabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool DriveDisabled = 2;
}

// Disable Google Drive over cellular connections in the Google ChromeOS Files
// app
//
// Setting the policy to Enabled turns off Google Drive syncing in the Google
// ChromeOS Files app when on a cellular connection. Data is only synced to
// Drive when connected through Wi-Fi or Ethernet.
//
// Setting the policy to Disabled or leaving it unset lets users transfer files
// to Drive on cellular connections.
//
// Valid values:
//   True: Disable Google Drive syncing over cellular connections
//   False: Enable Google Drive syncing over cellular connections
//
// Supported on: chrome_os
message DriveDisabledOverCellularProto {
  optional PolicyOptions policy_options = 1;
  optional bool DriveDisabledOverCellular = 2;
}

// ChromeOS file sync
//
// ChromeOS file sync automatically
// makes Google Drive files in a user's “My
// Drive” available offline (space permitting) on
// Chromebook Plus devices.
//
// Once the feature is on, all new files will also be made available offline
// automatically. If later there is insufficient space, all new files will stop
// being made available offline automatically. However, the user can still
// manually make items available offline.
//
// Setting the policy to visible: Shows
// file sync in the Files app and Settings. The user can turn file sync on or
// off.
//
// Setting the policy to disabled: Turns
// off file sync if it was previously turned on by the user. Hides the feature
// from the Files app and Settings so the user can’t turn it back on. Existing
// files that were made available offline by the user will remain available
// offline. The user can still manually make items available offline.
//
// If the policy is unset: visible is the
// default selection.
//
// Valid values:
//   disabled: The user can't see any of the UI relating to the ChromeOS file
// sync feature.
//   visible: The user can use the ChromeOS file sync feature.
//
// Supported on: chrome_os
message DriveFileSyncAvailableProto {
  optional PolicyOptions policy_options = 1;
  optional string DriveFileSyncAvailable = 2;
}

// Dynamic Code Settings
//
// This policy controls the dynamic code settings for Google Chrome.
//
// Disabling dynamic code improves the security of Google Chrome by preventing
// potentially hostile dynamic code and third-party code from making changes to
// Google Chrome's behavior, but might cause compatibility issues with third-
// party software (e.g. certain printer drivers) that must run inside the
// browser process.
//
// If the policy is set to 0 - Default or left unset then Google Chrome will use
// the default settings.
//
// If the policy is set to 1 - DisabledForBrowser then the Google Chrome browser
// process will be prevented from creating dynamic code.
//
// Note: Read more about process mitigation policies ( https://chromium.googleso
// urce.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-
// policies ).
//
// Valid values:
//   0: Default dynamic code settings
//   1: Prevent the browser process from creating dynamic code
//
// Supported on: win
message DynamicCodeSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 DynamicCodeSettings = 2;
}

// Allow Smart Lock to be used
//
// If you enable this setting, users will be allowed to use Smart Lock if the
// requirements for the feature are satisfied.
//
// If you disable this setting, users will not be allowed to use Smart Lock.
//
// If this policy is left not set, the default is not allowed for enterprise-
// managed users and allowed for non-managed users.
//
// Valid values:
//   True: Allow Smart Lock
//   False: Do not allow Smart Lock
//
// Supported on: chrome_os
message EasyUnlockAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool EasyUnlockAllowed = 2;
}

// Allow Eche to be enabled.
//
// If this setting is enabled, users will be able to launch the Eche
// application, for example by clicking on a Phone Hub notification.
//
// If this setting is disabled, users will not be able to launch the Eche
// application.
//
// If this policy is left not set, the default is allowed for both enterprise-
// managed users and non-managed users.
//
// Valid values:
//   True: Allows users to click on Phone Hub notification to launch Eche
// application.
//   False: Disallows users to click on Phone Hub notification to launch Eche
// application.
//
// Supported on: chrome_os
message EcheAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool EcheAllowed = 2;
}

// Migration strategy for ecryptfs
//
// This policy was removed in M87 and home directories will automatically
// migrate to ext4 at sign-in.
// Setting the policy specifies the action to take when the user's home
// directory was created with ecryptfs encryption. Unless ecryptfs-encrypted
// home directories migrate to ext4-encryption, Android apps might stop running.
//
// Setting the policy to:
//
// * Migrate (or an unsupported option such as AskUser or
// AskForEcryptfsArcUsers) means directories automatically migrate to ext4 at
// sign-in, without asking for user consent.
//
// * Wipe or MinimalMigrate means that, at sign-in, new ext4-encrypted home
// directories replace old ecryptfs-encrypted directories. To help the user
// avoid repeated sign-ins, MinimalMigrate tries to preserve sign-in tokens.
//
// * DisallowArc or leaving it unset prevents migration, and the user's Android
// apps stop running.
//
// This policy doesn't apply to kiosk users.
//
// Warning: Wipe and MinimalMigrate remove local data.
//
// Valid values:
//   0: Disallow data migration and ARC.
//   1: Migrate automatically, don’t ask for user consent.
//   2: Wipe the user’s ecryptfs home directory and start with a fresh
// ext4-encrypted home directory.
//   4: Similar to Wipe (value 2), but tries to preserve login tokens so the
// user does not have to sign in again.
//
// Supported on:
message EcryptfsMigrationStrategyProto {
  optional PolicyOptions policy_options = 1;
  optional int64 EcryptfsMigrationStrategy = 2;
}

// Enable or disable bookmark editing
//
// Setting the policy to True or leaving it unset lets users add, remove,
// modify, or upload bookmarks.
//
// Setting the policy to False means users can't add, remove, modify or upload
// bookmarks. They can still use existing bookmarks.
//
// Valid values:
//   True: Enable bookmark editing
//   False: Disable bookmark editing
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message EditBookmarksEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool EditBookmarksEnabled = 2;
}

// The valid version of Edu Coexistence Terms of Service
//
// This policy indicates current valid version of Edu Coexistence Terms of
// Service.
// It is compared with the version last accepted by the parent and used to
// prompt parent permission renewal when needed.
//
// When this policy is set Terms of Service version can be validated.
// When this policy is unset it is not possible to verify validity of Edu
// Coexistence Terms of Service.
//
// This policy is only used for Family Link users.
//
// Supported on: chrome_os
message EduCoexistenceToSVersionProto {
  optional PolicyOptions policy_options = 1;
  optional string EduCoexistenceToSVersion = 2;
}

// GIF Support in Emoji Picker
//
// This policy enables GIF support for Emoji Picker on Google ChromeOS.
// If this policy is set to Enabled, Emoji picker will support GIF emoji.
// If this policy is set to Disabled or not set, Emoji picker will not support
// GIF emoji.
// If this policy is not set, Emoji picker will be enabled for normal users but
// disabled for managed users.
//
// Valid values:
//   True: Enable GIF support.
//   False: Disable GIF support.
//
// Supported on: chrome_os
message EmojiPickerGifSupportEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool EmojiPickerGifSupportEnabled = 2;
}

// Enable Emoji Suggestion
//
// This policy enables Google ChromeOS to suggest emojis when users type text
// with their virtual or physical keyboards.
// If this policy is set to true, the feature will be enabled, and users will be
// able to change it.
// This policy is defaulted to false, no emoji will be suggested and users
// cannot override it.
//
// Valid values:
//   True: Enable emoji suggestions when users type
//   False: Disable emoji suggestions when users type
//
// Supported on: chrome_os
message EmojiSuggestionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool EmojiSuggestionEnabled = 2;
}

// Include non-standard port in Kerberos SPN
//
// Setting the policy to Enabled and entering a nonstandard port (in other
// words, a port other than 80 or 443) includes it in the generated Kerberos
// SPN.
//
// Setting the policy to Disabled or leaving it unset means the generated
// Kerberos SPN won't include a port.
//
// Valid values:
//   True: Include non-standard port in generated Kerberos SPN
//   False: Do not include port in generated Kerberos SPN
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message EnableAuthNegotiatePortProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableAuthNegotiatePort = 2;
}

// Allow certificates issued by local trust anchors without
// subjectAlternativeName extension
//
// When this setting is enabled, Google Chrome will use the commonName of a
// server certificate to match a hostname if the certificate is missing a
// subjectAlternativeName extension, as long as it successfully validates and
// chains to a locally-installed CA certificates.
//
// Note that this is not recommended, as this may allow bypassing the
// nameConstraints extension that restricts the hostnames that a given
// certificate can be authorized for.
//
// If this policy is not set, or is set to false, server certificates that lack
// a subjectAlternativeName extension containing either a DNS name or IP address
// will not be trusted.
//
// Valid values:
//   True: Allow certificates lacking a subjectAlternativeName extension when
// issued by local trust anchors
//   False: Disallow certificates lacking a subjectAlternativeName extension
//
// Supported on:
message EnableCommonNameFallbackForLocalAnchorsProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableCommonNameFallbackForLocalAnchors = 2;
}

// Enable deprecated privet printing
//
// This policy controls whether any available privet printers are shown to users
// in the print preview dialog.
// Setting this policy to Enabled will show available privet printers.
// Setting this policy to Disabled or leaving it unset will result in privet
// printers not appearing in print preview, as this printing method is
// deprecated.
//
// Valid values:
//   True: Enable deprecated privet printing
//   False: Disable deprecated privet printing
//
// Supported on:
message EnableDeprecatedPrivetPrintingProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableDeprecatedPrivetPrinting = 2;
}

// Enable the old web-based signin flow
//
// This setting was named EnableWebBasedSignin prior to Chrome 42, and support
// for it will be removed entirely in Chrome 43.
//
// This setting is useful for enterprise customers who are using SSO solutions
// that are not compatible with the new inline signin flow yet.
// If you enable this setting, the old web-based signin flow would be used.
// If you disable this setting or leave it not set, the new inline signin flow
// would be used by default. Users may still enable the old web-based signin
// flow through the command line flag --enable-web-based-signin.
//
// The experimental setting will be removed in the future when the inline signin
// fully supports all SSO signin flows.
//
// Supported on:
message EnableDeprecatedWebBasedSigninProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableDeprecatedWebBasedSignin = 2;
}

// Enable deprecated web platform features for a limited time
//
// Specify a list of deprecated web platform features to re-enable temporarily.
//
// This policy gives administrators the ability to re-enable deprecated web
// platform features for a limited time. Features are identified by a string tag
// and the features corresponding to the tags included in the list specified by
// this policy will get re-enabled.
//
// If this policy is left not set, or the list is empty or does not match one of
// the supported string tags, all deprecated web platform features will remain
// disabled.
//
// While the policy itself is supported on the above platforms, the feature it
// is enabling may be available on fewer platforms. Not all deprecated Web
// Platform features can be re-enabled. Only the ones explicitly listed below
// can be for a limited period of time, which is different per feature. The
// general format of the string tag will be
// [DeprecatedFeatureName]_EffectiveUntil[yyyymmdd]. As reference, you can find
// the intent behind the Web Platform feature changes at
// https://bit.ly/blinkintents.
//
// Valid values:
//   ExampleDeprecatedFeature_EffectiveUntil20080902: Enable
// ExampleDeprecatedFeature API through 2008/09/02
//
// Supported on:
message EnableDeprecatedWebPlatformFeaturesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList EnableDeprecatedWebPlatformFeatures = 2;
}

// Enables experimental policies
//
// Allows Google Chrome to load experimental policies.
//
// WARNING: Experimental policies are unsupported and subject to change or be
// removed without notice in future version of the browser!
//
// An experimental policy may not be finished or still have known or unknown
// defects. It may be changed or even removed without any notification. By
// enabling experimental policies, you could lose browser data or compromise
// your security or privacy.
//
// If a policy is not in the list and it's not officially released, its value
// will be ignored on Beta and Stable channel.
//
// If a policy is in the list and it's not officially released, its value will
// be applied.
//
// This policy has no effect on already released policies.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message EnableExperimentalPoliciesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList EnableExperimentalPolicies = 2;
}

// Enable Google Cast
//
// Setting the policy to Enabled or leaving it unset turns on Google Cast, which
// users can launch from the app menu, page context menus, media controls on
// Cast-enabled websites, and (if shown) the Cast toolbar icon.
//
// Setting the policy to Disabled turns off Google Cast.
//
// Valid values:
//   True: Allow users to use Google Cast
//   False: Do not allow users to use Google Cast
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message EnableMediaRouterProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableMediaRouter = 2;
}

// Enable online OCSP/CRL checks
//
// Setting the policy to True means online OCSP/CRL checks are performed.
//
// Setting the policy to False or leaving it unset means Google Chrome won't
// perform online revocation checks in Google Chrome 19 and later.
//
// Note: OCSP/CRL checks provide no effective security benefit.
//
// Valid values:
//   True: Allow online OCSP/CRL checks to be performed
//   False: Prevent online OCSP/CRL checks from being performed
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message EnableOnlineRevocationChecksProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableOnlineRevocationChecks = 2;
}

// Controls which managed users can set the ProxyOverrideRules policy.
//
// When this policy is set to 0 or left unset, the ProxyOverrideRules policy
// will only be applied at the user scope for affiliated users.
// When this policy is set to 1, the ProxyOverrideRules policy will be applied
// at the user scope, even that user is unaffiliated.
//
// Supported on: linux, mac, win
message EnableProxyOverrideRulesForAllUsersProto {
  optional PolicyOptions policy_options = 1;
  optional int64 EnableProxyOverrideRulesForAllUsers = 2;
}

// Allow SHA-1 signed certificates issued by local trust anchors
//
// When this setting is enabled, Google Chrome allows SHA-1 signed certificates
// as long as they successfully validate and chain to a locally-installed CA
// certificates.
//
// Note that this policy depends on the operating system certificate
// verification stack allowing SHA-1 signatures. If an OS update changes the OS
// handling of SHA-1 certificates, this policy may no longer have effect.
// Further, this policy is intended as a temporary workaround to give
// enterprises more time to move away from SHA-1.  This policy will be removed
// on or around January 1st 2019.
//
// If this policy is not set, or it is set to false, then Google Chrome follows
// the publicly announced SHA-1 deprecation schedule.
//
// Valid values:
//   True: Allow SHA-1 signed certificates issued by local trust anchors
//   False: Disallow SHA-1 signed certificates
//
// Supported on:
message EnableSha1ForLocalAnchorsProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableSha1ForLocalAnchors = 2;
}

// Enable trust in Symantec Corporation's Legacy PKI Infrastructure
//
// When this setting is enabled, Google Chrome allows certificates issued by
// Symantec Corporation's Legacy PKI operations to be trusted if they otherwise
// successfully validate and chain to a recognized CA certificate.
//
// Note that this policy depends on the operating system still recognizing
// certificates from Symantec's legacy infrastructure. If an OS update changes
// the OS handling of such certificates, this policy no longer has effect.
// Further, this policy is intended as a temporary workaround to give
// enterprises more time to transition away from legacy Symantec certificates.
// This policy will be removed on or around January 1st 2019.
//
// If this policy is not set, or it is set to false, then Google Chrome follows
// the publicly announced deprecation schedule.
//
// See https://g.co/chrome/symantecpkicerts for more details on this
// deprecation.
//
// Valid values:
//   True: Enable trust in certificates issued by Symantec Corporation Legacy
// PKI
//   False: Disable trust in certificates issued by Symantec Corporation Legacy
// PKI
//
// Supported on:
message EnableSymantecLegacyInfrastructureProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableSymantecLegacyInfrastructure = 2;
}

// Enable displaying Sync Consent during sign-in
//
// This policy controls if Sync Consent can be shown to the user during first
// sign-in. It should be set to false if Sync Consent is never needed for the
// user.
// If set to false, Sync Consent will not be displayed.
// If set to true or unset, Sync Consent can be displayed.
//
// Valid values:
//   True: Display Sync Consent during sign-in
//   False: Do not display Sync Consent during sign-in
//
// Supported on: chrome_os
message EnableSyncConsentProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableSyncConsent = 2;
}

// Allow software WebGL fallback using SwiftShader
//
// A policy that controls if SwiftShader will be used as a WebGL fallback when
// hardware GPU acceleration is not available.
//
// SwiftShader has been used to support WebGL on systems without GPU
// acceleration such as headless systems or virtual machines but has been
// deprecated due to security issues. Starting in M139, WebGL context creation
// will fail when it would have otherwise used SwiftShader. This policy allows
// the browser or administrator to temporarily defer the deprecation.
//
// Setting the policy to Enabled, SwiftShader will be used as a software WebGL
// fallback.
//
// Setting the policy to Disabled or not set, WebGL context creation may fail if
// hardware GPU acceleration is not available. Web pages may misbehave if they
// do not gracefully handle WebGL context creation failure.
//
// This is a temporary policy which will be removed in the future.
//
// Valid values:
//   True: Enable support for unsafe SwiftShader WebGL fallback
//   False: Disable support for unsafe SwiftShader WebGL fallback
//
// Supported on: linux, mac, win
message EnableUnsafeSwiftShaderProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnableUnsafeSwiftShader = 2;
}

// Specify a list of enabled plugins
//
// This policy is deprecated. Please use the DefaultPluginsSetting to control
// the availability of the Flash plugin and AlwaysOpenPdfExternally to control
// whether the integrated PDF viewer should be used for opening PDF files.
//
// Specifies a list of plugins that are enabled in Google Chrome and prevents
// users from changing this setting.
//
// The wildcard characters '*' and '?' can be used to match sequences of
// arbitrary characters. '*' matches an arbitrary number of characters while '?'
// specifies an optional single character, i.e. matches zero or one characters.
// The escape character is '\', so to match actual '*', '?', or '\' characters,
// you can put a '\' in front of them.
//
// The specified list of plugins is always used in Google Chrome if they are
// installed. The plugins are marked as enabled in 'about:plugins' and users
// cannot disable them.
//
// Note that this policy overrides both DisabledPlugins and
// DisabledPluginsExceptions.
//
// If this policy is left not set the user can disable any plugin installed on
// the system.
//
// Supported on:
message EnabledPluginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList EnabledPlugins = 2;
}

// Enable TLS Encrypted ClientHello
//
// Encrypted ClientHello (ECH) is an extension to TLS to encrypt sensitive
// fields of the ClientHello and improve privacy.
//
// If this policy is not configured, or is set to enabled, Google Chrome will
// follow the default rollout process for ECH. If it is disabled, Google Chrome
// will not enable ECH.
//
// When the feature is enabled, Google Chrome may or may not use ECH depending
// on server support, availability of the HTTPS DNS record, or rollout status.
//
// ECH is an evolving protocol, so Google Chrome's implementation is subject to
// change. As such, this policy is a temporary measure to control the initial
// experimental implementation. It will be replaced with final controls as the
// protocol finalizes.
//
// Valid values:
//   True: Enable the TLS Encrypted ClientHello experiment
//   False: Disable the TLS Encrypted ClientHello experiment
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message EncryptedClientHelloEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool EncryptedClientHelloEnabled = 2;
}

// Determines whether the built-in certificate verifier will enforce constraints
// encoded into trust anchors loaded from the platform trust store.
//
// X.509 certificates may encode constraints, such as Name Constraints,
// in extensions in the certificate. RFC 5280 specifies that enforcing such
// constraints on trust anchor certificates is optional. Starting in
// Google Chrome 112, such constraints
// in certificates loaded from the platform certificate store will now be
// enforced.
//
// This policy exists as a temporary opt-out in case an enterprise encounters
// issues with the constraints encoded in their private roots. In that case this
// policy may be used to temporarily disable enforcement of the constraints
// while correcting the certificate issues.
//
// When this policy is not set, or is set to enabled,
// Google Chrome will enforce
// constraints encoded into trust anchors loaded from the platform trust store.
//
// When this policy is set to disabled,
// Google Chrome will not enforce
// constraints encoded into trust anchors loaded from the platform trust store.
//
// In Google Chrome version 112,
// this policy has no effect if the
// ChromeRootStoreEnabled
// policy is disabled.
//
// This policy was removed in
// Google Chrome version 126. Starting
// that version, constraints in trust anchors are always enforced.
//
// Valid values:
//   True: Enforce constraints in locally added trust anchors
//   False: Do not enforce constraints in locally added trust anchors
//
// Supported on:
message EnforceLocalAnchorConstraintsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnforceLocalAnchorConstraintsEnabled = 2;
}

// Allow the enhanced network text-to-speech voices in Select-to-speak
//
// Allow the enhanced network text-to-speech voices in Select-to-speak
// accessibility feature. These voices send text to Google's servers to
// synthesize natural-sounding speech.
//
// If this policy is set to false, the enhanced network text-to-speech voices
// feature in Select-to-speak will always be disabled.
//
// If this policy is set to true or unset, the enhanced network text-to-speech
// voices feature in Select-to-speak can be enabled or disabled by the user.
//
// Valid values:
//   True: Allow enhanced network text-to-speech voices when using Select-to-
// Speak
//   False: Disallow enhanced network text-to-speech voices when using Select-
// to-Speak
//
// Supported on: chrome_os
message EnhancedNetworkVoicesInSelectToSpeakAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnhancedNetworkVoicesInSelectToSpeakAllowed = 2;
}

// External authentication app launch URLs
//
// Allows you to specify configs for authentication urls in Android WebView.
//
// These Authentication urls would be treated special by Android WebView, such
// that during authentication when webpage in Android WebView
// is navigated to authentication urls, corresponding Identity providers
// authenticator app that can handle this authentication URL would be launched.
//
// This flow of launching the Identity providers authenticator app would be used
// by the Identity providers to enable
// use cases like providing SSO across apps or provide better security by
// collecting zero trust device signals to understand device posture during
// authentication.
//
// If there is no valid app installed to handle authentication url on the
// device, navigation will continue in Android WebView.
//
// Authentication URL pattern has to be formatted according to
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "url": {
//                 "type": "string"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android
message EnterpriseAuthenticationAppLinkPolicyProto {
  optional PolicyOptions policy_options = 1;
  optional string EnterpriseAuthenticationAppLinkPolicy = 2;
}

// Control the visibility of enterprise badging
//
// This is a temporary policy that will be removed in M127.
// This policy controls the visibility of the enterprise badging on managed
// profiles which consists of an account specific management label shown in the
// profile menu, a new label associated to a profile managed by your
// organization shown in the toolbar and controlled by the policy ProfileLabel,
// and an enterprise logo shown in the profile menu next to the profile picture
// and controlled by the policy EnterpriseLogoUrl.
//
// Leaving this policy unset or setting this policy to "Hide all enterprise
// badging (value 0)" will hide all of the badging regardless of the policies
// that control each component.
//
// Setting this policy to "Show enterprise badging on unmanaged devices only
// (value 1)" will show all of the badging if a user from your organization uses
// a managed profile on an unmanaged device.
//
// Setting this policy to "Show enterprise badging on all devices (value 2)"
// will show all of the badging if a user from your organization uses a managed
// profile on any device.
//
// Setting this policy to "Show enterprise badging on managed devices only
// (value 3)" will show all of the badging if a user from your organization uses
// a managed profile on a managed device.
//
// A device is considered managed if an enterprise version of the OS is used, or
// if any policies are set at the machine level and affect the browser.
//
// Valid values:
//   0: Hide all enterprise badging
//   1: Show enterprise badging on unmanaged devices only
//   2: Show enterprise badging on all devices
//   3: Show enterprise badging on managed devices only
//
// Supported on:
message EnterpriseBadgingTemporarySettingProto {
  optional PolicyOptions policy_options = 1;
  optional int64 EnterpriseBadgingTemporarySetting = 2;
}

// Set a custom enterprise label for a managed profile
//
// This policy controls a custom label used to identify managed profiles. For
// managed profiles, this label will be shown next to the avatar in the toolbar.
// The custom label will not be translated.
//
// When this policy is applied, any strings that surpass 16 characters will be
// truncated with a “...” Please refrain from using extended names.
//
// This policy can only be set as a user policy.
//
// Note that this policy has no effect if the
// EnterpriseProfileBadgeToolbarSettings policy is set to
// hide_expanded_enterprise_toolbar_badge (value 1).
//
// Supported on: linux, mac, win
message EnterpriseCustomLabelProto {
  optional PolicyOptions policy_options = 1;
  optional string EnterpriseCustomLabel = 2;
}

// Set a custom enterprise label for a managed browser
//
// This policy controls a custom label used to indicate a managed browser. For
// managed browsers, this label will be shown in a management disclaimer on a
// footer on the New Tab page. The custom label will not be translated.
//
// Note that this policy is only applied for managed browsers, so it will have
// no effect for managed users on unmanaged browsers.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Supported on: linux, mac, win
message EnterpriseCustomLabelForBrowserProto {
  optional PolicyOptions policy_options = 1;
  optional string EnterpriseCustomLabelForBrowser = 2;
}

// Enables managed extensions to use the Enterprise Hardware Platform API
//
// Setting the policy to True lets extensions installed by enterprise policy use
// the Enterprise Hardware Platform API.
//
// Setting the policy to False or leaving it unset prevents extensions from
// using this API.
//
// Note: This policy also applies to component extensions, such as the Hangout
// Services extension.
//
// Valid values:
//   True: Allow managed extensions to use the Enterprise Hardware Platform API
//   False: Do not allow managed extensions to use the Enterprise Hardware
// Platform API
//
// Supported on: android, chrome_os, linux, mac, win
message EnterpriseHardwarePlatformAPIEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnterpriseHardwarePlatformAPIEnabled = 2;
}

// Enterprise Logo URL for a managed profile
//
// A URL to an image that will be used as an enterprise badge for a managed
// profile. The URL must point to an image.
//
// This policy can only be set as a user policy.
//
// It is recommended to use the favicon (example
// https://www.google.com/favicon.ico) or an icon no smaller than 48 x 48 px.
//
// Supported on: linux, mac, win
message EnterpriseLogoUrlProto {
  optional PolicyOptions policy_options = 1;
  optional string EnterpriseLogoUrl = 2;
}

// Enterprise Logo URL for a managed browser
//
// A URL to an image that will be used as an enterprise badge for a managed
// browser. The URL must point to an image.
//
// It is recommended to use the favicon (example
// https://www.google.com/favicon.ico) or an icon no smaller than 48 x 48 px.
//
// Note that this policy is only applied for managed browsers, so it will have
// no effect for managed users on unmanaged browsers.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Supported on: linux, mac, win
message EnterpriseLogoUrlForBrowserProto {
  optional PolicyOptions policy_options = 1;
  optional string EnterpriseLogoUrlForBrowser = 2;
}

// Controls visibility of enterprise profile badge in the toolbar
//
// For work and school profiles, the toolbar will show a "Work" or "School"
// label by default next to the toolbar avatar. The label will only be shown if
// the signed in account is managed.
//
// Setting this policy to hide_expanded_enterprise_toolbar_badge (value 1) will
// hide the enterprise badge for a managed profile in the toolbar.
//
// Leaving this policy unset or setting it to
// show_expanded_enterprise_toolbar_badge (value 0) will show the enterprise
// badge.
//
// The label is customizable via the EnterpriseCustomLabel policy.
//
// Valid values:
//   0: Show expanded enterprise toolbar badge
//   1: Hide expanded enterprise toolbar badge
//
// Supported on: linux, mac, win
message EnterpriseProfileBadgeToolbarSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 EnterpriseProfileBadgeToolbarSettings = 2;
}

// Keep browsing data when creating enterprise profile by default
//
// If this policy is Enabled, the option to keep any existing browsing data when
// creating an enterprise profile will be checked by default.
//
// If this policy is unset or Disabled, the option to keep any existing browsing
// data when creating an enterprise profile will not be checked by default.
//
// Regardless of the value, the user will be able to decide whether or not to
// keep any existing browsing data when creating an enterprise profile.
//
// This policy has no effect if the option to keep existing browsing data is not
// available; this happens if enterprise profile separation is strictly
// enforced, or if the data would be from an already managed profile.
//
// Valid values:
//   True: Check the option to keep existing browsing data by default
//   False: Do not check the option to keep existing browsing data by default
//
// Supported on: fuchsia, linux, mac, win
message EnterpriseProfileCreationKeepBrowsingDataProto {
  optional PolicyOptions policy_options = 1;
  optional bool EnterpriseProfileCreationKeepBrowsingData = 2;
}

// Configure Skills in Chrome
//
// Setting the policy publishes Generative AI skills to the user in Google
// Chrome.
//
// If set, users will see these configured skills by default on the
// chrome://skills page, in addition to their personal skills. Users can view,
// modify, and save these skills for their personal use.
//
// Each skill in the list must be an object containing a url where the skill
// content can be downloaded, and a hash (SHA-256) of that content to verify its
// integrity before it is applied. Each skill URL must be immutable. Updating a
// skill file requires a new URL and hash.
//
// If more than 10 skills are provided, a warning will be shown and only the
// first 10 skills will be published.
//
// If the policy is left unset or set to an empty list, no enterprise skills
// will be published to the user.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "hash": {
//                 "description": "The SHA-256 hash of the content at the URL.",
//                 "type": "string"
//             },
//             "url": {
//                 "description": "The URL pointing to the skill definition.
// Must be unique.",
//                 "type": "string"
//             }
//         },
//         "required": [
//             "url",
//             "hash"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: linux, mac, win
message EnterprisePublishedSkillsProto {
  optional PolicyOptions policy_options = 1;
  optional string EnterprisePublishedSkills = 2;
}

// Check Safe Browsing status of URLs in real time
//
// This policy controls checking URLs in real time to identify unsafe URLs.
//
// If this policy is left not set or set to ‘Disabled’, the consumer Safe
// Browsing checks will be applied. Consumer Safe Browsing checks can still
// include real time lookups, depending on the value of the “Make searches and
// browsing better” setting and the value of the
// UrlKeyedAnonymizedDataCollectionEnabled policy.
//
// If this policy is set to ‘Enabled’, URLs will be sent to be scanned in real
// time under enterprise ToS. It will result in Chrome sending URLs to Google
// Cloud or third parties of your choosing to check them in real time. The
// consumer version of Safe Browsing real time lookup will be switched off.
//
// This policy requires additional setup to take effect, please visit https://su
// pport.google.com/chrome/a?p=chrome_enterprise_connector_policies_setting for
// more information.
//
// Valid values:
//   0: Real time URL check is disabled.
//   1: Real time check for main frame URLs is enabled.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message EnterpriseRealTimeUrlCheckModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 EnterpriseRealTimeUrlCheckMode = 2;
}

// Enterprise search aggregator settings
//
// This policy allows administrators to set a designated enterprise search
// aggregator that will provide search recommendations and results within the
// omnibox (address bar) and the search box on the New Tab page.
//
// By default, enterprise search suggestions will be blended and shown alongside
// regular Google Chrome recommendations. Users can explicitly scope their
// search to just the enterprise search aggregator by typing the keyword
// specified in the shortcut field with or without the @ prefix (e.g. @work)
// followed by Space or Tab in the omnibox. Scoped enterprise searches
// (triggered by a keyword) are currently only supported in the omnibox and not
// in the search box on the New Tab page.
//
// The following fields are required: name, shortcut, search_url, suggest_url.
//
// The name field corresponds to the search engine name shown to the user in the
// address bar.
//
// The shortcut field corresponds to the keyword that the user enters to trigger
// the search. The shortcut can include plain words and characters, but cannot
// include spaces or start with the @ symbol. Shortcuts must be unique.
//
// The search_url field specifies the URL on which to search. Enter the web
// address for the search engine's results page, and use '{searchTerms}' in
// place of the query.
//
// The suggest_url field specifies the URL that provides search suggestions. A
// POST request will be made and the user's query will be passed in the POST
// params under key 'query'.
//
// The icon_url field specifies the URL to an image that will be used on the
// search suggestions. A default icon will be used when this field is not set.
// It's recommended to use a favicon (example
// https://www.google.com/favicon.ico). Supported image file formats: JPEG, PNG,
// and ICO.
//
// The require_shortcut field specifies whether the address bar shortcut is
// required to see search recommendations. If required, suggestions will not be
// shown in the search box on the New Tab page, but will continue to be shown in
// the omnibox (address bar) in scoped search mode. If this field is not set,
// the address bar shortcut is not required.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Value schema:
// {
//     "properties": {
//         "icon_url": {
//             "type": "string"
//         },
//         "name": {
//             "type": "string"
//         },
//         "require_shortcut": {
//             "type": "boolean"
//         },
//         "search_url": {
//             "type": "string"
//         },
//         "shortcut": {
//             "type": "string"
//         },
//         "suggest_url": {
//             "type": "string"
//         }
//     },
//     "required": [
//         "name",
//         "shortcut",
//         "suggest_url",
//         "search_url"
//     ],
//     "type": "object"
// }
//
// Supported on: chrome_os, linux, mac, win
message EnterpriseSearchAggregatorSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional string EnterpriseSearchAggregatorSettings = 2;
}

// Enterprise web store name (deprecated)
//
// This setting has been retired as of Google Chrome version 29. The recommended
// way to set up organization-hosted extension/app collections is to include the
// site hosting the CRX packages in ExtensionInstallSources and put direct
// download links to the packages on a web page. A launcher for that web page
// can be created using the ExtensionInstallForcelist policy.
//
// Supported on:
message EnterpriseWebStoreNameProto {
  optional PolicyOptions policy_options = 1;
  optional string EnterpriseWebStoreName = 2;
}

// Enterprise web store URL (deprecated)
//
// This setting has been retired as of Google Chrome version 29. The recommended
// way to set up organization-hosted extension/app collections is to include the
// site hosting the CRX packages in ExtensionInstallSources and put direct
// download links to the packages on a web page. A launcher for that web page
// can be created using the ExtensionInstallForcelist policy.
//
// Supported on:
message EnterpriseWebStoreURLProto {
  optional PolicyOptions policy_options = 1;
  optional string EnterpriseWebStoreURL = 2;
}

// Enable only essential cookies and data in search
//
// This policy lets admins control how Google processes cookies and data sent to
// Search through Google ChromeOS.
// When the policy is enabled, the user will be able to use the Google ChromeOS
// Launcher search box, and the Google Chrome Browser address box in Google
// ChromeOS, the cookies and data may be used only for essential purposes.
// When the policy is unset or disabled, the cookies and data may be used for
// non-essential purposes.
//
// Valid values:
//   True: Use only essential cookies and data in search.
//   False: Use essential and non-essential cookies in search.
//
// Supported on: chrome_os
message EssentialSearchEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool EssentialSearchEnabled = 2;
}

// Re-enable the Event.path API until M115.
//
// Starting in M109, the non-standard API Event.path will be removed to improve
// web compatibility. This policy re-enables the API until M115.
//
// If this policy is set to enabled, the Event.path API will be available.
//
// If this policy is set to disabled, the Event.path API will be unavailable.
//
// If this policy is not set, the Event.path API will be in the default status:
// available before M109, and unavailable in M109 to 114.
//
// This policy will be removed after Chrome 115.
//
// Valid values:
//   True: Event.path API will be available.
//   False: Event.path API will be unavailable.
//   None: Event.path API will be in the default status: available before M109,
// and unavailable in M109 to 114.
//
// Supported on:
message EventPathEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool EventPathEnabled = 2;
}

// Disable download file type extension-based warnings for specified file types
// on domains
//
// You can enable this policy to create a dictionary of file type extensions
// with a corresponding list of domains that will be exempted from file type
// extension-based download warnings. This lets enterprise administrators block
// file type extension-based download warnings for files that are associated
// with a listed domain. For example, if  the "jnlp" extension is associated
// with "website1.com", users would not see a warning when downloading "jnlp"
// files from "website1.com", but see a download warning when downloading "jnlp"
// files from "website2.com".
//
// Files with file type extensions specified for domains identified by this
// policy will still be subject to non-file type extension-based security
// warnings such as mixed-content download warnings and Safe Browsing warnings.
//
// If you disable this policy or don't configure it, file types that trigger
// extension-based download warnings will show warnings to the user.
//
// If you enable this policy:
//
// * The URL pattern should be formatted according to
// https://chromeenterprise.google/policies/url-patterns/.
//
// * The file type extension entered must be in lower-cased ASCII. The leading
// separator should not be included when listing the file type extension, so
// list "jnlp" should be used instead of ".jnlp".
//
// Example:
//
// The following example value would prevent file type extension-based download
// warnings on "exe" and "jnlp" extensions for *.example.com domains, and on
// "swf" extensions for all domains. It will show the user a file type
// extension-based download warning on any other domain for exe and jnlp files,
// but not for swf files.
//
// [
// { "file_extension": "jnlp", "domains": ["example.com"] },
// { "file_extension": "exe", "domains": ["example.com"] },
// { "file_extension": "swf", "domains": ["*"] }
// ]
//
// Note that while the preceding example shows the suppression of file type
// extension-based download warnings for "swf" files for all domains, applying
// suppression of such warnings for all domains for any dangerous file type
// extension is not recommended due to security concerns. It is shown in the
// example merely to demonstrate the ability to do so.
//
// If this policy is enabled alongside DownloadRestrictions, then the exemptions
// to file type extension-based warnings specified by this policy take
// precedence over a DownloadRestrictions setting that would block dangerous
// file types. The exemptions specified by this policy only apply to the "block
// dangerous file types" behavior specified by values 1 and 2 of
// DownloadRestrictions.
//
// For example, if this policy specifies an exemption for "exe" downloads from
// "website1.com", and DownloadRestrictions is set to block malicious downloads
// and dangerous file types (value 1), then "exe" downloads from "website1.com"
// will be exempt from file type extension-based blocking but will still be
// blocked if they are malicious.
//
// More information about DownloadRestrictions can be found at
// https://chromeenterprise.google/policies/?policy=DownloadRestrictions.
//
// Value schema:
// {
//     "items": {
//         "id": "DomainFiletypePair",
//         "properties": {
//             "domains": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "file_extension": {
//                 "type": "string"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message ExemptDomainFileTypePairsFromFileTypeDownloadWarningsProto {
  optional PolicyOptions policy_options = 1;
  optional string ExemptDomainFileTypePairsFromFileTypeDownloadWarnings = 2;
}

// Explicitly allowed network ports
//
// There is a list of restricted ports built into Google Chrome. Connections to
// these ports will fail. This setting permits bypassing that list. The value is
// a comma-separated list of zero or more ports that outgoing connections will
// be permitted on.
//
// Ports are restricted to prevent Google Chrome being used as a vector to
// exploit various network vulnerabilities. Setting this policy may expose your
// network to attacks. This policy is intended as a temporary workaround for
// errors with code "ERR_UNSAFE_PORT" while migrating a service running on a
// blocked port to a standard port (ie. port 80 or 443).
//
// Malicious websites can easily detect that this policy is set, and for what
// ports, and use that information to target attacks.
//
// Each port here is labelled with a date that it can be unblocked until. After
// that date the port will be restricted regardless of this setting.
//
// Leaving the value empty or unset means that all restricted ports will be
// blocked. If there is a mixture of valid and invalid values, the valid ones
// will be applied.
//
// This policy overrides the "--explicitly-allowed-ports" command-line option.
//
// Valid values:
//   554: port 554 (can be unblocked until 2021/10/15)
//   10080: port 10080 (can be unblocked until 2022/04/01)
//   6566: port 6566 (can be unblocked until 2021/10/15)
//   989: port 989 (can be unblocked until 2022/02/01)
//   990: port 990 (can be unblocked until 2022/02/01)
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ExplicitlyAllowedNetworkPortsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExplicitlyAllowedNetworkPorts = 2;
}

// Blocklist of identity providers that cannot use Extensible Enterprise SSO for
// the browser
//
// Disable single sign-on using Extensible Enterprise SSO for the listed
// identity providers.
//
// By adding the value 'all', all supported identity providers for SSO are
// disabled.
//
// By adding the value 'microsoft', support for single sign-on for Microsoft®
// cloud identity provider in Chrome is disabled.
//
// By leaving this policy unset, all identity providers that are supported by
// Google Chrome will be enabled.
//
// For identity providers that are enabled in Google Chrome and configured on
// the device the administrator, users who sign into their once using that
// identity provider, on any application that supports Extensible Enterprise
// SSO, can be signed into web properties using that identity provider
// automatically. Information pertaining to the user's authencitation
// information is transmitted to the user's cloud identity provider for each
// authentication event.
//
// Notes:
//
// Google Chrome does not support Single Sign-on using Extensible Enterprise SSO
// in Incognito or Guest modes.
//
// Google Chrome only supports Single Sign-on using Extensible Enterprise SSO
// for the following identity providers: Microsoft, Okta.
//
// This feature is available starting in macOS 10.15.
//
// Valid values:
//   all: All identity providers
//   microsoft: Microsoft® cloud identity provider
//   okta: Okta® cloud identity provider
//
// Supported on: mac
message ExtensibleEnterpriseSSOBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensibleEnterpriseSSOBlocklist = 2;
}

// Allow insecure algorithms in integrity checks on extension updates and
// installs
//
// Setting the policy to Enabled means Google Chrome permits installation and
// updates for extensions hosted outside the Chrome Web Store, the content of
// which might only be minimally protected.
//
// Setting the policy to Disabled means Google Chrome won't permit fresh
// installation of (and updates to) such extensions. The policy has no effect in
// Google Chrome 78 and later.
//
// Leaving this policy unset means it is Enabled in Google Chrome 73 to 75, and
// Disabled in Google Chrome 76 and 77.
//
// Valid values:
//   True: Allow installation and updates for extensions hosted outside of
// Chrome Web Store
//   False: Prevent installation and updates for extensions hosted outside of
// Chrome Web Store
//
// Supported on:
message ExtensionAllowInsecureUpdatesProto {
  optional PolicyOptions policy_options = 1;
  optional bool ExtensionAllowInsecureUpdates = 2;
}

// Configure allowed app/extension types
//
// Setting the policy controls which apps and extensions may be installed in
// Google Chrome, which hosts they can interact with, and limits runtime access.
//
// Leaving the policy unset results in no restrictions on the acceptable
// extension and app types.
//
// Extensions and apps which have a type that's not on the list won't be
// installed. Each value should be one of these strings:
//
// * "extension"
//
// * "theme"
//
// * "user_script"
//
// * "hosted_app"
//
// * "legacy_packaged_app"
//
// * "platform_app"
//
// See the Google Chrome extensions documentation for more information on these
// types.
//
// Versions earlier than 75 that use multiple comma separated extension IDs
// aren't supported and are skipped. The rest of the policy applies.
//
// Note: This policy also affects extensions and apps to be force-installed
// using ExtensionInstallForcelist.
//
// Note: This policy only applies to platforms that support extensions.
//
// Valid values:
//   extension: Extension
//   theme: Theme
//   user_script: User script
//   hosted_app: Hosted app
//   legacy_packaged_app: Legacy packaged app
//   platform_app: Platform app
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionAllowedTypesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensionAllowedTypes = 2;
}

// Control extension DOM activity logging
//
// Control whether extension DOM activity logging is enabled for enterprise
// users.
//
// Setting the policy to Enabled turns on telemetry for extension DOM activity.
// This includes monitoring code injection and sensitive data access by
// extensions.
//
// If this policy is set to Enabled, Google Chrome will collect and transmit
// signals about extension interactions with web pages to the Extension
// Telemetry Service for security auditing.
// If this policy is set to Disabled or not set, these signals are not collected
// or transmitted for enterprise users.
//
// Actual values of sensitive data (like cookies or input values) are NOT
// collected, only the fact that they were accessed.
//
// Valid values:
//   True: Enable extension DOM activity logging
//   False: Disable extension DOM activity logging
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionDOMActivityLoggingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ExtensionDOMActivityLoggingEnabled = 2;
}

// Control the availability of developer mode on extensions page
//
// Control if users can turn on Developer Mode on chrome://extensions.
//
// If the policy is not set, users can turn on developer mode on extension page
// unless DeveloperToolsAvailability policy is set to DeveloperToolsDisallowed
// (2).
// If the policy is set to Allow (0), users can turn on developer mode on
// extensions page.
// If the policy is set to Disallow (1), users can not turn on developer mode on
// extensions page.
//
// If this policy is set, DeveloperToolsAvailability can no longer control
// extensions developer mode.
//
// Note: This policy only applies to platforms that support extensions.
//
// Valid values:
//   0: Allow the usage of developer mode on extensions page
//   1: Do not allow the usage of developer mode on extensions page
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionDeveloperModeSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ExtensionDeveloperModeSettings = 2;
}

// Configure a list of origins that grant extended background lifetime to the
// connecting extensions.
//
// Extensions that connect to one of these origins will be be kept running as
// long as the port is connected.
//
// If unset, the policy's default values will be used. These are app origins
// that offer SDKs that are known to not offer the possibility to restart a
// closed connection to a previous state:
// - Smart Card Connector
// - Citrix Receiver (stable, beta, back-up)
// - VMware Horizon (stable, beta)
//
// If set, the default value list is extended with the newly configured values.
// Both defaults and the policy-provided entries will grant the exception to the
// connecting extensions, as long as the port is connected.
//
// Supported on: chrome_os, linux, mac, win
message ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls = 2;
}

// Enable Force-installed Extensions With Non-Malware Violations
//
// Controls whether extensions that are taken down due to non-malware violations
// can still be force installed in low-trust environments.
//
// More information about non-malware violations and taken down can be found
// here. https://developer.chrome.com/docs/webstore/review-process#warning
//
// Once the non-malware violation has been resolved, the extension will remain
// enabled and cannot be disabled or removed.
//
// On Microsoft® Windows®, this policy is not available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core`.
//
// On macOS, this policy is not available on instances that are managed via MDM,
// joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Force-installed extensions with non-malware violations will remain enabled in
// these instances.
//
// Currently, a force-installed extension with non-malware violations remains
// installed and enabled in Chrome.
//
// Setting the policy to Enabled will cause force-installed extensions to behave
// the same (i.e., remain enabled) regardless of non-malware violations.
//
// Setting the policy to Disabled or not setting the policy will cause force-
// installed extensions with non-malware violations to be disabled.
//
// This policy was removed in M145. Starting that version, force-installed
// extensions with non-malware violations will be disabled in low-trust
// environments.
//
// Valid values:
//   True: Enable force-installed extensions with non-malware violations.
//   False: Disable force-installed extensions with non-malware violations.
//
// Supported on:
message ExtensionForceInstallWithNonMalwareViolationsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ExtensionForceInstallWithNonMalwareViolationsEnabled = 2;
}

// Configure extension installation allow list
//
// Setting the policy specifies which extensions are not subject to the
// blocklist.
//
// A blocklist value of * means all extensions are blocked and users can only
// install extensions listed in the allow list.
//
// By default, all extensions are allowed. But, if you prohibited extensions by
// policy, use the list of allowed extensions to change that policy.
//
// Note: This policy only applies to platforms that support extensions.
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionInstallAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensionInstallAllowlist = 2;
}

// Configure extension installation blocklist
//
// This policy is deprecated and unsupported, please use the
// 'ExtensionInstallBlocklist' policy instead.
//
// Supported on:
message ExtensionInstallBlacklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensionInstallBlacklist = 2;
}

// Configure extension installation blocklist
//
// Allows you to specify which extensions the users can NOT install. Extensions
// already installed will be disabled if blocked, without a way for the user to
// enable them. Once an extension disabled due to the blocklist is removed from
// it, it will automatically get re-enabled.
//
// A blocklist value of '*' means all extensions are blocked by default.
// Extensions that are explicitly listed in the allowlist are allowed if they
// are signed (packed). All unpacked extensions are blocked.
//
// If this policy is left not set the user can install any extension in Google
// Chrome.
//
// Note: This policy only applies to platforms that support extensions.
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionInstallBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensionInstallBlocklist = 2;
}

// Enables additional cloud policy checks to allow/block installation of
// extensions.
//
// This policy incidates to browsers that they need to perform additional checks
// for extensions such as checking if an extension is in a category blocked by
// administrator.
//
// This policy will automatically be set to Enabled if any rules are configured
// in the Google Admin console,
// and will be Disabled otherwise.
//
// When this policy is set to Enabled, it signals to Google Chrome that it needs
// to consult the Cloud service to determine if an extension should be blocked.
// This policy check is performed for new installations and on all currently
// installed extensions, both at startup and periodically.
//
// When this policy is set to Disabled, this signals to Google Chrome that it
// does not need to perform any additional checks
// to determine if an extension should be blocked based on enterprise rules
// defined in the Google Admin console.
//
// If the extension is not allowed, Google Chrome will block the installation.
// For already installed extensions, Google Chrome will disable them.
//
// Chrome policies will take precedence over this policy such as if the
// extension is in ExtensionInstallAllowlist, ExtensionInstallBlocklist,
// or ExtensionInstallForced.
//
// Valid values:
//   True: Validate whether an extension can be installed or not with a cloud
// service.
//   False: Do not validate whether an extension can be installed or not with a
// cloud service.
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionInstallCloudPolicyChecksEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ExtensionInstallCloudPolicyChecksEnabled = 2;
}

// Log events for policy based extension installs
//
// Setting the policy to True sends reports of key, policy-triggered extension
// installation events to Google. Setting the policy to False means no events
// are captured. If the policy is unset, default value is set to True.
//
// Supported on:
message ExtensionInstallEventLoggingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ExtensionInstallEventLoggingEnabled = 2;
}

// Configure the list of force-installed apps and extensions
//
// Setting the policy specifies a list of apps and extensions that install
// silently, without user interaction, and which users can't uninstall or turn
// off through the Google Chrome interface. Permissions are granted implicitly,
// including for the enterprise.deviceAttributes and enterprise.platformKeys
// extension APIs. (These 2 APIs aren't available to apps and extensions that
// aren't force-installed.)
//
// Although Google Chrome aims to prevent users from uninstalling these
// extensions, some operating systems make it impossible for Google Chrome to
// defend robustly against extensions being modified externally, so this
// prevention is best efforts.
//
// Leaving the policy unset means no apps or extensions are autoinstalled, and
// users can uninstall any app or extension in Google Chrome.
//
// This policy supersedes ExtensionInstallBlocklist policy. If a previously
// force-installed app or extension is removed from this list, Google Chrome
// automatically uninstalls it.
//
// The source code of any extension may be altered by users through developer
// tools, potentially rendering the extension dysfunctional. If this is a
// concern, set the DeveloperToolsDisabled policy.
//
// Each list item of the policy is a string that contains an extension ID and,
// optionally, an update URL separated by a semicolon (;). The extension ID is
// the 32-letter string found, for example, on chrome://extensions when in
// Developer mode. If specified, the update URL should point to an Update
// Manifest XML document ( https://developer.chrome.com/extensions/autoupdate ).
// The update URL should use one of the following schemes: http, https or file.
// By default, the Chrome Web Store's update URL is used. The update URL set in
// this policy is only used for the initial installation; subsequent updates of
// the extension use the update URL in the extension's manifest. The update url
// for subsequent updates can be overridden using the ExtensionSettings policy,
// see http://support.google.com/chrome/a?p=Configure_ExtensionSettings_policy.
//
// On Microsoft® Windows® instances, apps and extensions from outside the Chrome
// Web Store can only be forced installed if the instance is joined to a
// Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active
// Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS instances, apps and extensions from outside the Chrome Web Store can
// only be force installed if the instance is managed via MDM, joined to a
// domain via MCX or enrolled in Chrome Enterprise Core.
//
// Note: This policy doesn't apply to Incognito mode. Read about hosting
// extensions ( https://developer.chrome.com/extensions/hosting ).
//
// Note: This policy only applies to platforms that support extensions.
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionInstallForcelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensionInstallForcelist = 2;
}

// Configure extension, app, and user script install sources
//
// Setting the policy specifies which URLs may install extensions, apps, and
// themes. Before Google Chrome 21, users could click on a link to a *.crx file,
// and Google Chrome would offer to install the file after a few warnings.
// Afterwards, such files must be downloaded and dragged to the Google Chrome
// settings page. This setting allows specific URLs to have the old, easier
// installation flow.
//
// Each item in this list is an extension-style match pattern (see
// https://developer.chrome.com/extensions/match_patterns). Users can easily
// install items from any URL that matches an item in this list. Both the
// location of the *.crx file and the page where the download is started from
// (the referrer) must be allowed by these patterns.
//
// ExtensionInstallBlocklist takes precedence over this policy. That is, an
// extension on the blocklist won't be installed, even if it happens from a site
// on this list.
//
// Note: This policy only applies to platforms that support extensions.
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionInstallSourcesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensionInstallSources = 2;
}

// Blocklist for install types of extensions
//
// The blocklist controls which extensions install types are disallowed.
//
// Setting "command_line" will block extension from being loaded from
// command line.
//
// Valid values:
//   command_line: Blocks extensions from being loaded from command line
//
// Supported on: linux, mac, win
message ExtensionInstallTypeBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensionInstallTypeBlocklist = 2;
}

// Configure extension installation allowlist
//
// This policy is deprecated and unsupported, please use the
// 'ExtensionInstallAllowlist' policy instead.
//
// Supported on:
message ExtensionInstallWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExtensionInstallWhitelist = 2;
}

// Control Manifest v2 extension availability
//
// Control if Manifest v2 extensions can be used by browser.
//
// Manifest v2 extensions support will be deprecated and all extensions need
// to be migrated to v3 in the future. More information and timeline of the
// migration can be found at
// https://developer.chrome.com/docs/extensions/mv3/mv2-sunset/.
//
// If the policy is set to Default (0) or not set, v2 extensions loading are
// decided by browser, following the timeline above.
// If the policy is set to Disable (1), v2 extensions installation are blocked,
// existing ones are disabled. The option is going to be treated the same as if
// the policy is not set after v2 support is turned off by default.
// If the policy is set to Enable (2), v2 extensions are allowed. The option is
// going to be treated the same as if the policy is not set before v2 support is
// turned off by default.
// If the policy is set to EnableForForcedExtensions (3), force installed v2
// extensions are allowed. This includes extensions that are listed by
// ExtensionInstallForcelist or ExtensionSettings with installation_mode
// "force_installed" or "normal_installed". All other v2 extensions are
// disabled. The option is always available regardless of the migration state.
//
//
// Extensions availability are still controlled by other policies.
//
// Valid values:
//   0: Default browser behavior
//   1: Manifest v2 is disabled
//   2: Manifest v2 is enabled
//   3: Manifest v2 is enabled for forced extensions only
//
// Supported on:
message ExtensionManifestV2AvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ExtensionManifestV2Availability = 2;
}

// Configure additional OAuth redirect URLs per extension
//
// Setting this policy specifies, for each affected extension, a list of OAuth
// redirect URLs that can
// be used by extensions with the identity API
// (https://developer.chrome.com/docs/extensions/reference/identity/)
// in addition to the standard https://&lt;extension id&gt;.chromiumapp.org/
// redirect URL.
//
// Leaving the policy unset, or providing an empty list of URLs means that all
// the apps or extensions
// may only use the standard redirect URL when using the identity API.
//
// Value schema:
// {
//     "additionalProperties": {
//         "items": {
//             "type": "string"
//         },
//         "type": "array"
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message ExtensionOAuthRedirectUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional string ExtensionOAuthRedirectUrls = 2;
}

// Extension management settings
//
// Setting the policy controls extension management settings for Google Chrome,
// including any controlled by existing extension-related policies.
//
// This policy maps an extension ID or an update URL to its specific setting
// only. A default configuration can be set for the special ID "*", which
// applies to all extensions without a custom configuration in this policy.
//
// This policy can override per-extension config from legacy policies.
//
// Note that any per-ID extension setting from either ExtensionInstallForcelist,
// ExtensionInstallAllowlist, ExtensionInstallBlocklist, or ExtensionSettings
// will only inherit 'installation_mode' and 'update_url' from the "*" defaults.
// It will not inherit any other properties. With an update URL, configuration
// applies to extensions with the exact update URL stated in the extension
// manifest (
// http://support.google.com/chrome/a?p=Configure_ExtensionSettings_policy ). If
// the 'override_update_url' flag is set to true, the extension is installed and
// updated using the "update" URL specified in the ExtensionInstallForcelist
// policy or in 'update_url' field in this policy. The flag
// 'override_update_url' is ignored if the 'update_url' is a Chrome Web Store
// url.
//
// On Microsoft® Windows® instances, apps and extensions from outside the Chrome
// Web Store can only be forced installed if the instance is joined to a
// Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active
// Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS instances, apps and extensions from outside the Chrome Web Store can
// only be force installed if the instance is managed via MDM, joined to a
// domain via MCX or enrolled in Chrome Enterprise Core.
//
// Note: This policy only applies to platforms that support extensions.
//
// Value schema:
// {
//     "patternProperties": {
//         "^[a-p]{32}(?:,[a-p]{32})*,?$": {
//             "properties": {
//                 "allowed_permissions": {
//                     "id": "ListOfPermissions",
//                     "items": {
//                         "pattern": "^[a-z][a-zA-Z0-9._]*$",
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "blocked_install_message": {
//                     "description": "text that will be displayed to the user
// in the chrome webstore if installation is blocked.",
//                     "type": "string"
//                 },
//                 "blocked_permissions": {
//                     "items": {
//                         "pattern": "^[a-z][a-zA-Z0-9._]*$",
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "file_url_navigation_allowed": {
//                     "type": "boolean"
//                 },
//                 "installation_mode": {
//                     "enum": [
//                         "blocked",
//                         "allowed",
//                         "force_installed",
//                         "normal_installed",
//                         "removed"
//                     ],
//                     "type": "string"
//                 },
//                 "minimum_version_required": {
//                     "pattern": "^[0-9]+([.][0-9]+)*$",
//                     "type": "string"
//                 },
//                 "override_update_url": {
//                     "type": "boolean"
//                 },
//                 "runtime_allowed_hosts": {
//                     "id": "ListOfUrlPatterns",
//                     "items": {
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "runtime_blocked_hosts": {
//                     "items": {
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "toolbar_pin": {
//                     "enum": [
//                         "force_pinned",
//                         "default_unpinned",
//                         "default_pinned"
//                     ],
//                     "type": "string"
//                 },
//                 "update_url": {
//                     "type": "string"
//                 }
//             },
//             "type": "object"
//         },
//         "^update_url:": {
//             "properties": {
//                 "allowed_permissions": {
//                     "items": {
//                         "pattern": "^[a-z][a-zA-Z0-9._]*$",
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "blocked_permissions": {
//                     "items": {
//                         "pattern": "^[a-z][a-zA-Z0-9._]*$",
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "installation_mode": {
//                     "enum": [
//                         "blocked",
//                         "allowed",
//                         "removed"
//                     ],
//                     "type": "string"
//                 }
//             },
//             "type": "object"
//         }
//     },
//     "properties": {
//         "*": {
//             "properties": {
//                 "allowed_types": {
//                     "items": {
//                         "enum": [
//                             "extension",
//                             "theme",
//                             "user_script",
//                             "hosted_app",
//                             "legacy_packaged_app",
//                             "platform_app"
//                         ],
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "blocked_install_message": {
//                     "type": "string"
//                 },
//                 "blocked_permissions": {
//                     "items": {
//                         "pattern": "^[a-z][a-zA-Z0-9._]*$",
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "install_sources": {
//                     "items": {
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "installation_mode": {
//                     "enum": [
//                         "blocked",
//                         "allowed",
//                         "removed"
//                     ],
//                     "type": "string"
//                 },
//                 "runtime_allowed_hosts": {
//                     "items": {
//                         "type": "string"
//                     },
//                     "type": "array"
//                 },
//                 "runtime_blocked_hosts": {
//                     "items": {
//                         "type": "string"
//                     },
//                     "type": "array"
//                 }
//             },
//             "type": "object"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional string ExtensionSettings = 2;
}

// Control availability of extensions unpublished on the Chrome Web Store.
//
// If this policy is enabled, extensions that are unpublished on the Chrome Web
// Store will be disabled in Google Chrome.
// This policy only applies to extensions that are installed and updated from
// the
// Chrome Web Store.
//
// Off-store extensions such as unpacked extensions installed using developer
// mode and extensions installed using the command-line switch are ignored.
// Force-installed extensions that are self-hosted are ignored. All
// version-pinned extensions are also ignored.
//
// If the policy is set to AllowUnpublished (0) or not set, extensions that are
// unpublished on the Chrome Web Store are allowed.
// If the policy is set to DisableUnpublished (1), extensions that are
// unpublished on the Chrome Web Store are disabled.
//
// Valid values:
//   0: Allow unpublished extensions
//   1: Disable unpublished extensions
//
// Supported on: android, chrome_os, linux, mac, win
message ExtensionUnpublishedAvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ExtensionUnpublishedAvailability = 2;
}

// External print servers
//
// Provides configurations of available print servers.
//
// This policy allows you to provide configuration of external print servers to
// Google ChromeOS devices as JSON file.
//
// The size of the file must not exceed 1MB and must contain an array of records
// (JSON objects). Each record must contain fields "id", "url" and
// "display_name" with strings as values. Values of "id" fields must be unique.
//
// The file is downloaded and cached. The cryptographic hash is used to verify
// the integrity of the download. The file will be re-downloaded whenever the
// URL or the hash changes.
//
// When this policy is set to correct value, devices will try to query specified
// print servers for available printers using IPP protocol.
//
// If this policy is unset or set to incorrect value, none of the provided
// server printers are visible to users.
//
// Currently, the number of print servers is limited to 16. Only the first 16
// print servers from the list will be queried.
//
// Supported on: chrome_os
message ExternalPrintServersProto {
  optional PolicyOptions policy_options = 1;
  optional string ExternalPrintServers = 2;
}

// Enabled external print servers
//
// Specifies the subset of print servers that will be queried for server
// printers.
//
// If this policy is used, only the server printers with ids matching the values
// in this policy are available to the user.
//
// The ids must correspond to the "id" field in the file specified in
// ExternalPrintServers.
//
// If this policy is not set, filtering is omitted and all print servers are
// taken into account.
//
// Supported on: chrome_os
message ExternalPrintServersAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExternalPrintServersAllowlist = 2;
}

// Enabled external print servers
//
// Specifies the subset of print servers that will be queried for server
// printers.
//
// If this policy is used, only the server printers with ids matching the values
// in this policy are available to the user.
//
// The ids must correspond to the "id" field in the file specified in
// ExternalPrintServers.
//
// If this policy is not set, filtering is omitted and all print servers are
// taken into account.
//
// This policy is deprecated, please use ExternalPrintServersAllowlist instead.
//
// Supported on:
message ExternalPrintServersWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ExternalPrintServersWhitelist = 2;
}

// Show an "Always open" checkbox in external protocol dialog.
//
// This policy controls whether or not the "Always open" checkbox is shown on
// external protocol launch confirmation prompts.
//
// If this policy is set to True or not set, when an external protocol
// confirmation is shown, the user can select "Always allow" to skip all future
// confirmation prompts for the protocol on this site.
//
// If this policy is set to False, the "Always allow" checkbox is not displayed
// and the user will be prompted each time an external protocol is invoked.
//
// Valid values:
//   True: Allow users to select "Always allow" when an external protocol dialog
// is shown to skip future confirmation prompts
//   False: Always require users to confrim external protocol prompts
//
// Supported on: fuchsia, linux, mac, win
message ExternalProtocolDialogShowAlwaysOpenCheckboxProto {
  optional PolicyOptions policy_options = 1;
  optional bool ExternalProtocolDialogShowAlwaysOpenCheckbox = 2;
}

// External Storage Allowlist
//
// This policy specifies a list of USB storage devices that are exempt from the
// ExternalStorageDisabled and ExternalStorageReadOnly policies.
//
// Entries are pairs of USB Vendor Identifier and Product Identifier that
// identify the specific USB device model.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "product_id": {
//                 "maximum": 65535,
//                 "minimum": 0,
//                 "type": "integer"
//             },
//             "vendor_id": {
//                 "maximum": 65535,
//                 "minimum": 0,
//                 "type": "integer"
//             }
//         },
//         "required": [
//             "product_id",
//             "vendor_id"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os
message ExternalStorageAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional string ExternalStorageAllowlist = 2;
}

// Disable mounting of external storage
//
// Setting the policy to True makes all types of external storage media (USB
// flash drives, external hard drives, SD and other memory cards, optical
// storage) unavailable in the file browser. Setting the policy to False or
// leaving it unset means users can use external storage on their device.
//
// Note: The policy doesn't affect Google Drive and internal storage. Users can
// still access files saved in the Downloads folder.
//
// Valid values:
//   True: Disallow external storage devices
//   False: Allow external storage devices
//
// Supported on: chrome_os
message ExternalStorageDisabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ExternalStorageDisabled = 2;
}

// Treat external storage devices as read-only
//
// Setting the policy to True prevents users from writing to external storage
// devices.
//
// Unless external storage is blocked, if you set ExternalStorageReadOnly to
// False or leave it unset, users can create and modify files of physically
// writable, external storage devices. (You can block external storage by
// setting ExternalStorageDisable to True.)
//
// Valid values:
//   True: Disallow writing to external storage devices
//   False: Allow writing to external storage devices
//
// Supported on: chrome_os
message ExternalStorageReadOnlyProto {
  optional PolicyOptions policy_options = 1;
  optional bool ExternalStorageReadOnly = 2;
}

// Control the shortcut used to trigger F11
//
// This policy controls the selected shortcut option for remapping events to
// F11 in the remap keys subpage. These settings are only applicable for
// Google ChromeOS keyboards
// and are disabled by default if the policy is unset. If you set this policy,
// users cannot change or override it.
//
// Valid values:
//   0: F11 settings are disabled
//   1: F11 settings use the shortcut that contains the alt modifier
//   2: F11 settings use the shortcut that contains the shift modifier
//   3: F11 settings use the shortcut that contains the modifiers ctrl and shift
//
// Supported on: chrome_os
message F11KeyModifierProto {
  optional PolicyOptions policy_options = 1;
  optional int64 F11KeyModifier = 2;
}

// Control the shortcut used to trigger F12
//
// This policy controls the selected shortcut option for remapping events to
// F12 in the remap keys subpage. These settings are only applicable for
// Google ChromeOS keyboards
// and are disabled by default if the policy is unset. If you set this policy,
// users cannot change or override it.
//
// Valid values:
//   0: F12 settings are disabled
//   1: F12 settings use the shortcut that contains the alt modifier
//   2: F12 settings use the shortcut that contains the shift modifier
//   3: F12 settings use the shortcut that contains the modifiers ctrl and shift
//
// Supported on: chrome_os
message F12KeyModifierProto {
  optional PolicyOptions policy_options = 1;
  optional int64 F12KeyModifier = 2;
}

// Enable the face control accessibility feature
//
// Enable the face control accessibility feature. When face control is active,
// you
// can use your head to control the mouse cursor and use facial gestures to
// perform
// system actions. This allows you to control your device hands-free.
//
// If this policy is set to enabled, face control will always be enabled.
//
// If this policy is set to disabled, face control will always be disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, face control is disabled initially but can be
// enabled by the user anytime.
//
// Valid values:
//   True: Enable face control
//   False: Disable face control
//   None: Allow the user to decide
//
// Supported on: chrome_os
message FaceGazeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FaceGazeEnabled = 2;
}

// Enable Fast Pair (fast Bluetooth pairing)
//
// Setting this policy will force Fast Pair to be enabled or disabled.
// Fast Pair is a new Bluetooth pairing flow that links paired peripherals with
// a GAIA account.
// This allows other ChromeOS (and Android) devices signed in with the same GAIA
// account to pair automatically.
// If unset, the default value is disabled for enterprise users and enabled for
// non
// managed accounts.
//
// Valid values:
//   True: Force Fast Pair (fast Bluetooth pairing) to be enabled.
//   False: Force Fast Pair (fast Bluetooth pairing) to be disabled.
//
// Supported on: chrome_os
message FastPairEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FastPairEnabled = 2;
}

// Specifies whether in-product Google Chrome surveys are shown to users.
//
// Google Chrome in-product surveys collect user feedback for the browser.
// Survey responses are not associated with user accounts.
// When this policy is Enabled or not set, in-product surveys may be shown to
// users.
// When this policy is Disabled, in-product surveys are not shown to users.
//
// This policy has no effect if MetricsReportingEnabled is set to Disabled,
// which disables in-product surveys as well.
//
// Valid values:
//   True: Enable in-product surveys
//   False: Disable in-product surveys
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message FeedbackSurveysEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FeedbackSurveysEnabled = 2;
}

// Fetch keepalive duration on Shutdown
//
// Controls the duration (in seconds) allowed for keepalive requests on browser
// shutdown.
//
// When specified, browser shutdown can be blocked up to the specified seconds,
// to process keepalive (https://fetch.spec.whatwg.org/#request-keepalive-flag)
// requests.
//
// The default value (0) means this feature is disabled.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message FetchKeepaliveDurationSecondsOnShutdownProto {
  optional PolicyOptions policy_options = 1;
  optional int64 FetchKeepaliveDurationSecondsOnShutdown = 2;
}

// Allow the File Handling API on these web apps
//
// Setting the policy lets you list the URL patterns that specify which web apps
// are granted access to file types.
//
// Leaving the policy unset means DefaultFileHandlingGuardSetting applies for
// all web apps, if it's set. If not, users' personal settings apply.
//
// For URL patterns which match neither FileHandlingAllowedForUrls nor
// FileHandlingBlockedForUrls, DefaultFileHandlingGuardSetting, or the users'
// personal settings, will be used, in that order.
//
// URL patterns must not conflict with FileHandlingBlockedForUrls. Neither
// policy takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on:
message FileHandlingAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList FileHandlingAllowedForUrls = 2;
}

// Block the File Handling API on these web apps
//
// Setting the policy lets you list the URL patterns that specify which web apps
// can't ask users to grant them access to file types.
//
// Leaving the policy unset means DefaultFileHandlingGuardSetting applies for
// all web apps, if it's set. If not, the user's personal setting applies.
//
// For URL patterns which match neither FileHandlingAllowedForUrls nor
// FileHandlingBlockedForUrls, DefaultFileHandlingGuardSetting, or the users'
// personal settings, will be used, in that order.
//
// URL patterns must not conflict with FileHandlingAllowedForUrls. Neither
// policy takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on:
message FileHandlingBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList FileHandlingBlockedForUrls = 2;
}

// Allow file or directory picker APIs to be called without prior user gesture
//
// For security reasons, the
// showOpenFilePicker(),
// showSaveFilePicker() and
// showDirectoryPicker() web APIs
// require a prior user gesture ("transient activation") to be called or will
// otherwise fail.
//
// With this policy set, admins can specify origins on which these APIs can be
// called without prior user gesture.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/. * is
// not an accepted value for this policy.
//
// If this policy is unset, all origins will require a prior user gesture to
// call
// these APIs.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message FileOrDirectoryPickerWithoutGestureAllowedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList FileOrDirectoryPickerWithoutGestureAllowedForOrigins = 2;
}

// Allow choosing files directly from Google Drive
//
// This policy controls whether the user is allowed to choose files from Google
// Drive directly when a website contains a form where files can be submitted.
// Setting the policy to "Show Google Drive option." (0) or not setting the
// policy allows the user to choose files from Google Drive in the file
// selection menu.
// Setting the policy to "Hide Google Drive option." (1) hides the Google Drive
// option in the file selection menu.
// This policy does not prevent users from choosing files from Google Drive
// using other ways beside the 'Google Drive' action in the file selection menu.
//
// Valid values:
//   0: Show Google Drive option.
//   1: Hide Google Drive option.
//
// Supported on: ios
message FilePickerChooseFromDriveSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 FilePickerChooseFromDriveSettings = 2;
}

// Allow read access via the File System API on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can ask users to grant them read access to files or directories in the host
// operating system's file system via the File System API.
//
// Leaving the policy unset means DefaultFileSystemReadGuardSetting applies for
// all sites, if it's set. If not, users' personal settings apply.
//
// URL patterns must not conflict with FileSystemReadBlockedForUrls. Neither
// policy takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message FileSystemReadAskForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList FileSystemReadAskForUrls = 2;
}

// Block read access via the File System API on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can't ask users to grant them read access to files or directories in the host
// operating system's file system via the File System API.
//
// Leaving the policy unset means DefaultFileSystemReadGuardSetting applies for
// all sites, if it's set. If not, users' personal settings apply.
//
// URL patterns can't conflict with FileSystemReadAskForUrls. Neither policy
// takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message FileSystemReadBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList FileSystemReadBlockedForUrls = 2;
}

// Re-enable the deprecated async interface for FileSystemSyncAccessHandle in
// File System Access API
//
// Starting in M108, all of FileSystemSyncAccessHandle methods will be invoked
// synchronously.
// Until M110, this policy re-enables asynchronous invocation of
// FileSystemSyncAccessHandle methods.
// If this policy is set to Enabled, FileSystemSyncAccessHandle methods are
// invoked asynchronously.
// If this policy is set to Disabled or not set, all of
// FileSystemSyncAccessHandle methods are invoked synchronously.
//
// Valid values:
//   True: Enables FileSystemSyncAccessHandle methods to be invoked
// asynchronously
//   False: Disables any asynchronous methods of FileSystemSyncAccessHandle.
//
// Supported on:
message FileSystemSyncAccessHandleAsyncInterfaceEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FileSystemSyncAccessHandleAsyncInterfaceEnabled = 2;
}

// Allow write access to files and directories on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can ask users to grant them write access to files or directories in the host
// operating system's file system.
//
// Leaving the policy unset means DefaultFileSystemWriteGuardSetting applies for
// all sites, if it's set. If not, users' personal settings apply.
//
// URL patterns must not conflict with FileSystemWriteBlockedForUrls. Neither
// policy takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message FileSystemWriteAskForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList FileSystemWriteAskForUrls = 2;
}

// Block write access to files and directories on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can't ask users to grant them write access to files or directories in the
// host operating system's file system.
//
// Leaving the policy unset means DefaultFileSystemWriteGuardSetting applies for
// all sites, if it's set. If not, users' personal settings apply.
//
// URL patterns can't conflict with FileSystemWriteAskForUrls. Neither policy
// takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message FileSystemWriteBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList FileSystemWriteBlockedForUrls = 2;
}

// Settings for Find and Fill with Gemini
//
// Controls whether users can use the "Find and Fill with Gemini" feature in
// Google Chrome.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. 0 is the
// default value, except when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// This policy has no effect when the Gemini app is disabled. For example, the
// Gemini app can be disabled by GeminiSettings policy.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Find and Fill with Gemini and improve AI models.
//   1: Allow Find and Fill with Gemini without improving AI models.
//   2: Do not allow Find and Fill with Gemini.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message FindAndFillWithGeminiSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 FindAndFillWithGeminiSettings = 2;
}

// Settings for Chrome Finds
//
// Chrome Finds is an AI-based feature that helps users search for and
// understand content on the current web page.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Chrome Finds and improve AI models.
//   1: Allow Chrome Finds without improving AI models.
//   2: Do not allow Chrome Finds.
//
// Supported on: android
message FindsSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 FindsSettings = 2;
}

// Enable First-Party Sets.
//
// This policy is provided as a way to opt-out of the First-Party Sets feature
// (which was later renamed Related Website Sets feature).
//
// When this policy is unset or set to Enabled, the First-Party Sets feature is
// enabled.
//
// When this policy is set to Disabled, the First-Party Sets feature is
// disabled.
//
// It controls whether Chrome supports First-Party Sets related integrations.
//
// This is the equivalent of the RelatedWebsiteSetsEnabled policy.
// Either policy may be used with the same effect on the browser's behavior.
// Both these policies are deprecated following Related Website Sets feature
// deprecation in Google Chrome version 144.
//
// Valid values:
//   True: Enable First-Party Sets for all affected users
//   False: Disable First-Party Sets for all affected users
//
// Supported on:
message FirstPartySetsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FirstPartySetsEnabled = 2;
}

// Override First-Party Sets.
//
// This policy provides a way to override the list of sets the browser uses for
// First-Party Sets features (which was later renamed Related Website Sets
// feature).
//
// Each set in the browser's list of First-Party Sets must meet the requirements
// of a First-Party Set.
// A First-Party Set must contain a primary site and one or more member sites.
// A set can also contain a list of service sites that it owns, as well as a map
// from a site to all of its ccTLD variants.
// See https://github.com/WICG/first-party-sets for more information on how
// First-Party Sets are used by Google Chrome.
//
// All sites in a First-Party Set must be a registrable domain served over
// HTTPS. Each site in a First-Party Set must also be unique,
// meaning a site cannot be listed more than once in a First-Party Set.
//
// When this policy is given an empty dictionary, the browser uses the public
// list of First-Party Sets.
//
// For all sites in a First-Party Set from the replacements list, if a site is
// also present
// on a First-Party Set in the browser's list, then that site will be removed
// from the browser's First-Party Set.
// After this, the policy's First-Party Set will be added to the browser's list
// of First-Party Sets.
//
// For all sites in a First-Party Set from the additions list, if a site is also
// present
// on a First-Party Set in the browser's list, then the browser's First-Party
// Set will be updated so that the
// new First-Party Set can be added to the browser's list. After the browser's
// list has been updated,
// the policy's First-Party Set will be added to the browser's list of First-
// Party Sets.
//
// The browser's list of First-Party Sets requires that for all sites in its
// list, no site is in
// more than one set. This is also required for both the replacements list
// and the additions list. Similarly, a site cannot be in both the
// replacements list and the additions list.
//
// Wildcards (*) are not supported as a policy value, nor within any First-Party
// Set in these lists.
//
// All sets provided by the policy must be valid First-Party Sets, if they
// aren't then an
// appropriate error will be outputted.
//
// This is the equivalent of the RelatedWebsiteSetsOverrides policy.
// Either policy may be used with the same effect on the browser's behavior.
// Both these policies are deprecated following Related Website Sets feature
// deprecation in Google Chrome version 144.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Value schema:
// {
//     "properties": {
//         "additions": {
//             "items": {
//                 "properties": {
//                     "associatedSites": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "ccTLDs": {
//                         "additionalProperties": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "type": "object"
//                     },
//                     "primary": {
//                         "type": "string"
//                     },
//                     "serviceSites": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "required": [
//                     "primary",
//                     "associatedSites"
//                 ],
//                 "type": "object"
//             },
//             "type": "array"
//         },
//         "replacements": {
//             "items": {
//                 "properties": {
//                     "associatedSites": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "ccTLDs": {
//                         "additionalProperties": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "type": "object"
//                     },
//                     "primary": {
//                         "type": "string"
//                     },
//                     "serviceSites": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "required": [
//                     "primary",
//                     "associatedSites"
//                 ],
//                 "type": "object"
//             },
//             "type": "array"
//         }
//     },
//     "type": "object"
// }
//
// Supported on:
message FirstPartySetsOverridesProto {
  optional PolicyOptions policy_options = 1;
  optional string FirstPartySetsOverrides = 2;
}

// Enables the floating accessibility menu
//
// In kiosk mode, controls whether the floating accessibility menu is being
// shown.
//
// If this policy is set to enabled, the floating accessibility menu will be
// always shown.
//
// If this policy is set to disabled or left unset, the floating accessibility
// menu will never be shown.
//
// Valid values:
//   True: Show the floating accessibility menu in kiosk mode
//   False: Do not show the floating accessibility menu in kiosk mode
//
// Supported on: chrome_os
message FloatingAccessibilityMenuEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FloatingAccessibilityMenuEnabled = 2;
}

// Floating SSO Service blocked domain list
//
// Configures a list of blocked cookie domains that will not be moved when a
// user switches between Google ChromeOS devices, when the Floating SSO Service
// is enabled.
//
// If a cookie is set for a domain which matches one of the provided filters,
// the cookie is excluded from the move. Cookie domains are matched according to
// "host" field rules outlined in
// https://support.google.com/chrome/a?p=url_blocklist_filter_format, all other
// fields are ignored. Wildcards, *, are allowed.
//
// The FloatingSsoDomainBlocklistExceptions policy takes precedence.
//
// Supported on: chrome_os
message FloatingSsoDomainBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList FloatingSsoDomainBlocklist = 2;
}

// Floating SSO Service domain blocklist exception list
//
// Configures the list of blocklist excepted cookie domains to be moved when a
// user switches between Google ChromeOS devices, when the Floating SSO Service
// is enabled.
//
// If a cookie is set for a domain which matches one of the provided filters,
// the cookie is included into the move. Cookie domains are matched according to
// "host" field rules outlined in
// https://support.google.com/chrome/a?p=url_blocklist_filter_format, all other
// fields are ignored. Wildcards, *, are allowed.
//
// Leaving the policy empty allows no exceptions to FloatingSsoDomainBlocklist.
// To only allow a limited number of domains to be moved, block all domains by
// setting the FloatingSsoDomainBlocklist policy to *, and configure the
// blocklist exceptions here.
//
// Supported on: chrome_os
message FloatingSsoDomainBlocklistExceptionsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList FloatingSsoDomainBlocklistExceptions = 2;
}

// Enable Floating SSO Service
//
// When a user switches between Google ChromeOS devices, the Floating SSO
// Service will restore the user's web service authentication state from the
// previous device onto the new device. This is achieved by moving user's
// cookies across devices.
//
// Setting the policy to Enabled will restore the user's web service
// authentication state from the user's last used Google ChromeOS device
// automatically upon login.
// Setting the policy to Disabled or leaving it unset will not restore the
// user's web service authentication state upon login on a different device.
//
// The web service domains blocked from being restored can be configured using
// the FloatingSsoDomainBlocklist policy, while exceptions to that policy can be
// configured using the FloatingSsoDomainBlocklistExceptions policy.
// If both of these policies are unset, all web service authentications, except
// Google authentications, will be moved.
//
// Valid values:
//   True: Enable Floating SSO and move the user's web service authentications
// to new device
//   False: Disable Floating SSO and do not move the user's web service
// authentications to new device
//
// Supported on: chrome_os
message FloatingSsoEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FloatingSsoEnabled = 2;
}

// Include session cookies in Floating SSO functionality
//
// By default, Floating SSO moves only persistent cookies between devices. This
// policy controls whether session cookies should also be included. It takes
// effect only when FloatingSsoEnabled policy is Enabled.
//
// When this policy is Enabled, Floating SSO will synchronize both session and
// persistent cookies.
// When this policy is Disabled or not set, Floating SSO will only synchronize
// persistent cookies.
//
// Valid values:
//   True: Include session cookies in Floating SSO functionality
//   False: Don't sync session cookies with Floating SSO
//
// Supported on: chrome_os
message FloatingSsoSessionCookiesIncludedProto {
  optional PolicyOptions policy_options = 1;
  optional bool FloatingSsoSessionCookiesIncluded = 2;
}

// Enable Floating Workspace Service
//
// When a user switches between Google ChromeOS devices, Floating Workspace
// Service will launch browser and app windows from the previous device onto the
// new device.
// Setting the policy to Enabled will launch browser and app windows from
// current user's last used Google ChromeOS device automatically upon login.
// Setting the policy to Disabled or leaving it unset will let full restore
// settings determine what to be launched upon login.
//
// Valid values:
//   True: Enable Floating Workspace Service and launch remote desk upon login
//   False: Disable Floating Workspace Service and do not launch remote desk
// upon login
//
// Supported on: chrome_os
message FloatingWorkspaceEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FloatingWorkspaceEnabled = 2;
}

// Enable Floating Workspace Service
//
// When a user switches between Google ChromeOS devices, Floating Workspace
// Service will launch browser and app windows from the previous device onto the
// new device.
// Setting the policy to Enabled will launch browser and app windows from
// current user's last used Google ChromeOS device automatically upon login.
// Setting the policy to Disabled or leaving it unset will let full restore
// settings determine what to be launched upon login.
//
// Valid values:
//   True: Enable Floating Workspace V2 Service and launch remote desk upon
// login
//   False: Disable Floating Workspace V2 Service and do not launch remote desk
// upon login
//
// Supported on: chrome_os
message FloatingWorkspaceV2EnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FloatingWorkspaceV2Enabled = 2;
}

// Enable Sounds in Focus Mode for ChromeOS
//
// Focus Mode is a feature that controls Do Not Disturb on a timer and is
// intended to reduce user distraction. A feature of Focus Mode allows users to
// listen to a limited set of music to help them focus. This policy controls
// access to this feature.
//
// If the policy is unset, all sounds are disabled for managed users.
//
// Setting the policy to Enabled will allow access to all sounds in Focus Mode.
//
// Setting the policy to EnabledFocusSoundsOnly will enable the sound feature
// with just Focus Sounds.
//
// Setting the policy to Disabled will disable sounds in Focus Mode.
//
// Valid values:
//   enabled: Enable all sounds in Focus Mode.
//   focus-sounds: Enable Focus Mode with only Focus Sounds.
//   disabled: Disable sounds in Focus Mode.
//
// Supported on: chrome_os
message FocusModeSoundsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional string FocusModeSoundsEnabled = 2;
}

// Enable force sign in for Google Chrome
//
// This policy is deprecated, consider using BrowserSignin instead.
//
// If this policy is set to true, user has to sign in to Google Chrome with
// their profile before using the browser. And the default value of
// BrowserGuestModeEnabled will be set to false. Note that existing unsigned
// profiles will be locked and inaccessible after enabling this policy. For more
// information, see help center article.
//
// If this policy is set to false or not configured, user can use the browser
// without sign in to Google Chrome.
//
// Valid values:
//   True: Force the user to sign in before using the browser
//   False: Allow the user to use the browser without signing in
//
// Supported on: android, linux, mac, win
message ForceBrowserSigninProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceBrowserSignin = 2;
}

// Enable support for the PPB_VideoDecoder(Dev) API.
//
// This policy can be temporarily used to force-enable support for the
// PPB_VideoDecoder(Dev) API.
//
// When the policy is left unset or set to Disabled, the browser will decide
// whether
// the API is supported.
// When the policy is set to Enabled, the API will be supported.
//
// This policy can be used in case our ongoing elimination of support for this
// API
// exposes problems. If you must use the policy, please file a bug on crbug.com
// explaining your use case and CC {blundell, vasilyt}@chromium.org. The policy
// is
// available through Google Chrome
// version 114, after which support for this API was eliminated unconditionally.
//
// NOTE: Only newly-started renderer processes will reflect changes to this
// policy while the browser is running.
//
// Valid values:
//   True: Enable support
//   False: Let browser decide support
//
// Supported on:
message ForceEnablePepperVideoDecoderDevAPIProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceEnablePepperVideoDecoderDevAPI = 2;
}

// Ephemeral profile
//
// If set to enabled this policy forces the profile to be switched to ephemeral
// mode. If this policy is specified as an OS policy (e.g. GPO on Windows) it
// will apply to every profile on the system; if the policy is set as a Cloud
// policy it will apply only to a profile signed in with a managed account.
//
// In this mode the profile data is persisted on disk only for the length of the
// user session. Features like browser history, extensions and their data, web
// data like cookies and web databases are not preserved after the browser is
// closed. However this does not prevent the user from downloading any data to
// disk manually, save pages or print them.
//
// If the user has enabled sync all this data is preserved in their sync profile
// just like with regular profiles. Incognito mode is also available if not
// explicitly disabled by policy.
//
// If the policy is set to disabled or left not set signing in leads to regular
// profiles.
//
// Valid values:
//   True: Clear profile data on disk when user session ends
//   False: Persist profile data on disk when user session ends
//
// Supported on: fuchsia, linux, mac, win
message ForceEphemeralProfilesProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceEphemeralProfiles = 2;
}

// Force foreground priority for all tabs
//
// This policy controls whether background web content is forced to run at
// foreground priority.
//
// By default, the browser optimizes resources by deprioritizing content in
// background tabs. Enabling this policy overrides that behavior, causing
// background tabs to be scheduled the same way as the active tab.
//
// Note that forcing background content to run at foreground priority may
// slightly impact the responsiveness of the active tab.
//
// If this policy is set to Enabled, all web content runs at foreground priority
// regardless of its visibility state.
//
// If this policy is set to Disabled or not set, the browser determines priority
// based on standard heuristics (e.g., deprioritizing content that is not
// visible, not playing audio, not participating in video calls...).
//
// Valid values:
//   True: Force foreground priority for all tabs
//   False: Use standard tab prioritization
//
// Supported on: chrome_os, linux, mac, win
message ForceForegroundPriorityForAllTabsProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceForegroundPriorityForAllTabs = 2;
}

// Force foreground priority for specific URLs
//
// This policy allows you to specify a list of URL patterns. Background web
// content matching these patterns will be forced to run at foreground priority.
//
// If the ForceForegroundPriorityForAllTabs policy is enabled, this list is
// ignored as all tabs will be forced to foreground priority.
//
// If ForceForegroundPriorityForAllTabs is disabled or unset, only content
// matching the patterns in this list will be forced.
//
// For detailed information on valid URL patterns, please see
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// If this list is empty or not set, no background content is forced to
// foreground priority.
//
// Supported on: chrome_os, linux, mac, win
message ForceForegroundPriorityForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ForceForegroundPriorityForUrls = 2;
}

// Force Google SafeSearch
//
// Setting the policy to Enabled means SafeSearch in Google Search is always
// active, and users can't change this setting.
//
// Setting the policy to Disabled or leaving it unset means SafeSearch in Google
// Search is not enforced.
//
// Valid values:
//   True: Force the use of SafeSearch in Google Search
//   False: Do not enforce the use of SafeSearch in Google Search
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ForceGoogleSafeSearchProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceGoogleSafeSearch = 2;
}

// Use a default referrer policy of no-referrer-when-downgrade.
//
// This enterprise policy is for short-term adaptation and will be removed in
// Google Chrome version 88.
//
// Chrome's default referrer policy is being strengthened from its current value
// of no-referrer-when-downgrade to the more secure strict-origin-when-cross-
// origin through a gradual rollout targeting Chrome 85 stable.
//
// Before the rollout, this enterprise policy will have no effect. After the
// rollout, when this enterprise policy is enabled, Chrome's default referrer
// policy will be set to its previous value of no-referrer-when-downgrade.
//
// This enterprise policy is disabled by default.
//
// Valid values:
//   True: Use a default referrer policy of no-referrer-when-downgrade
//   False: Do not use a default referrer policy of no-referrer-when-downgrade
//
// Supported on:
message ForceLegacyDefaultReferrerPolicyProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceLegacyDefaultReferrerPolicy = 2;
}

// Force logout the user when their account becomes unauthenticated
//
// Force logout the user when their primary account's authentication token
// becomes invalid.
// This policy can protect the user from access to restricted content on Google
// web properties.
// If this policy is set to True, the user will be logged out as soon as their
// authentication token becomes invalid and attempts to restore this token fail.
// If this policy is set to False or unset, the user can continue working in an
// unauthenticated state.
//
// Valid values:
//   True: Log the user out as soon as their account becomes unauthenticated
//   False: Allow the user to remain logged in after their account becomes
// unauthenticated
//
// Supported on:
message ForceLogoutUnauthenticatedUserEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceLogoutUnauthenticatedUserEnabled = 2;
}

// Freeze User-Agent string major version at 99
//
// This policy controls whether the User-Agent string major
// version should be frozen at 99.
//
// The User-Agent request header lets websites identify the application,
// operating system, vendor, and/or version of the requesting user agent.
// Some websites make assumptions about how this header is formatted and may
// encounter issues with version strings that include three digits in the
// major position (e.g. 100.0.0.0).
//
// Setting the policy to 'Default' or leaving it unset will default to
// browser settings for the User-Agent string major version.
// If set to 'ForceDisabled', the User-Agent string will not freeze the
// major version.
// If set to 'ForceEnabled', the User-Agent string will always report the
// major version as 99 and include the browser's major version in the minor
// position. For example, browser version 101.0.0.0 would send a User-Agent
// request header that reports version 99.101.0.0.
//
// This policy is temporary and will be deprecated in the future. Note that
// if this policy and
// User-Agent Reduction are
// both enabled, the User-Agent version string will always be 99.0.0.0.
//
// Valid values:
//   0: Default to browser settings for User-Agent string version.
//   1: The User-Agent string will not freeze the major version.
//   2: The User-Agent string will freeze the major version as 99 and include
// the browser's major version in the minor position.
//
// Supported on:
message ForceMajorVersionToMinorPositionInUserAgentProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ForceMajorVersionToMinorPositionInUserAgent = 2;
}

// Maximize the first browser window on first run
//
// Setting the policy to True means Chrome maximizes the first window shown on
// first run.
//
// Setting the policy to False or leaving it unset means that Chrome might
// maximize the first window, depending on the screen size.
//
// Valid values:
//   True: Maximize the first browser window on first run
//   False: Default system behavior (depends on screen size)
//
// Supported on: chrome_os
message ForceMaximizeOnFirstRunProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceMaximizeOnFirstRun = 2;
}

// Force networking code to run in the browser process
//
// This policy is deprecated.
//
// Supported on:
message ForceNetworkInProcessProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceNetworkInProcess = 2;
}

// Controls whether unload event handlers can be disabled.
//
// unload event handlers are being deprecated. Whether they fire depends on the
// unload Permissions-Policy. Currently, they are allowed by policy by default.
// In the future they will gradually move to being disallowed by default and
// sites must explicitly enable them using Permissions-Policy headers. This
// enterprise policy can be used to opt out of this gradual deprecation by
// forcing the default to remain as enabled.
//
// Pages may depend on unload event handlers to save data or signal the end of a
// user session to the server. This is not recommended as it is unreliable and
// impacts performance by blocking use of BackForwardCache. Recommended
// alternatives exist, however the unload event has been used for a long time.
// Some applications may still rely on them.
//
// If this policy is set to false or not set, then unload events handlers will
// be gradually deprecated in-line with the deprecation rollout and sites which
// do not set Permissions-Policy header will stop firing `unload` events.
//
// If this policy is set to true then unload event handlers will continue to
// work by default.
//
// NOTE: This policy had an incorrectly documented default of `true` in M117.
// The unload event did and will not change in M117, so this policy has no
// effect in that version.
//
// Valid values:
//   True: Force unload event handlers to remain enabled by default during
// deprecation
//   False: Allow unload event handlers to be disabled by default during
// deprecation
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ForcePermissionPolicyUnloadDefaultEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForcePermissionPolicyUnloadDefaultEnabled = 2;
}

// Force SafeSearch
//
// This policy is deprecated, please use ForceGoogleSafeSearch and
// ForceYouTubeRestrict instead. This policy is ignored if either the
// ForceGoogleSafeSearch, the ForceYouTubeRestrict or the (deprecated)
// ForceYouTubeSafetyMode policies are set.
//
// Forces queries in Google Web Search to be done with SafeSearch set to active
// and prevents users from changing this setting. This setting also forces
// Moderate Restricted Mode on YouTube.
//
// If you enable this setting, SafeSearch in Google Search and Moderate
// Restricted Mode YouTube is always active.
//
// If you disable this setting or do not set a value, SafeSearch in Google
// Search and Restricted Mode in YouTube is not enforced.
//
// Valid values:
//   True: Force the use of SafeSearch in Google Search and YouTube Restricted
// Mode to be at least Moderate
//   False: Do not enforce the use of SafeSearch in Google Search or YouTube
// Restricted Mode
//
// Supported on: android, chrome_os, linux, mac, win
message ForceSafeSearchProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceSafeSearch = 2;
}

// Force minimum YouTube Restricted Mode
//
// Setting the policy enforces a minimum Restricted mode on YouTube and prevents
// users from picking a less restricted mode. If you set it to:
//
// * Strict, Strict Restricted mode on YouTube is always active.
//
// * Moderate, the user may only pick Moderate Restricted mode and Strict
// Restricted mode on YouTube, but can't turn off Restricted mode.
//
// * Off or if no value is set, Restricted mode on YouTube isn't enforced by
// Chrome. External policies such as YouTube policies might still enforce
// Restricted mode.
//
// Valid values:
//   0: Do not enforce Restricted Mode on YouTube
//   1: Enforce at least Moderate Restricted Mode on YouTube
//   2: Enforce Strict Restricted Mode for YouTube
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ForceYouTubeRestrictProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ForceYouTubeRestrict = 2;
}

// Force YouTube Safety Mode
//
// This policy is deprecated. Consider using ForceYouTubeRestrict, which
// overrides this policy and allows more fine-grained tuning.
//
// Forces YouTube Moderate Restricted Mode and prevents users from changing this
// setting.
//
// If this setting is enabled, Restricted Mode on YouTube is always enforced to
// be at least Moderate.
//
// If this setting is disabled or no value is set, Restricted Mode on YouTube is
// not enforced by Google Chrome. External policies such as YouTube policies
// might still enforce Restricted Mode, though.
//
// Valid values:
//   True: Force YouTube Restricted Mode to be at least Moderate
//   False: Do not enforce YouTube Restricted Mode
//
// Supported on: android, chrome_os, linux, mac, win
message ForceYouTubeSafetyModeProto {
  optional PolicyOptions policy_options = 1;
  optional bool ForceYouTubeSafetyMode = 2;
}

// Configure the content and order of preferred languages
//
// This policy allows admins to configure the order of the preferred languages
// in Google Chrome's settings.
//
// The order of the list will appear in the same order under the "Order
// languages based on your preference" section in chrome://settings/languages.
// Users won't be able to remove or reorder languages set by the policy, but
// will be able to add languages underneath those set by the policy. Users will
// also have full control over the browser's UI language and translation/spell
// check settings, unless enforced by other policies.
//
// Leaving the policy unset lets users manipulate the entire list of preferred
// languages.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message ForcedLanguagesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ForcedLanguages = 2;
}

// Enable the full restore feature
//
// Setting the policy to enable the full restore feature.
// If this policy is true, apps and app windows will be restored or not restored
// after a crash or reboot based on the restore app setting.
// If this policy is false, only browser windows are automatcially launched.
//
// Valid values:
//   True: Enable the full restore feature.
//   False: Disable the full restore feature.
//
// Supported on: chrome_os
message FullRestoreEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FullRestoreEnabled = 2;
}

// Configure app restore on login
//
// Controls whether and how Google ChromeOS restores the last session on login.
// This policy has an effect only if the FullRestoreEnabled policy is set to
// true.
//
// Valid values:
//   1: Always restore the last session.
//   2: Ask the user on login whether to restore the last session.
//   3: Do not restore the last session.
//
// Supported on: chrome_os
message FullRestoreModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 FullRestoreMode = 2;
}

// Enable fullscreen alert
//
// Specifies whether the fullscreen alert should be shown when the device
// returns from sleep or dark screen.
//
// When the policy is unset or set to True, an alert will be shown to remind the
// users to exit fullscreen before entering password. When the policy is set to
// False, no alert would be shown.
//
// Valid values:
//   True: Enable fullscreen alert
//   False: Disable show fullscreen alert
//   None: Enable fullscreen alert
//
// Supported on: chrome_os
message FullscreenAlertEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool FullscreenAlertEnabled = 2;
}

// Allow fullscreen mode
//
// Setting the policy to True or leaving it unset means that, with appropriate
// permissions, users, apps, and extensions can enter Fullscreen mode (in which
// only web content appears).
//
// Setting the policy to False means users, apps, and extensions can't enter
// Fullscreen mode.
//
// Valid values:
//   True: Allow fullscreen mode
//   False: Do not allow fullscreen mode
//
// Supported on: chrome_os, fuchsia, linux, win
message FullscreenAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool FullscreenAllowed = 2;
}

// GSSAPI library name
//
// Setting the policy specifies which GSSAPI library to use for HTTP
// authentication. Set the policy to either a library name or a full path.
//
// Leaving the policy unset means Google Chrome uses a default library name.
//
// Supported on: linux
message GSSAPILibraryNameProto {
  optional PolicyOptions policy_options = 1;
  optional string GSSAPILibraryName = 2;
}

// Limit the time for which a user authenticated via GAIA without SAML can log
// in offline at the lock screen
//
// While logging in through the lock screen, Google ChromeOS can authenticate
// against a server (online) or using a cached password (offline).
//
// When this policy is set to -2, it will match the value of the login screen
// offline signin time limit which comes from GaiaOfflineSigninTimeLimitDays.
//
// When the policy is unset, or set to a value of -1, it will not enforce online
// authentication on the lock screen and will allow the user to use offline
// authentication unless a different reason than this policy enforces an online
// authentication.
//
// If the policy is set to a value of 0, online authentication will always be
// required.
//
// When this policy is set to any other value, it specifies the number of days
// since the last online authentication after which the user must use online
// authentication again in the next login through the lock screen.
//
// This policy affects users who authenticated using GAIA without SAML.
//
// The policy value should be specified in days.
//
// Supported on: chrome_os
message GaiaLockScreenOfflineSigninTimeLimitDaysProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GaiaLockScreenOfflineSigninTimeLimitDays = 2;
}

// Limit the time for which a user authenticated via GAIA without SAML can log
// in offline
//
// During login, Google ChromeOS can authenticate against a server (online) or
// using a cached password (offline).
//
// When this policy is set to a value of -1, this policy will not enforce online
// authentication and will allow the user to use offline authentication until a
// different reason than this policy enforces an online login. If the policy is
// set to a value of 0, online login will always be required. When this policy
// is set to any other value, it specifies the length of time since the last
// online authentication after which the user must use online authentication
// again in the next sign-in.
//
// Leaving this policy not set will make Google ChromeOS use offline login.
//
// This policy affects only users who authenticated using GAIA without SAML.
//
// The policy value should be specified in days.
//
// Supported on: chrome_os
message GaiaOfflineSigninTimeLimitDaysProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GaiaOfflineSigninTimeLimitDays = 2;
}

// Allow Gemini app integrations to directly act on specified sites
//
// Allows to set a list of URL patterns that specify on which sites Gemini app
// integrations can directly act on web pages.
//
// URLs matching neither the allowlist or the blocklist use
// GeminiActOnWebSettings.
//
// URLs matching both the allowlist and the blocklist are allowed.
//
// For detailed information on valid url patterns, please see
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// Supported on: android, chrome_os, linux, mac, win
message GeminiActOnWebAllowedForURLsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList GeminiActOnWebAllowedForURLs = 2;
}

// Block Gemini app integrations to directly act on specified sites
//
// Allows to set a list of URL patterns that specify on which sites Gemini app
// integrations cannot directly act on web pages.
//
// URLs matching neither the allowlist or the blocklist use
// GeminiActOnWebSettings.
//
// URLs matching both the allowlist and the blocklist are allowed.
//
// For detailed information on valid url patterns, please see
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// Supported on: android, chrome_os, linux, mac, win
message GeminiActOnWebBlockedForURLsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList GeminiActOnWebBlockedForURLs = 2;
}

// Allows Gemini app integrations to directly act on web pages
//
// Controls if the Gemini app is allowed to take action on the web pages on
// behalf of the user.
//
// 0/unset  = Gemini app is allowed to take action on the web pages.
//
// 1 = Gemini app is not allowed to take action on the web pages.
//
// This policy has no effect when the Gemini app is disabled. For example, the
// Gemini app can be disabled by GeminiSettings policy.
//
// For more information on Gemini in Chrome, please see
// https://support.google.com/chrome/a/answer/16291696.
//
// Gemini's actuation is not available in all countries or all languages.
// Setting this policy does not guarantee the feature will be enabled; it
// remains subject to availability. For more info on the roll-out, check the
// Enterprise Release Notes:
// https://support.google.com/chrome/a/answer/7679408?hl=en
//
// Valid values:
//   0: Allow the Gemini app to take action on the web pages.
//   1: Disallow the Gemini app to take action on the web pages.
//
// Supported on: android, chrome_os, linux, mac, win
message GeminiActOnWebSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GeminiActOnWebSettings = 2;
}

// Settings for Gemini in Chrome File Uploads
//
// This setting controls whether file uploads are allowed within Gemini in
// Chrome (see https://support.google.com/chrome/a/answer/16291696).
//
// 0/unset = File uploads to Gemini in Chrome will be allowed for users.
//
// 1 = File uploads to Gemini in Chrome will not be allowed for users.
//
// Valid values:
//   0: Allow file uploads to Gemini in Chrome.
//   1: Do not allow file uploads to Gemini in Chrome.
//
// Supported on: chrome_os, linux, mac, win
message GeminiChromeFileUploadSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GeminiChromeFileUploadSettings = 2;
}

// Configure Gemini Enterprise settings (BETA)
//
// Configures the connection settings for Gemini Enterprise to improve responses
// for Gemini in Chrome features.
//
// If this policy is set, Gemini Enterprise can be used to enhance Gemini in
// Chrome responses for users signed in with a managed account that is
// associated with the specified project and app ID. Gemini Enterprise will not
// be available for profiles signed in with personal accounts.
//
// If policy is unset, Gemini Enterprise will not be used to enhance Gemini in
// Chrome responses.
//
// Note that this policy does not control the general Gemini integration, which
// can be controlled by the GeminiSettings policy.
//
// All settings of this policy must match the configuration of Gemini Enterprise
// project in Google Cloud Console. Any mismatch will cause unexpected behavior
// while using Gemini Enterprise.
//
// Value schema:
// {
//     "properties": {
//         "app_id": {
//             "description": "The unique identifier of the <ph
// name=\"GEMINI_ENTERPRISE_PRODUCT_NAME\">Gemini Enterprise</ph> engine. The
// format must be 1-63 characters matching the pattern [a-z0-9][a-z0-9-_]*.
// Learn more at https://docs.cloud.google.com/gemini/enterprise/docs/reference/
// rest/v1/projects.locations.collections.engines#Engine.",
//             "pattern": "^[a-z0-9][a-z0-9-_]{0,62}$",
//             "type": "string"
//         },
//         "location": {
//             "description": "The multi-region or location of the <ph
// name=\"GEMINI_ENTERPRISE_PRODUCT_NAME\">Gemini Enterprise</ph> app. Learn
// more about <ph name=\"GEMINI_ENTERPRISE_PRODUCT_NAME\">Gemini Enterprise</ph>
// location at https://docs.cloud.google.com/gemini/enterprise/docs/locations.",
//             "pattern": "^[a-z]([a-z0-9-]{0,48}[a-z0-9])?$",
//             "type": "string"
//         },
//         "project_id": {
//             "description": "The ID or number of the <ph
// name=\"GOOGLE_CLOUD_PRODUCT_NAME\">Google Cloud</ph> project corresponding to
// the <ph name=\"GEMINI_ENTERPRISE_PRODUCT_NAME\">Gemini Enterprise</ph>
// instance to be enabled. Learn more about project IDs at
// https://docs.cloud.google.com/resource-manager/docs/creating-managing-
// projects.",
//             "pattern": "^[a-z0-9-]{1,30}$",
//             "type": "string"
//         }
//     },
//     "required": [
//         "project_id",
//         "app_id",
//         "location"
//     ],
//     "type": "object"
// }
//
// Supported on: chrome_os, linux, mac, win
message GeminiEnterpriseSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional string GeminiEnterpriseSettings = 2;
}

// Settings for Gemini integration
//
// This setting allows Gemini app integrations.
//
// 0 = Gemini integration will be available for users.
//
// 1 = Gemini integration will not be available for users.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information, please check the Help Center article
// https://support.google.com/chrome/a?p=gemini_in_chrome.
//
// Valid values:
//   0: Allow Gemini integrations.
//   1: Do not allow Gemini integrations.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message GeminiSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GeminiSettings = 2;
}

// Allows Gemini Spark to connect to Google Chrome and use auto browse via
// Gemini in Chrome
//
// Controls if the Gemini Spark agent is allowed to connect to Google Chrome and
// use auto browse. Gemini Spark might not be available to your organization.
//
// 0 = Gemini Spark is allowed to connect to and use Google Chrome auto browse
//
// 1 = Gemini Spark is not allowed to connect to or use Google Chrome auto
// browse
//
// Warning: Enabling Gemini Spark to connect to Google Chrome and use auto
// browse permits the Gemini Spark agent to perform autonomous, multi-step
// actions on Google Chrome clients using the active browser session. This
// entails significant security risks, including credential risks, Local Network
// Ingress and loss of context aware signals. Existing management and security
// controls might not be respected.
//
// Administrators are advised to carefully evaluate their organization's network
// threat model, compliance and privacy guidelines before enabling this feature.
//
// This policy has no effect when the Google Gemini app or Google Chrome auto
// browse policies are disabled. For example, the Google Gemini app can be
// disabled by GeminiSettings policy. For more information on Google Gemini in
// Google Chrome, please see
// https://support.google.com/chrome/a?p=gemini_in_chrome.
//
// Google Chrome auto browse and Gemini Spark are not available in all countries
// or all languages. Setting this policy to 0 - Enabled does not guarantee the
// feature will be enabled; it remains subject to availability. For more info on
// the roll-out, check the Enterprise Release Notes:
// https://chromeenterprise.google/resources/release-notes/.
//
// Valid values:
//   0: Gemini Spark is allowed to connect to and use Google Chrome auto browse.
//   1: Gemini Spark is not allowed to connect to or use Google Chrome auto
// browse.
//
// Supported on: chrome_os, linux, mac, win
message GeminiSparkSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GeminiSparkSettings = 2;
}

// Settings for GenAI Inline Image feature
//
// This policy controls the settings of the Inline Image feature for Google
// ChromeOS.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Inline Image and improve AI models.
//   1: Allow Inline Image without improving AI models.
//   2: Do not allow Inline Image.
//
// Supported on: chrome_os
message GenAIInlineImageSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GenAIInlineImageSettings = 2;
}

// Settings for GenAI local foundational model
//
// Configure how Google Chrome downloads the foundational GenAI model and uses
// for inference locally.
//
// When the policy is set to Allowed (0) or not set, the model is downloaded
// automatically, and used for inference.
//
// When the policy is set to Disabled (1), the model will not be downloaded, and
// the existing model (if already downloaded) will be deleted.
//
// On desktop platforms, model downloading can also be disabled by setting
// ComponentUpdatesEnabled to false.
//
// Valid values:
//   0: Downloads model automatically
//   1: Do not download model
//
// Supported on: android, chrome_os, linux, mac, win
message GenAILocalFoundationalModelSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GenAILocalFoundationalModelSettings = 2;
}

// Settings for Generative AI Photo Editing feature
//
// This policy controls the settings of the Generative AI Photo Editing feature
// for Google ChromeOS.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Generative AI Photo Editing and improve AI models.
//   1: Allow Generative AI Photo Editing without improving AI models.
//   2: Do not allow Generative AI Photo Editing.
//
// Supported on: chrome_os
message GenAIPhotoEditingSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GenAIPhotoEditingSettings = 2;
}

// Settings for Suggested Groups
//
// This policy controls whether groups based on similar content will be
// suggested for Google ChromeOS. Content can include browser tabs and apps.
// Groups will be suggested when users login. Suggested desks for a group will
// be available during a session.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Generative AI overview window grouping and improve AI models.
//   1: Allow Generative AI overview window grouping without improving AI
// models.
//   2: Do not allow Generative AI overview window grouping.
//
// Supported on: chrome_os
message GenAISmartGroupingSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GenAISmartGroupingSettings = 2;
}

// Settings for Generative AI VC Background feature
//
// Generative AI VC Background allows users to self-express using generative AI
// features to create personalized video conferencing backgrounds in Google
// ChromeOS.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Generative AI VC Background and improve AI models
//   1: Allow Generative AI VC Background without improving AI models
//   2: Do not allow Generative AI VC Background
//
// Supported on: chrome_os
message GenAIVcBackgroundSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GenAIVcBackgroundSettings = 2;
}

// Settings for Generative AI Wallpaper feature
//
// Generative AI Wallpaper allows users to self-express using generative AI
// features to create personalized wallpapers in Google ChromeOS.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Generative AI VC Background and improve AI models
//   1: Allow Generative AI Wallpaper without improving AI models
//   2: Do not allow Generative AI Wallpaper
//
// Supported on: chrome_os
message GenAIWallpaperSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GenAIWallpaperSettings = 2;
}

// Settings for the Text Capture feature
//
// This policy controls the settings of the Text Capture feature for Google
// ChromeOS.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Text Capture and improve AI models.
//   1: Allow Text Capture without improving AI models.
//   2: Do not allow Text Capture.
//
// Supported on: chrome_os
message GenAiChromeOsSmartActionsSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GenAiChromeOsSmartActionsSettings = 2;
}

// Set the default policy value for Google Chrome's covered generative AI
// features
//
// This policy defines the default setting for all covered generative AI
// features. For example, if this policy is set to value 1, then 1 will be the
// default setting for all covered generative AI features. It will not impact
// any manually set policy values. This setting will define the defaults for
// covered generative AI features in Chrome. See
// https://support.google.com/chrome/a?p=generative_ai_settings for the list of
// covered features.
//
// Some policies, e.g. GeminiSettings, only support the states Allowed and Do
// not allow. In this case, if GenAiDefaultSettings is set to 0 or 1, this
// feature will be enabled. If GenAiDefaultSettings is set to 2, this feature
// will be disabled. The documentation for each feature contains more details
// about how it interacts with values in this policy (e.g. Gemini in Chrome -
// https://support.google.com/chrome/a/answer/16291696). This applies to the
// following features: Gemini in Chrome, Google Lens, and AI Mode as they are
// subject to their own guarantees and/or terms of service
// (https://support.google.com/chrome/a/?p=genai_features_chrome).
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow GenAI features and improve AI models
//   1: Allow GenAI features without improving AI models
//   2: Do not allow GenAI features
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message GenAiDefaultSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GenAiDefaultSettings = 2;
}

// Block geolocation on these sites
//
// Setting the policy lets you set a list of URL patterns that specify sites
// that are not allowed to access the user's geolocation, and are also prevented
// from requesting user permission to do so.
//
// Leaving the policy unset means DefaultGeolocationSetting applies for all
// sites, if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message GeolocationBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList GeolocationBlockedForUrls = 2;
}

// Enables auto-select for multi screen captures
//
// The getDisplayMediaSet API allows web applications to capture multiple
// surfaces at once.
// This policy unlocks the autoSelectAllScreens property for web applications at
// defined origins.
// If the autoSelectAllScreens property is defined in a getDisplayMediaSet
// request, all screen surfaces are automatically captured without requiring
// explicit user permission.
// If the policy is not set, autoSelectAllScreens is not available for any web
// application.
// In order to improve privacy, starting with Google Chrome version 116, this
// policy will not support dynamic refresh anymore. Therefore, the user can be
// sure that no additional pages will be able to capture the screens after login
// if it were not allowed at session start already.
//
// Supported on:
message GetDisplayMediaSetSelectAllScreensAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList GetDisplayMediaSetSelectAllScreensAllowedForUrls = 2;
}

// Enable the ghost window feature
//
// Setting the policy to enable the ghost window feature.
// If this policy is true, ARC ghost windows will be created before ARC boots
// after a crash or reboot based on the restore app setting.
// If this policy is false, there is no ghost window created before ARC boots.
// Arc apps are restored after ARC boots
//
// Valid values:
//   True: Enable the ghost window feature.
//   False: Disable the ghost window feature.
//
// Supported on: chrome_os
message GhostWindowEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool GhostWindowEnabled = 2;
}

// Glanceables on Google ChromeOS
//
// Enables the presence of Glanceables widgets on Google ChromeOS. Specifically,
// the widgets accessible via the date chip on shelf.
// When this policy is enabled, Glanceables are enabled on Google ChromeOS.
// When this policy is disabled or unset, Glanceables are not enabled on Google
// ChromeOS.
//
// Valid values:
//   True: Glanceables are enabled for users.
//   False: Glanceables are not enabled for users.
//
// Supported on:
message GlanceablesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool GlanceablesEnabled = 2;
}

// Enable globally scoped HTTP auth cache
//
// This policy configures a single global per profile cache with HTTP server
// authentication credentials.
//
// If this policy is unset or disabled, the browser will use the default
// behavior of cross-site auth, this behavior will be to scope HTTP server
// authentication credentials by top-level site, so if two sites use resources
// from the same authenticating domain, credentials will need to be provided
// independently in the context of both sites. Cached proxy credentials will be
// reused across sites.
//
// If the policy is enabled, HTTP auth credentials entered in the context of one
// site will automatically be used in the context of another.
//
// Enabling this policy leaves sites open to some types of cross-site attacks,
// and allows users to be tracked across sites even without cookies by adding
// entries to the HTTP auth cache using credentials embedded in URLs.
//
// This policy is intended to give enterprises depending on the legacy behavior
// a chance to update their login procedures, and will be removed in the future.
//
// Valid values:
//   True: Enable globally scoped HTTP authentication cache
//   False: Disable globally scoped HTTP authentication cache
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message GloballyScopeHTTPAuthCacheEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool GloballyScopeHTTPAuthCacheEnabled = 2;
}

// Control Google ChromeOS access to Google location services
//
// Set Google ChromeOS geolocation system availability level.
//
// This is an additional layer of control, sitting below the permission layer
// for apps and websites. E.g. If this policy is set to either Block or
// OnlyAllowedForSystemServices, no apps or websites can resolve location,
// regardless of their respective location permission. But if it's set to Allow,
// apps and websites can individually get location if they have permission.
//
// Users can't override the admin selection. Leaving the policy unset gives
// users the consumer experience, i.e. they can freely modify the system
// location setting, and where the default is Allow.
//
// Note: This policy deprecates the ArcGoogleLocationServicesEnabled policy.
// Also when this policy is set, DefaultGeolocationSetting will no longer affect
// the Android location preference on Google ChromeOS.
//
// Valid values:
//   0: Block system geolocation access to all clients
//   1: Allow system geolocation access
//   2: Only allow system geolocation access to system services
//
// Supported on: chrome_os
message GoogleLocationServicesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional int64 GoogleLocationServicesEnabled = 2;
}

// Enable Google Search Side Panel
//
// If set to Enabled or not set, Google Search Side Panel is allowed on all web
// pages.
//
// If set to Disabled, Google Search Side Panel is not available on any webpage.
//
// GenAI capabilities that are part of this feature are not available for
// Educational or Enterprise accounts.
//
// Valid values:
//   True: Enable Google Search Side Panel on all web pages
//   False: Disable Google Search Side Panel on all web pages
//
// Supported on: chrome_os, linux, mac, win
message GoogleSearchSidePanelEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool GoogleSearchSidePanelEnabled = 2;
}

// Configures the Cloud Upload flow for Google Drive and Google Workspace
//
// This policy allows the admins to configure the Cloud Upload flow for Google
// Drive and Google Workspace on Google ChromeOS.
//
// Setting the policy to 'allowed' lets the user set up the Cloud Upload flow
// for Google Drive and Google Workspace if they wish to.
// After completing the setup process, files with matching file formats will by
// default be moved to Google Drive and handled by one of the Google Workspace
// apps when the user attempts to open them.
//
// Setting the policy to 'disallowed' prohibits the user from setting up the
// Cloud Upload flow for Google Drive as described above and removes Google
// Workspace apps from the list of potential file handlers.
//
// Setting the policy to 'automated' sets up the Cloud Upload flow for Google
// Drive and Google Workspace automatically, so that files with matching file
// formats will by default be moved to Google Drive and handled by one of the
// Google Workspace apps when the user attempts to open them.
//
// Leaving the policy unset is functionally equivalent to setting it to
// 'allowed' for regular users; for enterprise users unset policy defaults to
// 'disallowed'.
//
// Valid values:
//   allowed: Allow the Cloud Upload flow for Google Drive and Google Workspace
//   disallowed: Disallow the Cloud Upload flow for Google Drive and Google
// Workspace
//   automated: Automate the Cloud Upload flow for Google Drive and Google
// Workspace
//
// Supported on: chrome_os
message GoogleWorkspaceCloudUploadProto {
  optional PolicyOptions policy_options = 1;
  optional string GoogleWorkspaceCloudUpload = 2;
}

// List of names that will bypass the HSTS policy check
//
// Setting the policy specifies a list of hostnames that bypass preloaded HSTS
// upgrades from http to https.
//
// Only single-label hostnames are allowed in this policy, and this policy only
// applies to "static" HSTS-preloaded entries (for instance, "app", "new",
// "search", "play"). This policy does not prevent HSTS upgrades for servers
// that have "dynamically" requested HSTS upgrades using a Strict-Transport-
// Security response header.
//
// Supplied hostnames must be canonicalized: Any IDNs must be converted to their
// A-label format, and all ASCII letters must be lowercase. This policy only
// applies to the specific single-label hostnames specified, not to subdomains
// of those names.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message HSTSPolicyBypassListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList HSTSPolicyBypassList = 2;
}

// Use the Happy Eyeballs V3 algorithm
//
// This feature enables the Happy Eyeballs V3 algorithm to make connection
// attempts. See https://datatracker.ietf.org/doc/draft-pauly-happy-
// happyeyeballs-v3 for details.
//
// Setting the policy to Enabled means Google Chrome will use the Happy Eyeballs
// V3 algorithm for connection attempts.
//
// Setting the policy to Disabled turns off the Happy Eyeballs V3 algorithm.
//
// Not setting the policy, Google Chrome will turn on or off the Happy Eyeballs
// V3 algorithm based on chrome://flags/#happy-eyeballs-v3.
//
// This policy supports dynamic refresh.
//
// This policy is a temporary measure and will be removed in future versions of
// Google Chrome.
//
// Valid values:
//   True: Using the Happy Eyeballs V3 algorithm.
//   False: Do not use the Happy Eyeballs V3 algorithm.
//   None: Allow Google Chrome to decide
//
// Supported on: android, chrome_os, linux, mac, win
message HappyEyeballsV3EnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool HappyEyeballsV3Enabled = 2;
}

// Use graphics acceleration when available
//
// Setting the policy to Enabled or leaving it unset turns on graphics
// acceleration, if available.
//
// Setting the policy to Disabled turns off graphics acceleration.
//
// Valid values:
//   True: Enable graphics acceleration
//   False: Disable graphics acceleration
//
// Supported on: fuchsia, linux, mac, win
message HardwareAccelerationModeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool HardwareAccelerationModeEnabled = 2;
}

// Control use of the Headless Mode
//
// Setting this policy to Enabled or leaving the policy unset allows use of the
// headless mode. Setting this policy to Disabled denies use of the headless
// mode.
//
// Valid values:
//   1: Allow use of the Headless Mode
//   2: Do not allow use of the Headless Mode
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message HeadlessModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 HeadlessMode = 2;
}

// Settings for Help Me Read feature
//
// This policy controls the settings of the Help Me Read feature for Google
// ChromeOS.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Help Me Read and improve AI models.
//   1: Allow Help Me Read without improving AI models.
//   2: Do not allow Help Me Read.
//
// Supported on: chrome_os
message HelpMeReadSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 HelpMeReadSettings = 2;
}

// Settings for Help Me Write
//
// Help Me Write is an AI-based writing assistant for short-form content on the
// web. Suggested content is based on prompts entered by the user and the
// content of the web page.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Help Me Write and improve AI models.
//   1: Allow Help Me Write without improving AI models.
//   2: Do not allow Help Me Write.
//
// Supported on: chrome_os, linux, mac, win
message HelpMeWriteSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 HelpMeWriteSettings = 2;
}

// Hide the web store from the New Tab Page and app launcher
//
// Hide the Chrome Web Store app and footer link from the New Tab Page and
// Google ChromeOS app launcher.
//
// When this policy is set to true, the icons are hidden.
//
// When this policy is set to false or is not configured, the icons are visible.
//
// Valid values:
//   True: Do not show the Chrome Web Store icon in the Google ChromeOS launcher
// or on the new tab page
//   False: Show the Chrome Web Store icon in the Google ChromeOS launcher and
// on the new tab page
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message HideWebStoreIconProto {
  optional PolicyOptions policy_options = 1;
  optional bool HideWebStoreIcon = 2;
}

// Prevent app promotions from appearing on the new tab page
//
// When set to True, promotions for Chrome Web Store apps will not appear on the
// new tab page.
//
// Setting this option to False or leaving it not set will make the promotions
// for Chrome Web Store apps appear on the new tab page
//
// Supported on:
message HideWebStorePromoProto {
  optional PolicyOptions policy_options = 1;
  optional bool HideWebStorePromo = 2;
}

// Enable high contrast mode
//
// Setting the policy to True keeps High-contrast mode on. Setting the policy to
// False keeps High-contrast mode off.
//
// If you set the policy, users can't change it. If not set, High-contrast mode
// is off, but users can turn it on any time.
//
// Valid values:
//   True: Enable high contrast
//   False: Disable high contrast
//   None: Allow the user to decide
//
// Supported on: chrome_os
message HighContrastEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool HighContrastEnabled = 2;
}

// Enable High Efficiency Mode
//
// This policy enables or disables the High Efficiency Mode setting. This
// setting makes it so that tabs are discarded after some period of time in the
// background to reclaim memory.
// If this policy is unset, the end user can control this setting in
// chrome://settings/performance.
//
// Valid values:
//   True: High Efficiency Mode will be enabled.
//   False: High Efficiency Mode will be disabled.
//   None: The end user can enable or disable High Efficiency Mode.
//
// Supported on: chrome_os, linux, mac, win
message HighEfficiencyModeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool HighEfficiencyModeEnabled = 2;
}

// Enable the Hindi Inscript Layout
//
// Setting the policy enables Hindi Inscript Layout on Google ChromeOS. If false
// or unset, the layout is not available.
//
// Valid values:
//   True: Enable Hindi Inscript Layout
//   False: Disable Hindi Inscript Layout
//
// Supported on:
message HindiInscriptLayoutEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool HindiInscriptLayoutEnabled = 2;
}

// Show a view of Chrome history with groups of pages
//
// This policy controls the visibility of the Chrome history page organized into
// groups of pages.
//
// If the policy is set to Enabled, a Chrome history page organized into groups
// will be visible at chrome://history/grouped.
//
// If the policy is set to Disabled, a Chrome history page organized into groups
// will not be visible at chrome://history/grouped.
//
// If the policy is left unset, a Chrome history page organized into groups will
// be visible at chrome://history/grouped by default.
//
// Please note, if ComponentUpdatesEnabled policy is set to Disabled, but
// HistoryClustersVisible is set to Enabled or unset, a Chrome history page
// organized into groups will still be available at chrome://history/grouped,
// but may be less relevant to the user.
//
// Valid values:
//   True: Chrome history page organized into groups will be visible at
// chrome://history/grouped.
//   False: Chrome history page organized into groups will not be visible at
// chrome://history/grouped.
//   None: Chrome history page organized into groups will be visible at
// chrome://history/grouped by default.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message HistoryClustersVisibleProto {
  optional PolicyOptions policy_options = 1;
  optional bool HistoryClustersVisible = 2;
}

// Settings for AI-powered History Search
//
// AI History Search is a feature that allows users to search their browsing
// history and receive generated answers based on page contents and not just the
// page title and URL.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow AI History Search and improve AI models.
//   1: Allow AI History Search without improving AI models.
//   2: Do not allow AI History Search.
//
// Supported on: chrome_os, linux, mac, win
message HistorySearchSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 HistorySearchSettings = 2;
}

// Control the shortcut used to trigger the Home/End "six pack" keys
//
// This policy determines the behavior for remapping the Home/End keys
// within the 'remap keys' subpage. The 'remap keys' subpage allows users to
// customize keyboard keys. If enabled, this policy prevents users from
// customizing these specific remappings. If the policy is not set,
// search-based shortcuts will act as the default and allows users to
// configure the shortcuts.
//
// Valid values:
//   0: Home/End settings are disabled
//   1: Home/End settings use the shortcut that contains the alt modifier
//   2: Home/End settings use the shortcut that contains the search modifier
//
// Supported on: chrome_os
message HomeAndEndKeysModifierProto {
  optional PolicyOptions policy_options = 1;
  optional int64 HomeAndEndKeysModifier = 2;
}

// Use New Tab Page as homepage
//
// Setting the policy to Enabled makes the New Tab page the user's homepage,
// ignoring any homepage URL location. Setting the policy to Disabled means that
// their homepage is never the New Tab page, unless the user's homepage URL is
// set to chrome://newtab.
//
// If you set the policy, users can't change their homepage type in Google
// Chrome. If not set, the user decides whether or not the New Tab page is their
// homepage.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   True: Use New Tab Page as homepage
//   False: Do not use New Tab Page as homepage
//   None: Allow users to choose
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message HomepageIsNewTabPageProto {
  optional PolicyOptions policy_options = 1;
  optional bool HomepageIsNewTabPage = 2;
}

// Configure the home page URL
//
// Setting the policy sets the default homepage URL in Google Chrome. You open
// the homepage using the Home button. On desktop, the RestoreOnStartup policies
// control the pages that open on startup.
//
// If the homepage is set to the New Tab Page, by the user or
// HomepageIsNewTabPage, this policy has no effect.
//
// The URL needs a standard scheme, such as http://example.com or
// https://example.com. When this policy is set, users can't change their
// homepage URL in Google Chrome.
//
// Leaving both HomepageLocation and HomepageIsNewTabPage unset lets users
// choose their homepage.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message HomepageLocationProto {
  optional PolicyOptions policy_options = 1;
  optional string HomepageLocation = 2;
}

// Enable HTTP/0.9 support on non-default ports
//
// This policy is deprecated, and slated for removal in Chrome 78, with no
// replacement.
//
// This policy enables HTTP/0.9 on ports other than 80 for HTTP and 443 for
// HTTPS.
//
// This policy is disabled by default, and if enabled, leaves users open to the
// security issue https://crbug.com/600352.
//
// This policy is intended to give enterprises a chance to migrate existing
// servers off of HTTP/0.9, and will be removed in the future.
//
// If this policy is not set, HTTP/0.9 will be disabled on non-default ports.
//
// Valid values:
//   True: Enable HTTP/0.9 support on non-default ports
//   False: Disable HTTP/0.9 support on non-default ports
//
// Supported on:
message Http09OnNonDefaultPortsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool Http09OnNonDefaultPortsEnabled = 2;
}

// HTTP Allowlist
//
// Setting the policy specifies a list of hostnames or hostname patterns (such
// as
// '[*.]example.com') that will not be upgraded to HTTPS and will not show an
// error interstitial if HTTPS-First Mode is enabled. Organizations can use this
// policy to maintain access to servers that do not support HTTPS, without
// needing to disable HTTPS Upgrades and/or HTTPS-First Mode.
//
// Supplied hostnames must be canonicalized: Any IDNs must be converted to their
// A-label format, and all ASCII letters must be lowercase.
//
// Blanket host wildcards (i.e., "*" or "[*]") are not allowed. Instead,
// HTTPS-First Mode and HTTPS Upgrades should be explicitly disabled via their
// specific policies.
//
// Note: This policy does not apply to HSTS upgrades.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message HttpAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList HttpAllowlist = 2;
}

// Configure HTTP Header Injection for specific URL patterns
//
// This policy enables defining a list of rules to inject custom HTTP headers
// into web requests matching specific URL patterns. Headers set by this policy
// take precedence over those that initially were present in the request, as
// well as modifications attempted by users or extensions.
//
// A common use case for this policy is to enforce tenant access controls by
// injecting custom headers (e.g., X-Tenant-ID).
//
// The policy accepts a list of Rules. Each Rule contains:
//
// * patterns: A list of URL patterns to match. See how to format a URL pattern
// ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ).
//
// * headers: A list of objects representing headers to inject, each containing:
//
// * name: The name of the header to inject.
//
// * value: The value of the header to inject.
//
// If multiple rules match a request, headers from all matching rules will be
// applied. In case there're multiple headers with the same name, the one with
// the most specific URL pattern will be applied. If patterns are equally
// specific, the one that appears last in the list will be applied.
//
// Header names must be compliant with RFC 2616 ( https://www.rfc-
// editor.org/rfc/rfc2616 ). Header values must not contain NUL, CR or LF
// symbols. Individual headers must not exceed 8KB in size. Invalid headers and
// URL patterns will be ignored.
//
// This policy is limited to a total of 500 URL patterns across all rules. Each
// rule can contain at most 20 headers. Patterns and headers beyond these
// thresholds will be ignored.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "headers": {
//                 "items": {
//                     "properties": {
//                         "name": {
//                             "type": "string"
//                         },
//                         "value": {
//                             "type": "string"
//                         }
//                     },
//                     "required": [
//                         "name",
//                         "value"
//                     ],
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "patterns": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             }
//         },
//         "required": [
//             "patterns",
//             "headers"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, linux, mac, win
message HttpHeaderInjectionProto {
  optional PolicyOptions policy_options = 1;
  optional string HttpHeaderInjection = 2;
}

// Allow HTTPS-Only Mode to be enabled
//
// This policy controls whether users can enable HTTPS-Only Mode (Always Use
// Secure Connections) in Settings. HTTPS-Only Mode upgrades all navigations to
// HTTPS.
//
// If this setting is not set or set to "allowed", users will be allowed to
// enable HTTPS-Only Mode.
//
// If this setting is set to "disallowed", HTTPS-Only Mode will be disabled.
//
// If this setting is set to "force_enabled", HTTPS-Only Mode will be enabled in
// Strict mode.
//
// If this setting is set to "force_balanced_enabled", HTTPS-Only Mode will be
// enabled in Balanced mode.
//
// "force_enabled" is supported from M112 onwards, "force_balanced_enabled" is
// supported from M129 onwards.
//
// "force_enabled" and "force_balanced_enabled" can be recommended to users too.
// HTTPS-Only Mode will be set Strict or Balanced initially but users are
// allowed to
// change it.
//
// If you set this policy to a value that is not supported by the version of
// Chrome that receives the policy, Chrome will default to the allowed setting.
//
// The separate HttpAllowlist policy
// can be used to exempt specific hostnames or hostname patterns from being
// upgraded to HTTPS by this feature.
//
// Valid values:
//   allowed: Do not restrict users' HTTPS-Only Mode setting
//   disallowed: Disable HTTPS-Only Mode
//   force_enabled: Enable HTTPS-Only Mode in Strict mode
//   force_balanced_enabled: Enable HTTPS-Only Mode in Balanced Mode
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message HttpsOnlyModeProto {
  optional PolicyOptions policy_options = 1;
  optional string HttpsOnlyMode = 2;
}

// Enable automatic HTTPS upgrades
//
// Google Chrome attempts to upgrade some
// navigations from HTTP to HTTPS, when possible. This policy can be used to
// disable this behavior. If set to "true" or left unset, this feature will be
// enabled by default.
//
// The separate HttpAllowlist policy
// can be used to exempt specific hostnames or hostname patterns from being
// upgraded to HTTPS by this feature.
//
// See also the HttpsOnlyMode policy.
//
// Valid values:
//   True: HTTPS Upgrades may be applied depending on feature launch status.
//   False: Disable HTTPS Upgrades.
//   None: HTTPS Upgrades may be applied depending on feature launch status.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message HttpsUpgradesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool HttpsUpgradesEnabled = 2;
}

// Enable IPv6 reachability check override
//
// Setting the policy to true overrides the IPv6 reachability check. This means
// that the
// system will always query AAAA records when resolving host names. It applies
// to
// all users and interfaces on the device.
//
// Setting the policy to false or leaving it unset does not overrides the IPv6
// reachability check.
// The system only queries AAAA records when it is reachable to a global IPv6
// host.
//
// Valid values:
//   True: Override the IPv6 reachability check. Always query AAAA record for
// host name resolution.
//   False: Do not override the IPv6 reachability check. Only query AAAA record
// for host name resolution when the device is reachable to a global IPv6 host.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message IPv6ReachabilityOverrideEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool IPv6ReachabilityOverrideEnabled = 2;
}

// Action to take when the idle delay is reached
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// This policy provides a fallback value for the more-specific IdleActionAC and
// IdleActionBattery policies. If this policy is set, its value gets used if the
// respective more-specific policy is not set.
//
// When this policy is unset, behavior of the more-specific policies remains
// unaffected.
//
// Valid values:
//   0: Suspend
//   1: Log the user out
//   2: Shut down
//   3: Do nothing
//
// Supported on: chrome_os
message IdleActionProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IdleAction = 2;
}

// Action to take when the idle delay is reached while running on AC power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// When this policy is set, it specifies the action that Google ChromeOS takes
// when the user remains idle for the length of time given by the idle delay,
// which can be configured separately.
//
// When this policy is unset, the default action is taken, which is suspend.
//
// If the action is suspend, Google ChromeOS can separately be configured to
// either lock or not lock the screen before suspending.
//
// Valid values:
//   0: Suspend
//   1: Log the user out
//   2: Shut down
//   3: Do nothing
//
// Supported on: chrome_os
message IdleActionACProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IdleActionAC = 2;
}

// Action to take when the idle delay is reached while running on battery power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// When this policy is set, it specifies the action that Google ChromeOS takes
// when the user remains idle for the length of time given by the idle delay,
// which can be configured separately.
//
// When this policy is unset, the default action is taken, which is suspend.
//
// If the action is suspend, Google ChromeOS can separately be configured to
// either lock or not lock the screen before suspending.
//
// Valid values:
//   0: Suspend
//   1: Log the user out
//   2: Shut down
//   3: Do nothing
//
// Supported on: chrome_os
message IdleActionBatteryProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IdleActionBattery = 2;
}

// Idle delay when running on AC power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// Specifies the length of time without user input after which the idle action
// is taken when running on AC power.
//
// When this policy is set, it specifies the length of time that the user must
// remain idle before Google ChromeOS takes the idle action, which can be
// configured separately.
//
// When this policy is unset, a default length of time is used.
//
// The policy value should be specified in milliseconds.
//
// Supported on: chrome_os
message IdleDelayACProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IdleDelayAC = 2;
}

// Idle delay when running on battery power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// Specifies the length of time without user input after which the idle action
// is taken when running on battery power.
//
// When this policy is set, it specifies the length of time that the user must
// remain idle before Google ChromeOS takes the idle action, which can be
// configured separately.
//
// When this policy is unset, a default length of time is used.
//
// The policy value should be specified in milliseconds.
//
// Supported on: chrome_os
message IdleDelayBatteryProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IdleDelayBattery = 2;
}

// Allow idle detection on these sites
//
// Allows you to set a list of URL patterns that specify the sites that are
// allowed to use the Idle Detection API witout asking the user. Blocklist
// entries have higher priority than allowlist entries, which in turn have
// higher priority than the configured default value.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed. This policy only matches based on origin, so any path in the URL
// pattern is ignored.
//
// If this policy is not set, the global default value will be used for all
// sites, which is configured by the DefaultIdleDetectionSetting (Default idle
// detection setting) policy, if set, or by the user's personal configuration
// otherwise.
//
// Supported on: android, chrome_os, linux, mac, win
message IdleDetectionAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList IdleDetectionAllowedForUrls = 2;
}

// Block idle detection on these sites
//
// Allows you to set a list of URL patterns that specify the sites that are not
// allowed to use the Idle Detection API.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed. This policy only matches based on origin, so any path in the URL
// pattern is ignored.
//
// If this policy is not set, the global default value will be used for all
// sites, which is configured by the DefaultIdleDetectionSetting (Default idle
// detection setting) policy, if set, or by the user's personal configuration
// otherwise.
//
// Supported on: android, chrome_os, linux, mac, win
message IdleDetectionBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList IdleDetectionBlockedForUrls = 2;
}

// Delay before running idle actions
//
// Triggers an action when the computer is idle.
//
// If this policy is set, it specifies the length of time without user input (in
// minutes) before the browser runs actions configured via the
// IdleTimeoutActions policy.
//
// If this policy is not set, no action will be ran.
//
// The minimum threshold is 1 minute.
//
// "User input" is defined by Operating System APIs, and includes things like
// moving the mouse or typing on the keyboard.
//
// Supported on: android, ios, linux, mac, win
message IdleTimeoutProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IdleTimeout = 2;
}

// Actions to run when the computer is idle
//
// List of actions to run when the timeout from the IdleTimeout policy is
// reached.
//
// Warning: Setting this policy can impact and permanently remove local personal
// data. It is recommended to test your settings before deploying to prevent
// accidental deletion of personal data.
//
// If the IdleTimeout policy is unset, this policy has no effect.
//
// When the timeout from the IdleTimeout policy is reached, the browser runs the
// actions configured in this policy.
//
// If this policy is empty or left unset, the IdleTimeout policy has no effect.
//
// Supported actions are:
//
// 'close_browsers': close all browser windows and PWAs for this profile. Not
// supported on Android and iOS.
//
// 'close_tabs': close all open tabs in open windows. Only supported on iOS.
//
// 'show_profile_picker': show the Profile Picker window. Not supported on
// Android and iOS.
//
// 'sign_out': Signs out the current signed in user. Only supported on iOS.
//
// 'clear_browsing_history', 'clear_download_history',
// 'clear_cookies_and_other_site_data', 'clear_cached_images_and_files',
// 'clear_password_signing', 'clear_autofill', 'clear_site_settings',
// 'clear_hosted_app_data': clear the corresponding browsing data. See the
// ClearBrowsingDataOnExitList policy for more details. The types supported on
// iOS are 'clear_browsing_history', 'clear_cookies_and_other_site_data',
// 'clear_cached_images_and_files', 'clear_password_signing', and
// 'clear_autofill'
//
// 'reload_pages': reload all webpages. For some pages, the user may be prompted
// for confirmation first. Not supported on iOS.
//
// The user will stay signed into their Google account when deleting cookies
// using 'clear_cookies_and_other_site_data'.
//
// Setting 'clear_browsing_history', 'clear_password_signing', 'clear_autofill',
// and 'clear_site_settings' will disable sync for the respective data types if
// neither `Chrome Sync` is disabled by setting the SyncDisabled policy nor
// BrowserSignin is disabled.
//
// Valid values:
//   close_browsers: Close Browsers
//   show_profile_picker: Show Profile Picker
//   clear_browsing_history: Clear Browsing History
//   clear_download_history: Clear Download History
//   clear_cookies_and_other_site_data: Clear Cookies and Other Site Data
//   clear_cached_images_and_files: Clear Cached Images and Files
//   clear_password_signin: Clear Password Signin
//   clear_autofill: Clear Autofill
//   clear_site_settings: Clear Site Settings
//   clear_hosted_app_data: Clear Hosted App Data
//   reload_pages: Reload Pages
//   sign_out: Sign Out
//   close_tabs: Close Tabs
//
// Supported on: android, ios, linux, mac, win
message IdleTimeoutActionsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList IdleTimeoutActions = 2;
}

// Idle warning delay when running on AC power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// Specifies the length of time without user input after which a warning dialog
// is shown when running on AC power.
//
// When this policy is set, it specifies the length of time that the user must
// remain idle before Google ChromeOS shows a warning dialog telling the user
// that the idle action is about to be taken.
//
// When this policy is unset, no warning dialog is shown.
//
// The policy value should be specified in milliseconds. Values are clamped to
// be less than or equal the idle delay.
//
// The warning message is only shown if the idle action is to logout or shut
// down.
//
// Supported on: chrome_os
message IdleWarningDelayACProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IdleWarningDelayAC = 2;
}

// Idle warning delay when running on battery power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// Specifies the length of time without user input after which a warning dialog
// is shown when running on battery power.
//
// When this policy is set, it specifies the length of time that the user must
// remain idle before Google ChromeOS shows a warning dialog telling the user
// that the idle action is about to be taken.
//
// When this policy is unset, no warning dialog is shown.
//
// The policy value should be specified in milliseconds. Values are clamped to
// be less than or equal the idle delay.
//
// The warning message is only shown if the idle action is to logout or shut
// down.
//
// Supported on: chrome_os
message IdleWarningDelayBatteryProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IdleWarningDelayBattery = 2;
}

// Allow images on these sites
//
// Setting the policy lets you set a list of URL patterns that specify sites
// that may display images.
//
// Leaving the policy unset means DefaultImagesSetting applies for all sites, if
// it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Note that previously this policy was erroneously enabled on Android, but this
// functionality has never been fully supported on Android.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ImagesAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ImagesAllowedForUrls = 2;
}

// Block images on these sites
//
// Setting the policy lets you set a list of URL patterns that specify sites
// that can't display images.
//
// Leaving the policy unset means DefaultImagesSetting applies for all sites, if
// it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Note that previously this policy was erroneously enabled on Android, but this
// functionality has never been fully supported on Android.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ImagesBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ImagesBlockedForUrls = 2;
}

// Import autofill form data from default browser on first run
//
// Setting the policy to Enabled imports autofill form data from the previous
// default browser on first run. Setting the policy to Disabled or leaving it
// unset means no autofill form data is imported on first run.
//
// Users can trigger an import dialog and the autofill form data checkbox will
// be checked or unchecked to match this policy's value.
//
// Valid values:
//   True: Enable import of autofill form data on first run
//   False: Disable import of autofill form data on first run
//
// Supported on: fuchsia, linux, mac, win
message ImportAutofillFormDataProto {
  optional PolicyOptions policy_options = 1;
  optional bool ImportAutofillFormData = 2;
}

// Import bookmarks from default browser on first run
//
// Setting the policy to Enabled imports bookmarks from the previous default
// browser on first run. Setting the policy to Disabled or leaving it unset
// means no bookmarks are imported on first run.
//
// Users can trigger an import dialog and the bookmarks checkbox will be checked
// or unchecked to match this policy's value.
//
// Valid values:
//   True: Enable import of bookmarks on first run
//   False: Disable import of bookmarks on first run
//
// Supported on: fuchsia, linux, mac, win
message ImportBookmarksProto {
  optional PolicyOptions policy_options = 1;
  optional bool ImportBookmarks = 2;
}

// Import browsing history from default browser on first run
//
// Setting the policy to Enabled imports browsing history from the previous
// default browser on first run. Setting the policy to Disabled or leaving it
// unset means no browsing history is imported on first run.
//
// Users can trigger an import dialog and the browsing history checkbox will be
// checked or unchecked to match this policy's value.
//
// Valid values:
//   True: Enable import of browsing history on first run
//   False: Disable import of browsing history on first run
//
// Supported on: fuchsia, linux, mac, win
message ImportHistoryProto {
  optional PolicyOptions policy_options = 1;
  optional bool ImportHistory = 2;
}

// Import of homepage from default browser on first run
//
// Setting the policy to Enabled imports the homepage from the previous default
// browser on first run. Setting the policy to Disabled or leaving it unset
// means the homepage isn't imported on first run.
//
// Users can trigger an import dialog and the homepage checkbox will be checked
// or unchecked to match this policy's value.
//
// Valid values:
//   True: Enable import of homepage on first run
//   False: Disable import of homepage on first run
//
// Supported on: fuchsia, linux, mac, win
message ImportHomepageProto {
  optional PolicyOptions policy_options = 1;
  optional bool ImportHomepage = 2;
}

// Import saved passwords from default browser on first run
//
// This policy controls only the first run import behavior after installation.
// It enables more seamless transition to Google Chrome in environments where a
// different browser was extensively used prior to installing the browser. This
// policy does not affect password manager capabilities for Google accounts.
//
// Setting the policy to Enabled imports saved passwords from the previous
// default browser on first run and manual importing from the settings page is
// also possible.
// Setting the policy to Disabled means no saved passwords are imported on first
// run and manual importing from the Settings page is blocked.
// Leaving the policy unset means no saved passwords are imported on first run
// but the user can choose to do that from the settings page.
//
// Valid values:
//   True: Enable import of saved passwords on first run
//   False: Disable import of saved passwords on first run
//
// Supported on: fuchsia, linux, mac, win
message ImportSavedPasswordsProto {
  optional PolicyOptions policy_options = 1;
  optional bool ImportSavedPasswords = 2;
}

// Import search engines from default browser on first run
//
// Setting the policy to Enabled imports the default search engine from the
// previous default browser on first run. Setting the policy to Disabled or
// leaving it unset means the default search engine isn't imported on first run.
//
// Users can trigger an import dialog and the default search engine checkbox
// will be checked or unchecked to match this policy's value.
//
// Valid values:
//   True: Enable import of default search engine on first run
//   False: Disable import of default search engine on first run
//
// Supported on: fuchsia, linux, mac, win
message ImportSearchEngineProto {
  optional PolicyOptions policy_options = 1;
  optional bool ImportSearchEngine = 2;
}

// Enable Incognito mode
//
// This policy is deprecated. Please, use IncognitoModeAvailability instead.
// Enables Incognito mode in Google Chrome.
//
// If this setting is enabled or not configured, users can open web pages in
// incognito mode.
//
// If this setting is disabled, users cannot open web pages in incognito mode.
//
// If this policy is left not set, this will be enabled and the user will be
// able to use incognito mode.
//
// Valid values:
//   True: Enable Incognito mode
//   False: Disable Incognito mode
//
// Supported on: android, chrome_os, linux, mac, win
message IncognitoEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool IncognitoEnabled = 2;
}

// Incognito mode availability
//
// Specifies whether the user may open pages in Incognito mode in Google Chrome.
//
// If 'Enabled' is selected or the policy is left unset, pages may be opened in
// Incognito mode.
//
// If 'Disabled' is selected, pages may not be opened in Incognito mode.
//
// If 'Forced' is selected, pages may be opened ONLY in Incognito mode. Note
// that 'Forced' does not work for Android-on-Chrome
//
// The IncognitoModeUrlAllowlist policy takes precedence over this policy and
// can re-enable Incognito mode for specific URLs. When Incognito mode is
// disabled by this policy when an allowlist is provided, Incognito mode is
// available only for URLs matching the allowlist, while all other pages are
// blocked.
//
// Note: On iOS, if the policy is changed during a session, it will only take
// effect on relaunch.
//
// Valid values:
//   0: Incognito mode available
//   1: Incognito mode disabled
//   2: Incognito mode forced
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message IncognitoModeAvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IncognitoModeAvailability = 2;
}

// Allow access to a list of URLs in Incognito mode.
//
// Setting the policy provides access to the listed URLs in Incognito mode. Use
// it to open exceptions to certain URL patterns defined in
// IncognitoModeUrlBlocklist, using the format specified at (
// https://support.google.com/chrome/a?p=url_blocklist_filter_format ).
//
// If both this policy and IncognitoModeUrlBlocklist are set, the allowlist
// takes precedence. If a URL matches a pattern on the allowlist, it will be
// allowed. If it matches a pattern on the blocklist (but not the allowlist), it
// will be blocked. If a URL matches neither, the general
// URLBlocklist/URLAllowlist policies will be used as a fallback.
//
// If this policy is set and  IncognitoModeUrlBlocklist is not, any URL not on
// the allowlist will be blocked in Incognito mode.
//
// If IncognitoModeAvailability is set to disallow (value 1), but this policy is
// configured, Incognito mode will be available only for the URLs matching the
// allowlist.
//
// Leaving the policy unset allows no exceptions to IncognitoModeUrlBlocklist
// and IncognitoModeAvailability.
//
// This policy only affects Incognito mode. To allow URLs for all user profiles,
// please use the URLAllowlist policy.
//
// Blanket host wildcards (i.e., "*" or "[*]") are not allowed; use the
// IncognitoModeAvailability policy to enable the feature globally.
//
// This policy is limited to 1000 entries.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message IncognitoModeUrlAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList IncognitoModeUrlAllowlist = 2;
}

// Block access to a list of URLs in Incognito mode.
//
// Setting the IncognitoModeUrlBlocklist policy stops web pages with prohibited
// URLs from loading in Incognito mode. Administrators can specify the list of
// URL patterns to be blocked. See how to format a URL pattern (
// https://support.google.com/chrome/a?p=url_blocklist_filter_format ).
//
// If both this and the IncognitoModeUrlAllowlist are set, the allowlist takes
// precedence. If a URL matches a pattern on the allowlist, it will be allowed.
// If it matches a pattern on the blocklist but not the allowlist, it will be
// blocked. If a URL matches neither, the general URLBlocklist/URLAllowlist
// policies will be used as a fallback.
//
// If the IncognitoModeUrlAllowlist policy is set and this policy is not, any
// URL not on the allowlist will be blocked in Incognito mode.
//
// If IncognitoModeAvailability is set to disallow (value 1), but the
// IncognitoModeUrlAllowlist policy is configured, Incognito mode will be
// available only for the URLs matching the allowlist.
//
// This policy only affects Incognito mode. To block URLs for all user profiles,
// please use the URLBlocklist policy.
//
// This policy is limited to 1000 entries.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message IncognitoModeUrlBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList IncognitoModeUrlBlocklist = 2;
}

// Settings for Indigo.
//
// Controls if Indigo is allowed to transform images on the web.
//
// 0 = Enable Indigo with model improvement.
//
// 1 = Enable Indigo without model improvement.
//
// 2 = Disable Indigo.
//
// If this policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// Valid values:
//   0: Enable Indigo with model improvement.
//   1: Enable Indigo without model improvement.
//   2: Disable Indigo.
//
// Supported on: chrome_os, linux, mac, win
message IndigoProto {
  optional PolicyOptions policy_options = 1;
  optional int64 Indigo = 2;
}

// Allow insecure content on these sites
//
// Allows you to set a list of url patterns that specify sites which are allowed
// to display blockable (i.e. active) mixed content (i.e. HTTP content on HTTPS
// sites) and for which optionally blockable mixed content upgrades will be
// disabled.
//
// If this policy is left not set blockable mixed content will be blocked and
// optionally blockable mixed content will be upgraded, and users will be
// allowed to set exceptions to allow it for specific sites.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message InsecureContentAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList InsecureContentAllowedForUrls = 2;
}

// Block insecure content on these sites
//
// Allows you to set a list of url patterns that specify sites which are not
// allowed to display blockable (i.e. active) mixed content (i.e. HTTP content
// on HTTPS sites), and for which optionally blockable (i.e. passive) mixed
// content will be upgraded.
//
// If this policy is left not set blockable mixed content will be blocked and
// optionally blockable mixed content will be upgraded, but users will be
// allowed to set exceptions to allow it for specific sites.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message InsecureContentBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList InsecureContentBlockedForUrls = 2;
}

// Enable warnings for insecure forms
//
// This policy controls the treatment for insecure forms (forms that submit over
// HTTP) embedded in secure (HTTPS) sites in the browser.
// If the policy is enabled or unset, a full page warning will be shown when an
// insecure form is submitted. Additionally, a warning bubble will be shown next
// to the form fields when they are focused, and autofill will be disabled for
// those forms.
// If the policy is disabled, warnings will not be shown for insecure forms, and
// autofill will work normally.
//
// This policy is intended to be removed in Chrome 130.
//
// Valid values:
//   True: Show warnings and disable autofill on insecure forms
//   False: Do not show warnings or disable autofill on insecure forms
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message InsecureFormsWarningsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool InsecureFormsWarningsEnabled = 2;
}

// Insecure Hashes in TLS Handshakes Enabled
//
// This policy was removed in Google Chrome 124. Starting that version, insecure
// hashes always disallowed. In prior versions, this policy controlled whether
// the browser allowed legacy insecure hashes during the TLS handshake process.
//
// If this policy is not configured, Google Chrome would follow the default
// rollout process for disallowing insecure hashes. If it is enabled, Google
// Chrome would allow insecure hashes to be used by a server when negotiating a
// TLS handshake. If it is disabled, Google Chrome would disallow insecure
// hashes to be used by a server when negotiating a TLS handshake.
//
// Valid values:
//   None: Use Default Value for Hashes Allowed in TLS Handshakes.
//   False: Do Not Allow Insecure Hashes in TLS Handshakes
//   True: Allow Insecure Hashes in TLS Handshakes
//
// Supported on:
message InsecureHashesInTLSHandshakesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool InsecureHashesInTLSHandshakesEnabled = 2;
}

// Specifies whether to allow websites to make requests to more-private network
// endpoints in an insecure manner
//
// Controls whether websites are allowed to make requests to more-private
// network endpoints in an insecure manner.
//
// When this policy is set to true, all Private Network Access checks are
// disabled for all origins. This may allow attackers to perform CSRF attacks on
// private network servers.
//
// When this policy is either not set or set to false, the default behavior for
// requests to more-private network endpoints will depend on the user's personal
// configuration for the BlockInsecurePrivateNetworkRequests,
// PrivateNetworkAccessSendPreflights, and
// PrivateNetworkAccessRespectPreflightResults feature flags, which may be set
// by field trials or on the command line.
//
// This policy relates to the Private Network Access specification. See
// https://wicg.github.io/private-network-access/ for more details.
//
// A network endpoint is more private than another if:
// 1) Its IP address is localhost and the other is not.
// 2) Its IP address is private and the other is public.
// In the future, depending on spec evolution, this policy might apply to all
// cross-origin requests directed at private IPs or localhost.
//
// When this policy is set to true, websites are allowed to make requests to any
// network endpoint, subject to other cross-origin checks.
//
// Valid values:
//   True: Allow websites to make requests to any network endpoint in an
// insecure manner.
//   False: Use default behavior when determining if websites can make requests
// to network endpoints.
//
// Supported on:
message InsecurePrivateNetworkRequestsAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool InsecurePrivateNetworkRequestsAllowed = 2;
}

// Allow the listed sites to make requests to more-private network endpoints in
// an insecure manner.
//
// List of URL patterns. Requests initiated from websites served by matching
// origins are not subject to Private Network Access checks.
//
// If unset, this policy behaves as if set to the empty list.
//
// For origins not covered by the patterns specified here, the global default
// value will be used either from the InsecurePrivateNetworkRequestsAllowed
// policy, if it is set, or the user's personal configuration otherwise.
//
// For detailed information on valid URL patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.
//
// Supported on:
message InsecurePrivateNetworkRequestsAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList InsecurePrivateNetworkRequestsAllowedForUrls = 2;
}

// Control the shortcut used to trigger the Insert "six pack" key
//
// This policy determines the default behavior for remapping the Insert key
// within the 'remap keys' subpage. The 'remap keys' subpage allows users to
// customize keyboard keys. If enabled, this policy prevents users from
// customizing these specific remappings. If the policy is not set,
// search-based shortcuts will act as the default.
//
// Valid values:
//   0: Setting a shortcut for the "Insert" action is disabled.
//   2: Insert shortcut setting uses the shortcut that contains the search
// modifier
//
// Supported on: chrome_os
message InsertKeyModifierProto {
  optional PolicyOptions policy_options = 1;
  optional int64 InsertKeyModifier = 2;
}

// Enable insights extension for reporting usage metrics
//
// The insights extension reports user internet download and upload speed, user
// idle time, and application insights.
//
// If the policy is set to enabled, the insights extension will be installed and
// report metrics.
//
// If the policy is not set or set to disabled, then the insights extension will
// not be installed and will not report metrics.
//
// Valid values:
//   True: Enable insights extension
//   False: Disable insights extension
//
// Supported on: chrome_os
message InsightsExtensionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool InsightsExtensionEnabled = 2;
}

// Enable Instant
//
// Enables Google Chrome's Instant feature and prevents users from changing this
// setting.
//
// If you enable this setting, Google Chrome Instant is enabled.
//
// If you disable this setting, Google Chrome Instant is disabled.
//
// If you enable or disable this setting, users cannot change or override this
// setting.
//
// If this setting is left not set the user can decide to use this function or
// not.
//
// This setting has been removed from Google Chrome 29 and higher versions.
//
// Supported on:
message InstantEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool InstantEnabled = 2;
}

// Allow Instant Tethering to be used.
//
// If this setting is enabled, users will be allowed to use Instant Tethering,
// which allows their Google phone to share its mobile data with their device.
//
// If this setting is disabled, users will not be allowed to use Instant
// Tethering.
//
// If this policy is left not set, the default is not allowed for enterprise-
// managed users and allowed for non-managed users.
//
// Valid values:
//   True: Allow users to use Instant Tethering
//   False: Do not allow users to use Instant Tethering
//
// Supported on: chrome_os
message InstantTetheringAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool InstantTetheringAllowed = 2;
}

// Allow reusing the Google ChromeOS login credentials for network
// authentication
//
// This policy is deprecated, please configure Kerberos policies to reuse the
// login password instead.
//
// Valid values:
//   True: The Google ChromeOS login credentials will be used for network
// authentication to a managed proxy.
//   False: The Google ChromeOS login credentials will not be used for network
// authentication.
//
// Supported on:
message IntegratedWebAuthenticationAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool IntegratedWebAuthenticationAllowed = 2;
}

// Control the IntensiveWakeUpThrottling feature.
//
// When enabled the IntensiveWakeUpThrottling feature causes JavaScript timers
// in background tabs to be aggressively throttled and coalesced, running no
// more than once per minute after a page has been backgrounded for 5 minutes or
// more.
//
// This is a web standards compliant feature, but it may break functionality
// on some websites by causing certain actions to be delayed by up to a
// minute. However, it results in significant CPU and battery savings when
// enabled. See https://bit.ly/30b1XR4 for more details.
//
// If this policy is set to enabled then the feature will be force enabled, and
// users will not be able to override this.
//
// If this policy is set to disabled then the feature will be force disabled,
// and
// users will not be able to override this.
//
// If this policy is left unset then the feature will be controlled by its
// own internal logic, which can be manually configured by users.
//
// Note that the policy is applied per renderer process, with the most recent
// value of the policy setting in force when a renderer process starts. A full
// restart is required to ensure that all loaded tabs receive a consistent
// policy setting. It is harmless for processes to be running with different
// values of this policy.
//
// Valid values:
//   True: Force throttling of background JavaScript timers
//   False: Force no throttling of background JavaScript timers
//   None: Allow throttling of background JavaScript timers to be controlled by
// Chrome logic and configured by users
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message IntensiveWakeUpThrottlingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool IntensiveWakeUpThrottlingEnabled = 2;
}

// Intranet Redirection Behavior
//
// This policy configures behavior for intranet redirection via DNS interception
// checks. The checks attempt to discover whether the browser is behind a proxy
// that redirects unknown host names.
//
// If this policy is not set, the browser will use the default behavior of DNS
// interception checks and intranet redirect suggestions. In M88, they are
// enabled by default but will be disabled by default in the future release.
//
// DNSInterceptionChecksEnabled is a related policy that may also disable DNS
// interception checks; this policy is a more flexible version which may
// separately control intranet redirection infobars and may be expanded in the
// future.
// If either DNSInterceptionChecksEnabled or this policy requests to disable
// interception checks, the checks will be disabled.
//
// Valid values:
//   0: Use default browser behavior.
//   1: Disable DNS interception checks and did-you-mean "http://intranetsite/"
// infobars.
//   2: Disable DNS interception checks; allow did-you-mean
// "http://intranetsite/" infobars.
//   3: Allow DNS interception checks and did-you-mean "http://intranetsite/"
// infobars.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message IntranetRedirectBehaviorProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IntranetRedirectBehavior = 2;
}

// Enable Site Isolation for specified origins
//
// Specify a list of origins that run in a dedicated process.
//
// On Android, this policy only works on devices with sufficient memory
// (strictly more than 3.2GB RAM), as isolating too many sites on resource-
// constrained devices may cause performance problems. For resource-constrained
// Android devices, please use IsolateOriginsShortlist instead.
//
// Devices with less than 1GB memory are not recommended to configure any
// process isolation specifically.
//
// Each named origin's process will only be allowed to contain documents from
// that origin and its subdomains. For example, specifying
// https://a1.example.com/ allows https://a2.a1.example.com/ in the same
// process, but not https://example.com or https://b.example.com.
//
// Since Google Chrome 77, you can also specify a range of origins to isolate
// using a wildcard. For example, specifying https://[*.]corp.example.com will
// give every origin underneath https://corp.example.com its own dedicated
// process, including https://corp.example.com itself,
// https://a1.corp.example.com, and https://a2.a1.corp.example.com.
//
// Note that all sites (i.e., scheme plus eTLD+1, such as https://example.com)
// are already isolated by default on Desktop platforms, as noted in the
// SitePerProcess policy. This IsolateOrigins policy is useful to isolate
// specific origins at a finer granularity (e.g., https://a.example.com).
//
// Note that Android isolates certain sensitive sites by default starting in
// Google Chrome version 77, and this policy extends that mode to isolate
// specific additional origins.
//
// Also note that origins isolated by this policy will be unable to script other
// origins in the same site, which is otherwise possible if two same-site
// documents modify their document.domain values to match. Administrators should
// confirm this uncommon behavior is not used on an origin before isolating it.
//
// Setting the policy to an empty string or leaving it unset means site
// isolation won't be required for any specific origins. Users can still turn on
// process isolation manually, through the command line flag.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message IsolateOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional string IsolateOrigins = 2;
}

// Enable Site Isolation for specified origins on Android devices (deprecated)
//
// Setting the policy means each of the named origins in a comma-separated list
// runs in a dedicated process on Android. Each named origin's process will only
// be allowed to contain documents from that origin and its subdomains. For
// example, specifying https://a1.example.com/ allows https://a2.a1.example.com/
// in the same process, but not https://example.com or https://b.example.com.
// Note that Android isolates certain sensitive sites by default starting in
// Google Chrome version 77, and this policy extends that mode to isolate
// specific additional origins.
//
// Since Google Chrome 77, you can also specify a range of origins to isolate
// using a wildcard. For example, specifying https://[*.]corp.example.com will
// give every origin underneath https://corp.example.com its own dedicated
// process, including https://corp.example.com itself,
// https://a1.corp.example.com, and https://a2.a1.corp.example.com.
//
// Note that origins isolated by this policy will be unable to script other
// origins in the same site, which is otherwise possible if two same-site
// documents modify their document.domain values to match. Administrators should
// confirm this uncommon behavior is not used on an origin before isolating it.
//
// Setting the policy to an empty string or leaving it unset means site
// isolation won't be required for any specific origins. Users can still turn on
// process isolation manually, through the command line flag.
//
// Note: This policy is deprecated, use IsolateOrigins (for high-performance
// devices) or IsolateOriginsShortlist instead. This policy applies only to
// Chrome on Android running on devices with strictly more than 1 GB of RAM
// which are not recommended to configure any process isolation specifically.
//
// Supported on: android
message IsolateOriginsAndroidProto {
  optional PolicyOptions policy_options = 1;
  optional string IsolateOriginsAndroid = 2;
}

// Enable Site Isolation for specified origins on resource-constrained devices
//
// Specify a list of origins that run in a dedicated process on resource-
// constrained platforms.
//
// This policy only works on devices with limited memory (between 1GB and 3.2GB
// RAM), as isolating too many sites on resource-constrained devices may cause
// performance problems. For high-performance environments (including high-end
// Android devices), please use IsolateOrigins instead.
//
// Devices with less than 1GB memory are not recommended to configure any
// process isolation specifically.
//
// Each named origin's process will only be allowed to contain documents from
// that origin and its subdomains. For example, specifying
// https://a1.example.com/ allows https://a2.a1.example.com/ in the same
// process, but not https://example.com or https://b.example.com.
//
// You can also specify a range of origins to isolate using a wildcard. For
// example, specifying https://[*.]corp.example.com will give every origin
// underneath https://corp.example.com its own dedicated process, including
// https://corp.example.com itself, https://a1.corp.example.com, and
// https://a2.a1.corp.example.com.
//
// Note that Android isolates certain sensitive sites by default starting in
// Google Chrome version 77, and this policy extends that mode to isolate
// specific additional origins.
//
// Note that origins isolated by this policy will be unable to script other
// origins in the same site, which is otherwise possible if two same-site
// documents modify their document.domain values to match. Administrators should
// confirm this uncommon behavior is not used on an origin before isolating it.
//
// Setting the policy to an empty string or leaving it unset means site
// isolation won't be required for any specific origins. Users can still turn on
// process isolation manually, through the command line flag.
//
// Supported on: android, linux, mac, win
message IsolateOriginsShortlistProto {
  optional PolicyOptions policy_options = 1;
  optional string IsolateOriginsShortlist = 2;
}

// Replace Incognito Mode with Isolated Mode
//
// Specifies whether Isolated Mode is enabled.
//
// Isolated Mode is an Enterprise-only ephemeral browsing mode.
// It supports DLP-related Enterprise policies and force-installed extensions.
//
// If set to 1 - Enabled, Isolated Mode is enabled and Incognito Mode is
// disabled.
//
// If set to 0 - Disabled or left unset, Isolated Mode is disabled.
//
// This policy requires a `Chrome Enterprise Premium` license to take effect.
//
// Valid values:
//   0: Isolated mode disabled
//   1: Isolated mode available
//
// Supported on: android, chrome_os, ios, linux, mac, win
message IsolatedModeSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 IsolatedModeSettings = 2;
}

// Configure list of force-installed Isolated Web Apps
//
// Setting the policy specifies a list of isolated web apps (IWAs) that install
// silently.
// IWAs are applications that have useful security properties unavailable to
// normal web pages. They are packaged in a Signed Web Bundle. The public key of
// the Signed Web Bundle is used to create the Web Bundle ID that identifies the
// IWA.
// So far this policy works for Managed Guest Session only.
//
// Each list item of the policy is an object which has two mandatory fields: the
// update manifest URL and Web Bundle ID of the Isolated Web App.
//
// Each item can also include these optional fields:
//
// * update_channel: The IWA release/update channel name. If not set, "default"
// is used.
//
// * pinned_version:  A specific version to install. The system will attempt to
// install this version if available on the specified update channel. By
// default, pinning an IWA to a specific version prevents it from being updated
// beyond that version. To unpin, remove this field.
//
// * allow_downgrades:: Enables installing older versions of the IWA. This
// requires the `pinned_version` field to be set. If not provided or set to
// false downgrading is disabled for that IWA.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "allow_downgrades": {
//                 "description": "Enables the downgrading feature for IWAs. By
// default, only newer versions of IWAs are installed. When set to <ph
// name=\"TRUE\">true</ph>, this allows you to install older versions as well.
// To enable downgrading, the desired version value must be specified by using
// the `pinned_version` field. If `allow_downgrades` is not provided or is set
// to <ph name=\"FALSE\">false</ph>, downgrading is disabled for that IWA.",
//                 "type": "boolean"
//             },
//             "pinned_version": {
//                 "description": "Specifies the desired version of the IWA. If
// provided, the system will attempt to install this specific version and
// subsequently block any further updates. To unpin the app and enable updates
// again, remove this field. **Important:** If the provided version does not
// exist, the IWA will get stuck on the currently installed version. This is
// because after trying (and it this case failing) to update to pinned version,
// pinning disables any further automatic updates.",
//                 "type": "string"
//             },
//             "update_channel": {
//                 "description": "The name of the IWA's update/release channel.
// This value can be any string; no restrictions are imposed. If no value is
// provided, the \"default\" channel will be used.",
//                 "type": "string"
//             },
//             "update_manifest_url": {
//                 "type": "string"
//             },
//             "web_bundle_id": {
//                 "type": "string"
//             }
//         },
//         "required": [
//             "update_manifest_url",
//             "web_bundle_id"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, linux, mac, win
message IsolatedWebAppInstallForceListProto {
  optional PolicyOptions policy_options = 1;
  optional string IsolatedWebAppInstallForceList = 2;
}

// Controls the ability for a user to manually install Isolated Web Apps
//
// Controls the user's ability to manually install Isolated Web Apps (IWAs).
//
// If this policy is set to false, IWA user installation is blocked.
//
// If this policy is set to true, or if the policy is not set, IWA user
// installations are permitted.
//
// Valid values:
//   True: Enable IWA user installation
//   False: Disable IWA user installation
//
// Supported on: chrome_os
message IsolatedWebAppUserInstallationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool IsolatedWebAppUserInstallationEnabled = 2;
}

// Allow JavaScript on these sites
//
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can run JavaScript.
//
// Leaving the policy unset means DefaultJavaScriptSetting applies for all
// sites, if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message JavaScriptAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList JavaScriptAllowedForUrls = 2;
}

// Block JavaScript on these sites
//
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can't run JavaScript.
//
// Leaving the policy unset means DefaultJavaScriptSetting applies for all
// sites, if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Note that this policy blocks JavaScript based on whether the origin of the
// top-level document (usually the page URL that is also displayed in the
// address bar) matches any of the patterns. Therefore this policy is not
// appropriate for mitigating web supply-chain attacks. For example, supplying
// the pattern "https://[*.]foo.com/" will not prevent a page hosted on, say,
// https://example.com from running a script loaded from
// https://www.foo.com/example.js. Furthermore, supplying the pattern
// "https://example.com/" will not prevent a document from https://example.com
// from running scripts if it is not the top-level document, but embedded as a
// sub-frame into a page hosted on another origin, say, https://www.bar.com.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message JavaScriptBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList JavaScriptBlockedForUrls = 2;
}

// Allow JavaScript to use JIT on these sites
//
// Allows you to set a list of site url patterns that specify sites which are
// allowed to run JavaScript with JIT (Just In Time) compiler enabled.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// JavaScript JIT policy exceptions will only be enforced at a site granularity
// (eTLD+1). A policy set for only subdomain.site.com will not correctly apply
// to site.com or subdomain.site.com since they both resolve to the same eTLD+1
// (site.com) for which there is no policy. In this case, policy must be set on
// site.com to apply correctly for both site.com and subdomain.site.com.
//
// This policy applies on a frame-by-frame basis and not based on top level
// origin url alone, so e.g. if site-one.com is listed in the
// JavaScriptJitAllowedForSites policy but site-one.com loads a frame containing
// site-two.com then site-one.com will have JavaScript JIT enabled, but site-
// two.com will use the policy from DefaultJavaScriptJitSetting, if set, or
// default to JavaScript JIT enabled.
//
// If this policy is not set for a site then the policy from
// DefaultJavaScriptJitSetting applies to the site, if set, otherwise Javascript
// JIT is enabled for the site.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message JavaScriptJitAllowedForSitesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList JavaScriptJitAllowedForSites = 2;
}

// Block JavaScript from using JIT on these sites
//
// Allows you to set a list of site url patterns that specify sites which are
// not allowed to run JavaScript JIT (Just In Time) compiler enabled.
//
// Disabling the JavaScript JIT will mean that Google Chrome may render web
// content more slowly, and may also disable parts of JavaScript including
// WebAssembly. Disabling the JavaScript JIT may allow Google Chrome to render
// web content in a more secure configuration.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// JavaScript JIT policy exceptions will only be enforced at a site granularity
// (eTLD+1). A policy set for only subdomain.site.com will not correctly apply
// to site.com or subdomain.site.com since they both resolve to the same eTLD+1
// (site.com) for which there is no policy. In this case, policy must be set on
// site.com to apply correctly for both site.com and subdomain.site.com.
//
// This policy applies on a frame-by-frame basis and not based on top level
// origin url alone, so e.g. if site-one.com is listed in the
// JavaScriptJitBlockedForSites policy but site-one.com loads a frame containing
// site-two.com then site-one.com will have JavaScript JIT disabled, but site-
// two.com will use the policy from DefaultJavaScriptJitSetting, if set, or
// default to JavaScript JIT enabled.
//
// If this policy is not set for a site then the policy from
// DefaultJavaScriptJitSetting applies to the site, if set, otherwise JavaScript
// JIT is enabled for the site.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message JavaScriptJitBlockedForSitesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList JavaScriptJitBlockedForSites = 2;
}

// Allow JavaScript optimization on these sites
//
// Allows you to set a list of site url patterns that specify sites for which
// advanced JavaScript optimizations are enabled.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns.
// Wildcards, *, are allowed.
//
// JavaScript optimization policy exceptions will only be enforced at a site
// granularity (eTLD+1). A policy set for only subdomain.site.com will not
// correctly apply to site.com or subdomain.site.com since they both resolve to
// the same eTLD+1 (site.com) for which there is no policy. In this case, policy
// must be set on site.com to apply correctly for both site.com and
// subdomain.site.com.
//
// This policy applies on a frame-by-frame basis and not based on top level
// origin url alone, so e.g. if site-one.com is listed in the
// JavaScriptOptimizerAllowedForSites policy but site-one.com loads a frame
// containing site-two.com then site-one.com will have JavaScript optimizations
// enabled, but site-two.com will use the policy from
// DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript
// optimizations enabled. Blocklist entries have higher priority than allowlist
// entries, which in turn have higher priority than the configured default
// value.
//
// If this policy is not set for a site then the policy from
// DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise
// Javascript optimization is enabled for the site.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message JavaScriptOptimizerAllowedForSitesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList JavaScriptOptimizerAllowedForSites = 2;
}

// Block JavaScript optimizations on these sites
//
// Allows you to set a list of site url patterns that specify sites for which
// advanced JavaScript optimizations are disabled.
//
// Disabling JavaScript optimizations will mean that Google Chrome may render
// web content more slowly.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns.
// Wildcards, *, are allowed.
//
// JavaScript optimization policy exceptions will only be enforced at a site
// granularity (eTLD+1). A policy set for only subdomain.site.com will not
// correctly apply to site.com or subdomain.site.com since they both resolve to
// the same eTLD+1 (site.com) for which there is no policy. In this case, policy
// must be set on site.com to apply correctly for both site.com and
// subdomain.site.com.
//
// This policy applies on a frame-by-frame basis and not based on top level
// origin url alone, so e.g. if site-one.com is listed in the
// JavaScriptOptimizerBlockedForSites policy but site-one.com loads a frame
// containing site-two.com then site-one.com will have JavaScript optimizations
// disabled, but site-two.com will use the policy from
// DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript
// optimizations enabled. Blocklist entries have higher priority than allowlist
// entries, which in turn have higher priority than the configured default
// value.
//
// If this policy is not set for a site then the policy from
// DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise
// JavaScript optimization is enabled for the site.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message JavaScriptOptimizerBlockedForSitesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList JavaScriptOptimizerBlockedForSites = 2;
}

// Enable JavaScript
//
// This policy is deprecated, please use DefaultJavaScriptSetting instead.
//
// Can be used to disabled JavaScript in Google Chrome.
//
// If this setting is disabled, web pages cannot use JavaScript and the user
// cannot change that setting.
//
// If this setting is enabled or not set, web pages can use JavaScript but the
// user can change that setting.
//
// Valid values:
//   True: Enable JavaScript
//   False: Disable JavaScript
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message JavascriptEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool JavascriptEnabled = 2;
}

// List of URLs which are allowed to remain in full screen mode without showing
// a notification
//
// Configure a list of URLs that are allowed to stay in full screen mode without
// showing a notification when the device returns from the lock screen.
//
// Normally, full screen mode is turned off when returning from the lock screen
// in order to reduce the risk of phishing attacks. This policy allows to
// specify URLs that will be considered trusted sources which are permitted to
// continue full screen mode on unlock. It is set by specifying a list of URL
// patterns formatted according to this format (
// https://support.google.com/chrome/a?p=url_blocklist_filter_format ). E.g., it
// is possible to always keep full screen mode on unlock and disable the
// notifications altogether by specifying the wildcard character * matching all
// URLs.
//
// Setting this policy to an empty list or leaving it unset means no URLs are
// allowed to continue full screen mode without a notification.
//
// Supported on: chrome_os
message KeepFullscreenWithoutNotificationUrlAllowListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList KeepFullscreenWithoutNotificationUrlAllowList = 2;
}

// Configure Kerberos accounts
//
// Adds prefilled Kerberos accounts. If the Kerberos credentials match the login
// credentials, an account can be configured to reuse the login credentials by
// specifying '${LOGIN_EMAIL}' and ${PASSWORD}' for principal and password,
// respectively, so that the Kerberos ticket can be retrieved automatically,
// unless two-factor authentication is configured. Users cannot modify accounts
// added via this policy.
//
// If this policy is enabled, the list of accounts defined by the policy is
// added to the Kerberos Accounts settings.
//
// If this policy is disabled or not set, no accounts are added to the Kerberos
// Accounts settings and all accounts previously added with this policy are
// removed. Users may still add accounts manually if the 'Users can add Kerberos
// accounts' policy is enabled.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "krb5conf": {
//                 "description": "Kerberos configuration (one line per array
// item), see
// https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html.",
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "password": {
//                 "description": "Kerberos password. The placeholder <ph
// name=\"PASSWORD_PLACEHOLDER\">${PASSWORD}</ph> is replaced by the login
// password.",
//                 "sensitiveValue": true,
//                 "type": "string"
//             },
//             "principal": {
//                 "description": "User principal 'user@realm'. The placeholder
// <ph name=\"LOGIN_ID_PLACEHOLDER\">${LOGIN_ID}</ph> is replaced by the
// username 'user'. The placeholder <ph
// name=\"LOGIN_EMAIL_PLACEHOLDER\">${LOGIN_EMAIL}</ph> is replaced by the full
// principal 'user@realm'.",
//                 "pattern":
// "^(?:[^@]+@[^@]+)|(?:\\${LOGIN_ID})|(?:\\${LOGIN_EMAIL})$",
//                 "type": "string"
//             },
//             "remember_password_from_policy": {
//                 "description": "Whether to remember the Kerberos password
// value set in this policy item. If not set or set to true, the password is
// remembered. If set to false, the password is not remembered. Ignored if the
// password field is not specified for this account. This field is supported
// since ChromeOS version 116.",
//                 "type": "boolean"
//             }
//         },
//         "required": [
//             "principal"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os
message KerberosAccountsProto {
  optional PolicyOptions policy_options = 1;
  optional string KerberosAccounts = 2;
}

// Users can add Kerberos accounts
//
// Controls whether users may add Kerberos accounts.
//
// If this policy is enabled or not set, users may add Kerberos accounts via the
// Kerberos Accounts settings in the Kerberos settings page. Users have full
// control over accounts they added and may modify or remove them.
//
// If this policy is disabled, users may not add Kerberos accounts. Accounts can
// only be added via the 'Configure Kerberos accounts' policy. This is an
// effective way to lock down accounts.
//
// Valid values:
//   True: Allow users to add Kerberos accounts
//   False: Do not allow users to add Kerberos accounts
//
// Supported on: chrome_os
message KerberosAddAccountsAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool KerberosAddAccountsAllowed = 2;
}

// Prefilled configuration for Kerberos tickets
//
// Specifies the suggested krb5 configuration for the new manually created
// tickets.
//
// If the 'KerberosUseCustomPrefilledConfig' policy is enabled, the policy's
// value is applied as the suggested configuration and shown in the "Advanced"
// section of the Kerberos authentication dialog. Setting this policy to an
// empty string, or leaving it unset, will result in deleting the recommended
// Google ChromeOS configuration.
//
// If the 'KerberosUseCustomPrefilledConfig' policy is disabled, the value of
// this policy is not used.
//
// Supported on: chrome_os
message KerberosCustomPrefilledConfigProto {
  optional PolicyOptions policy_options = 1;
  optional string KerberosCustomPrefilledConfig = 2;
}

// Autocomplete domain for new Kerberos tickets
//
// Adds a prefilled domain to the Kerberos authentication dialog.
//
// If this policy is set, the "Kerberos username" field shows the prefilled
// domain on the right. If the user enters their username it is going to be
// concatenated with the prefilled domain. If the user's input contains "@", the
// prefilled domain is not shown and does not affect the input.
//
// If this policy is unset, no additional information is shown and creating the
// ticket works as usual.
//
// Supported on: chrome_os
message KerberosDomainAutocompleteProto {
  optional PolicyOptions policy_options = 1;
  optional string KerberosDomainAutocomplete = 2;
}

// Enable Kerberos functionality
//
// Controls whether the Kerberos functionality is enabled. Kerberos is an
// authentication protocol that can be used to authenticate to web apps and file
// shares.
//
// If this policy is enabled, Kerberos functionality is enabled. Kerberos
// accounts can be added either through the 'Configure Kerberos accounts' policy
// or through the Kerberos Accounts settings in the Kerberos settings page.
//
// If this policy is disabled or not set, the Kerberos Accounts settings are
// disabled. No Kerberos accounts can be added and Kerberos authentication
// cannot be used. All existing Kerberos accounts are deleted, all stored
// passwords are deleted.
//
// Valid values:
//   True: Enable Kerberos
//   False: Disable Kerberos
//
// Supported on: chrome_os
message KerberosEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool KerberosEnabled = 2;
}

// Enable 'Remember password' feature for Kerberos
//
// Controls whether the 'Remember password' feature is enabled in the Kerberos
// authentication dialog. Passwords are stored encrypted on disk, only
// accessible to the Kerberos system daemon and during a user session.
//
// If this policy is enabled or not set, users can decide whether Kerberos
// passwords are remembered, so that they do not have to be entered again.
// Kerberos tickets are automatically fetched unless additional authentication
// is required (two-factor authentication).
//
// If this policy is disabled, passwords are never remembered and all previously
// stored passwords are removed. Users have to enter their password every time
// they need to authenticate with the Kerberos system. Depending on server
// settings, this usually happens between every 8 hours to several months.
//
// Valid values:
//   True: Allow users to remember Kerberos passwords
//   False: Do not allow users to remember Kerberos passwords
//
// Supported on: chrome_os
message KerberosRememberPasswordEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool KerberosRememberPasswordEnabled = 2;
}

// Change the prefilled configuration for Kerberos tickets
//
// Changes the suggested krb5 configuration for the new manually created
// tickets.
//
// If this policy is enabled, the value of 'KerberosCustomPrefilledConfig'
// policy is applied as the suggested configuration and shown in the "Advanced"
// section of the Kerberos authentication dialog.
//
// If this policy is disabled or not set, the recommended Google ChromeOS
// configuration is applied instead. Note that it is also shown in the
// "Advanced" section of the Kerberos authentication dialog.
//
// Valid values:
//   True: Change the recommended Google ChromeOS configuration.
//   False: Don't change the recommended Google ChromeOS configuration.
//
// Supported on: chrome_os
message KerberosUseCustomPrefilledConfigProto {
  optional PolicyOptions policy_options = 1;
  optional bool KerberosUseCustomPrefilledConfig = 2;
}

// Key Permissions
//
// Setting the policy grants access to corporate keys to extensions or Android
// applications. Keys are designated for corporate usage only if they're
// generated using the chrome.enterprise.platformKeys API on a managed account.
// Users can't grant or withdraw access to corporate keys to or from extensions
// or Android applications.
//
// By default, an extension or an Android applications can't use a key
// designated for corporate usage, which is equivalent to setting
// allowCorporateKeyUsage to False for it. Only if allowCorporateKeyUsage is set
// to True for an extension or an Android application can it use any platform
// key marked for corporate usage to sign arbitrary data. Only grant this
// permission if the extension or the Android application is trusted to secure
// access to the key against attackers.
//
// Value schema:
// {
//     "additionalProperties": {
//         "properties": {
//             "allowCorporateKeyUsage": {
//                 "description": "If set to true, this extension can use all
// keys that are designated for corporate usage to sign arbitrary data. If set
// to false, it cannot access any such keys and the user cannot grant such
// permission either. As an exception, an extension can access such a key
// exactly once if the same extension generated that key.",
//                 "type": "boolean"
//             }
//         },
//         "type": "object"
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message KeyPermissionsProto {
  optional PolicyOptions policy_options = 1;
  optional string KeyPermissions = 2;
}

// Media keys default to function keys
//
// Setting the policy to True makes the top row of keys on the keyboard act as
// function key commands. Pressing the Search key changes their behavior back to
// media keys.
//
// If set to False or not set, the keyboard defaults to producing media key
// commands. Pressing the Search key changes them to function keys.
//
// Valid values:
//   True: Treat top-row keys as function keys, but allow user to change
//   False: Treat top-row keys as media keys, but allow user to change
//
// Supported on: chrome_os
message KeyboardDefaultToFunctionKeysProto {
  optional PolicyOptions policy_options = 1;
  optional bool KeyboardDefaultToFunctionKeys = 2;
}

// Enable the keyboard focus highlighting accessibility feature
//
// Enable the keyboard focus highlighting accessibility feature.
//
// This feature is responsible for highlighting the object that has the focus by
// the keyboard.
//
// If this policy is set to enabled, the keyboard focus highlighting will always
// be enabled.
//
// If this policy is set to disabled, the keyboard focus highlighting will
// always be disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the keyboard focus highlighting is disabled
// initially but can be enabled by the user anytime.
//
// Valid values:
//   True: Enable keyboard focus highlighting
//   False: Disable keyboard focus highlighting
//   None: Allow the user to decide
//
// Supported on: chrome_os
message KeyboardFocusHighlightEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool KeyboardFocusHighlightEnabled = 2;
}

// Enable keyboard focusable scrollers
//
// This policy provides a temporary opt-out for the new keyboard focusable
// scrollers behavior.
//
// When this policy is Enabled or unset, scrollers without focusable children
// are keyboard-focusable by default.
//
// When this policy is Disabled, scrollers will not be keyboard-focusable by
// default.
//
// This policy is a temporary workaround. From M139, this policy is deprecated.
//
// Valid values:
//   True: Enabled: Scrollers are focusable by default.
//   False: Disabled: Scrollers are not focusable by default.
//
// Supported on:
message KeyboardFocusableScrollersEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool KeyboardFocusableScrollersEnabled = 2;
}

// Allow key generation on these sites
//
// Allows you to set a list of url patterns that specify sites which are allowed
// to use key generation. If a url pattern is in 'KeygenBlockedForUrls', that
// overrides these exceptions.
//
// If this policy is left not set the global default value will be used for all
// sites either from the 'DefaultKeygenSetting' policy if it is set, or the
// user's personal configuration otherwise.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on:
message KeygenAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList KeygenAllowedForUrls = 2;
}

// Block key generation on these sites
//
// Allows you to set a list of url patterns that specify sites which are not
// allowed to use key generation. If a url pattern is in 'KeygenAllowedForUrls',
// this policy overrides these exceptions.
//
// If this policy is left not set the global default value will be used for all
// sites either from the 'DefaultKeygenSetting' policy if it is set, or the
// user's personal configuration otherwise.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on:
message KeygenBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList KeygenBlockedForUrls = 2;
}

// Expose per-app kiosk active WiFi credentials to the device level
//
// Setting the policy to Enabled means Google ChromeOS will automatically save
// the active kiosk WiFi credentials at the device level: the active WiFi can be
// used by any other kiosk apps or users on the device.
// Leaving this policy unset or setting it to Disabled means kiosk active WiFi
// credentials are stored at the kiosk level: WiFi configured in a kiosk app can
// only be used in that same kiosk app.
// This policy is not recommended and has to be used when no other options are
// available (e.g. OpenNetworkConfiguration policy).
//
// Valid values:
//   True: Save the active WiFi credentials at the device level
//   False: Kiosk WiFi credentials are stored at the kiosk level
//
// Supported on: chrome_os
message KioskActiveWiFiCredentialsScopeChangeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool KioskActiveWiFiCredentialsScopeChangeEnabled = 2;
}

// Enable kiosk application log collection
//
// Setting the policy to Enabled means Kiosk application level logs would be
// collected when a kiosk application is running on the device. Logs would be
// collected for all kiosk application types.
// These logs would be stored in a separate kiosk_apps.log file.
// Leaving this policy unset or setting it to Disabled means the Kiosk
// application level logs would not be collected.
//
// Valid values:
//   True: Enable Kiosk application logs
//   False: Disable Kiosk application logs
//
// Supported on: chrome_os
message KioskApplicationLogCollectionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool KioskApplicationLogCollectionEnabled = 2;
}

// Allow origins to access browser permissions available to the web kiosk
// install origin.
//
// Setting the policy allows listed additional origins to access browser
// permissions (e.g. geo location, camera, microphone) which are already
// available to the web kiosk applications install origin.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os
message KioskBrowserPermissionsAllowedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList KioskBrowserPermissionsAllowedForOrigins = 2;
}

// Force Allow Chrome Apps in Kiosk mode
//
// Setting this policy to True allows Chrome Apps to continue to run in a Kiosk
// session, regardless of the default Chrome Apps enablement.
//
// Leaving this policy unset or setting this policy to False will use the
// default behavior defined on the device.
//
// Attempting to launch a disabled Chrome App will show the user a message
// explaining why the app was not launched and suggesting to contact their IT
// department.
//
// The value of this policy will be honored until the deprecation of Chrome Apps
// in Kiosk sessions, which is expected to happen in M151.
//
// Valid values:
//   True: Allow Chrome Apps to run in Kiosk sessions.
//   False: Use Default behavior.
//
// Supported on: chrome_os
message KioskChromeAppsForceAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool KioskChromeAppsForceAllowed = 2;
}

// Allow pinch-to-zoom in Kiosk mode
//
// Setting the policy to Enabled or leaving it unset means pinch-to-zoom is
// allowed in a Kiosk session.
//
// Setting the policy to Disabled means pinch-to-zoom is not allowed in a Kiosk
// session.
//
// Valid values:
//   True: Allow pinch-to-zoom in Kiosk mode
//   False: Disable pinch-to-zoom in Kiosk mode
//
// Supported on: chrome_os
message KioskPinchToZoomAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool KioskPinchToZoomAllowed = 2;
}

// Enable Kiosk troubleshooting tools
//
// Setting the policy to Enabled means Kiosk troubleshooting tools are available
// to be used in a Kiosk session:
// - Chrome developer tools
// - Chrome browser window
// - Task manager
// Leaving this policy unset or setting to Disabled means Kiosk troubleshooting
// tools are disabled.
//
// Please remember not to keep this policy enabled at all times, especially in
// production deployments.
//
// Valid values:
//   True: Enable Kiosk troubleshooting tools.
//   False: Disable Kiosk troubleshooting tools.
//
// Supported on: chrome_os
message KioskTroubleshootingToolsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool KioskTroubleshootingToolsEnabled = 2;
}

// Allow kiosk web app to show network prompt on app launch if the device is
// offline
//
// If the policy is disabled, it represents that the kiosk web app cannot
// function offline. A network prompt will be shown on a kiosk session start
// only if the device is offline. This will make sure that the device is online
// before the app is successfully launched.
//
// This network prompt might not be shown if an app is set to auto-launch and
// the DeviceLocalAccountPromptForNetworkWhenOffline (https://chromeenterprise.g
// oogle/policies/#DeviceLocalAccountPromptForNetworkWhenOffline) is disabled.
//
// This policy has no effect on Chrome App or Web app which has a install URL
// which performs a cross-origin redirect to a different Web app (For eg. if the
// app install URL is  https://example.com, but, on load it redirects to a
// different Web App i.e. https://www.app.example.de).
//
// If the policy is set to true or not set, web apps will be launched even if
// the device is offline.
//
// Valid values:
//   True: Kiosk web app is offline capable
//   False: Kiosk web app is not offline capable
//
// Supported on: chrome_os
message KioskWebAppOfflineEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool KioskWebAppOfflineEnabled = 2;
}

// Enable Krisp noise cancellation
//
// This policy controls the Krisp AI noise cancellation technology on the
// device.
// It is integrated as a separate local third-party library into Google ChromeOS
// and is available only for managed users.
//
// Setting the policy to Enabled turns on Krisp AI noise cancellation audio
// processing and prevents users from disabling it.
//
// Setting the policy to Disabled or not setting the policy turns off Krisp AI
// noise cancellation audio processing.
//
// Valid values:
//   True: Enable Krisp noise cancellation
//   False: Disable Krisp noise cancellation
//
// Supported on: chrome_os
message KrispNoiseCancellationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool KrispNoiseCancellationEnabled = 2;
}

// Allow usage of Lacros
//
// This setting is deprecated. Use LacrosAvailability instead.
//
// If this policy is set to Disabled or unset, the user cannot use Lacros.
//
// If this policy is set to Enabled, the user can use the Lacros browser.
//
// Valid values:
//   True: Allow users to use the Lacros browser
//   False: Prevent users from using the Lacros browser
//
// Supported on:
message LacrosAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool LacrosAllowed = 2;
}

// Make the Lacros browser available
//
// This setting provides several availability options for the Lacros browser.
//
// If the policy is set to user_choice, the user can enable Lacros and make it
// primary.
//
// If the policy is set to lacros_disallowed, the user cannot use Lacros.
//
// If the policy is set to side_by_side, Lacros is enabled but is not the
// primary browser.
//
// If the policy is set to lacros_primary, Lacros is enabled and is the primary
// browser.
//
// If the policy is unset, the default is lacros_disallowed for enterprise-
// managed users and user_choice for non-managed users.
//
// In the future it will be possible to make Lacros the only available browser
// in Google ChromeOS with lacros_only value.
//
// Valid values:
//   user_choice: Allow users to enable Lacros and make it the primary browser
//   lacros_disallowed: Prevent users from using Lacros
//   side_by_side: Enable Lacros
//   lacros_primary: Enable Lacros and make it the primary browser
//   lacros_only: Make Lacros the only available browser (not implemented yet)
//
// Supported on:
message LacrosAvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional string LacrosAvailability = 2;
}

// Choose what happens with user data after Lacros is disabled
//
// This setting decides how much user data is kept after Lacros is disabled.
//
// If the policy is set to none or unset, backward data migration is not
// performed.
//
// If the policy is set to keep_none, all user data is removed. This is the
// safest option.
//
// If the policy is set to keep_safe_data, most user data is removed. Only
// browser independent files are kept (such as Downloads).
//
// If the policy is set to keep_all, all user data is kept. This option has a
// high risk of failure, requiring a powerwash to recover.
//
// Valid values:
//   none: After Lacros is disabled, data migration is not performed. The Lacros
// folder is removed and users continue using the remaining data.
//   keep_none: After Lacros is disabled, all user data is removed on next
// login.
//   keep_safe_data: After Lacros is disabled, we attempt to keep as much user
// data as possible, while removing all browser data.
//   keep_all: After Lacros is disabled, we attempt to migrate all data.
//
// Supported on:
message LacrosDataBackwardMigrationModeProto {
  optional PolicyOptions policy_options = 1;
  optional string LacrosDataBackwardMigrationMode = 2;
}

// Allow users to create and use secondary profiles, and use guest mode in the
// Lacros browser
//
// This setting is deprecated. Allows users to create and use secondary
// profiles, and use guest mode in the Lacros browser.
//
// Similar to both BrowserAddPersonEnabled and BrowserGuestModeEnabled, if this
// policy is set to false or unset, the user cannot create or use secondary
// profiles, and use guest mode. Previously created secondary profiles, if any,
// will be unavailable.
//
// If this policy is set to true, the user can create and use secondary
// profiles, and use guest mode.
//
// Note: If this policy is set to true but BrowserAddPersonEnabled is set to
// false, the user cannot create secondary profiles. The same for
// BrowserGuestModeEnabled and guest mode.
//
// Valid values:
//   True: Allow users to create and use secondary profiles, and use guest mode
// in the Lacros browser
//   False: Prevent users from creating and using secondary profiles, and from
// using guest mode in the Lacros browser
//
// Supported on:
message LacrosSecondaryProfilesAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool LacrosSecondaryProfilesAllowed = 2;
}

// Select Lacros browser binary
//
// This setting configures which Lacros browser to use.
//
// If the policy is set to user_choice,
// the user can decide which Lacros browser to load: binary from
// rootfs or stateful partition.
// If the user has not set any preference, the binary with the newest version
// will be chosen.
//
// If the policy is set to rootfs,
// always load rootfs binary of
// Lacros browser.
//
// If the policy is unset, the default is rootfs for enterprise-managed users
// and
// user_choice for non-managed users.
//
// Note that changing the policy's value may cause
// Lacros browser's data loss if the browser's
// version it changes to is older than the current one. For example, if the
// policy changes from user_choice
// to rootfs, and the first one was
// updated. Or if Google ChromeOS was
// updated together with rootfs
// Lacros browser, and
// stateful has not been updated yet.
// In such scenarios the correct data migration is not guaranteed.
//
// Using user_choice or rootfs
// is a safe option. Switching from rootfs to user_choice
// is safe as well.
//
// Valid values:
//   user_choice: Allow users to select Lacros browser binary
//   rootfs: Always load rootfs Lacros browser
//
// Supported on:
message LacrosSelectionProto {
  optional PolicyOptions policy_options = 1;
  optional string LacrosSelection = 2;
}

// Enable large cursor
//
// Setting the policy to True keeps the large cursor on. Setting the policy to
// False keeps the large cursor off.
//
// If you set the policy, users can't change the feature. If not set, the large
// cursor is off at first, but users can turn it on any time.
//
// Valid values:
//   True: Enable large cursor
//   False: Disable large cursor
//   None: Allow the user to decide
//
// Supported on: chrome_os
message LargeCursorEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LargeCursorEnabled = 2;
}

// Revert to legacy cookie scope behavior
//
// This policy allows to revert back to the legacy behavior for cookie scoping.
//
// It means cookies set on a specific protocol (e.g. HTTPS) or port can be
// accessed from another.
//
// Setting the policy to Enabled, cookies will not be bound to their originating
// scheme and port.
//
// Setting the policy to Disabled or not set, cookies will behave with origin-
// bound scope.
//
// This configuration will only apply to top-level domains (e.g. example.com)
// and not to
// subdomains (e.g. sub.example.com).
//
// This policy will be removed in the future.
//
// Valid values:
//   0: Cookies have origin-bound scope
//   1: Revert back to legacy cookie scope behavior
//
// Supported on: android, chrome_os, linux, mac, win
message LegacyCookieScopeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional int64 LegacyCookieScopeEnabled = 2;
}

// Enable Legacy Cookie Scope behavior for a list of domains
//
// This policy provides a temporary exemption for specified domains from the new
// origin-bound cookie behavior.
//
// Adding a domain to the list will allow cookies from those domain being used
// by different scheme or port.
// More information can be found with LegacyCookieScopeEnabled.
//
// For cookies on domains not covered by the patterns specified here, or for all
// cookies if this policy is not set, they will behave with origin-bound cookie
// behavior.
//
// This policy will be removed in the future.
//
// Supported on: android, chrome_os, linux, mac, win
message LegacyCookieScopeEnabledForDomainListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LegacyCookieScopeEnabledForDomainList = 2;
}

// Default legacy SameSite cookie behavior setting
//
// This policy is deprecated, if you still require legacy cookie behavior please
// use LegacySameSiteCookieBehaviorEnabledForDomainList. Allows you to revert
// all cookies to legacy SameSite behavior. Reverting to legacy behavior causes
// cookies that don't specify a SameSite attribute to be treated as if they were
// "SameSite=None", removes the requirement for "SameSite=None" cookies to carry
// the "Secure" attribute, and skips the scheme comparison when evaluating if
// two sites are same-site. See https://www.chromium.org/administrators/policy-
// list-3/cookie-legacy-samesite-policies for full description.
//
// When this policy is not set, the default SameSite behavior for cookies will
// depend on the user's personal configuration for the SameSite-by-default
// feature, the Cookies-without-SameSite-must-be-secure feature, and the
// Schemeful Same-Site feature which may be set by a field trial or by enabling
// or disabling the same-site-by-default-cookies flag, the cookies-without-same-
// site-must-be-secure flag, or the schemeful-same-site flag, respectively.
//
// Valid values:
//   1: Revert to legacy SameSite behavior for cookies on all sites
//   2: Use SameSite-by-default behavior for cookies on all sites
//
// Supported on:
message LegacySameSiteCookieBehaviorEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional int64 LegacySameSiteCookieBehaviorEnabled = 2;
}

// Revert to legacy SameSite behavior for cookies on these sites
//
// Cookies set for domains matching these patterns will revert to legacy
// SameSite behavior. Reverting to legacy behavior causes cookies that don't
// specify a SameSite attribute to be treated as if they were "SameSite=None",
// removes the requirement for "SameSite=None" cookies to carry the "Secure"
// attribute, and skips the scheme comparison when evaluating if two sites are
// same-site. See https://www.chromium.org/administrators/policy-list-3/cookie-
// legacy-samesite-policies for full description.
//
// For cookies on domains not covered by the patterns specified here, or for all
// cookies if this policy is not set, the global default value will be the
// user's personal configuration.
//
// For detailed information on valid patterns, please see
// https://chromeenterprise.google/policies/url-patterns.
//
// Note that patterns you list here are treated as domains, not URLs, so you
// should not specify a scheme or port.
//
// Supported on:
message LegacySameSiteCookieBehaviorEnabledForDomainListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LegacySameSiteCookieBehaviorEnabledForDomainList = 2;
}

// Specifies URLs that allow legacy technology report
//
// Controls if a page that use legacy technologies will be reported based on its
// URL.
//
// When policy is set, the URLs whose prefix match an allowlist entry will be
// used to generated report and uploaded. Unmatched URLs will be ignored.
// When policy is not set or set to an empty list, no report will be generated.
//
// The matching patterns use a similar format to those for the 'URLBlocklist'
// policy, which are documented at
// https://support.google.com/chrome/a?p=url_blocklist_filter_format. With a few
// exceptions below:
// * No wildcard '*' support.
// * Schema, port and query are ignored.
// * At most 100 URLs can be added into the allowlist,
//
// For Google Chrome, this policy is only effective when the machine is enrolled
// with CloudManagementEnrollmentToken.
//
// More information about legacy technologies can be found at
// https://chromestatus.com/features.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message LegacyTechReportAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LegacyTechReportAllowlist = 2;
}

// Allow Google Lens camera assisted search
//
// Leaving the policy unset or setting it to Enabled allows users to search with
// their cameras using Google Lens. Setting the policy to Disabled means users
// can't see the Google Lens button in the search box when Google Lens camera
// assisted search is supported.
// Starting in Google Chrome 147, this policy will be deprecated. IT Admins can
// use SearchContentSharingSettings to control this feature going forward.
//
// Valid values:
//   True: Enable Google Lens camera assisted search for Enterprise user
//   False: Disable Google Lens camera assisted search for Enterprise user
//
// Supported on: android, ios
message LensCameraAssistedSearchEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LensCameraAssistedSearchEnabled = 2;
}

// Allow Google Lens button to be shown in the search box on the New Tab page if
// supported.
//
// Leaving the policy unset or setting it to Enabled allows users to view and
// use the Google Lens button in the search box on the New Tab page. Setting the
// policy to Disabled means users will not see the Google Lens button in the
// search box on the New Tab page.
// Starting in Google Chrome 147, this policy will be deprecated. IT Admins can
// use SearchContentSharingSettings to control this feature going forward.
//
// Valid values:
//   True: Show the Google Lens button in the search box on the New Tab page.
//   False: Do not show the Google Lens button in the search box on the New Tab
// page.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message LensDesktopNTPSearchEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LensDesktopNTPSearchEnabled = 2;
}

// Enables the Lens / Gallery App integration on Google ChromeOS
//
// This policy controls the availability of the Lens integration in the Gallery
// App on Google ChromeOS
//
// When the policy is enabled or not set, users can use Lens to search
// selections of media that they are viewing in the Gallery App.
// When the policy is disabled this feature is disabled.
//
// Valid values:
//   True: Enable the Lens integration
//   False: Disable the Lens integration
//
// Supported on: chrome_os
message LensOnGalleryEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LensOnGalleryEnabled = 2;
}

// Settings for the Lens Overlay feature
//
// Lens Overlay lets users perform contextual Google searches either via a
// screenshot or by asking a question about the current page's contents. This
// feature requires the end user to opt-in.
//
// This feature is available to all users with Google as their default search
// engine, unless it is disabled by this policy.
//
// When policy is set to 0 - Allow or not set, the feature will be available to
// users.
//
// When policy is set to 1 - Do not allow, the feature will not be available.
//
// Starting in Google Chrome 140, if the policy is unset, its behavior is
// determined by the GenAiDefaultSettings policy.
//
// Starting in Google Chrome 147, this policy will be deprecated. IT Admins can
// use SearchContentSharingSettings to control this feature going forward.
//
// Valid values:
//   0: Allow
//   1: Do not allow
//
// Supported on: chrome_os, ios, linux, mac, win
message LensOverlaySettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 LensOverlaySettings = 2;
}

// Allow Google Lens region search menu item to be shown in context menu if
// supported.
//
// Leaving the policy unset or setting it to Enabled allows users to view and
// use the Google Lens region search menu item in the context menu. Setting the
// policy to Disabled means users will not see the Google Lens region search
// menu item in the context menu when Google Lens region search is supported.
// Starting in Google Chrome 147, this policy will be deprecated. IT Admins can
// use SearchContentSharingSettings to control this feature going forward.
//
// Valid values:
//   True: Enable Google Lens region search.
//   False: Disable Google Lens region search.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message LensRegionSearchEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LensRegionSearchEnabled = 2;
}

// Action to take when the user closes the lid
//
// Setting the policy specifies the action that Google ChromeOS takes when the
// user closes the device's lid.
//
// Leaving the policy unset means the Suspend action is taken.
//
// Note: If the action is Suspend, Google ChromeOS can separately be set up to
// lock or not lock the screen before suspending.
//
// Valid values:
//   0: Suspend
//   1: Log the user out
//   2: Shut down
//   3: Do nothing
//
// Supported on: chrome_os
message LidCloseActionProto {
  optional PolicyOptions policy_options = 1;
  optional int64 LidCloseAction = 2;
}

// Enable read aloud (text distillation and text-to-speech synthesis) for web
// pages
//
// Setting the policy to be true allows users to have eligible web
// pages read aloud using text-to-speech. This is achieved by server
// side content distillation and audio synthesis. Setting to false
// disables this feature. If this policy is set to default or unset,
// read aloud is enabled.
//
// Valid values:
//   True: Always allow read aloud
//   False: Never allow read aloud
//
// Supported on: android
message ListenToThisPageEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ListenToThisPageEnabled = 2;
}

// Enable Live Caption
//
// Enable the Live Caption feature.
//
// If this policy is set to Enabled, Live Caption will always be turned on.
//
// If this policy is set to Disabled, Live Caption will always be turned off.
//
// If you set this policy as mandatory, users cannot change or override it.
//
// If this policy is left unset, Live Caption is disabled initially but can be
// enabled by the user anytime.
//
// Valid values:
//   True: Enable Live Caption
//   False: Disable Live Caption
//   None: Allow the user to decide
//
// Supported on: chrome_os, linux, mac, win
message LiveCaptionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LiveCaptionEnabled = 2;
}

// Enable Live Translate
//
// Enable translation of live captions. Captions will be sent to Google for
// translation.
//
// If this policy is set to Enabled, Live Translate will always be turned on.
//
// If this policy is set to Disabled, Live Translate will always be turned off.
//
// If you set this policy as mandatory, users cannot change or override it.
//
// If this policy is left unset, Live Translate is disabled initially but can be
// enabled by the user anytime.
//
// In LiveCaptionEnabled is set to Disabled, Live Translate will be disabled
// regardless of this policy setting.
//
// Valid values:
//   True: Enable Live Translate
//   False: Disable Live Translate
//   None: Allow the user to decide
//
// Supported on: chrome_os, linux, mac, win
message LiveTranslateEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LiveTranslateEnabled = 2;
}

// Load the CryptoToken component extension at startup
//
// If set to Enabled, the built-in CryptoToken component extension is loaded at
// startup. If set to Disabled or not set, CryptoToken is not loaded at browser
// startup. This policy is meant as a temporary workaround for sites broken by
// `chrome.runtime` being undefined as a side effect of the removal of
// CryptoToken in M106. Websites must not depend on `chrome.runtime` being
// defined unconditionally.
//
// Valid values:
//   True: Load the extension
//   False: Apply default behavior
//
// Supported on:
message LoadCryptoTokenExtensionProto {
  optional PolicyOptions policy_options = 1;
  optional bool LoadCryptoTokenExtension = 2;
}

// Set minimum complexity for local PINs and passwords
//
// This policy configures the minimum complexity requirements for local
// authentication factors (PINs and local passwords) set by users on Google
// ChromeOS.
//
// If this policy is not set, default to complexity level None.
//
// This policy's requirements are enforced when a user sets up a new local
// PIN/password or changes an existing one.
//
// The complexity levels are based on Android's password quality metrics (https:
// //developers.google.com/android/management/reference/rest/v1/PasswordRequirem
// ents), adapted for Google ChromeOS:
// - 1 = None: A PIN/password is required, but there are no restrictions on its
// content or length.
// - 2 = Low: Basic complexity requirements.
// - 3 = Medium: Stricter length and character-type requirements.
// - 4 = High: Strongest complexity requirements, demanding multiple character
// types.
//
// See the help center article for detailed explanations of what each level
// entails for both PINs and passwords.
//
// Valid values:
//   1: No Complexity
//   2: Low Complexity
//   3: Medium Complexity
//   4: High Complexity
//
// Supported on: chrome_os
message LocalAuthFactorsComplexityProto {
  optional PolicyOptions policy_options = 1;
  optional int64 LocalAuthFactorsComplexity = 2;
}

// Enable chrome://devices
//
// This policy controls access to controllable features in the local discovery
// UI (chrome://devices) which shows discoverable devices near the user as well
// as cloud devices registered to them. On all operating systems except for
// Google ChromeOS, the local discovery UI also allows users to add classic
// printers connected to their computers to Google Cloud Print.
//
// Setting the policy to Enabled or not set allow local device discovery.
//
// Setting the policy to Disabled prevents local device discovery.
//
// Valid values:
//   True: Allow local device discovery
//   False: Prevent local device discovery
//
// Supported on:
message LocalDiscoveryEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LocalDiscoveryEnabled = 2;
}

// Allow Local Fonts permission on these sites
//
// Sets a list of site url patterns that specify sites which will automatically
// grant the local fonts permission. This will extend the ability of sites to
// see information about local fonts.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed. This policy only matches based on origin, so any path in the URL
// pattern is ignored.
//
// If this policy is not set for a site then the policy from
// DefaultLocalFontsSetting applies to the site, if set, otherwise the
// permission will follow the browser's defaults and allow users to choose this
// permission per site.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message LocalFontsAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LocalFontsAllowedForUrls = 2;
}

// Block Local Fonts permission on these sites
//
// Sets a list of site url patterns that specify sites which will automatically
// deny the local fonts permission. This will limit the ability of sites to see
// information about local fonts.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed. This policy only matches based on origin, so any path in the URL
// pattern is ignored.
//
// If this policy is not set for a site then the policy from
// DefaultLocalFontsSetting applies to the site, if set, otherwise the
// permission will follow the browser's defaults and allow users to choose this
// permission per site.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message LocalFontsBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LocalFontsBlockedForUrls = 2;
}

// Allow sites to make network requests to local devices and local network
// endpoints.
//
// List of URL patterns. Network requests initiated from websites served by
// matching origins are not subject to Local Network Access checks.
//
// For origins not covered by the patterns specified here, the user's personal
// configuration will apply.
//
// For detailed information on valid URL patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.
//
// See https://wicg.github.io/local-network-access/ for Local Network Access
// restrictions.
//
// There are multiple policies listing origins that impact requests to local
// device and local network endpoints. If an origin is matched by more than one
// of the following policies, the policies take precedence in the following
// order:
//
// - LocalNetworkBlockedForUrls
// - LocalNetworkAllowedForUrls
// - LoopbackNetworkBlockedForUrls
// - LoopbackNetworkAllowedForUrls
// - LocalNetworkAccessBlockedForUrls
// - LocalNetworkAccessAllowedForUrls
//
// Supported on: android, chrome_os, linux, mac, win
message LocalNetworkAccessAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LocalNetworkAccessAllowedForUrls = 2;
}

// Block sites from making network requests to local devices and local network
// endpoints.
//
// List of URL patterns. Network requests initiated from websites served by
// matching origins are blocked from issuing Local Network Access requests.
//
// For origins not covered by the patterns specified here, the user's personal
// configuration will apply.
//
// For detailed information on valid URL patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.
//
// See https://wicg.github.io/local-network-access/ for Local Network Access
// restrictions.
//
// There are multiple policies listing origins that impact requests to local
// device and local network endpoints. If an origin is matched by more than one
// of the following policies, the policies take precedence in the following
// order:
//
// - LocalNetworkBlockedForUrls
// - LocalNetworkAllowedForUrls
// - LoopbackNetworkBlockedForUrls
// - LoopbackNetworkAllowedForUrls
// - LocalNetworkAccessBlockedForUrls
// - LocalNetworkAccessAllowedForUrls
//
// Supported on: android, chrome_os, linux, mac, win
message LocalNetworkAccessBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LocalNetworkAccessBlockedForUrls = 2;
}

// Override IP address space mappings
//
// This can be used to treat certain internal address ranges as "public" and
// thus not subject to Local Network Access checks. Conversely, this can be used
// to treat certain public address ranges that might be used internally as
// "local" so that they are protected by Local Network Access checks.
//
// IP address space overrides have two forms:
//
// [cidr]=[public|local|loopback]
//
// where [cidr] is a IP address range in CIDR notation (see section 3.1 of
// https://tools.ietf.org/html/rfc4632 for IPv4 and section 2.3 of
// https://tools.ietf.org/html/rfc4291 for IPv6). IPv6 addresses must be
// specified in URL-safe (bracketed) format. CIDR overrides apply to all ports.
//
// or
//
// [ip-address]:[port]=[public|local|loopback]
//
// For more information on Local Network Access, see
// https://wicg.github.io/local-network-access/ and
// https://developer.chrome.com/blog/local-network-access.
//
// This policy does not support dynamic refresh.
//
// Overrides from the command-line switch --ip-address-space-overrides take
// precedence over overrides set by this policy.
//
// Supported on: android, chrome_os, linux, mac, win
message LocalNetworkAccessIpAddressSpaceOverridesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LocalNetworkAccessIpAddressSpaceOverrides = 2;
}

// Allow Local Network Access (LNA) requests in subframes without explicit
// delegation
//
// By default, the permissions for Local Network Access (LNA) are only allowed
// to be requested in cross-origin subframes if they are explicitly delegated.
// This policy can be used to override this default behavior so that LNA
// permissions are default inherited into subframes, unless explicitly denied in
// permissions policy.
//
// If this policy is set to enabled, then subframes are by default delegated all
// LNA permissions policy features and can make local network requests
// (triggering the permission prompt).
//
// If this policy is set to disabled or not set, then subframes must be
// explicitly delegated the permissions policy feature in order make local
// network requests and trigger the permission prompt.
//
// This policy applies to the permissions policy features "local-network-
// access", "loopback-network", and "local-network".
//
// For more information on Local Network Access, see
// https://wicg.github.io/local-network-access/ and
// https://developer.chrome.com/blog/local-network-access.
//
// For more information on permissions policy, see
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Permissions_Policy.
//
// Valid values:
//   True: Allow LNA requests in subframes without explicit delegation
//   False: Do not allow LNA requests in subframes without explicit delegation
//
// Supported on: android, chrome_os, linux, mac, win
message LocalNetworkAccessPermissionsPolicyDefaultEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LocalNetworkAccessPermissionsPolicyDefaultEnabled = 2;
}

// Specifies whether to apply restrictions to requests to local network
// endpoints
//
// When this policy is set to Enabled, any time when a warning is supposed to be
// displayed in Chrome DevTools due to Local Network Access checks failing, the
// main request will be blocked instead.
//
// When this policy is set to Disabled or unset, Local Network Access requests
// will use the
// default handling of these requests.
//
// See https://wicg.github.io/local-network-access/ for Local Network Access
// restrictions.
//
// Valid values:
//   True: Apply restrictions to requests to local network endpoints
//   False: Use default behavior when determining if websites can make requests
// to local network endpoints
//
// Supported on:
message LocalNetworkAccessRestrictionsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LocalNetworkAccessRestrictionsEnabled = 2;
}

// Specifies whether to (temporarily) opt out of Local Network Access
// restrictions
//
// When this policy is set to Enabled, Local Network Access
// requests will only display warnings in Chrome DevTools due to Local Network
// Access checks failing.
//
// When this policy is set to Disabled or unset, Local Network Access requests
// will use the
// default handling of these requests.
//
// See https://wicg.github.io/local-network-access/ for Local Network Access
// restrictions.
//
// This enterprise policy is temporary, and will be removed after M163.
//
// Long term, the policy LocalNetworkAccessAllowedForUrls
// can be used to allowlist URL patterns that should be automatically granted
// the Local Network Access permission.
//
// Valid values:
//   True: Temporarily opt out of restrictions on requests to local network
// endpoints
//   False: Use default behavior when determining if websites can make requests
// to local network endpoints
//
// Supported on: android, chrome_os, linux, mac, win
message LocalNetworkAccessRestrictionsTemporaryOptOutProto {
  optional PolicyOptions policy_options = 1;
  optional bool LocalNetworkAccessRestrictionsTemporaryOptOut = 2;
}

// Allow sites to make network requests to local network endpoints.
//
// List of URL patterns. Network requests initiated from websites served by
// matching origins to local network endpoints are not subject to Local Network
// Access checks.
//
// For origins not covered by the patterns specified here, the user's personal
// configuration will apply.
//
// For detailed information on valid URL patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.
//
// See https://wicg.github.io/local-network-access/ for Local Network Access
// restrictions.
//
// There are multiple policies listing origins that impact requests to local
// network endpoints. If an origin is matched by more than one of the following
// policies, the policies take precedence in the following order:
//
// - LocalNetworkBlockedForUrls
// - LocalNetworkAllowedForUrls
// - LocalNetworkAccessBlockedForUrls
// - LocalNetworkAccessAllowedForUrls
//
// Supported on: android, chrome_os, linux, mac, win
message LocalNetworkAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LocalNetworkAllowedForUrls = 2;
}

// Block sites from making network requests to local network endpoints.
//
// List of URL patterns. Network requests initiated from websites served by
// matching origins to local network endpoints are blocked from issuing Local
// Network Access requests.
//
// For origins not covered by the patterns specified here, the user's personal
// configuration will apply.
//
// For detailed information on valid URL patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.
//
// See https://wicg.github.io/local-network-access/ for Local Network Access
// restrictions.
//
// There are multiple policies listing origins that impact requests to local
// network endpoints. If an origin is matched by more than one of the following
// policies, the policies take precedence in the following order:
//
// - LocalNetworkBlockedForUrls
// - LocalNetworkAllowedForUrls
// - LocalNetworkAccessBlockedForUrls
// - LocalNetworkAccessAllowedForUrls
//
// Supported on: android, chrome_os, linux, mac, win
message LocalNetworkBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LocalNetworkBlockedForUrls = 2;
}

// Enable local user files
//
// This policy controls whether Google ChromeOS users can store data locally or
// not.
// Setting this policy to False blocks local storage on Google ChromeOS - users
// cannot store any data locally, and cannot access any local directories.
// Setting this policy to True or leaving it unset allows local storage on
// Google ChromeOS - there are no restrictions on where users can store data, or
// which directories they can access.
//
// Valid values:
//   True: Enable storing user files locally
//   False: Disable storing user files locally
//
// Supported on: chrome_os
message LocalUserFilesAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool LocalUserFilesAllowed = 2;
}

// Local user files migration destination
//
// Controls the local files migration to the cloud.
// Applies only for SkyVault users, i.e. when LocalUserFilesAllowed is false and
// is ignored otherwise.
//
// If set to "google_drive", local files are moved to Google Drive and local
// folders are hidden.
// If set to "microsoft_onedrive", local files are moved to OneDrive and local
// folders are hidden.
// If set to "read-only" or left unset: local files remain in read-only mode.
// If set to "delete": existing local files are deleted.
//
// Valid values:
//   google_drive: Migrate local files to Google Drive and hide local folders
//   microsoft_onedrive: Migrate local files to Microsoft OneDrive and hide
// local folders
//   read_only: Keep local files in read-only mode
//   delete: Delete existing local files  (supported since version 137)
//
// Supported on: chrome_os
message LocalUserFilesMigrationDestinationProto {
  optional PolicyOptions policy_options = 1;
  optional string LocalUserFilesMigrationDestination = 2;
}

// Enable lock icon in the omnibox for secure connections
//
// This policy controls the treatment for lock icon in the omnibox.
// From Chrome M93, there is a new omnibox icon for secure connections.
// If the policy is Enabled, Chrome will use the existing lock icon for secure
// connections.
// If the policy is Disabled or not set, Chrome will use the default icon for
// secure connections.
//
// Valid values:
//   True: Use lock icon for secure connections
//   False: Use default icons for secure connections
//
// Supported on:
message LockIconInAddressBarEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LockIconInAddressBarEnabled = 2;
}

// Automatic start of online re-authentication on the lock screen
//
// On the lock screen users have an option to open an online re-authentication
// window and use it for authentication process to re-enter their session. This
// policy can be used to automatically open the window if online
// re-authentication is required.
//
// If the policy is set to Enabled and online re-authentication is required, the
// online re-authentication window is opened automatically.
//
// If the policy is set to Disabled or unset, the online re-authentication
// window
// has to be opened manually.
//
// Online re-authentication can become required for a number of reasons, such as
// password change, but it can be also enforced by certain policies such as
// GaiaLockScreenOfflineSigninTimeLimitDays or
// SamlLockScreenOfflineSigninTimeLimitDays.
//
// Valid values:
//   True: Enable automatic online re-authentication start.
//   False: Disable automatic online re-authentication start.
//
// Supported on: chrome_os
message LockScreenAutoStartOnlineReauthProto {
  optional PolicyOptions policy_options = 1;
  optional bool LockScreenAutoStartOnlineReauth = 2;
}

// Allows users to play media when the device is locked
//
// Setting the policy to Enabled or leaving it unset displays media controls on
// the lock screen if users lock the device when media is playing.
//
// Setting the policy to Disabled turns media controls on the lock screen off.
//
// Valid values:
//   True: Allow users to play media when the device is locked
//   False: Do not allow users to play media when the device is locked
//
// Supported on: chrome_os
message LockScreenMediaPlaybackEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LockScreenMediaPlaybackEnabled = 2;
}

// Enables online re-authentication on lock screen for SAML users
//
// Enables online user signin on a lock screen. If the policy is set to true
// online re-authentication on the lock screen is triggered e.g. by
// SAMLOfflineSigninTimeLimit.
// The re-authentication is enforced immediately when on the lock screen or next
// time a user locks the screen after the condition is met.
// If the policy is set to false or unset users can always unlock the screen
// with their local credentials.
//
// Valid values:
//   True: Enforce online logins on the login and lock screens
//   False: Only enforce online logins on the login screen
//
// Supported on: chrome_os
message LockScreenReauthenticationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LockScreenReauthenticationEnabled = 2;
}

// Show the display password button on the login and lock screen
//
// When enabled, this feature shows a button on the login and lock screen that
// allows the password to be displayed.
// It is represented as an eye icon on the password textfield. The button is
// absent when the feature is disabled.
//
// Valid values:
//   True: Show the display password button on the login and lock screen
//   False: Do not show the display password button on the login and lock screen
//
// Supported on: chrome_os
message LoginDisplayPasswordButtonEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool LoginDisplayPasswordButtonEnabled = 2;
}

// Suppress lookalike domain warnings on domains
//
// This policy prevents the display of lookalike URL warnings on the sites
// listed. These warnings are typically shown on sites that Google Chrome
// believes might be trying to spoof another site the user is familiar with.
//
// If the policy is enabled and set to one or more domains, no lookalike
// warnings pages will be shown when the user visits pages on that domain.
//
// If the policy is not set, or set to an empty list, warnings may appear on any
// site the user visits.
//
// A hostname can be allowed with a complete host match, or any domain match.
// For example, a URL like "https://foo.example.com/bar" may have warnings
// suppressed if this list includes either "foo.example.com" or "example.com".
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message LookalikeWarningAllowlistDomainsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LookalikeWarningAllowlistDomains = 2;
}

// Allow sites to make network requests to the local device.
//
// List of URL patterns. Network requests initiated from websites served by
// matching origins to the local device are not subject to Local Network Access
// checks.
//
// For origins not covered by the patterns specified here, the user's personal
// configuration will apply.
//
// For detailed information on valid URL patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.
//
// See https://wicg.github.io/local-network-access/ for Local Network Access
// restrictions.
//
// There are multiple policies listing origins that impact requests to the local
// device. If an origin is matched by more than one of the following policies,
// the policies take precedence in the following order:
//
// - LoopbackNetworkBlockedForUrls
// - LoopbackNetworkAllowedForUrls
// - LocalNetworkAccessBlockedForUrls
// - LocalNetworkAccessAllowedForUrls
//
// Supported on: android, chrome_os, linux, mac, win
message LoopbackNetworkAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LoopbackNetworkAllowedForUrls = 2;
}

// Block sites from making network requests to the local device.
//
// List of URL patterns. Network requests initiated from websites served by
// matching origins to the local device are blocked from issuing Local Network
// Access requests.
//
// For origins not covered by the patterns specified here, the user's personal
// configuration will apply.
//
// For detailed information on valid URL patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.
//
// See https://wicg.github.io/local-network-access/ for Local Network Access
// restrictions.
//
// There are multiple policies listing origins that impact requests to the local
// device. If an origin is matched by more than one of the following policies,
// the policies take precedence in the following order:
//
// - LoopbackNetworkBlockedForUrls
// - LoopbackNetworkAllowedForUrls
// - LocalNetworkAccessBlockedForUrls
// - LocalNetworkAccessAllowedForUrls
//
// Supported on: android, chrome_os, linux, mac, win
message LoopbackNetworkBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList LoopbackNetworkBlockedForUrls = 2;
}

// The enrollment token of cloud policy on desktop
//
//
// This policy is deprecated in M72. Please use CloudManagementEnrollmentToken
// instead.
//
// Supported on:
message MachineLevelUserCloudPolicyEnrollmentTokenProto {
  optional PolicyOptions policy_options = 1;
  optional string MachineLevelUserCloudPolicyEnrollmentToken = 2;
}

// Add restrictions on managed accounts
//
// This policy is deprecated. Please use ProfileSeparationSettings instead.
//
// Default behavior (Policy unset)
// When an account is added in the content area a small dialog may appear asking
// the user to create a new profile. This dialog is dismissable.
//
// ManagedAccountsSigninRestriction = 'primary_account'
// If a user signs into a Google service for the first time in a Google Chrome
// browser, a dialog will appear asking the user to create a new profile for
// their enterprise account. The user may click Cancel and get signed out, or
// Continue to create a new profile. Any existing browsing data will not be
// added to the new profile. The newly created profile is allowed to have
// secondary accounts, for example the user can sign into another account in the
// content area.
//
// ManagedAccountsSigninRestriction = 'primary_account_strict'
// This is the same behavior as 'primary_account' except the newly created
// profile is not allowed to have secondary accounts.
//
// ManagedAccountsSigninRestriction = 'primary_account_keep_existing_data'
// This is the same behavior as 'primary_account' except a checkbox will be
// added to the dialog to allow the user to keep local browsing data.
// If the user checks the box, then the existing profile data becomes associated
// with the Managed account.
// -  All existing browsing data will be present in the new profile.
// -  This data includes bookmarks, history, password, autofill data, open tabs,
// cookies, cache, web storage, extensions, etc.
// If the user does not check the box:
// -  The old profile will continue to exist, no data will be lost.
// -  A new profile will be created.
//
// ManagedAccountsSigninRestriction =
// 'primary_account_strict_keep_existing_data'
// This is the same behavior as 'primary_account_keep_existing_data' except the
// newly created profile is not allowed to have secondary accounts.
//
// Valid values:
//   primary_account: A Managed account must be a primary account and importing
// existing browsing data is allowed at the time of profile creation
//   primary_account_strict: A Managed account must be a primary account and
// have no secondary accounts and importing existing browsing data is allowed at
// the time of profile creation
//   none: No restrictions on managed accounts
//   primary_account_keep_existing_data: A Managed account must be a primary
// account and the user can import existing data at the time of its creation
//   primary_account_strict_keep_existing_data: A Managed account must be a
// primary account and have no secondary accounts and the user can import
// existing data at the time of its creation
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message ManagedAccountsSigninRestrictionProto {
  optional PolicyOptions policy_options = 1;
  optional string ManagedAccountsSigninRestriction = 2;
}

// Managed Bookmarks
//
// Setting the policy sets up a list of bookmarks where each one is a dictionary
// with the keys "name" and "url". These keys hold the bookmark's name and
// target. Admins can set up a subfolder by defining a bookmark without a "url"
// key, but with an additional "children" key. This key also has a list of
// bookmarks, some of which can also be folders. Chrome amends incomplete URLs
// as if they were submitted through the address bar. For example, "google.com"
// becomes "https://google.com/".
//
// Users can't change the folders the bookmarks are placed in (though they can
// hide it from the bookmark bar). The default folder name for managed bookmarks
// is "Managed bookmarks" but it can be changed by adding a new sub-dictionary
// to the policy with a single key named "toplevel_name" with the desired folder
// name as its value. Managed bookmarks are not synced to the user account and
// extensions can't modify them.
//
// Value schema:
// {
//     "items": {
//         "id": "BookmarkType",
//         "properties": {
//             "children": {
//                 "items": {
//                     "$ref": "BookmarkType"
//                 },
//                 "type": "array"
//             },
//             "name": {
//                 "type": "string"
//             },
//             "toplevel_name": {
//                 "type": "string"
//             },
//             "url": {
//                 "type": "string"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message ManagedBookmarksProto {
  optional PolicyOptions policy_options = 1;
  optional string ManagedBookmarks = 2;
}

// Sets managed configuration values to websites to specific origins
//
// Setting the policy defines the return value of Managed Configuration API for
// given origin.
//
// Managed configuration API is a key-value configuration that can be accessed
// via navigator.managed.getManagedConfiguration() javascript call. This API is
// only available to origins which correspond to force-installed web
// applications via WebAppInstallForceList.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "managed_configuration_hash": {
//                 "type": "string"
//             },
//             "managed_configuration_url": {
//                 "type": "string"
//             },
//             "origin": {
//                 "type": "string"
//             }
//         },
//         "required": [
//             "origin",
//             "managed_configuration_url",
//             "managed_configuration_hash"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message ManagedConfigurationPerOriginProto {
  optional PolicyOptions policy_options = 1;
  optional string ManagedConfigurationPerOrigin = 2;
}

// Reduce Managed-guest session auto-launch notifications
//
// Note that this policy is deprecated in M87 and removed in M89. Please use
// ManagedGuestSessionPrivacyWarningsEnabled to configure the privacy warnings
// of managed-guest sessions instead.
//
// Control the auto launch notification of the managed guest session on Google
// ChromeOS.
//
// If this policy is set to True, the privacy warning notification will be
// closed after some seconds.
//
// If the policy is set to False or not set, the privacy warning notification
// will be pinned until the user dismisses it.
//
// Supported on:
message ManagedGuestSessionAutoLaunchNotificationReducedProto {
  optional PolicyOptions policy_options = 1;
  optional bool ManagedGuestSessionAutoLaunchNotificationReduced = 2;
}

// Extensions that have to be allowed to run in Incognito by the user in order
// to navigate in Incognito mode
//
// This policy allows administrators to configure a list of extension ids
// required for Incognito mode navigation.
//
// The user must explicitly allow all extensions in this list to run in
// Incognito mode, otherwise navigation in Incognito is not allowed.
//
// If an extension specified in this policy is not installed, Incognito
// navigation is blocked.
//
// This policy is applied to the Incognito mode. This means Incognito must be
// enabled in the browser. If Incognito mode is disabled via the policy
// IncognitoModeAvailability, this policy has no effect.
//
// Supported on: android, chrome_os, linux, mac, win
message MandatoryExtensionsForIncognitoNavigationProto {
  optional PolicyOptions policy_options = 1;
  optional StringList MandatoryExtensionsForIncognitoNavigation = 2;
}

// Maximal number of concurrent connections per proxy server for non-WebSocket
// requests
//
// Setting the policy specifies the maximal number of simultaneous connections
// per proxy server for non-WebSocket requests.
//
// To modify WebSocket request limits, see MaxConnectionsPerProxyForWebSocket.
//
// Leaving the policy unset means a default of 128 is used.
//
// Some web apps are known to consume many connections with hanging GETs, so
// setting a value below 128 may lead to browser networking hangs if there are
// too many web apps with hanging connections open.
// Some proxy servers can't handle a high number of concurrent connections per
// client, which is solved by setting this policy to a lower value.
//
// The value should be equal to or higher than 6.
// Setting a value below that limit will cause 6 to be used.
// Lower below the default (128) at your own risk.
//
// The value should be equal to or lower than 256 (99 in Google Chrome 147 and
// earlier).
// Setting a value above that limit will cause 256 (99 in Google Chrome 147 and
// earlier) to be used.
// Raise above the default (128) at your own risk.
//
// Please note that the enforced limits are impacted by
// AllowSocketPoolSizeRandomizationForProxies.
//
// Supported on: android, chrome_os, linux, mac, win
message MaxConnectionsPerProxyProto {
  optional PolicyOptions policy_options = 1;
  optional int64 MaxConnectionsPerProxy = 2;
}

// Maximal number of concurrent connections per proxy server for WebSocket
// requests
//
// Setting the policy specifies the maximal number of simultaneous connections
// per proxy server for WebSocket requests.
//
// To modify non-WebSocket request limits, see MaxConnectionsPerProxy.
//
// Leaving the policy unset means a default of 128 is used.
//
// Some web apps are known to consume many connections with hanging GETs, so
// setting a value below 128 may lead to browser networking hangs if there are
// too many web apps with hanging connections open.
// Some proxy servers can't handle a high number of concurrent connections per
// client, which is solved by setting this policy to a lower value.
//
// The value should be equal to or higher than 6.
// Setting a value below that limit will cause 6 to be used.
// Lower below the default (128) at your own risk.
//
// The value should be equal to or lower than 256.
// Setting a value above that limit will cause 256 to be used.
// Raise above the default (128) at your own risk.
//
// Please note that the enforced limits are impacted by
// AllowSocketPoolSizeRandomizationForProxies.
//
// Supported on: android, chrome_os, linux, mac, win
message MaxConnectionsPerProxyForWebSocketProto {
  optional PolicyOptions policy_options = 1;
  optional int64 MaxConnectionsPerProxyForWebSocket = 2;
}

// Maximum fetch delay after a policy invalidation
//
// Setting the policy specifies the maximum delay in milliseconds between
// receiving a policy invalidation and fetching the new policy from the device
// management service. Valid values range from 1,000 (1 second) to 300,000 (5
// minutes). Values outside this range will be clamped to the respective
// boundary.
//
// Leaving the policy unset means Google Chrome uses the default value of 10
// seconds.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message MaxInvalidationFetchDelayProto {
  optional PolicyOptions policy_options = 1;
  optional int64 MaxInvalidationFetchDelay = 2;
}

// Set media disk cache size in bytes
//
// Setting the policy configures the cache size that Google Chrome uses for
// storing cached media files on the disk, regardless of whether or not users
// specify the --media-cache-size flag. The value specified in this policy isn't
// a hard boundary, but a suggestion to the caching system. Any value below a
// few megabytes is rounded up.
//
// Setting the value of the policy to 0 uses the default cache size, and users
// can't change it.
//
// Leaving the policy unset uses the default cache size and users can change it
// with the --media-cache-size flag.
//
// Supported on:
message MediaCacheSizeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 MediaCacheSize = 2;
}

// Enable Media Recommendations
//
// By default the browser will show media recommendations that are personalized
// to the user. Setting this policy to Disabled will result in these
// recommendations being hidden from the user. Setting this policy to Enabled or
// leaving it unset will result in the media recommendations being shown to the
// user.
//
// Valid values:
//   True: Show media recommendations to the user
//   False: Hide media recommendations from the user
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message MediaRecommendationsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool MediaRecommendationsEnabled = 2;
}

// Allow Google Cast to connect to Cast devices on all IP addresses.
//
// Unless EnableMediaRouter is set to Disabled, setting
// MediaRouterCastAllowAllIPs to Enabled connects Google Cast to Cast devices on
// all IP addresses, not just RFC1918/RFC4193 private addresses.
//
// Setting the policy to Disabled connects Google Cast to Cast devices only on
// RFC1918/RFC4193.
//
// Leaving the policy unset connects Google Cast to Cast devices only on
// RFC1918/RFC4193, unless the CastAllowAllIPs feature is turned on.
//
// Valid values:
//   True: Allow Google Cast to connect to devices on all IP addresses
//   False: Allow Google Cast to only connect to devices on private IP addresses
//   None: Allow Google Cast to only connect to devices on private IP addresses,
// unless the CastAllowAllIPs feature is turned on.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message MediaRouterCastAllowAllIPsProto {
  optional PolicyOptions policy_options = 1;
  optional bool MediaRouterCastAllowAllIPs = 2;
}

// Change Memory Saver Mode Savings
//
// This policy changes the savings level of Memory Saver.
//
// This only takes effect when Memory Saver is enabled through settings or
// through the HighEfficiencyModeEnabled policy, and will affect how heuristics
// are used to determine when to discard tabs. For example, reducing the
// lifetime of an inactive tab before discarding it can save memory, but it also
// means that tabs will be reloaded more frequently which can lead to bad user
// experience and cost more network traffic.
//
// Setting the policy to 0 - Memory Saver will get moderate memory savings. Tabs
// become inactive after a longer period of time
//
// Setting the policy to 1 - Memory Saver will get balanced memory savings. Tabs
// become inactive after an optimal period of time.
//
// Setting the policy to 2 - Memory Saver will get maximum memory savings. Tabs
// become inactive after a shorter period of time.
//
// If this policy is unset, the end user can control this setting in
// chrome://settings/performance.
//
// Valid values:
//   0: Moderate memory savings.
//   1: Balanced memory savings.
//   2: Maximum memory savings.
//
// Supported on: chrome_os, linux, mac, win
message MemorySaverModeSavingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 MemorySaverModeSavings = 2;
}

// Enable reporting of usage and crash-related data
//
// When this policy is Enabled, anonymous reporting of usage and crash-related
// data about Google Chrome to Google is recommended to be enabled by default.
// Users will still be able to change this setting.
//
// When this policy is Disabled, anonymous reporting is disabled and no usage or
// crash data is sent to Google. Users won't be able to change this setting.
//
// When this policy is not set, users can choose the anonymous reporting
// behavior at installation or first run, and can change this setting later.
//
// (For Google ChromeOS, see DeviceMetricsReportingEnabled.)
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   True: Enable reporting of usage and crash-related data
//   False: Disable reporting of usage and crash-related data
//   None: Allow users to choose
//
// Supported on: android, fuchsia, ios, linux, mac, win
message MetricsReportingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool MetricsReportingEnabled = 2;
}

// Configures the Cloud Upload flow for Microsoft OneDrive and Microsoft 365
//
// This policy allows the admins to configure the Cloud Upload flow for
// Microsoft OneDrive and Microsoft 365 on Google ChromeOS.
//
// Setting the policy to 'allowed' lets the user set up the Cloud Upload flow
// for Microsoft OneDrive and Microsoft 365 if they wish to.
// After completing the setup process, files with matching file formats will by
// default be moved to Microsoft OneDrive and handled by the Microsoft 365 app
// when the user attempts to open them.
//
// Setting the policy to 'disallowed' prohibits the user from setting up the
// Cloud Upload flow for Microsoft OneDrive and Microsoft 365 as described above
// and removes Microsoft 365 from the list of potential file handlers.
//
// Setting the policy to 'automated' sets up the Cloud Upload flow for Microsoft
// OneDrive and Microsoft 365 automatically, so that files with matching file
// formats will by default be moved to Microsoft OneDrive and handled by the
// Microsoft 365 app when the user attempts to open them.
//
// Leaving the policy unset is functionally equivalent to setting it to
// 'allowed' for regular users; for enterprise users unset policy defaults to
// 'disallowed'.
//
// Valid values:
//   allowed: Allow the Cloud Upload flow for Microsoft OneDrive and Microsoft
// 365
//   disallowed: Disallow the Cloud Upload flow for Microsoft OneDrive and
// Microsoft 365
//   automated: Automate the Cloud Upload flow for Microsoft OneDrive and
// Microsoft 365
//
// Supported on: chrome_os
message MicrosoftOfficeCloudUploadProto {
  optional PolicyOptions policy_options = 1;
  optional string MicrosoftOfficeCloudUpload = 2;
}

// Restricts accounts that can use the Microsoft OneDrive integration
//
// This policy allows admins to restrict which accounts are allowed to sign-in
// for Microsoft OneDrive when the MicrosoftOneDriveMount policy is enabled.
//
// If this policy contains a value of 'common', any account can be used to sign-
// in.
//
// If this policy contains a value of 'organizations', work or school accounts
// can be used to sign-in.
//
// If this policy contains a value of 'consumers', personal Microsoft accounts
// can be used to sign-in.
//
// If this policy contains domain names or tenant IDs, accounts from these
// domain names or tenant IDs (see https://learn.microsoft.com/en-
// us/azure/active-directory/develop/v2-protocols#endpoints) can be used to
// sign-in.
//
// If this policy is unset or only contains an empty value, it behaves as if
// 'common' was specified for regular users; for enterprise users it behaves as
// if 'organizations' was specified.
//
// Changing restrictions might lead to users being signed out of their Microsoft
// OneDrive account if it does not adhere to the new restrictions.
//
// Note: At this time only the first entry will be taken into account. Later
// extensions will support multiple entries.
//
// Supported on: chrome_os
message MicrosoftOneDriveAccountRestrictionsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList MicrosoftOneDriveAccountRestrictions = 2;
}

// Configures the mounting of Microsoft OneDrive
//
// This policy allows the admins to configure the mounting of Microsoft
// OneDrive.
//
// Setting the policy to 'allowed' lets the user set up Microsoft OneDrive if
// they wish to.
// After completing the setup process, Microsoft OneDrive will be mounted in the
// file manager.
//
// Setting the policy to 'disallowed' prohibits the user from setting up
// Microsoft OneDrive.
//
// Setting the policy to 'automated' attempts to set up Microsoft OneDrive
// automatically. This requires the user to log in to Google ChromeOS with a
// Microsoft account. In case of failure it falls back to showing the setup
// flow.
//
// Leaving the policy unset is functionally equivalent to setting it to
// 'allowed' for regular users; for enterprise users unset policy defaults to
// 'disallowed'.
//
// It is possible to add further account restrict with the
// MicrosoftOneDriveAccountRestrictions policy.
//
// Valid values:
//   allowed: Allow setup of Microsoft OneDrive
//   disallowed: Disallow setup of Microsoft OneDrive
//   automated: Automate setup of Microsoft OneDrive
//
// Supported on: chrome_os
message MicrosoftOneDriveMountProto {
  optional PolicyOptions policy_options = 1;
  optional string MicrosoftOneDriveMount = 2;
}

// Enable mixed content autoupgrading on HTTPS sites
//
// Chrome attempts to upgrade some types of mixed content (HTTP on an HTTPS
// site) subresources on iOS.
// See https://chromium.googlesource.com/chromium/src/+/main/docs/security/autou
// pgrade-mixed.md for details.
//
// This policy was used to disable mixed content autoupgrading on iOS. The
// policy is now deprecated and unsupported.
//
// Valid values:
//   True: Enable mixed content autoupgrading
//   False: Disable mixed content autoupgrading
//
// Supported on:
message MixedContentAutoupgradeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool MixedContentAutoupgradeEnabled = 2;
}

// Enable the mono audio accessibility feature
//
// Enable the mono audio accessibility feature.
//
// This feature is responsible for outputing stereo audio which includes
// different left and right channels, so different ears get different sounds.
//
// If this policy is set to enabled, the mono audio will always be enabled.
//
// If this policy is set to disabled, the mono audio will always be disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the mono audio is disabled initially but can be
// enabled by the user anytime.
//
// Valid values:
//   True: Enable mono audio
//   False: Disable mono audio
//   None: Allow the user to decide
//
// Supported on: chrome_os
message MonoAudioEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool MonoAudioEnabled = 2;
}

// Enables automatic screencapture of multiple screens
//
// The getAllScreensMedia API allows isolated web applications (identified by
// their origin) to capture multiple surfaces at once without additional user
// permission.
// If the policy is not set, getAllScreensMedia is not available for any web
// application.
// In order to improve privacy, this policy will not support mid-session updates
// of the policy value and therefore changes will only apply after the user
// logged out and logged in again.
// The user can be sure that no additional apps will be able to capture the
// screens after login if it were not allowed at session start already.
//
// Supported on: chrome_os
message MultiScreenCaptureAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList MultiScreenCaptureAllowedForUrls = 2;
}

// Re-enable deprecated/removed Mutation Events
//
// This policy provides a temporary opt-back-in to a deprecated and removed set
// of platform events called Mutation Events.
// When this policy is Enabled, mutation events will continue to be fired, even
// if they've been disabled by default for normal web users. When this policy is
// Disabled or unset, these events may not be fired.
// This policy is a temporary workaround, and will no longer work in M137.
//
// Valid values:
//   True: Enabled: Temporarily re-enable mutation events.
//   False: Disabled: Normal behavior for mutation events, which will mean not
// firing these events after the removal date.
//
// Supported on: fuchsia
message MutationEventsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool MutationEventsEnabled = 2;
}

// Controls enabling NTLM as an authentication protocol for SMB mounts
//
// Setting the policy to Enabled means the Network File Shares feature for
// Google ChromeOS uses NTLM for authentication to SMB shares if necessary.
// Setting the policy to Disabled turns off NTLM authentication to SMB shares.
//
// Leaving the policy unset means the behavior defaults to off for managed users
// and on for other users.
//
// Valid values:
//   True: Use NTLM authentication
//   False: Do not use NTLM authentication
//
// Supported on: chrome_os
message NTLMShareAuthenticationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool NTLMShareAuthenticationEnabled = 2;
}

// Show cards on the New Tab Page
//
// This policy controls the visibility of cards on the New Tab Page. Cards
// surface entry points to launch common user journeys based on the user's
// browsing behavior.
//
// If the policy is set to Enabled, the New Tab Page will show cards if content
// is available.
//
// If the policy is set to Disabled, the New Tab Page won't show cards.
//
// If the policy is not set, the user can control the card visibility. The
// default is visible.
//
// Valid values:
//   True: New Tab Page will show cards if content is available
//   False: New Tab Page will not show cards
//   None: New Tab Page will show cards if content is available, but allow the
// user to change this setting
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message NTPCardsVisibleProto {
  optional PolicyOptions policy_options = 1;
  optional bool NTPCardsVisible = 2;
}

// Show content suggestions on the New Tab page
//
// Setting the policy to True or leaving it unset displays autogenerated content
// suggestions on the New Tab page, based on the user's browsing history,
// interests, or location.
//
// Setting the policy to False prevents autogenerated content suggestions from
// appearing on the New Tab page.
//
// Valid values:
//   True: Show content suggestions on the New Tab page
//   False: Do not show content suggestions on the New Tab page
//
// Supported on: android, ios
message NTPContentSuggestionsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool NTPContentSuggestionsEnabled = 2;
}

// Allow users to customize the background on the New Tab page
//
// If the policy is set to false, the New Tab page won't allow users to
// customize the background. Any existing custom background will be permanently
// removed even if the policy is set to true later.
//
// If the policy is set to true or unset, users can customize the background on
// the New Tab page.
//
// Note: On Android, the policy is applied to browser only after restart.
//
// Valid values:
//   True: Users can customize the New Tab page background
//   False: Users can not customize the New Tab page background
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message NTPCustomBackgroundEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool NTPCustomBackgroundEnabled = 2;
}

// Control the visibility of the extension attribution on the New Tab page
//
// This policy determines whether an attribution to the extension modifying the
// New Tab Page (NTP) is displayed in the NTP's footer.
//
// By default, if an extension has overridden the standard NTP, a message
// attributing this change to the specific extension will appear in the footer.
// This attribution typically includes a link to the relevant extension in the
// Chrome Web Store.
//
// If this policy is left unset or set to true, the extension attribution will
// be visible on the NTP footer when an extension is controlling the NTP.
//
// If this policy is set to false, the attribution to the extension in the NTP
// footer will be suppressed.
//
// Valid values:
//   True: Enable extension attribution on NTP Footer
//   False: Disable extension attribution on NTP Footer
//
// Supported on: chrome_os, linux, mac, win
message NTPFooterExtensionAttributionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool NTPFooterExtensionAttributionEnabled = 2;
}

// Control the visibility of the management notice on the New Tab Page for
// managed browsers
//
// This policy controls the visibility of the management notice within the
// footer of the New Tab Page (NTP). By default, the NTP footer displays
// information when the browser is managed by an organization (indicated by a
// building icon and "Managed by [domain name]"). This can be customized using
// the EnterpriseCustomLabelForBrowser and EnterpriseLogoUrlForBrowser policies.
//
// If this policy is left unset or set to true, managed browsers will display a
// “Managed by…” notice with an icon.
//
// If this policy is set to false, the management notice will be hidden.
//
// Note that this policy is only applied for managed browsers, so it will have
// no effect for managed users on unmanaged browsers.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   True: Enable management notice on NTP Footer
//   False: Disable management notice on NTP Footer
//
// Supported on: linux, mac, win
message NTPFooterManagementNoticeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool NTPFooterManagementNoticeEnabled = 2;
}

// Show the middle slot announcement on the New Tab Page
//
// This policy controls the visibility of the middle slot announcement on the
// New Tab Page.
//
// If the policy is set to Enabled, the New Tab Page will show the middle slot
// announcement if it is available.
//
// If the policy is set to Disabled, the New Tab Page will not show the middle
// slot announcement even if it is available.
//
// Valid values:
//   True: New Tab Page will show the middle slot announcement if it is
// available
//   False: New Tab Page will not show the middle slot announcement even if it
// is available
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message NTPMiddleSlotAnnouncementVisibleProto {
  optional PolicyOptions policy_options = 1;
  optional bool NTPMiddleSlotAnnouncementVisible = 2;
}

// Show Outlook Calendar card on the New Tab Page
//
// This policy controls the visibility of the Outlook Card on the New Tab Page.
// The card will only be displayed on the New Tab Page if the policy is enabled
// and your organization authorized the usage of the Outlook Calendar data in
// the browser.
//
// Outlook data will not be stored by the browser.
//
// The Outlook card shows the next calendar event, along with a glanceable look
// at the rest of the day's meetings. It aims to address the issue of context
// switching and enhance productivity by giving users a shortcut to their next
// meeting.
//
// The Microsoft Outlook card will require additional admin configuration. For
// detailed information on connecting the Chrome New Tab Page Card to Outlook,
// please see https://support.google.com/chrome/a?p=chrome_ntp_microsoft_cards.
//
// If the NTPCardsVisible is disabled, the Outlook Card will not be shown. If
// NTPCardsVisible is enabled, the Outlook card will be shown if this policy is
// also enabled and there is data to be shown. If NTPCardsVisible is unset, the
// Outlook card will be shown if this policy is also enabled, the user has the
// card enabled in Customize Chrome, and there is data to be shown.
//
// Valid values:
//   True: Enable NTP Outlook Calendar Card
//   False: Disable NTP Outlook Calendar Card
//
// Supported on: chrome_os, linux, mac, win
message NTPOutlookCardVisibleProto {
  optional PolicyOptions policy_options = 1;
  optional bool NTPOutlookCardVisible = 2;
}

// Show SharePoint and OneDrive File Card on the New Tab Page
//
// This policy controls the visibility of the SharePoint and OneDrive File Card
// on the New Tab Page. The card will only be displayed on the New Tab Page if
// the policy is enabled and your organization authorized the usage of the
// SharePoint and OneDrive File data in the browser.
//
// SharePoint and OneDrive data will not be stored by the browser.
//
// The SharePoint and OneDrive Files recommendation card shows a list of
// recommended files.  It aims to address the issue of context switching and
// enhance productivity by giving users a shortcut to their most important
// documents.
//
// The Microsoft SharePoint and OneDrive card will require additional admin
// configuration. For detailed information on connecting the Chrome New Tab Page
// Card to Sharepoint, please see
// https://support.google.com/chrome/a?p=chrome_ntp_microsoft_cards.
//
// If the NTPCardsVisible is disabled, the SharePoint and OneDrive Card will not
// be shown. If NTPCardsVisible is enabled, the SharePoint and OneDrive card
// will be shown if this policy is also enabled and there is data to be shown.
// If NTPCardsVisible is unset, the SharePoint and OneDrive card will be shown
// if this policy is also enabled, the user has the card enabled in Customize
// Chrome, and there is data to be shown.
//
// Valid values:
//   True: Enable NTP SharePoint and OneDrive File Card
//   False: Disable NTP SharePoint and OneDrive File Card
//
// Supported on: chrome_os, linux, mac, win
message NTPSharepointCardVisibleProto {
  optional PolicyOptions policy_options = 1;
  optional bool NTPSharepointCardVisible = 2;
}

// Setting shortcuts on the New Tab Page
//
// Setting the policy pre-configures up to 10 custom shortcuts on the Google
// Chrome New Tab page.
//
// If set, users will see these shortcuts by default, in addition to their
// personal shortcuts. Users can control visibility of their organization's
// shortcuts on the "Customize Chrome" panel.
//
// Shortcut URLs must be unique.
//
// If allow_user_edit is set to true, users can change the name of the shortcut.
// If set to false or unset, users cannot edit the name.
//
// If allow_user_delete is set to true, users can remove the shortcut. If set to
// false or unset, users cannot remove the shortcut.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "allow_user_delete": {
//                 "type": "boolean"
//             },
//             "allow_user_edit": {
//                 "type": "boolean"
//             },
//             "name": {
//                 "type": "string"
//             },
//             "url": {
//                 "type": "string"
//             }
//         },
//         "required": [
//             "name",
//             "url"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, linux, mac, win
message NTPShortcutsProto {
  optional PolicyOptions policy_options = 1;
  optional string NTPShortcuts = 2;
}

// Forces Native Client (NaCl) to be allowed to run.
//
// Setting the policy to True allows Native Client to continue to run even if
// the default behavior is that Native Client is disabled.
// Setting the policy to False will use the default behavior.
//
// Valid values:
//   True: Allow Native Client to Run
//   False: Use Default Behavior
//
// Supported on:
message NativeClientForceAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool NativeClientForceAllowed = 2;
}

// Force Windows executable Native Messaging hosts to launch directly
//
// This policy controls whether native host executables launch directly on
// Windows.
//
// Setting the policy to Enabled forces Google Chrome to launch native messaging
// hosts implemented as executables directly.
//
// Setting the policy to Disabled will result in Google Chrome launching hosts
// using cmd.exe as an intermediary process.
//
// Leaving the policy unset allows Google Chrome to decide which approach to
// use.
//
// Valid values:
//   True: Directly launch executable Native Messaging Hosts on Windows
//   False: Force Windows Native Messaging Hosts to launch via cmd.exe
//   None: Allows Google Chrome to decide which approach to use
//
// Supported on: win
message NativeHostsExecutablesLaunchDirectlyProto {
  optional PolicyOptions policy_options = 1;
  optional bool NativeHostsExecutablesLaunchDirectly = 2;
}

// Configure native messaging allowlist
//
// Setting the policy specifies which native messaging hosts aren't subject to
// the deny list. A deny list value of * means all native messaging hosts are
// denied, unless they're explicitly allowed.
//
// All native messaging hosts are allowed by default. But, if all native
// messaging hosts are denied by policy, the admin can use the allow list to
// change that policy.
//
// Supported on: fuchsia, linux, mac, win
message NativeMessagingAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NativeMessagingAllowlist = 2;
}

// Configure native messaging blocklist
//
// This policy is deprecated and unsupported, please use the
// 'NativeMessagingBlocklist' policy instead.
//
// Supported on:
message NativeMessagingBlacklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NativeMessagingBlacklist = 2;
}

// Configure native messaging blocklist
//
// Setting the policy specifies which native messaging hosts shouldn't be
// loaded. A deny list value of * means all native messaging hosts are denied,
// unless they're explicitly allowed.
//
// Leaving the policy unset means Google Chrome loads all installed native
// messaging hosts.
//
// Supported on: fuchsia, linux, mac, win
message NativeMessagingBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NativeMessagingBlocklist = 2;
}

// Allow user-level Native Messaging hosts (installed without admin permissions)
//
// Setting the policy to Enabled or leaving it unset means Google Chrome can use
// native messaging hosts installed at the user level.
//
// Setting the policy to Disabled means Google Chrome can only use these hosts
// if installed at the system level.
//
// Valid values:
//   True: Allow both user-level and system-level native messaging hosts
//   False: Allow only system-level native messaging hosts
//
// Supported on: fuchsia, linux, mac, win
message NativeMessagingUserLevelHostsProto {
  optional PolicyOptions policy_options = 1;
  optional bool NativeMessagingUserLevelHosts = 2;
}

// Configure native messaging allowlist
//
// This policy is deprecated and unsupported, please use the
// 'NativeMessagingAllowlist' policy instead.
//
// Supported on:
message NativeMessagingWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NativeMessagingWhitelist = 2;
}

// Native Printing
//
// Setting the policy lets administrators set up a list of printers for their
// users. Printer selection occurs the first time users try to print.
//
// Using the policy:
//
// * Customize free-form display_name and description for ease of printer
// selection.
//
// * Help users identify printers using manufacturer and model.
//
// * uri should be an address reachable from a client computer, including the
// scheme, port, and queue.
//
// * Optionally provide uuid to help deduplicate zeroconf printers.
//
// * Either use the model name for effective_model or set autoconf to True.
// Printers with both or no properties get ignored.
//
// PPDs are downloaded after the printer is used, and frequently used PPDs are
// cached. This policy doesn't affect whether users can configure printers on
// individual devices.
//
// Note: For Microsoft® Active Directory® managed devices, this policy supports
// expansion of ${MACHINE_NAME[,pos[,count]]} to the Microsoft® Active
// Directory® machine name or a substring of it. For example, if the machine
// name is CHROMEBOOK, then ${MACHINE_NAME,6,4} gets replaced by the 4
// characters starting after the 6th position, in other words, BOOK. The
// position is zero-based.
//
// This policy is deprecated, please use Printers instead.
//
// Supported on:
message NativePrintersProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NativePrinters = 2;
}

// Printer configuration access policy.
//
// This policy is deprecated and unsupported, please use PrintersBulkAccessMode
// instead.
//
// Valid values:
//   0: All printers are shown except those in the blocklist.
//   1: Only printers in the allowlist are shown to users
//   2: Allow all printers from the configuration file.
//
// Supported on:
message NativePrintersBulkAccessModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 NativePrintersBulkAccessMode = 2;
}

// Disabled enterprise printers
//
// If BlacklistRestriction is chosen for NativePrintersBulkAccessMode, then
// setting NativePrintersBulkBlacklist specifies which printers users can't use.
// All printers are provided to the user, except for the IDs listed in this
// policy. The IDs must correspond to the "id" or "guid" fields in the file
// specified in NativePrintersBulkConfiguration.
//
// This policy is deprecated, please use PrintersBulkBlocklist instead.
//
// Supported on:
message NativePrintersBulkBlacklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NativePrintersBulkBlacklist = 2;
}

// Enterprise printer configuration file
//
// Setting this policy configure enterprise printers. Its format matches the
// NativePrinters dictionary, with an additional required "id" or "guid" field
// for each printer for allow listing or deny listing. The file size can't
// exceed 5MB and is in JSON format. A file with about 21,000 printers encodes
// as a 5MB file. The cryptographic hash helps verify download integrity. The
// file is downloaded, cached, and redownloaded when the URL or the hash
// changes. Google ChromeOS downloads the file for printer configurations and
// makes printers available along with NativePrintersBulkAccessMode,
// NativePrintersBulkWhitelist, and NativePrintersBulkBlacklist.
//
// This policy has no effect on whether users can configure printers on
// individual devices. It is intended to be supplementary to the configuration
// of printers by individual users.
//
// If you set the policy, users can't change it.
//
// This policy is deprecated, please use PrintersBulkConfiguration instead.
//
// Supported on:
message NativePrintersBulkConfigurationProto {
  optional PolicyOptions policy_options = 1;
  optional string NativePrintersBulkConfiguration = 2;
}

// Enabled enterprise printers
//
// If WhitelistPrintersOnly is chosen for NativePrintersBulkAccessMode, then
// setting NativePrintersBulkWhitelist specifies which printers users can use.
// Only the printers with IDs matching the values in this policy are available
// to the user. The IDs must correspond to the "id" or "guid" fields in the file
// specified in NativePrintersBulkConfiguration.
//
// This policy is deprecated, please use PrintersBulkAllowlist instead.
//
// Supported on:
message NativePrintersBulkWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NativePrintersBulkWhitelist = 2;
}

// Enable Native Window Occlusion
//
// This policy is deprecated, please use the 'WindowOcclusionEnabled' policy
// instead.
//
// Enables native window occlusion in Google Chrome.
//
// If you enable this setting, to reduce CPU and power consumption Google Chrome
// will detect when a window is covered by other windows, and will suspend work
// painting pixels.
//
// If you disable this setting Google Chrome will not detect when a window is
// covered by other windows.
//
// If this policy is left not set, occlusion detection will be enabled.
//
// Valid values:
//   True: Detect covered window and suspend its painting
//   False: Do not detect covered window
//
// Supported on:
message NativeWindowOcclusionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool NativeWindowOcclusionEnabled = 2;
}

// Allow Nearby Share to be enabled.
//
// If this setting is enabled, users will be allowed to opt in to Nearby Share,
// which allows them to send and receive files from people closeby.
//
// If this setting is disabled, users will not be allowed to opt in to Nearby
// Share.
//
// If this policy is left not set, the default is not allowed for enterprise-
// managed users and allowed for non-managed users.
//
// Valid values:
//   True: Allow users to enable Nearby Share
//   False: Prevent users from enabling Nearby Share
//
// Supported on: chrome_os
message NearbyShareAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool NearbyShareAllowed = 2;
}

// Controls Network File Share discovery via NetBIOS
//
// Setting the policy to Enabled means share discovery (the Network File Shares
// feature for Google ChromeOS) uses the NetBIOS Name Query Request protocol to
// discover shares on the network. Setting the policy to Disabled means share
// discovery won't use this protocol to discover shares.
//
// Leaving the policy unset means the behavior defaults to off for managed users
// and on for other users.
//
// Valid values:
//   True: Allow NetBIOS share discovery
//   False: Do not allow NetBIOS share discovery
//
// Supported on: chrome_os
message NetBiosShareDiscoveryEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool NetBiosShareDiscoveryEnabled = 2;
}

// Controls Network File Shares for ChromeOS availability
//
// Setting the policy to Enabled lets users use Network File Shares for Google
// ChromeOS. Setting the policy to Disabled means users can't use this feature.
//
// Valid values:
//   True: Allow network file shares
//   False: Block network file shares
//
// Supported on: chrome_os
message NetworkFileSharesAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool NetworkFileSharesAllowed = 2;
}

// List of preconfigured network file shares.
//
// Setting the policy specifies a list of preset network file shares. Each item
// is an object with 2 properties: share_url and mode.
//
// The share URL should be share_url.
//
// For mode, it should be drop_down or pre_mount:
//
// * drop_down indicates that share_url will be added to the share discovery
// list.
//
// * pre_mount indicates that share_url will be mounted.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "mode": {
//                 "enum": [
//                     "drop_down",
//                     "pre_mount"
//                 ],
//                 "type": "string"
//             },
//             "share_url": {
//                 "type": "string"
//             }
//         },
//         "required": [
//             "share_url",
//             "mode"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os
message NetworkFileSharesPreconfiguredSharesProto {
  optional PolicyOptions policy_options = 1;
  optional string NetworkFileSharesPreconfiguredShares = 2;
}

// Enable network prediction
//
// This policy controls network prediction in Google Chrome. It controls DNS
// prefetching, TCP, and SSL preconnection and prerendering of webpages.
//
// If you set the policy, users can't change it. Leaving it unset turns on
// network prediction, but the user can change it.
//
// Valid values:
//   0: Predict network actions on any network connection
//   1: Predict network actions on any network that is not cellular.
//           (Deprecated in 50, removed in 52. After 52, if value 1 is set, it
// will be treated as 0 - predict network actions on any network connection.)
//   2: Do not predict network actions on any network connection
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message NetworkPredictionOptionsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 NetworkPredictionOptions = 2;
}

// Enable the network service sandbox
//
// This policy controls whether or not the network service process runs
// sandboxed.
// If this policy is enabled, the network service process will run sandboxed.
// If this policy is disabled, the network service process will run unsandboxed.
// This leaves users open to additional security risks related to running the
// network service unsandboxed.
// If this policy is not set, the default configuration for the network sandbox
// will be used. This may vary depending on Google Chrome release, currently
// running field trials, and platform.
// This policy is intended to give enterprises flexibility to disable the
// network sandbox if they use third party software that interferes with the
// network service sandbox.
//
// Valid values:
//   True: Enable the network service sandbox
//   False: Disable the network service sandbox
//   None: Use the default configuration for the network service sandbox
//
// Supported on: linux, win
message NetworkServiceSandboxEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool NetworkServiceSandboxEnabled = 2;
}

// Allows enabling the feature NewBaseUrlInheritanceBehavior
//
// NewBaseUrlInheritanceBehavior is a Google Chrome feature that causes
// about:blank and about:srcdoc frames to consistently inherit their base url
// values via snapshots of their initiator's base url. For more details, refer
// to https://chromestatus.com/feature/5161101671530496.
//
// When the policy is set to disabled, it prevents users or Google Chrome
// variations from enabling NewBaseUrlInheritanceBehavior, in case compatibility
// issues are discovered. When the policy is set to enabled or not set, it
// allows enabling NewBaseUrlInheritanceBehavior.
//
// Valid values:
//   True: NewBaseUrlInheritanceBehavior feature available
//   False: NewBaseUrlInheritanceBehavior feature disabled
//
// Supported on: fuchsia
message NewBaseUrlInheritanceBehaviorAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool NewBaseUrlInheritanceBehaviorAllowed = 2;
}

// Configure the New Tab page URL
//
// Setting the policy configures the default New Tab page URL and prevents users
// from changing it.
//
// The New Tab page opens with new tabs and windows.
//
// This policy doesn't decide which pages open on start up. Those are controlled
// by the RestoreOnStartup policies. This policy does affect the homepage, if
// that's set to open the New Tab page, as well as the startup page if it's set
// to open the New Tab page.
//
// It is a best practice to provide fully canonicalized URL, if the URL is not
// fully canonicalized Google Chrome will default to https://.
//
// Leaving the policy unset or empty puts the default New Tab page in use.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message NewTabPageLocationProto {
  optional PolicyOptions policy_options = 1;
  optional string NewTabPageLocation = 2;
}

// Allow Web Kiosk to open more than one browser window on any screen
//
// Setting the policy to Enabled means a Kiosk Web App can open another browser
// window which can be placed on the same screen or on a different screen. To
// open a new window, Web App should call window.open(url, target,
// windowFeatures) JavaScript function.
//
// Setting the policy to Disabled or leaving it unset means a Kiosk Web App can
// use only the main browser window and cannot open a new window. Calling any
// Javascript functions for opening a new window will be ignored.
//
// Valid values:
//   True: Allow a Kiosk Web App to open another browser window
//   False: Prohibit a Kiosk Web App from opening another browser window
//
// Supported on: chrome_os
message NewWindowsInKioskAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool NewWindowsInKioskAllowed = 2;
}

// The list of note-taking apps allowed on the Google ChromeOS lock screen
//
// Setting the policy specifies the apps that users can turn on as a note-taking
// app on the Google ChromeOS lock screen.
//
// If the preferred app is on the lock screen, a UI element for launching the
// preferred note-taking app appears on the screen. When launched, the app can
// create a window on top of the lock screen and create notes in this context.
// The app can import created notes to the primary user session, when the
// session is unlocked. Only Google Chrome note-taking apps are supported on the
// lock screen.
//
// Setting the policy means users can turn on an app on the lock screen if the
// app's extension ID is in the policy list value. So, setting it to an empty
// list will turn off note-taking on the lock screen. The policy with an app ID
// doesn't necessarily mean that users can turn the app on as a note-taking app
// on the lock screen. For example, on Google Chrome 61, the set of available
// apps is also restricted by the platform.
//
// Leaving the policy unset amounts to no restrictions on the set of apps users
// can enable on the lock screen imposed by the policy.
//
// Supported on: chrome_os
message NoteTakingAppsLockScreenAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NoteTakingAppsLockScreenAllowlist = 2;
}

// Allowlist note-taking apps allowed on the Google ChromeOS lock screen
//
// This policy is deprecated and unsupported, please use
// NoteTakingAppsLockScreenAllowlist instead.
//
// Supported on:
message NoteTakingAppsLockScreenWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NoteTakingAppsLockScreenWhitelist = 2;
}

// Allow notifications on these sites
//
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can display notifications.
//
// Leaving the policy unset means DefaultNotificationsSetting applies for all
// sites, if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message NotificationsAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NotificationsAllowedForUrls = 2;
}

// Block notifications on these sites
//
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can't display notifications.
//
// Leaving the policy unset means DefaultNotificationsSetting applies for all
// sites, if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message NotificationsBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList NotificationsBlockedForUrls = 2;
}

// Enable NTLMv2 authentication.
//
// Setting the policy to Enabled or leaving it unset turns NTLMv2 on.
//
// Setting the policy to Disabled turns NTLMv2 off.
//
// All recent versions of Samba and Microsoft® Windows® servers support NTLMv2.
// This should only be turned off for backward compatibility as it reduces the
// security of authentication.
//
// Valid values:
//   True: Turn NTLMv2 on
//   False: Turn NTLMv2 off
//
// Supported on: android, chrome_os, linux, mac
message NtlmV2EnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool NtlmV2Enabled = 2;
}

// Control the new behavior of HTMLElement.offsetParent
//
// The HTMLElement.offsetParent API is being changed in Google Chrome in order
// to comply with changes that have been made in Firefox and Safari. This policy
// brings back the old behavior until M120.
//
// The new behavior may break some Google Chrome-only websites which use
// HTMLElement.offsetParent, HTMLElement.offsetTop, or HTMLElement.offsetLeft in
// conjunction with Shadow DOM.
//
// Here are some polyfills which bring back the old behavior to help migrate
// https://github.com/josepharhar/offsetparent-polyfills
//
// If this policy is enabled, then the new behavior will be used.
//
// If this policy is disabled, then the old behavior will be used.
//
// If this policy is not set, then the new behavior will be used just like the
// rest of chromium users.
//
// Valid values:
//   True: New offsetParent behavior will be used.
//   False: Old offsetParent behavior will be used.
//   None: New offsetParent behavior will be used by default.
//
// Supported on:
message OffsetParentNewSpecBehaviorEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool OffsetParentNewSpecBehaviorEnabled = 2;
}

// Configuration policy for the OnBulkDataEntry Chrome Enterprise Connector
//
// List of Chrome Enterprise Connectors services settings to be applied to the
// OnBulkDataEntry Enterprise Connector, which triggers when data is entered in
// Chrome from the clipboard or by drag and dropping web content.
//
// The url_list, tags, enable and disable fields are used to determine if the
// connector should send data for analysis when it is entered in a specific page
// and what tags to include in the analysis request for that data. A tag
// corresponding to an 'enable' pattern will be included in the analysis request
// if the page URL matches a pattern associated to that tag as long as no
// 'disable' pattern with that same tag matches the page URL. The analysis
// occurs if at least 1 tag is to be included in the request.
//
// The service_provider field identifies which analysis service provider the
// settings correspond to.
//
// The block_until_verdict field being set to 1 means Chrome will wait to get a
// response from the analysis service before giving the page access to the data.
// Any other integer value means Chrome gives the page access to the data
// immediately.
//
// The default_action field being set to block means Chrome will not give the
// page access to the data if an error occurs while communicating with the
// analysis service. Any other value means Chrome gives the page access to the
// data.
//
// The minimum_data_size field indicates the minimum size (in bytes) data
// entered in Chrome must equal or surpass to be scanned. The default value is
// 100 bytes if the field is unset.
//
// The require_justification_tags field is used to determine for which tags the
// connector should require the user to enter a justification to bypass a scan
// that results in a bypassable warning. If the field is not set, it's assumed
// that a justification is not required.
//
// The custom_messages, message, learn_more_url, language and tag fields are
// used to configure a message to show the user when a warning is shown after a
// scan had a non-clean verdict. The message field contains the text to show the
// user and should have at most 200 characters. The learn_more_url field
// contains an admin-provided URL that will be clickable by the user to get more
// customer-provided information about why the action was blocked. The language
// field is optional and contains the language of the message. An empty language
// field or a value of 'default' indicates a message to be used when the user's
// language doesn't have a message. The tag field specifies for which type of
// scans the message is displayed. The custom_messages list can have zero or
// more entries, where each entry is required to have non-empty message and tag
// fields.
//
// This policy requires additional setup to take effect, please visit https://su
// pport.google.com/chrome/a?p=chrome_enterprise_connector_policies_setting for
// more information.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "block_until_verdict": {
//                 "type": "integer"
//             },
//             "custom_messages": {
//                 "items": {
//                     "properties": {
//                         "language": {
//                             "type": "string"
//                         },
//                         "learn_more_url": {
//                             "type": "string"
//                         },
//                         "message": {
//                             "type": "string"
//                         },
//                         "tag": {
//                             "type": "string"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "default_action": {
//                 "enum": [
//                     "allow",
//                     "block"
//                 ],
//                 "type": "string"
//             },
//             "disable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "enable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "minimum_data_size": {
//                 "minimum": 0,
//                 "type": "integer"
//             },
//             "require_justification_tags": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "service_provider": {
//                 "enum": [
//                     "google",
//                     "local_user_agent",
//                     "local_system_agent",
//                     "brcm_chrm_cas",
//                     "trellix"
//                 ],
//                 "type": "string"
//             },
//             "verification": {
//                 "properties": {
//                     "linux": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "mac": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "windows": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, ios, linux, mac, win
message OnBulkDataEntryEnterpriseConnectorProto {
  optional PolicyOptions policy_options = 1;
  optional string OnBulkDataEntryEnterpriseConnector = 2;
}

// Configuration policy for the OnDataCopied Chrome Enterprise Connector
//
// List of Google Chrome Enterprise Connectors services settings to be applied
// to the OnDataCopied Enterprise Connector, which triggers when data is copied
// to the clipboard from Google Chrome.
//
// The url_list, tags, enable and disable fields are used to determine if the
// connector should send data for analysis when it is copied from a specific
// page and what tags to include in the analysis request for that data. A tag
// corresponding to an 'enable' pattern will be included in the analysis request
// if the page URL matches a pattern associated to that tag as long as no
// 'disable' pattern with that same tag matches the page URL. The analysis
// occurs if at least 1 tag is to be included in the request.
//
// The service_provider field identifies which analysis service provider the
// settings correspond to.
//
// The block_until_verdict field being set to 1 means Google Chrome will wait to
// get a response from the analysis service before giving the OS clipboard
// access to the data. Any other integer value means Google Chrome gives the OS
// clipboard access to the data immediately.
//
// The default_action field being set to block means Google Chrome will not give
// the OS clipboard access to the data if an error occurs while communicating
// with the analysis service. Any other value means Google Chrome gives the OS
// clipboard access to the data.
//
// The minimum_data_size field indicates the minimum size (in bytes) data copied
// from Google Chrome must equal or surpass to be scanned. The default value is
// 100 bytes if the field is unset.
//
// The require_justification_tags field is used to determine for which tags the
// connector should require the user to enter a justification to bypass a scan
// that results in a bypassable warning. If the field is not set, it's assumed
// that a justification is not required.
//
// The verification field allows administrators to configure platform-specific
// verification requirements.
//
// This policy requires additional setup to take effect, please visit https://su
// pport.google.com/chrome/a?p=chrome_enterprise_connector_policies_setting for
// more information.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "block_until_verdict": {
//                 "type": "integer"
//             },
//             "default_action": {
//                 "enum": [
//                     "allow",
//                     "block"
//                 ],
//                 "type": "string"
//             },
//             "disable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "enable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "minimum_data_size": {
//                 "minimum": 0,
//                 "type": "integer"
//             },
//             "require_justification_tags": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "service_provider": {
//                 "enum": [
//                     "google"
//                 ],
//                 "type": "string"
//             },
//             "verification": {
//                 "properties": {
//                     "linux": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "mac": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "windows": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, linux, mac, win
message OnDataCopiedEnterpriseConnectorProto {
  optional PolicyOptions policy_options = 1;
  optional string OnDataCopiedEnterpriseConnector = 2;
}

// Configuration policy for the OnFileAttached Chrome Enterprise Connector
//
// List of Chrome Enterprise Connectors services settings to be applied to the
// OnFileAttached Enterprise Connector, which triggers when a file is attached
// to Chrome.
//
// The url_list, tags, enable and disable fields are used to determine if the
// connector should send a file for analysis when it is attached to a specific
// page and what tags to include in the analysis request for that file. A tag
// corresponding to an 'enable' pattern will be included in the analysis request
// if the page URL matches a pattern associated to that tag as long as no
// 'disable' pattern with that same tag matches the page URL. The analysis
// occurs if at least 1 tag is to be included in the request.
//
// The service_provider field identifies which analysis service provider the
// settings correspond to.
//
// The block_until_verdict field being set to 1 means Chrome will wait to get a
// response from the analysis service before giving the page access to the file.
// Any other integer value means Chrome gives the page access to the file
// immediately.
//
// The default_action field being set to block means Chrome will not give the
// page access to the file if an error occurs while communicating with the
// analysis service. Any other value means Chrome gives the page access to the
// file.
//
// The block_password_protected field controls whether Chrome blocks or allows
// files that are password protected.
//
// The block_large_files fields controls whether Chrome blocks or allows files
// that are too large to be analyzed.
//
// The require_justification_tags field is used to determine for which tags the
// connector should require the user to enter a justification to bypass a scan
// that results in a bypassable warning. If the field is not set, it's assumed
// that a justification is not required.
//
// The custom_messages, message, learn_more_url, language and tag fields are
// used to configure a message to show the user when a warning is shown after a
// scan had a non-clean verdict. The message field contains the text to show the
// user and should have at most 200 characters. The learn_more_url field
// contains an admin-provided URL that will be clickable by the user to get more
// customer-provided information about why the action was blocked. The language
// field is optional and contains the language of the message. An empty language
// field or a value of 'default' indicates a message to be used when the user's
// language doesn't have a message. The tag field specifies for which type of
// scans the message is displayed. The custom_messages list can have zero or
// more entries, where each entry is required to have non-empty message and tag
// fields.
//
// This policy requires additional setup to take effect, please visit https://su
// pport.google.com/chrome/a?p=chrome_enterprise_connector_policies_setting for
// more information.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "block_large_files": {
//                 "type": "boolean"
//             },
//             "block_password_protected": {
//                 "type": "boolean"
//             },
//             "block_until_verdict": {
//                 "type": "integer"
//             },
//             "custom_messages": {
//                 "items": {
//                     "properties": {
//                         "language": {
//                             "type": "string"
//                         },
//                         "learn_more_url": {
//                             "type": "string"
//                         },
//                         "message": {
//                             "type": "string"
//                         },
//                         "tag": {
//                             "type": "string"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "default_action": {
//                 "enum": [
//                     "allow",
//                     "block"
//                 ],
//                 "type": "string"
//             },
//             "disable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "enable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "require_justification_tags": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "service_provider": {
//                 "enum": [
//                     "google",
//                     "local_user_agent",
//                     "local_system_agent",
//                     "brcm_chrm_cas",
//                     "trellix"
//                 ],
//                 "type": "string"
//             },
//             "verification": {
//                 "properties": {
//                     "linux": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "mac": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "windows": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message OnFileAttachedEnterpriseConnectorProto {
  optional PolicyOptions policy_options = 1;
  optional string OnFileAttachedEnterpriseConnector = 2;
}

// Configuration policy for the OnFileDownloaded Chrome Enterprise Connector
//
// List of Chrome Enterprise Connectors services settings to be applied to the
// OnFileDownloaded Enterprise Connector, which triggers when a file is
// downloaded in Chrome.
//
// The url_list, tags, enable and disable fields are used to determine if the
// connector should send a file for analysis when it is downloaded from a
// specific page and what tags to include in the analysis request for that file.
// A tag corresponding to an 'enable' pattern will be included in the analysis
// request if the page URL matches a pattern associated to that tag as long as
// no 'disable' pattern with that same tag matches the page URL. The analysis
// occurs if at least 1 tag is to be included in the request.
//
// The service_provider field identifies which analysis service provider the
// settings correspond to.
//
// The block_until_verdict field being set to 1 means Chrome will wait to get a
// response from the analysis service before giving the user access to the
// downloaded file. Any other integer value means Chrome gives the user access
// to the file immediately.
//
// The default_action field being set to block means Chrome will not give the
// user access to the downloaded file if an error occurs while communicating
// with the analysis service. Any other value means Chrome gives the user access
// to the downloaded file.
//
// The block_password_protected field controls whether Chrome blocks or allows
// files that are password protected.
//
// The block_large_files fields controls whether Chrome blocks or allows files
// that are too large to be analyzed.
//
// The require_justification_tags field is used to determine for which tags the
// connector should require the user to enter a justification to bypass a scan
// that results in a bypassable warning. If the field is not set, it's assumed
// that a justification is not required.
//
// The custom_messages, message, learn_more_url, language and tag fields are
// used to configure a message to show the user when a warning is shown after a
// scan had a non-clean verdict. The message field contains the text to show the
// user and should have at most 200 characters. The learn_more_url field
// contains an admin-provided URL that will be clickable by the user to get more
// customer-provided information about why the action was blocked. The language
// field is optional and contains the language of the message. An empty language
// field or a value of 'default' indicates a message to be used when the user's
// language doesn't have a message. The tag field specifies for which type of
// scans the message is displayed. The custom_messages list can have zero or
// more entries, where each entry is required to have non-empty message and tag
// fields.
//
// This policy requires additional setup to take effect, please visit https://su
// pport.google.com/chrome/a?p=chrome_enterprise_connector_policies_setting for
// more information.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "block_large_files": {
//                 "type": "boolean"
//             },
//             "block_password_protected": {
//                 "type": "boolean"
//             },
//             "block_until_verdict": {
//                 "type": "integer"
//             },
//             "custom_messages": {
//                 "items": {
//                     "properties": {
//                         "language": {
//                             "type": "string"
//                         },
//                         "learn_more_url": {
//                             "type": "string"
//                         },
//                         "message": {
//                             "type": "string"
//                         },
//                         "tag": {
//                             "type": "string"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "default_action": {
//                 "enum": [
//                     "allow",
//                     "block"
//                 ],
//                 "type": "string"
//             },
//             "disable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "enable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "require_justification_tags": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "service_provider": {
//                 "enum": [
//                     "google",
//                     "local_user_agent",
//                     "local_system_agent",
//                     "brcm_chrm_cas",
//                     "trellix"
//                 ],
//                 "type": "string"
//             },
//             "verification": {
//                 "properties": {
//                     "linux": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "mac": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "windows": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message OnFileDownloadedEnterpriseConnectorProto {
  optional PolicyOptions policy_options = 1;
  optional string OnFileDownloadedEnterpriseConnector = 2;
}

// Configuration policy for the OnFileTransfer Chrome Enterprise Connector
//
// List of Chrome Enterprise Connectors services settings to be applied to the
// OnFileTransfer Enterprise Connector, which triggers when a file is
// transferred within Google ChromeOS.
//
// The source_destination_list, tags, enable and disable fields are used to
// determine if the connector should send a file for analysis when it is
// transferred between a source and a destination and what tags to include in
// the analysis request for that file. A tag corresponding to an 'enable' rule
// will be included in the analysis request if the source and destination match
// the rule associated to that tag as long as no 'disable' rule with that same
// tag matches the transfer. The analysis occurs if at least 1 tag is to be
// included in the request. A source_destination_list rule is defined by a list
// of pairs, where each pair contains a list of sources and a list of
// destinations. The file_system_type defines for which file system a rule
// should apply.
//
// The service_provider field identifies which analysis service provider the
// settings correspond to.
//
// The block_until_verdict field being set to 1 means Google ChromeOS will wait
// to get a response from the analysis service before allowing the transfer. Any
// other integer value means Google ChromeOS allows the transfer immediately.
//
// The default_action field being set to block means Google ChromeOS will not
// allow users to transfer the file if an error occurs while communicating with
// the analysis service. Any other value means Google ChromeOS allows transfers
// of the file if an error occurs while communicating with the analysis service.
//
// The block_password_protected field controls whether Google ChromeOS blocks or
// allows files that are password protected.
//
// The block_large_files fields controls whether Google ChromeOS blocks or
// allows files that are too large to be analyzed.
//
// The require_justification_tags field is used to determine for which tags the
// connector should require the user to enter a justification to bypass a scan
// that results in a bypassable warning. If the field is not set, it's assumed
// that a justification is not required.
//
// The custom_messages, message, learn_more_url, language and tag fields are
// used to configure a message to show the user when a warning is shown after a
// scan had a non-clean verdict. The message field contains the text to show the
// user and should have at most 200 characters. The learn_more_url field
// contains an admin-provided URL that will be clickable by the user to get more
// customer-provided information about why the action was blocked. The language
// field is optional and contains the language of the message. An empty language
// field or a value of 'default' indicates a message to be used when the user's
// language doesn't have a message. The tag field specifies for which type of
// scans the message is displayed. The custom_messages list can have zero or
// more entries, where each entry is required to have non-empty message and tag
// fields.
//
// This policy requires additional setup to take effect, please visit https://su
// pport.google.com/chrome/a?p=chrome_enterprise_connector_policies_setting for
// more information.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "block_large_files": {
//                 "type": "boolean"
//             },
//             "block_password_protected": {
//                 "type": "boolean"
//             },
//             "block_until_verdict": {
//                 "type": "integer"
//             },
//             "custom_messages": {
//                 "items": {
//                     "properties": {
//                         "language": {
//                             "type": "string"
//                         },
//                         "learn_more_url": {
//                             "type": "string"
//                         },
//                         "message": {
//                             "type": "string"
//                         },
//                         "tag": {
//                             "type": "string"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "default_action": {
//                 "enum": [
//                     "allow",
//                     "block"
//                 ],
//                 "type": "string"
//             },
//             "disable": {
//                 "id": "file_transfer_enable_disable_schema",
//                 "items": {
//                     "properties": {
//                         "source_destination_list": {
//                             "items": {
//                                 "properties": {
//                                     "destinations": {
//                                         "id":
// "file_transfer_source_destination_schema",
//                                         "items": {
//                                             "properties": {
//                                                 "file_system_type": {
//                                                     "enum": [
//                                                         "UNKNOWN",
//                                                         "ANY",
//                                                         "*",
//                                                         "MY_FILES",
//                                                         "REMOVABLE",
// "DEVICE_MEDIA_STORAGE",
//                                                         "PROVIDED",
//                                                         "ARC",
//                                                         "GOOGLE_DRIVE",
//                                                         "SMB",
//                                                         "CROSTINI",
//                                                         "PLUGIN_VM",
//                                                         "BOREALIS",
//                                                         "BRUSCHETTA",
//                                                         "UNKNOWN_VM"
//                                                     ],
//                                                     "type": "string"
//                                                 }
//                                             },
//                                             "type": "object"
//                                         },
//                                         "type": "array"
//                                     },
//                                     "sources": {
//                                         "items": {
//                                             "properties": {
//                                                 "file_system_type": {
//                                                     "enum": [
//                                                         "UNKNOWN",
//                                                         "ANY",
//                                                         "*",
//                                                         "MY_FILES",
//                                                         "REMOVABLE",
// "DEVICE_MEDIA_STORAGE",
//                                                         "PROVIDED",
//                                                         "ARC",
//                                                         "GOOGLE_DRIVE",
//                                                         "SMB",
//                                                         "CROSTINI",
//                                                         "PLUGIN_VM",
//                                                         "BOREALIS",
//                                                         "BRUSCHETTA",
//                                                         "UNKNOWN_VM"
//                                                     ],
//                                                     "type": "string"
//                                                 }
//                                             },
//                                             "type": "object"
//                                         },
//                                         "type": "array"
//                                     }
//                                 },
//                                 "type": "object"
//                             },
//                             "type": "array"
//                         },
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "enable": {
//                 "items": {
//                     "properties": {
//                         "source_destination_list": {
//                             "items": {
//                                 "properties": {
//                                     "destinations": {
//                                         "items": {
//                                             "properties": {
//                                                 "file_system_type": {
//                                                     "enum": [
//                                                         "UNKNOWN",
//                                                         "ANY",
//                                                         "*",
//                                                         "MY_FILES",
//                                                         "REMOVABLE",
// "DEVICE_MEDIA_STORAGE",
//                                                         "PROVIDED",
//                                                         "ARC",
//                                                         "GOOGLE_DRIVE",
//                                                         "SMB",
//                                                         "CROSTINI",
//                                                         "PLUGIN_VM",
//                                                         "BOREALIS",
//                                                         "BRUSCHETTA",
//                                                         "UNKNOWN_VM"
//                                                     ],
//                                                     "type": "string"
//                                                 }
//                                             },
//                                             "type": "object"
//                                         },
//                                         "type": "array"
//                                     },
//                                     "sources": {
//                                         "items": {
//                                             "properties": {
//                                                 "file_system_type": {
//                                                     "enum": [
//                                                         "UNKNOWN",
//                                                         "ANY",
//                                                         "*",
//                                                         "MY_FILES",
//                                                         "REMOVABLE",
// "DEVICE_MEDIA_STORAGE",
//                                                         "PROVIDED",
//                                                         "ARC",
//                                                         "GOOGLE_DRIVE",
//                                                         "SMB",
//                                                         "CROSTINI",
//                                                         "PLUGIN_VM",
//                                                         "BOREALIS",
//                                                         "BRUSCHETTA",
//                                                         "UNKNOWN_VM"
//                                                     ],
//                                                     "type": "string"
//                                                 }
//                                             },
//                                             "type": "object"
//                                         },
//                                         "type": "array"
//                                     }
//                                 },
//                                 "type": "object"
//                             },
//                             "type": "array"
//                         },
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "require_justification_tags": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "service_provider": {
//                 "type": "string"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os
message OnFileTransferEnterpriseConnectorProto {
  optional PolicyOptions policy_options = 1;
  optional string OnFileTransferEnterpriseConnector = 2;
}

// Configuration policy for the OnNetworkRequest Google Chrome Enterprise
// Connector
//
// List of Google Chrome Enterprise Connectors services settings to be applied
// to the OnNetworkRequest Enterprise Connector, which triggers when a network
// request is made from Google Chrome. Only HTTP POST requests are evaluated by
// this policy.
//
// The audit field is used to determine what requests should be audited. The
// request and its contents will create an analysis request, but it will not be
// blocked. Only one list entry in the policy needs to be matched by a network
// request for an audit analysis request to be created.
//
// The request_domain and tab_domain list fields are matched against a request's
// URL and the main tab URL in which the request originated respectively. If one
// of the fields is missing, it will be implicitly considered as matching.
//
// The tags field is used to determine what tag(s) to include in the analysis
// request if the audit field is matching.
//
// This policy requires additional setup to take effect, please visit https://su
// pport.google.com/chrome/a?p=chrome_enterprise_connector_policies_setting for
// more information.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "audit": {
//                 "properties": {
//                     "request_domain": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "tab_domain": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "tags": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, linux, mac, win
message OnNetworkRequestEnterpriseConnectorProto {
  optional PolicyOptions policy_options = 1;
  optional string OnNetworkRequestEnterpriseConnector = 2;
}

// Configuration policy for the OnPrint Google Chrome Enterprise Connector
//
// List of Google Chrome Enterprise Connectors services settings to be applied
// to the OnPrint Enterprise Connector, which triggers when a page or file is
// printed from Google Chrome.
//
// The url_list, tags, enable and disable fields are used to determine if the
// connector should send data for analysis when printing is triggered on a
// specific page and what tags to include in the analysis request. The analysis
// occurs if at least 1 tag is to be included in the request.
//
// The service_provider field identifies which analysis service provider the
// settings correspond to.
//
// The block_until_verdict field being set to 1 means Google Chrome will wait to
// get a response from the analysis service before allowing the print preview
// dialog to be shown for the printed page. Any other integer value means Google
// Chrome shows the print preview dialog immediately.
//
// The default_action field being set to block means Google Chrome will block
// the page from printing if an error occurs while communicating with the
// analysis service. Any other value means Google Chrome allows the page to be
// printed.
//
// The block_large_files fields controls whether Google Chrome blocks or allows
// files/pages that are too large to be analyzed.
//
// The require_justification_tags field is used to determine for which tags the
// connector should require the user to enter a justification to bypass a scan
// that results in a bypassable warning. If the field is not set, it's assumed
// that a justification is not required.
//
// The custom_messages, message, learn_more_url, language and tag fields are
// used to configure a message to show the user when a warning is shown after a
// scan had a non-clean verdict. The administrator is able to configure messages
// of up to 200 characters.
//
// This policy requires additional setup to take effect, please visit https://su
// pport.google.com/chrome/a?p=chrome_enterprise_connector_policies_setting for
// more information.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "block_large_files": {
//                 "type": "boolean"
//             },
//             "block_until_verdict": {
//                 "enum": [
//                     0,
//                     1
//                 ],
//                 "type": "integer"
//             },
//             "custom_messages": {
//                 "items": {
//                     "properties": {
//                         "language": {
//                             "type": "string"
//                         },
//                         "learn_more_url": {
//                             "type": "string"
//                         },
//                         "message": {
//                             "type": "string"
//                         },
//                         "tag": {
//                             "type": "string"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "default_action": {
//                 "enum": [
//                     "allow",
//                     "block"
//                 ],
//                 "type": "string"
//             },
//             "disable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "enable": {
//                 "items": {
//                     "properties": {
//                         "tags": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "url_list": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "require_justification_tags": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "service_provider": {
//                 "enum": [
//                     "google",
//                     "local_user_agent",
//                     "local_system_agent",
//                     "brcm_chrm_cas",
//                     "trellix"
//                 ],
//                 "type": "string"
//             },
//             "verification": {
//                 "properties": {
//                     "linux": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "mac": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "windows": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message OnPrintEnterpriseConnectorProto {
  optional PolicyOptions policy_options = 1;
  optional string OnPrintEnterpriseConnector = 2;
}

// Configuration policy for the OnSecurityEvent Chrome Enterprise Connector
//
// List of Chrome Enterprise Connectors services settings to be applied to the
// OnSecurityEvent Enterprise Connector, which triggers when a security event
// occurs in Chrome. This includes negative verdicts from analysis Enterprise
// Connectors, password reuse, navigations to unsafe pages and other security
// sensitive user actions.
//
// The service_provider field identifies which reporting service provider the
// settings correspond to and the enabled_event_names field identifies which
// events are enabled for this provider.
//
// This policy requires additional setup to take effect, please visit https://su
// pport.google.com/chrome/a?p=chrome_enterprise_connector_policies_setting for
// more information.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "enabled_event_names": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "enabled_opt_in_events": {
//                 "items": {
//                     "properties": {
//                         "name": {
//                             "type": "string"
//                         },
//                         "url_patterns": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "service_provider": {
//                 "enum": [
//                     "google"
//                 ],
//                 "type": "string"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message OnSecurityEventEnterpriseConnectorProto {
  optional PolicyOptions policy_options = 1;
  optional string OnSecurityEventEnterpriseConnector = 2;
}

// Out-of-process print drivers allowed
//
// Controls if Google Chrome interacts with printer drivers from a separate
// service process. Platform printing calls to query available printers, get
// print driver settings, and submit documents for printing to local printers
// are made from a service process. Moving such calls out of the browser process
// helps improve stability and reduce frozen UI behavior in Print Preview.
//
// When this policy is set to Enabled or not set, Google Chrome will use a
// separate service process for platform printing tasks.
//
// When this policy is set to Disabled, Google Chrome will use the browser
// process for platform printing tasks.
//
// This policy will be removed in the future, after the out-of-process print
// drivers feature has fully rolled out.
//
// Valid values:
//   True: Platform printing uses service process.
//   False: Platform printing from browser process.
//
// Supported on: chrome_os, linux, mac, win
message OopPrintDriversAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool OopPrintDriversAllowed = 2;
}

// User-level network configuration
//
// Setting the policy allows pushing network configuration per-user for each
// Google Chrome device. The network configuration is a JSON-formatted string,
// as defined by the Open Network Configuration format.
//
// Supported on: chrome_os
message OpenNetworkConfigurationProto {
  optional PolicyOptions policy_options = 1;
  optional string OpenNetworkConfiguration = 2;
}

// Enable Optimization Guide Fetching
//
// Setting the policy to Enabled or leaving it unset will enable the fetching of
// page load metadata and machine learning models that enhance the browsing
// experience.
// Setting the policy to Disabled may cause some features to not work
// appropriately.
//
// Valid values:
//   True: Enable fetching of page load metadata and machine learning models to
// enhance the browsing experience
//   False: Disable fetching of page load metadata and machine learning models
// that enhance the browsing experience
//
// Supported on:
message OptimizationGuideFetchingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool OptimizationGuideFetchingEnabled = 2;
}

// Control the enablement of ChromeOS "Help me write" feature
//
// This policy enables or disables "Help me write" for ChromeOS.
//
// If this policy is set to Enabled, "Help me write" will be enabled.
//
// If this policy is set to Disabled, "Help me write" will be disabled.
//
// If this policy is set to Unset, "Help me write" will be enabled on non-
// managed devices and disabled for enterprise-managed devices.
//
// Valid values:
//   True: Enable Orca
//   False: Disable Orca
//
// Supported on: chrome_os
message OrcaEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool OrcaEnabled = 2;
}

// Allows origin-keyed agent clustering by default.
//
// This policy allows origin-keyed agent clustering by default.
//
// The Origin-Agent-Cluster HTTP header controls whether a document is
// isolated in an origin-keyed agent cluster, or in a site-keyed agent
// cluster. This has security implications since an origin-keyed agent
// cluster allows isolating documents by origin. The developer-visible
// consequence of this is that the document.domain accessor can no longer
// be set.
//
// The default behaviour - when no Origin-Agent-Cluster header has been set -
// changes in M111 from site-keyed to origin-keyed.
//
// If this policy is enabled or not set, the browser will follow this
// new default from that version on.
//
// If this policy is disabled this change is reversed and
// documents without Origin-Agent-Cluster headers will be assigned to
// site-keyed agent clusters. As a consequence, the document.domain accessor
// remains settable by default. This matches the legacy behaviour.
//
// See https://developer.chrome.com/blog/immutable-document-domain/ for
// additional details.
//
// Valid values:
//   True: By default, documents may be put in origin-keyed agent clusters.
// document.domain is not settable for such documents.
//   False: By default, documents are put in site-keyed agent clusters.
// document.domain remains settable.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message OriginAgentClusterDefaultEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool OriginAgentClusterDefaultEnabled = 2;
}

// Enable origin-keyed process isolation by default.
//
// Enables origin-keyed process isolation for most pages (i.e., those assigned
// to an origin-keyed agent cluster by default). This improves security but also
// increases the number of processes created. Users are allowed to override the
// set policy value via the command-line flags or chrome://flags (both to turn
// this feature on or off).
//
// Setting the policy to Enabled results in most origins being isolated, even
// from other origins in the same site. See also the IsolateOrigins and
// SitePerProcess policies.
//
// Setting the policy to Disabled results in no origins being isolated from the
// rest of their site unless an origin explicitly asks to.
//
// Not setting the policy results in the browser determining which origins to
// isolate and when to isolate them.
//
// Valid values:
//   True: Most origins will be isolated from other origins in the same site.
//   False: No origins will be isolated from other origins in the same site
// unless the origin explicitly asked to be isolated.
//   None: Let Google Chrome decide which origins to isolate from other same-
// site origins.
//
// Supported on: chrome_os, linux, mac, win
//
// Note: this policy must have a RECOMMENDED PolicyMode set in PolicyOptions.
message OriginKeyedProcessesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool OriginKeyedProcessesEnabled = 2;
}

// ChromeOS color mode
//
// Controls the theme used to render UI during OOBE and in session
// (dark/light/auto).
// The auto mode automatically switches between dark and light themes on sunrise
// and sunset.
// This policy should be recommended, giving users the possibility to change the
// theme in system settings.
//
// Valid values:
//   light: Use the Light theme
//   dark: Use the Dark theme
//   auto: Use the Auto mode
//
// Supported on: chrome_os
message OsColorModeProto {
  optional PolicyOptions policy_options = 1;
  optional string OsColorMode = 2;
}

// Enable system DNS resolution outside of the network service
//
// Setting this policy to true causes system DNS resolution (getaddrinfo()) to
// possibly run outside of the network process, depending on system
// configuration and feature flags.
//
// Setting this policy to false causes system DNS resolution (getaddrinfo()) to
// run in the network process rather than the browser process. This may force
// the network service sandbox to be disabled, degrading the security of Google
// Chrome.
//
// If this policy is not set, system DNS resolution may run in the network
// service, outside of the network service, or partially inside and partially
// outside, depending on system configuration and feature flags.
//
// Valid values:
//   True: System DNS resolution may be run in or out of the network process
// depending on system configuration and feature flags.
//   False: System DNS resolution will be run in the network process.
//   None: System DNS resolution may be run in or out of the network process, or
// partially in and partially out of the network process, depending on system
// configuration and feature flags.
//
// Supported on: android, linux
message OutOfProcessSystemDnsResolutionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool OutOfProcessSystemDnsResolutionEnabled = 2;
}

// Origins or hostname patterns for which restrictions on insecure origins
// should not apply
//
// Setting the policy specifies a list of origins (URLs) or hostname patterns
// (such as *.example.com) for which security restrictions on insecure origins
// won't apply. Patterns are only accepted for hostnames; URLs/origins with
// schemes must be exact strings. Organizations can specify origins for legacy
// applications that can't deploy TLS or set up a staging server for internal
// web development, so developers can test out features requiring secure
// contexts without having to deploy TLS on the staging server. This policy also
// prevents the origin from being labeled "Not Secure" in the address bar.
//
// Setting a list of URLs in this policy amounts to setting the command-line
// flag --unsafely-treat-insecure-origin-as-secure to a comma-separated list of
// the same URLs. The policy overrides the command-line flag and
// UnsafelyTreatInsecureOriginAsSecure, if present.
//
// For more information on secure contexts, see Secure Contexts (
// https://www.w3.org/TR/secure-contexts ).
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message OverrideSecurityRestrictionsOnInsecureOriginProto {
  optional PolicyOptions policy_options = 1;
  optional StringList OverrideSecurityRestrictionsOnInsecureOrigin = 2;
}

// Allow Pepper to use shared images for video decoding.
//
// This policy controls the recent refactor for VideoDecoder APIs in PPAPI
// plugin.
//
// The migration only affects internal implementation details and should not
// change any behavior. However, this policy can be used in case any PPAPI
// applications do not work as expected.
//
// When the policy is left unset or set to Enabled, the browser will decide
// which
// implementation is used.
// When the policy is set to Disabled, browser will use the old implementation
// until the policy is expired.
//
// NOTE: Only newly-started renderer processes will reflect changes to this
// policy while the browser is running.
//
// Valid values:
//   True: Allow new implementation
//   False: Force old implementation
//
// Supported on:
message PPAPISharedImagesForVideoDecoderAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool PPAPISharedImagesForVideoDecoderAllowed = 2;
}

// Allow modern buffer allocation for Graphics3D APIs PPAPI plugin.
//
// This policy controls the recent refactor for Graphics3D APIs in PPAPI plugin.
//
// The migration only affects internal implementation details and should not
// change any behavior. However, this policy can be used in case any PPAPI
// applications do not work as expected.
//
// When the policy is left unset or set to Enabled, the browser will decide
// which
// implementation is used.
// When the policy is set to Disabled, browser will use the old implementation
// until the policy is expired.
//
// If you must use the policy, please file a bug on crbug.com explaining your
// use case and CC {blundell, vasilyt}@chromium.org. The policy is scheduled to
// be offered through Google Chrome
// version 114, after which the old implementation will be removed.
//
// NOTE: Only newly-started renderer processes will reflect changes to this
// policy while the browser is running.
//
// Valid values:
//   True: Allow new implementation
//   False: Force old implementation
//
// Supported on:
message PPAPISharedImagesSwapChainAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool PPAPISharedImagesSwapChainAllowed = 2;
}

// Enable PAC URL stripping (for https://)
//
// Strips privacy and security sensitive parts of https:// URLs before passing
// them on to PAC scripts (Proxy Auto Config) used by Google Chrome during proxy
// resolution.
//
// When True, the security feature is enabled, and https:// URLs are
// stripped before submitting them to a PAC script. In this manner the PAC
// script is not able to view data that is ordinarily protected by an
// encrypted channel (such as the URL's path and query).
//
// When False, the security feature is disabled, and PAC scripts are
// implicitly granted the ability to view all components of an https://
// URL. This applies to all PAC scripts regardless of origin (including
// those fetched over an insecure transport, or discovered insecurely
// through WPAD).
//
// This defaults to True (security feature enabled).
//
// It is recommended that this be set to True. The only reason to set it to
// False is if it causes a compatibility problem with existing PAC scripts.
//
// The policy will be removed in M75.
//
// Supported on:
message PacHttpsUrlStrippingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PacHttpsUrlStrippingEnabled = 2;
}

// Control the shortcut used to trigger the PageUp/PageDown "six pack" keys
//
// This policy determines the behavior for remapping the PageUp/PageDown
// keys within the 'remap keys' subpage. The 'remap keys' subpage allows users
// to customize keyboard keys. If enabled, this policy prevents users from
// customizing these specific remappings. If the policy is not set,
// search-based shortcuts will act as the default and allows users to
// configure the shortcuts.
//
// Valid values:
//   0: PageUp/PageDown settings are disabled
//   1: PageUp/PageDown settings use the shortcut that contains the alt modifier
//   2: PageUp/PageDown settings use the shortcut that contains the search
// modifier
//
// Supported on: chrome_os
message PageUpAndPageDownKeysModifierProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PageUpAndPageDownKeysModifier = 2;
}

// Allows users to track their packages on Chrome.
//
// When the policy is not set or set to Enabled, users will be able to track
// their packages on Google Chrome through the New Tab Page.
// When the policy is set to Disabled, users will not be able to track their
// packages on Google Chrome through the New Tab Page.
// Deprecated: The Parcel Tracking feature is disabled since M132, and this
// policy has no effect since then.
//
// Valid values:
//   True: Allow Parcel Tracking on Chrome
//   False: Do not allow Parcel Tracking on Chrome
//
// Supported on:
message ParcelTrackingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ParcelTrackingEnabled = 2;
}

// Parent Access Code Configuration
//
// This policy specifies configuration that is used to generate and verify
// Parent Access Code.
//
// |current_config| is always used for generating access code and should be used
// for validating access code only when it cannot be validated with
// |future_config|.
// |future_config| is the primary config used for validating access code.
// |old_configs| should be used for validating access code only when it cannot
// be validated with |future_config| nor |current_config|.
//
// The expected way of using this policy is to gradually rotate access code
// configuration. New configuration is always put into |future_config| and at
// the same
// time the existing value is moved into |current_config|. |current_config|'s
// previous values are moved into |old_configs| and removed after rotation cycle
// is finished.
//
// This policy applies only to child user.
// When this policy is set Parent Access Code can be verified on child user's
// device.
// When this policy is unset it is not possible to verify Parent Access Code on
// child user's device.
//
// Value schema:
// {
//     "properties": {
//         "current_config": {
//             "description": "Configuration used to generate and verify Parent
// Access Code.",
//             "id": "Config",
//             "properties": {
//                 "access_code_ttl": {
//                     "description": "Time that access code is valid for (in
// seconds).",
//                     "maximum": 3600,
//                     "minimum": 60,
//                     "type": "integer"
//                 },
//                 "clock_drift_tolerance": {
//                     "description": "The allowed difference between the clock
// on child and parent devices (in seconds).",
//                     "maximum": 1800,
//                     "minimum": 0,
//                     "type": "integer"
//                 },
//                 "shared_secret": {
//                     "description": "Secret shared between child and parent
// devices.",
//                     "type": "string"
//                 }
//             },
//             "type": "object"
//         },
//         "future_config": {
//             "description": "Configuration used to generate and verify Parent
// Access Code.",
//             "properties": {
//                 "access_code_ttl": {
//                     "description": "Time that access code is valid for (in
// seconds).",
//                     "maximum": 3600,
//                     "minimum": 60,
//                     "type": "integer"
//                 },
//                 "clock_drift_tolerance": {
//                     "description": "The allowed difference between the clock
// on child and parent devices (in seconds).",
//                     "maximum": 1800,
//                     "minimum": 0,
//                     "type": "integer"
//                 },
//                 "shared_secret": {
//                     "description": "Secret shared between child and parent
// devices.",
//                     "type": "string"
//                 }
//             },
//             "type": "object"
//         },
//         "old_configs": {
//             "items": {
//                 "description": "Configuration used to generate and verify
// Parent Access Code.",
//                 "properties": {
//                     "access_code_ttl": {
//                         "description": "Time that access code is valid for
// (in seconds).",
//                         "maximum": 3600,
//                         "minimum": 60,
//                         "type": "integer"
//                     },
//                     "clock_drift_tolerance": {
//                         "description": "The allowed difference between the
// clock on child and parent devices (in seconds).",
//                         "maximum": 1800,
//                         "minimum": 0,
//                         "type": "integer"
//                     },
//                     "shared_secret": {
//                         "description": "Secret shared between child and
// parent devices.",
//                         "type": "string"
//                     }
//                 },
//                 "type": "object"
//             },
//             "type": "array"
//         }
//     },
//     "sensitiveValue": true,
//     "type": "object"
// }
//
// Supported on: chrome_os
message ParentAccessCodeConfigProto {
  optional PolicyOptions policy_options = 1;
  optional string ParentAccessCodeConfig = 2;
}

// Choose whether Blob URLs are partitioned during fetching and navigations
//
// This policy controls whether Blob URLs are partitioned during fetching and
// navigation.
// If this policy is set to Enabled or not set, Blob URLs will be partitioned.
// If this policy is set to Disabled, Blob URLs won't be partitioned.
//
// If you must use the policy, please file a bug at
// https://crbug.com/new?component=1779870&amp;cc=awillia@chromium.org&amp;prior
// ity=p1&amp;type=bug&amp;noWizard=true
// explaining your use case. The policy is scheduled to be offered through
// Google Chrome version 146, after which
// the old implementation will be removed.
//
// NOTE: Only newly-started renderer processes will reflect changes to this
// policy while the browser is running.
//
// For detailed information on third-party storage partitioning, please see
// https://developers.google.com/privacy-sandbox/cookies/storage-partitioning.
//
// Valid values:
//   True: Partition Blob URLs during fetching and navigation.
//   False: Do not partition Blob URLs during fetching and navigation.
//
// Supported on: android, chrome_os, linux, mac, win
message PartitionedBlobUrlUsageProto {
  optional PolicyOptions policy_options = 1;
  optional bool PartitionedBlobUrlUsage = 2;
}

// Enable dismissing compromised password alerts for entered credentials
//
// Setting the policy to Enabled or leaving it unset gives the user the option
// to dismiss/restore compromised password alerts.
//
// If you disable this setting, users will not be able to dismiss alerts about
// compromised passwords. If enabled, users will be able to dismiss alerts about
// compromised passwords.
//
// Valid values:
//   True: Enable dismissing compromised password alerts
//   False: Disable dismissing compromised password alerts
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PasswordDismissCompromisedAlertEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PasswordDismissCompromisedAlertEnabled = 2;
}

// Enable leak detection for entered credentials
//
// Setting the policy to Enabled lets users have Google Chrome check whether
// usernames and passwords entered were part of a leak.
//
// Setting the policy to Disabled does not let users have this functionality.
//
// If the policy is set, users can't change it in Google Chrome. If not set,
// credential leak checking is allowed, but the user can turn it off.
//
// Valid values:
//   True: Enable password leak detection
//   False: Disable password leak detection
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message PasswordLeakDetectionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PasswordLeakDetectionEnabled = 2;
}

// Allow users to show passwords in Password Manager (deprecated)
//
// The associated setting was used before reauthentication on viewing passwords
// was introduced. Since then, the setting and hence this policy had no effect
// on the behavior of Chrome. The current behavior of Chrome is now the same as
// if the policy was set to disable showing passwords in clear text in the
// password manager settings page. That means that the settings page contains
// just a placeholder, and only upon the user clicking "Show" (and
// reauthenticating, if applicable) Chrome shows the password. Original
// description of the policy follows below.
//
// Controls whether the user may show passwords in clear text in the password
// manager.
//
// If you disable this setting, the password manager does not allow showing
// stored passwords in clear text in the password manager window.
//
// If you enable or do not set this policy, users can view their passwords in
// clear text in the password manager.
//
// Supported on:
message PasswordManagerAllowShowPasswordsProto {
  optional PolicyOptions policy_options = 1;
  optional bool PasswordManagerAllowShowPasswords = 2;
}

// Configure the list of domains for which the Password Manager (Save and Fill)
// will be disabled
//
// Configure the list of domains where Google Chrome should disable the Password
// Manager. This means that Save and Fill workflows will be disabled, ensuring
// that passwords for those websites can't be saved or auto filled into web
// forms.
//
// If a domain is present in the list, the Password Manager will be disabled for
// it.
//
// If a domain is not present in the list, the Password Manager will be
// available for it.
//
// If the policy is unset, the Password Manager will be available for all
// domains.
//
// For detailed information on valid URL patterns, please see
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// Supported on: chrome_os, linux, mac, win
message PasswordManagerBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PasswordManagerBlocklist = 2;
}

// Enable saving passwords to the password manager
//
// This policy controls the browser's ability to automatically remember
// passwords on websites and save them in the built-in password manager. It does
// not limit access or change the contents of passwords saved in the password
// manager and possibly synchronized to the Google account profile and Android.
//
// Setting the policy to Enabled means users have Google Chrome remember
// passwords and provide them the next time they sign in to a site.
//
// Setting the policy to Disabled means users can't save new passwords, but
// previously saved passwords will still work.
//
// If the policy is set, users can't change it in Google Chrome. If not set, the
// user can turn off password saving.
//
// Valid values:
//   True: Enable saving passwords using the password manager
//   False: Disable saving passwords using the password manager
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message PasswordManagerEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PasswordManagerEnabled = 2;
}

// Enable saving passkeys to the password manager
//
// This policy controls the browser's ability to save passkeys in the built-in
// password manager. It does not limit access to, or change the contents of,
// passkeys already saved in the password manager. If the PasswordManagerEnabled
// policy is set to Disabled then saving in the built-in password manager is
// disabled in general, including passkeys and passwords, and thus this policy
// is not applicable.
//
// Setting the policy to Enabled or leaving unset means that users can save
// passkeys in the built-in password manager if signed into Google Chrome.
//
// Setting the policy to Disabled means users can't save passkeys to the built-
// in password manager, but previously saved passkeys will still work.
//
// Valid values:
//   True: Enable saving passkeys using the password manager
//   False: Disable saving passkeys using the password manager
//
// Supported on: chrome_os, ios, linux, mac, win
message PasswordManagerPasskeysEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PasswordManagerPasskeysEnabled = 2;
}

// Configure the change password URL.
//
// Setting the policy sets the URL for users to change their password after
// seeing a warning in the browser. The password protection service sends users
// to the URL (HTTP and HTTPS protocols only) you designate through this policy.
// For Google Chrome to correctly capture the salted hash of the new password on
// this change password page, make sure your change password page follows these
// guidelines ( https://www.chromium.org/developers/design-documents/create-
// amazing-password-forms ).
//
// Turning the policy off or leaving it unset means the service sends users to
// https://myaccount.google.com to change their password.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PasswordProtectionChangePasswordURLProto {
  optional PolicyOptions policy_options = 1;
  optional string PasswordProtectionChangePasswordURL = 2;
}

// Configure the list of enterprise login URLs where password protection service
// should capture salted hashes of passwords.
//
// Setting the policy sets the list of enterprise login URLs (HTTP and HTTPS
// protocols only). Password protection service will capture salted hashes of
// passwords on these URLs and use them for password reuse detection. For Google
// Chrome to correctly capture password salted hashes, ensure your sign-in pages
// follow these guidelines ( https://www.chromium.org/developers/design-
// documents/create-amazing-password-forms ).
//
// Turning this setting off or leaving it unset means the password protection
// service only captures the password salted hashes on
// https://accounts.google.com.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PasswordProtectionLoginURLsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PasswordProtectionLoginURLs = 2;
}

// Password protection warning trigger
//
// Setting the policy lets you control the triggering of password protection
// warning. Password protection alerts users when they reuse their protected
// password on potentially suspicious sites.
//
// Use PasswordProtectionLoginURLs and PasswordProtectionChangePasswordURL to
// set which password to protect.
//
// If this policy is set to:
//
// * PasswordProtectionWarningOff, no password protection warning will be shown.
//
// * PasswordProtectionWarningOnPasswordReuse, password protection warning will
// be shown when the user reuses their protected password on a non-allowed site.
//
// * PasswordProtectionWarningOnPhishingReuse, password protection warning will
// be shown when the user reuses their protected password on a phishing site.
//
// Leaving the policy unset has the password protection service only protect
// Google passwords, but users can change this setting.
//
// Valid values:
//   0: Password protection warning is off
//   1: Password protection warning is triggered by password reuse
//   2: Password protection warning is triggered by password reuse on phishing
// page
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PasswordProtectionWarningTriggerProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PasswordProtectionWarningTrigger = 2;
}

// Enable sharing user credentials with other users
//
// Setting the policy to Enabled lets users send to and receive from family
// members (according to Family Service) their passwords.
// When the policy is Enabled or not set, there is a button in the Password
// Manager allowing to send a password.
// The received passwords are stored into user's account and are available in
// the Password Manager.
//
// Setting the policy to Disabled means users can't send passwords from Password
// Manager to other users, and can't receive passwords from other users.
//
// The feature is not available if synchronization of Passwords is turned off
// (either via user settings or SyncDisabled policy is Enabled).
//
// Managed accounts aren't eligible to join or create a family group and
// therefore cannot share passwords.
//
// Valid values:
//   True: Enable sharing user credentials
//   False: Disable sharing user credentials
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message PasswordSharingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PasswordSharingEnabled = 2;
}

// Allow websites to query for available payment methods.
//
// Allows you to set whether websites are allowed to check if the user has
// payment methods saved.
//
// If this policy is set to disabled, websites that use
// PaymentRequest.canMakePayment or PaymentRequest.hasEnrolledInstrument API
// will be informed that no payment methods are available.
//
// If the setting is enabled or not set then websites are allowed to check if
// the user has payment methods saved.
//
// Valid values:
//   True: Allow websites to check if the user has payment methods saved
//   False: Always tell websites that no payment methods are saved
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message PaymentMethodQueryEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PaymentMethodQueryEnabled = 2;
}

// Enable PDF Annotations
//
// Controls if the PDF viewer in Google Chrome can annotate PDFs.
//
// When this policy is not set, or is set to true, then the PDF viewer will be
// able to annotate PDFs.
//
// When this policy is set to false, then the PDF viewer will not be able to
// annotate PDFs.
//
// Valid values:
//   True: The PDF viewer can annotate PDFs
//   False: The PDF viewer cannot annotate PDFs
//
// Supported on: chrome_os, linux, mac, win
message PdfAnnotationsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PdfAnnotationsEnabled = 2;
}

// Allow local file access to file:// URLs on these sites in the PDF Viewer
//
// Setting this policy allows the domains listed to access file:// URLs in the
// PDF Viewer.
// Adding to the policy allows the domain to access file:// URLs in the PDF
// Viewer.
// Removing from the policy disallows the domain from accessing file:// URLs in
// the PDF Viewer.
// Leaving the policy unset disallows all domains from accessing file:// URLs in
// the PDF Viewer.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PdfLocalFileAccessAllowedForDomainsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PdfLocalFileAccessAllowedForDomains = 2;
}

// Use Skia renderer for PDF rendering
//
// Controls whether the PDF viewer in Google Chrome uses Skia renderer.
//
// When this policy is enabled, the PDF viewer uses Skia renderer.
//
// When this policy is disabled, the PDF viewer uses its current AGG renderer.
//
// When this policy is not set, the PDF renderer will be chosen by the browser.
//
// Valid values:
//   True: The PDF viewer uses Skia renderer.
//   False: The PDF viewer uses AGG renderer.
//   None: Use the default renderer based on the field trial config.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PdfUseSkiaRendererEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PdfUseSkiaRendererEnabled = 2;
}

// Use out-of-process iframe PDF Viewer
//
// Controls whether the PDF viewer in Google Chrome uses an out-of-process
// iframe (OOPIF). This will be the new PDF viewer architecture in the future,
// as it is simpler and makes adding new features easier. The existing GuestView
// PDF viewer is an outdated, complex architecture that is being deprecated.
//
// When this policy is set to Enabled or not set, Google Chrome will be able to
// use the OOPIF PDF viewer architecture. Once Enabled or not set, the default
// behavior will be decided by Google Chrome.
//
// When this policy is set to Disabled, Google Chrome will strictly use the
// existing GuestView PDF viewer. It embeds a web page with a separate frame
// tree into another web page.
//
// This policy is deprecated in M152 and will be removed in M155. The GuestView
// PDF viewer is being removed, and the out-of-process iframe (OOPIF) PDF viewer
// architecture will always be used.
//
// Valid values:
//   True: PDF viewer uses the OOPIF architecture.
//   False: PDF viewer uses the GuestView architecture.
//
// Supported on: chrome_os, linux, mac, win
message PdfViewerOutOfProcessIframeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PdfViewerOutOfProcessIframeEnabled = 2;
}

// Enable support for XFA forms in PDF documents
//
// Controls whether the PDF viewer in Google Chrome supports XFA forms in PDF
// documents.
//
// If this policy is set to True, support for XFA forms is enabled.
// If this policy is set to False, support for XFA forms is disabled.
// If this policy is not set, the default Chrome behavior is used, which may
// also be influenced by the `#pdf-xfa-forms` flag. When this policy is set, it
// takes precedence over the `#pdf-xfa-forms` flag.
//
// Valid values:
//   False: PDF XFA Forms support disabled
//   True: PDF XFA Forms support enabled
//   None: Use the default Chrome browser behavior
//
// Supported on: chrome_os
message PdfXfaFormsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PdfXfaFormsEnabled = 2;
}

// Per-App Time Limits
//
// Allows to set per-app usage restrictions.
// Usage restrictions can be applied to the apps installed on Google ChromeOS
// for the given user.
// Restrictions should be passed in |app_limits| list. Only one entry per-app is
// allowed. Apps not included in the list have no restrictions.
// It is not possible to block apps that are essential for the operating system,
// the restrictions for such apps will be ignored.
// App is uniquely identified by |app_id|. Since different types of apps can use
// different id format |app_type| needs to be specified next to |app_id|.
// Per-App Time Limits only support |ARC| apps currently. Android package name
// is used as |app_id|.
// Support for other types of applications will be added in the future, for now
// they can be specified in the policy, but the restrictions will take no
// effect.
// There are two types of available restrictions: |BLOCK| and |TIME_LIMIT|.
// |BLOCK| makes app unavailable for the user. If |daily_limit_mins| is
// specified with |BLOCK| restriction |daily_limit_mins| will be ignored.
// |TIME_LIMITS| applies daily usage limit and makes app unavailable after the
// limit is reached on the given day. Usage limit is specified in
// |daily_limit_mins|. Usage limit is reset daily at the UTC time passed in
// |reset_at|.
// This policy is only used for child users.
// This policy is complementary to 'UsageTimeLimit'. Restrictions specified in
// 'UsageTimeLimit' like screen time and bedtime will be enforced regardless of
// 'PerAppTimeLimits'.
//
// Value schema:
// {
//     "properties": {
//         "activity_reporting_enabled": {
//             "description": "The value of app activity collection toggle. If
// set to true user app activity will be reported to the server with purpose of
// being displayed in child and parent <ph name=\"PRODUCT_NAME\">$1<ex>Family
// Link</ex></ph> app. If set to false Per-app time limits feature will still
// work, but no data will be reported to the server and therefore displayed in
// <ph name=\"PRODUCT_NAME\">$1<ex>Family Link</ex></ph>.",
//             "type": "boolean"
//         },
//         "app_limits": {
//             "items": {
//                 "properties": {
//                     "app_info": {
//                         "properties": {
//                             "app_id": {
//                                 "type": "string"
//                             },
//                             "app_type": {
//                                 "enum": [
//                                     "ARC",
//                                     "BUILT-IN",
//                                     "EXTENSION",
//                                     "WEB",
//                                     "CROSTINI"
//                                 ],
//                                 "type": "string"
//                             }
//                         },
//                         "type": "object"
//                     },
//                     "daily_limit_mins": {
//                         "maximum": 1440,
//                         "minimum": 0,
//                         "type": "integer"
//                     },
//                     "last_updated_millis": {
//                         "description": "UTC timestamp for the last time this
// entry was updated. Sent as a string because the timestamp would not fit in an
// integer",
//                         "type": "string"
//                     },
//                     "restriction": {
//                         "enum": [
//                             "BLOCK",
//                             "TIME_LIMIT"
//                         ],
//                         "type": "string"
//                     }
//                 },
//                 "type": "object"
//             },
//             "type": "array"
//         },
//         "reset_at": {
//             "description": "The time of the day in local time when usage
// quota is renewed.",
//             "properties": {
//                 "hour": {
//                     "maximum": 23,
//                     "minimum": 0,
//                     "type": "integer"
//                 },
//                 "minute": {
//                     "maximum": 59,
//                     "minimum": 0,
//                     "type": "integer"
//                 }
//             },
//             "type": "object"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message PerAppTimeLimitsProto {
  optional PolicyOptions policy_options = 1;
  optional string PerAppTimeLimits = 2;
}

// Per-App Time Limits Allowlist
//
// This policy specifies which applications and URLs should be allowed for per-
// app usage restrictions.
// The configured allowlist is applied to the apps installed on Google ChromeOS
// for the given user with per-app time limits.
// The configured allowlist can only be applied to child user accounts and take
// effect when PerAppTimeLimits policy is set.
// The configured allowlist is applied to applications and URLs so that they
// will not be blocked by per-app time limits.
// Accessing allowed URLs will not count towards the chrome time limit.
// Add url regular expressions to |url_list| to allow urls that match any of the
// regular expressions in the list.
// Add an application with its |app_id| and |app_type| to |app_list| to allow
// the application.
//
// Value schema:
// {
//     "properties": {
//         "app_list": {
//             "items": {
//                 "properties": {
//                     "app_id": {
//                         "type": "string"
//                     },
//                     "app_type": {
//                         "enum": [
//                             "ARC",
//                             "BUILT-IN",
//                             "EXTENSION",
//                             "WEB",
//                             "CROSTINI"
//                         ],
//                         "type": "string"
//                     }
//                 },
//                 "type": "object"
//             },
//             "type": "array"
//         },
//         "url_list": {
//             "items": {
//                 "type": "string"
//             },
//             "type": "array"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message PerAppTimeLimitsAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional string PerAppTimeLimitsAllowlist = 2;
}

// Per-App Time Limits Allowlist
//
// This policy is deprecated and unsupported , please use
// PerAppTimeLimitsAllowlist instead.
//
// Value schema:
// {
//     "properties": {
//         "app_list": {
//             "items": {
//                 "properties": {
//                     "app_id": {
//                         "type": "string"
//                     },
//                     "app_type": {
//                         "enum": [
//                             "ARC",
//                             "BUILT-IN",
//                             "EXTENSION",
//                             "WEB",
//                             "CROSTINI"
//                         ],
//                         "type": "string"
//                     }
//                 },
//                 "type": "object"
//             },
//             "type": "array"
//         },
//         "url_list": {
//             "items": {
//                 "type": "string"
//             },
//             "type": "array"
//         }
//     },
//     "type": "object"
// }
//
// Supported on:
message PerAppTimeLimitsWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional string PerAppTimeLimitsWhitelist = 2;
}

// Force persistent quota to be enabled
//
// Starting in M106 persistent quota will no longer be supported. This policy
// will re-enable persistent quota functionality until M107.
//
// If this policy is set to enabled, webkitRequestFileSystem with persistent
// type will operate with persistent quota.
//
// If this policy is unset or disabled, webkitRequestFileSystem with persistent
// type will operate with temporary quota.
//
// Valid values:
//   True: Enable persistent quota.
//   False: Disable persistent quota.
//
// Supported on:
message PersistentQuotaEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PersistentQuotaEnabled = 2;
}

// Allow Phone Hub to be enabled.
//
// If this setting is enabled, users will be allowed to opt in to Phone Hub,
// which allows them to interact with their phone on a ChromeOS device.
//
// If this setting is disabled, users will not be allowed to opt in to Phone
// Hub.
//
// If this policy is left not set, the default is not allowed for enterprise-
// managed users and allowed for non-managed users.
//
// Valid values:
//   True: Allow Phone Hub to be enabled
//   False: Do not allow Phone Hub to be enabled
//
// Supported on: chrome_os
message PhoneHubAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool PhoneHubAllowed = 2;
}

// Allow recent photos and videos taken on the phone to be accessed via Phone
// Hub.
//
// If this setting is enabled, users who have already opted in to Phone Hub will
// be able to view and download recent photos and videos taken on their phone on
// ChromeOS.
//
// If this setting is disabled, users will not be allowed to use this feature.
// If the PhoneHubAllowed policy is disabled, users also will not be allowed to
// use this feature.
//
// If this policy is left not set, the default is allowed for both enterprise-
// managed users and non-managed users.
//
// Valid values:
//   True: Allows users who have opted in to Phone Hub to access recent photos
// and videos taken on their phone
//   False: Disallows users who have opted in to Phone Hub to access recent
// photos and videos taken on their phone
//
// Supported on: chrome_os
message PhoneHubCameraRollAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool PhoneHubCameraRollAllowed = 2;
}

// Allow Phone Hub notifications to be enabled.
//
// If this setting is enabled, users who have already opted in to Phone Hub,
// will be able to send/receive their phone's notifications on ChromeOS.
//
// If this setting is disabled, users will not be allowed to use this feature.
// If the PhoneHubAllowed policy is disabled, users also will not be allowed to
// use this feature.
//
// If this policy is left not set, the default is allowed for both enterprise-
// managed users and non-managed users.
//
// Valid values:
//   True: Allow Phone Hub notifications to be enabled
//   False: Do not allow Phone Hub notifications to be enabled
//
// Supported on: chrome_os
message PhoneHubNotificationsAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool PhoneHubNotificationsAllowed = 2;
}

// Allow Phone Hub task continuation to be enabled.
//
// If this setting is enabled, users who have already opted in to Phone Hub,
// will be able to continue tasks such as viewing their phone's webpages on
// ChromeOS.
//
// If this setting is disabled, users will not be allowed to use this feature.
// If the PhoneHubAllowed policy is disabled, users also will not be allowed to
// use this feature.
//
// If this policy is left not set, the default is allowed for both enterprise-
// managed users and non-managed users.
//
// Valid values:
//   True: Allow Phone Hub task continuation to be enabled
//   False: Do not allow Phone Hub task continuation to be enabled
//
// Supported on: chrome_os
message PhoneHubTaskContinuationAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool PhoneHubTaskContinuationAllowed = 2;
}

// Control the autocorrect feature on the physical keyboard
//
// Enable or disable the autocorrect feature on the physical keyboard.
//
// If this policy is set to Enabled or left unset, it will allow the autocorrect
// feature on the physical keyboard.
//
// If this policy is set to Disabled, it will disallow the autocorrect feature
// on the physical keyboard.
//
// Valid values:
//   True: Enable physical keyboard autocorrect when users type
//   False: Disable physical keyboard autocorrect when users type
//
// Supported on: chrome_os
message PhysicalKeyboardAutocorrectProto {
  optional PolicyOptions policy_options = 1;
  optional bool PhysicalKeyboardAutocorrect = 2;
}

// Control the predictive writing feature on the physical keyboard
//
// Enable or disable the predictive writing feature on the physical keyboard.
//
// If this policy is set to Enabled or left unset, it will allow the predictive
// writing feature on the physical keyboard.
//
// If this policy is set to Disabled, it will disallow the predictive writing
// feature on the physical keyboard.
//
// Valid values:
//   True: Enable physical keyboard predictive writing when users type
//   False: Disable physical keyboard predictive writing when users type
//
// Supported on: chrome_os
message PhysicalKeyboardPredictiveWritingProto {
  optional PolicyOptions policy_options = 1;
  optional bool PhysicalKeyboardPredictiveWriting = 2;
}

// Enable PIN auto-submit feature on the lock and login screen.
//
// The PIN auto-submit feature changes how PINs are entered in Google ChromeOS.
// Instead of showing the same textfield that is used for password input, this
// feature shows a special UI that clearly shows to the user how many
// digits are necessary for their PIN. As a consequence, the user's PIN length
// will be stored outside the user encrypted data. Only supports PINs that are
// between 6 and 12 digits long.
//
// If the policy is set to true, users will have PIN auto-submit on the lock and
// login screen.
// If the policy is set to false or not set, users will not have PIN auto-submit
// on the lock and login screen.
//
// If this policy is set, users will not have the option of enabling the
// feature.
//
// Valid values:
//   True: Enable PIN auto-submit on the lock and login screen
//   False: Disable PIN auto-submit on the lock and login screen
//
// Supported on: chrome_os
message PinUnlockAutosubmitEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PinUnlockAutosubmitEnabled = 2;
}

// Set the maximum length of the lock screen PIN
//
// Setting the policy means the configured maximum PIN length is enforced. A
// value of 0 or less means the user may set a PIN of any length. If the value
// is less than PinUnlockMinimumLength but greater than 0, the maximum length is
// set to the minimum length.
//
// Leaving the policy unset means no maximum length is enforced.
//
// Supported on: chrome_os
message PinUnlockMaximumLengthProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PinUnlockMaximumLength = 2;
}

// Set the minimum length of the lock screen PIN
//
// Setting the policy enforces the minimum PIN length chosen. (Values below 1
// are rounded up to the minimum of 1.)
//
// Leaving the policy unset enforces a minimal PIN length of 6 digits, the
// recommended minimum.
//
// Supported on: chrome_os
message PinUnlockMinimumLengthProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PinUnlockMinimumLength = 2;
}

// Enable users to set weak PINs for the lock screen PIN
//
// Setting the policy to Enabled allows weak PINs. Some characteristics of weak
// PINs: only one digit (1111), digits increase by 1 (1234), digits decrease by
// 1 (4321), and common PINs. Setting the policy to Disabled means users can't
// set weak, easy-to-guess PINs.
//
// If policy is not set, users get a warning, not an error, for a weak PIN.
//
// Valid values:
//   True: Allow users to set a weak PIN
//   False: Do not allow users to set a weak PIN
//   None: Allow users to set a weak PIN, but show a warning
//
// Supported on: chrome_os
message PinUnlockWeakPinsAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool PinUnlockWeakPinsAllowed = 2;
}

// List of pinned apps to show in the launcher
//
// Setting the policy fixes which application identifiers Google ChromeOS shows
// as pinned apps in the launcher bar, and users can't change them.
//
// Specify Chrome apps by their ID, such as pjkljhegncpnkpknbcohdijeoejaedia;
// Android apps by their package name, such as com.google.android.gm;
// web apps by the URL used in WebAppInstallForceList, such as
// https://google.com/maps;
// System Web Apps by their snake case name, such as camera.
// Isolated Web Apps by their web bundle ID, such as
// egoxo6biqdjrk62rman4vvr5cbq2ozsyydig7jmdxcmohdob2ecaaaic.
//
// Leaving it unset lets users change the list of pinned apps in the launcher.
//
// Supported on: chrome_os
message PinnedLauncherAppsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PinnedLauncherApps = 2;
}

// Allow PluginVm Product Analytics
//
// Allow PluginVm to collect PluginVm usage data.
//
// If the policy is set to false or left unset, PluginVm is not allowed to
// collect data.
// If set to true, PluginVm might collect PluginVm usage data that is then
// combined and thoroughly analyzed to improve PluginVm experience.
//
// Valid values:
//   True: Enable sharing diagnostics data to PluginVm
//   False: Disable sharing diagnostics data to PluginVm
//
// Supported on:
message PluginVmDataCollectionAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool PluginVmDataCollectionAllowed = 2;
}

// PluginVm image
//
// Setting the policy specifies the PluginVm image for a user. Specify this
// policy as a JSON format string, with URL stating where to download the image
// and hash as a SHA-256 hash used to verify the integrity of the download.
//
// Value schema:
// {
//     "properties": {
//         "hash": {
//             "description": "The SHA-256 hash of the <ph
// name=\"PLUGIN_VM_NAME\">PluginVm</ph> image.",
//             "type": "string"
//         },
//         "url": {
//             "description": "The URL from which the <ph
// name=\"PLUGIN_VM_NAME\">PluginVm</ph> image can be downloaded.",
//             "type": "string"
//         }
//     },
//     "type": "object"
// }
//
// Supported on:
message PluginVmImageProto {
  optional PolicyOptions policy_options = 1;
  optional string PluginVmImage = 2;
}

// Required free disk space for PluginVm
//
// Free disk space (in GB) required to install PluginVm.
//
// If this policy is left unset, PluginVm installation fails if free disk space
// available on the device is less than 20 GB (default value).
// If this policy is set, PluginVm installation fails if free disk space
// available on the device is less than required by policy.
//
// Supported on:
message PluginVmRequiredFreeDiskSpaceProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PluginVmRequiredFreeDiskSpace = 2;
}

// PluginVm user id
//
// This policy specifies the PluginVm licensing user id for this device.
//
// Supported on:
message PluginVmUserIdProto {
  optional PolicyOptions policy_options = 1;
  optional string PluginVmUserId = 2;
}

// Allow the Flash plugin on these sites
//
// This policy is deprecated in M88, Flash is no longer supported by Chrome.
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can run the Flash plugin.
//
// Leaving the policy unset means DefaultPluginsSetting applies for all sites,
// if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. However, starting in
// M85, patterns with '*' and '[*.]' wildcards in the host are no longer
// supported for this policy.
//
// Supported on:
message PluginsAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PluginsAllowedForUrls = 2;
}

// Block the Flash plugin on these sites
//
// This policy is deprecated in M88, Flash is no longer supported by Chrome.
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can't run the Flash plugin.
//
// Leaving the policy unset means DefaultPluginsSetting applies for all sites,
// if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. However, starting in
// M85, patterns with '*' and '[*.]' wildcards in the host are no longer
// supported for this policy.
//
// Supported on:
message PluginsBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PluginsBlockedForUrls = 2;
}

// Enables the concept of policy atomic groups
//
// Setting the policy to Enabled means policies coming from an atomic group that
// don't share the source with the highest priority from that group get ignored.
//
// Setting the policy to Disabled means no policy is ignored because of its
// source. Policies are ignored only if there's a conflict, and the policy
// doesn't have the highest priority.
//
// If this policy is set from a cloud source, it can't target a specific user.
//
// Valid values:
//   True: Enable policy atomic groups
//   False: Disable policy atomic groups
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message PolicyAtomicGroupsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PolicyAtomicGroupsEnabled = 2;
}

// Allow merging dictionary policies from different sources
//
// Setting the policy allows merging of selected policies when they come from
// different sources, with the same scopes and level. This merging is in the
// first level keys of the dictionary from each source. The key coming from the
// highest priority source takes precedence.
//
// Use the wildcard character '*' to allow merging of all supported dictionary
// policies.
//
// If a policy is in the list and there's conflict between sources with:
//
// * The same scopes and level: The values merge into a new policy dictionary.
//
// * Different scopes or level: The policy with the highest priority applies.
//
// If a policy isn't in the list and there's conflict between sources, scopes,
// or level, the policy with the highest priority applies.
//
// Valid values:
//   ContentPackManualBehaviorURLs: Managed user manual exception URLs
//   DeviceLoginScreenPowerManagement: Power management on the login screen
//   ExtensionSettings: Extension management settings
//   KeyPermissions: Key Permissions
//   PowerManagementIdleSettings: Power management settings when the user
// becomes idle
//   ScreenBrightnessPercent: Screen brightness percent
//   ScreenLockDelays: Screen lock delays
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message PolicyDictionaryMultipleSourceMergeListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PolicyDictionaryMultipleSourceMergeList = 2;
}

// Allow merging list policies from different sources
//
// Setting the policy allows merging of selected policies when they come from
// different sources, with the same scopes and level.
//
// Use the wildcard character '*' to allow merging of all list policies.
//
// If a policy is in the list and there's conflict between sources with:
//
// * The same scopes and level: The values merge into a new policy list.
//
// * Different scopes or level: The policy with the highest priority applies.
//
// If a policy isn't in the list and there's conflict between sources, scopes,
// or level, the policy with the highest priority applies.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message PolicyListMultipleSourceMergeListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PolicyListMultipleSourceMergeList = 2;
}

// Refresh rate for user policy
//
// Setting the policy specifies the period in milliseconds at which the device
// management service is queried for user policy information. Valid values range
// from 1,800,000 (30 minutes) to 86,400,000 (1 day). Values outside this range
// will be clamped to the respective boundary.
//
// Leaving the policy unset uses the default value of 3 hours.
//
// Note: Policy notifications force a refresh when the policy changes, making
// frequent refreshes unnecessary. So, if the platform supports these
// notifications, the refresh delay is 24 hours (ignoring defaults and the value
// of this policy).
//
// Supported on: chrome_os, fuchsia, ios, linux, mac, win
message PolicyRefreshRateProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PolicyRefreshRate = 2;
}

// Allow policy scope detection on macOS
//
// Controls whether browser can detect mandatory policy scope on macOS or not.
//
// If the policy is set to Enabled or not set, each policy's scope will be
// determined by the scope of macOS managed profile.
// If the policy is set to Disabled, all policies will be reconized as machine
// scope policy.
//
// This policy is temporary in order to facilitate smooth transition to properly
// scoped policies on macOS and will be removed in Google Chrome 107.
//
//
// Valid values:
//   True: Allow Policy scope detection.
//   False: Block Policy scope detection.
//
// Supported on:
message PolicyScopeDetectionProto {
  optional PolicyOptions policy_options = 1;
  optional bool PolicyScopeDetection = 2;
}

// Allow access to the policy test page
//
// This policy will provide access to the policy test page,
// while policies are tested on this page, all other policies will be ignored.
// Feature will only be available on Canary channel.
//
// If policy is Enabled or not set, the page will be accessible.
// If policy is Disabled, the page will be blocked.
//
// Valid values:
//   True: Policy test page is accessible
//   False: Policy test page is blocked
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message PolicyTestPageEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PolicyTestPageEnabled = 2;
}

// Allow pop-ups on these sites
//
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can open pop-ups.
//
// Leaving the policy unset means DefaultPopupsSetting applies for all sites, if
// it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message PopupsAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PopupsAllowedForUrls = 2;
}

// Block pop-ups on these sites
//
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can't open pop-ups.
//
// Leaving the policy unset means DefaultPopupsSetting applies for all sites, if
// it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message PopupsBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PopupsBlockedForUrls = 2;
}

// Enable post-quantum key agreement for TLS
//
// This policy configures whether Google Chrome will offer a post-quantum key
// agreement algorithm in TLS, using the ML-KEM NIST standard. Prior to Google
// Chrome 131, the algorithm was Kyber, an earlier draft iteration of the
// standard. This allows supporting servers to protect user traffic from being
// later decrypted by quantum computers.
//
// If this policy is Enabled or not set, Google Chrome will offer a post-quantum
// key agreement in TLS connections. User traffic will then be protected from
// quantum computers when communicating with compatible servers.
//
// If this policy is Disabled, Google Chrome will not offer a post-quantum key
// agreement in TLS connections. User traffic will then be unprotected from
// quantum computers.
//
// Offering a post-quantum key agreement is backwards-compatible. Existing TLS
// servers and networking middleware are expected to ignore the new option and
// continue selecting previous options.
//
// However, devices that do not correctly implement TLS may malfunction when
// offered the new option. For example, they may disconnect in response to
// unrecognized options or the resulting larger messages. Such devices are not
// post-quantum-ready and will interfere with an enterprise's post-quantum
// transition. If encountered, administrators should contact the vendor for a
// fix.
//
// This policy is a temporary measure and will be removed sometime after Google
// Chrome version 145. It may be Enabled to allow you to test for issues, and
// may be Disabled while issues are being resolved.
//
// Valid values:
//   None: Use Default Value for post-quantum key agreement for TLS
//   True: Enable post-quantum key agreement for TLS
//   False: Disable post-quantum key agreement for TLS
//
// Supported on: fuchsia
message PostQuantumKeyAgreementEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PostQuantumKeyAgreementEnabled = 2;
}

// Power management settings when the user becomes idle
//
// Setting the policy controls the power management strategy when the user
// idles.
//
// There are 4 actions:
//
// * The screen dims if the user is idle for the time specified by ScreenDim.
//
// * The screen turns off if the user is idle for the time specified by
// ScreenOff.
//
// * A warning dialog appears if the user remains idle for the time specified by
// IdleWarning. It warns the user that the idle action will be taken and only
// appears if the idle action is to sign out or shut down.
//
// * The action specified by IdleAction is taken if the user is idle for the
// time specified by Idle.
//
// For each of the above actions, the delay should be specified in milliseconds
// and must be set to a value greater than zero to trigger the corresponding
// action. If the delay is set to zero, Google ChromeOS won't take the
// corresponding action.
//
// For each of the above delays, when the time is unset, a default value is
// used.
//
// ScreenDim values will be clamped to be less than or equal to ScreenOff.
// ScreenOff and IdleWarning will be clamped to be less than or equal to Idle.
//
// IdleAction can be one of 4 actions:
//
// * Suspend
//
// * Logout
//
// * Shutdown
//
// * DoNothing
//
// If the IdleAction is not set, Suspend is taken.
//
// Note: There are separate settings for AC power and battery.
//
// Value schema:
// {
//     "properties": {
//         "AC": {
//             "description": "Delays and actions to take when the device is
// idle and running on AC power",
//             "id": "PowerManagementDelays",
//             "properties": {
//                 "Delays": {
//                     "properties": {
//                         "Idle": {
//                             "description": "The length of time without user
// input after which the idle action is taken, in milliseconds",
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "IdleWarning": {
//                             "description": "The length of time without user
// input after which a warning dialog is shown, in milliseconds",
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "ScreenDim": {
//                             "description": "The length of time without user
// input after which the screen is dimmed, in milliseconds",
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "ScreenOff": {
//                             "description": "The length of time without user
// input after which the screen is turned off, in milliseconds",
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "IdleAction": {
//                     "description": "Action to take when the idle delay is
// reached",
//                     "enum": [
//                         "Suspend",
//                         "Logout",
//                         "Shutdown",
//                         "DoNothing"
//                     ],
//                     "type": "string"
//                 }
//             },
//             "type": "object"
//         },
//         "Battery": {
//             "description": "Delays and actions to take when the device is
// idle and running on AC power",
//             "properties": {
//                 "Delays": {
//                     "properties": {
//                         "Idle": {
//                             "description": "The length of time without user
// input after which the idle action is taken, in milliseconds",
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "IdleWarning": {
//                             "description": "The length of time without user
// input after which a warning dialog is shown, in milliseconds",
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "ScreenDim": {
//                             "description": "The length of time without user
// input after which the screen is dimmed, in milliseconds",
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "ScreenOff": {
//                             "description": "The length of time without user
// input after which the screen is turned off, in milliseconds",
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "IdleAction": {
//                     "description": "Action to take when the idle delay is
// reached",
//                     "enum": [
//                         "Suspend",
//                         "Logout",
//                         "Shutdown",
//                         "DoNothing"
//                     ],
//                     "type": "string"
//                 }
//             },
//             "type": "object"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message PowerManagementIdleSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional string PowerManagementIdleSettings = 2;
}

// Specify whether audio activity affects power management
//
// Setting the policy to Enabled or leaving it unset means the user is not
// considered idle while audio plays. This prevents the idle timeout from being
// reached and the idle action from being taken. However, screen dimming, screen
// off, and screen lock will still occur after their configured timeouts despite
// audio activity.
//
// Setting the policy to Disabled means the system can consider users idle
// despite audio activity.
//
// Valid values:
//   True: Do not consider the user as idle while audio plays
//   False: Consider the user as idle while audio plays
//
// Supported on: chrome_os
message PowerManagementUsesAudioActivityProto {
  optional PolicyOptions policy_options = 1;
  optional bool PowerManagementUsesAudioActivity = 2;
}

// Specify whether video activity affects power management
//
// Setting the policy to Enabled or leaving it unset means the user is not
// considered idle while video plays. This prevents the idle delay, screen dim
// delay, screen off delay, and screen lock delay from being reached and the
// corresponding actions from being taken.
//
// Setting the policy to Disabled means the system can consider users idle
// despite video activity.
//
// Valid values:
//   True: Do not consider the user as idle while video plays
//   False: Consider the user as idle while video plays
//
// Supported on: chrome_os
message PowerManagementUsesVideoActivityProto {
  optional PolicyOptions policy_options = 1;
  optional bool PowerManagementUsesVideoActivity = 2;
}

// Enable smart dim model to extend the time until the screen is dimmed
//
// Setting the policy to Enabled or leaving it unset turns the smart dim model
// on and can extend the time until the screen dims. If it delays the time, the
// screen off, screen lock, and idle delays adjust to maintain the same
// distances from the screen dim delay as originally set.
//
// Setting the policy to Disabled means the smart dim model won't influence
// screen dimming.
//
// Valid values:
//   True: Allow the smart dim model to extend the time until the screen dims
//   False: Do not allow the smart dim model to extend the time until the screen
// dims
//
// Supported on: chrome_os
message PowerSmartDimEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PowerSmartDimEnabled = 2;
}

// Allow precise geolocation on these sites
//
// Setting the policy lets you set a list of URL patterns that specify sites
// that are allowed to access the user's high accuracy geolocation without first
// having to request the user's permission to do so.
//
// Leaving the policy unset means DefaultGeolocationSetting applies for all
// sites, if it's set. If not, the user's personal setting applies.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message PreciseGeolocationAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PreciseGeolocationAllowedForUrls = 2;
}

// Allow users to select a preconfigured desktop layout to load
//
// If set, this policy contains information to download a desk template file.
// The file contains a desk template to be provisioned for the current user.
// If not set, no preconfigured desk template will be included in the list of
// desk templates.  If the DeskTemplatesEnabled
// policy is not set to true, this policy has no effect.
//
// Supported on: chrome_os
message PreconfiguredDeskTemplatesProto {
  optional PolicyOptions policy_options = 1;
  optional string PreconfiguredDeskTemplates = 2;
}

// Prefer specific encryption cipher algorithms for TLS
//
// This policy configures Google Chrome to order its preferred encryption
// ciphers in TLS 1.3 to reflect a preference for algorithms that have been
// approved by a specific compliance regime.
//
// Setting this policy does not guarantee that any specific algorithms will be
// negotiated.
//
// This policy exists to allow server operators who wish to support clients with
// and without compliance requirements to differentiate between those clients,
// and only use certain non-default algorithms with increased cryptographic
// strength for those explicitly configured to prefer them.
//
// Setting the policy to 'cnsa' configures Google Chrome to prefer ciphers
// required for compliance with the Commercial National Security Algorithm Suite
// versions 1.0 and 2.0 (CNSA 1.0 and 2.0).
//
// Not setting the policy, or setting it to 'default', configures Google Chrome
// to use its default ciphers.
//
// Setting this policy is not required for security. The default cryptography
// used by Google Chrome is strong enough to withstand a brute force attack
// using the entire power of the Sun.
//
// Setting this policy will cause Google Chrome to be slower when accessing
// websites.
//
// This policy only affects TLS 1.3 and QUIC; it does not affect earlier
// versions of TLS.
//
// Valid values:
//   cnsa: Prefer ciphers satisfying the requirements of CNSA 1.0 and 2.0
//   default: Use Google Chrome's default cipher order
//
// Supported on: android, chrome_os, linux, mac, win
message PreferSlowCiphersProto {
  optional PolicyOptions policy_options = 1;
  optional string PreferSlowCiphers = 2;
}

// Prefer specific key exchange algorithms for TLS
//
// This policy configures Google Chrome to order its preferred key agreement
// algorithms (supported groups) in TLS 1.3 to reflect a preference for
// algorithms that have been approved by a specific compliance regime.
//
// Setting this policy does not guarantee that any specific algorithms will be
// negotiated.
//
// This policy exists to allow server operators who wish to support clients with
// and without compliance requirements to differentiate between those clients,
// and only use certain non-default algorithms with increased cryptographic
// strength for those explicitly configured to prefer them.
//
// Setting the policy to 'cnsa2' configures Google Chrome to prefer key exchange
// methods required for compliance with the Commercial National Security
// Algorithm Suite 2.0 (CNSA 2.0).
//
// Not setting the policy, or setting it to 'default', configures Google Chrome
// to use its default key exchange methods.
//
// Setting this policy is not required for security. The default cryptography
// used by Google Chrome is strong enough to withstand a brute force attack
// using the entire power of the Sun.
//
// Setting this policy will cause Google Chrome to be slower when accessing
// websites.
//
// This policy only affects TLS 1.3 and QUIC; it does not affect earlier
// versions of TLS.
//
// Valid values:
//   cnsa2: Prefer key exchange methods satisfying the requirements of CNSA 2.0
//   default: Use Google Chrome's default supported groups
//
// Supported on: android, chrome_os, linux, mac, win
message PreferSlowKexAlgorithmsProto {
  optional PolicyOptions policy_options = 1;
  optional string PreferSlowKexAlgorithms = 2;
}

// Allow SpeculationRules prefetch to ServiceWorker-controlled URLs
//
// SpeculationRules prefetch can be issued to URLs that are controlled by
// ServiceWorker. However, legacy code did not allow it and canceled the
// prefetch
// requests. This policy enables to control the behavior.
//
// Setting this policy to Enabled or not set allows SpeculationRules prefetch to
// ServiceWorker-controlled URLs (if the PrefetchServiceWorker feature flag is
// enabled). This is the current default behavior and is aligned with the
// specifications.
//
// Setting this policy to Disabled disallows SpeculationRules prefetch to
// ServiceWorker-controlled URLs. This is the legacy behavior.
//
// This policy is intended to be temporary and will be removed in the future.
//
// Valid values:
//   True: SpeculationRules prefetch can be sent to ServiceWorker-controlled
// URLs.
//   False: SpeculationRules prefetch cannot be sent to ServiceWorker-controlled
// URLs (legacy behavior).
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message PrefetchWithServiceWorkerEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrefetchWithServiceWorkerEnabled = 2;
}

// Re-enable the deprecated window.webkitStorageInfo API
//
// Starting in M110, the non-standard API window.webkitStorageInfo will be
// removed. This policy re-enables the API.
// If this policy is set to Enabled, the window.webkitStorageInfo API will be
// available.
// If this policy is set to Disabled or not set, the window.webkitStorageInfo
// API will be unavailable.
// This was removed in M112.
//
// Valid values:
//   True: window.webkitStorageInfo will be available.
//   False: window.webkitStorageInfo will be unavailable.
//
// Supported on:
message PrefixedStorageInfoEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrefixedStorageInfoEnabled = 2;
}

// Manage the deprecated prefixed video fullscreen API's availability
//
// Starting in M132, this policy will be removed, along with the prefixed video-
// specific fullscreen APIs.
//
// Setting the policy to enabled will allow the prefixed video-specific
// fullscreen APIs (e.g. Video.webkitEnterFullscreen()) to be used from
// Javascript.
//
// Setting the policy to disabled will prevent the prefixed video-specific
// fullscreen APIs from being used in Javascript, leaving only the standard
// fullscreen APIs (e.g. Element.requestFullscreen()).
//
// Setting the policy to runtime-enabled will allow the PrefixedFullscreenVideo
// runtime enabled feature flag to determine whether the prefixed video-specific
// fullscreen APIs are available to websites.
//
// If the policy is unset, the behavior defaults to runtime-enabled.
//
// Note: this policy is a temporary solution to help transition away from
// webkit-prefixed fullscreen APIs. M131 is the last release which will have
// this policy.
//
// Valid values:
//   runtime-enabled: Follows regular deprecation timelines for the
// PrefixedVideoFullscreen API
//   disabled: Disables prefixed video fullscreen APIs
//   enabled: Enables prefixed video fullscreen APIs
//
// Supported on:
message PrefixedVideoFullscreenApiAvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional string PrefixedVideoFullscreenApiAvailability = 2;
}

// Percentage by which to scale the idle delay in presentation mode (deprecated)
//
// This policy has been retired as of Google ChromeOS version 29. Please use the
// PresentationScreenDimDelayScale policy instead.
//
// Supported on:
message PresentationIdleDelayScaleProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PresentationIdleDelayScale = 2;
}

// Percentage by which to scale the screen dim delay in presentation mode
//
// If PowerSmartDimEnabled is Disabled, then setting
// PresentationScreenDimDelayScale specifies the percent that the screen dim
// delay scales when the device is presenting. When the screen dim delay scales,
// the screen off, screen lock, and idle delays adjust to maintain the same
// distances from the screen dim delay as originally set.
//
// Leaving the policy unset puts a default scale factor in use.
//
// Note: The scale factor must be 100% or more.
//
// Supported on: chrome_os
message PresentationScreenDimDelayScaleProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PresentationScreenDimDelayScale = 2;
}

// Switch the primary mouse button to the right button
//
// Switch the primary mouse button to the right button.
//
// If this policy is set to enabled, the right button of the mouse will always
// be the primary key.
//
// If this policy is set to disabled, the left button of the mouse will always
// be the primary key.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the left button of the mouse will be the
// primary key initially, but can be switched by the user anytime.
//
// Valid values:
//   True: Right button is primary
//   False: Left button is primary
//   None: Allow the user to decide
//
// Supported on: chrome_os
message PrimaryMouseButtonSwitchProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrimaryMouseButtonSwitch = 2;
}

// Print Headers and Footers
//
// Setting the policy to Enabled turns headers and footers on in print preview.
// Setting the policy to Disabled turns them off in print preview.
//
// If you set the policy, users can't change it. If unset, users decides whether
// headers and footers appear.
//
// Valid values:
//   True: Show headers and footers in print preview
//   False: Hide headers and footers in print preview
//   None: Allow the user to decide
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PrintHeaderFooterProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrintHeaderFooter = 2;
}

// Set the time period in days for storing print jobs metadata
//
// This policy controls how long print jobs metadata is stored on the device, in
// days.
//
// When this policy is set to a value of -1, the print jobs metadata is stored
// indefinitely. When this policy is set to a value of 0, the print jobs
// metadata is not stored at all. When this policy is set to any other value, it
// specifies the period of time during which the metadata of completed print
// jobs is stored on the device.
//
// If not set, the default period of 90 days is used for Google ChromeOS
// devices.
//
// The policy value should be specified in days.
//
// Supported on: chrome_os
message PrintJobHistoryExpirationPeriodProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PrintJobHistoryExpirationPeriod = 2;
}

// Print PDF as Image Available
//
// Controls how Google Chrome makes the Print as image option available on
// Microsoft® Windows® and macOS when printing PDFs.
//
// When printing a PDF on Microsoft® Windows® or macOS, sometimes print jobs
// need to be rasterized to an image for certain printers to get correct looking
// output.
//
// When this policy is set to Enabled, Google Chrome will make the Print as
// image option available in the Print Preview when printing a PDF.
//
// When this policy is set to Disabled or not set Google Chrome the Print as
// image option will not be available to users in Print Preview and PDFs will be
// printed as usual without being rasterized to an image before being sent to
// the destination.
//
// Valid values:
//   True: Print as image option available to user to allow PDF rasterization
// prior to sending print job to destination.
//   False: Print as image option not available for user selection.
//
// Supported on: mac, win
message PrintPdfAsImageAvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrintPdfAsImageAvailability = 2;
}

// Print PDF as Image Default
//
// Controls if Google Chrome makes the Print as image option default to set when
// printing PDFs.
//
// When this policy is set to Enabled, Google Chrome will default to setting the
// Print as image option in the Print Preview when printing a PDF.
//
// When this policy is set to Disabled or not set Google Chrome then the user
// selection for Print as image option will be initially unset.  The user will
// be allowed to select it for each individual PDFs print job, if the option is
// available.
//
// For Microsoft® Windows® or macOS this policy only has an effect if
// PrintPdfAsImageAvailability is also enabled.
//
// Valid values:
//   True: Print as image option defaults to set for print previews of PDF
// documents when it is available.
//   False: Print as image option defaults to unset for print previews of PDF
// documents when it is available.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PrintPdfAsImageDefaultProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrintPdfAsImageDefault = 2;
}

// Print PostScript Mode
//
// Controls how Google Chrome prints on Microsoft® Windows®.
//
// When printing to a PostScript printer on Microsoft® Windows® different
// PostScript generation methods can affect printing performance.
//
// When this policy is set to Default, Google Chrome will use a set of default
// options when generating PostScript. For text in particular, text will always
// be rendered using Type 3 fonts.
//
// When this policy is set to Type42, Google Chrome will render text using Type
// 42 fonts if possible. This should increase printing speed for some PostScript
// printers.
//
// When this policy is not set, Google Chrome will be in Default mode.
//
// Valid values:
//   0: Default
//   1: Type42
//
// Supported on: win
message PrintPostScriptModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PrintPostScriptMode = 2;
}

// Use System Default Printer as Default
//
// Setting the policy to Enabled means Google Chrome uses the OS default printer
// as the default destination for print preview.
//
// Setting the policy to Disabled or leaving it unset means Google Chrome uses
// the most recently used printer as the default destination for print preview.
//
// Valid values:
//   True: Use the system default printer as the default choice in Print Preview
//   False: Use the most recently used printer as the default choice in Print
// Preview
//
// Supported on: fuchsia, linux, mac, win
message PrintPreviewUseSystemDefaultPrinterProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrintPreviewUseSystemDefaultPrinter = 2;
}

// Print Rasterization Mode
//
// Controls how Google Chrome prints on Microsoft® Windows®.
//
// When printing to a non-PostScript printer on Microsoft® Windows®, sometimes
// print jobs need to be rasterized to print correctly.
//
// When this policy is set to Full, Google Chrome will do full page
// rasterization if necessary.
//
// When this policy is set to Fast, Google Chrome will avoid rasterization if
// possible, reducing the amount of rasterization can help reduce print job
// sizes and increase printing speed.
//
// When this policy is not set, Google Chrome will be in Full mode.
//
// Valid values:
//   0: Full
//   1: Fast
//
// Supported on: win
message PrintRasterizationModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PrintRasterizationMode = 2;
}

// Print Rasterize PDF DPI
//
// Controls print image resolution when Google Chrome prints PDFs with
// rasterization.
//
// When printing a PDF using the Print to image option, it can be beneficial to
// specify a print resolution other than a device's printer setting or the PDF
// default.  A high resolution will significantly increase the processing and
// printing time while a low resolution can lead to poor imaging quality.
//
// This policy allows a particular resolution to be specified for use when
// rasterizing PDFs for printing.
//
// If this policy is set to zero or not set at all then the system default
// resolution will be used during rasterization of page images.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PrintRasterizePdfDpiProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PrintRasterizePdfDpi = 2;
}

// Disable printer types on the deny list
//
// The printers of types placed on the deny list will be disabled from being
// discovered or having their capabilities fetched.
//
// Placing all printer types on the deny list effectively disables printing, as
// there would be no available destinations to send a document for printing.
//
// In versions before 102, including cloud on the deny list has the same effect
// as setting the CloudPrintSubmitEnabled policy to false. In order to keep
// Google Cloud Print destinations discoverable, the CloudPrintSubmitEnabled
// policy must be set to true and cloud must not be on the deny list. Beginning
// in version 102, Google Cloud Print destinations are not supported and will
// not appear regardless of policy values.
//
// If the policy is not set, or is set to an empty list, all printer types will
// be available for discovery.
//
// Extension printers are also known as print provider destinations, and include
// any destination that belongs to a Google Chrome extension.
//
// Local printers are also known as native printing destinations, and include
// destinations available to the local machine and shared network printers.
//
// Valid values:
//   privet: Zeroconf-based (mDNS + DNS-SD) protocol destinations (Deprecated)
//   extension: Extension-based destinations
//   pdf: The 'Save as PDF' destination, as well as the 'Save to Google Drive'
// destination on Google ChromeOS devices
//   local: Local printer destinations
//   cloud: Google Cloud Print (Deprecated)
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PrinterTypeDenyListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PrinterTypeDenyList = 2;
}

// Configures a list of printers
//
// Setting the policy lets administrators set up a list of printers for their
// users. Printer selection occurs the first time users try to print.
//
// Using the policy:
//
// * Customize free-form display_name and description for ease of printer
// selection.
//
// * Help users identify printers using manufacturer and model.
//
// * uri should be an address reachable from a client computer, including the
// scheme, port, and queue.
//
// * Optionally provide uuid to help deduplicate zeroconf printers.
//
// * Either use the model name for effective_model or set autoconf to True.
// Printers with both or no properties get ignored.
//
// PPDs are downloaded after the printer is used, and frequently used PPDs are
// cached. This policy doesn't affect whether users can configure printers on
// individual devices.
//
// Note: For Microsoft® Active Directory® managed devices, this policy supports
// expansion of ${MACHINE_NAME[,pos[,count]]} to the Microsoft® Active
// Directory® machine name or a substring of it. For example, if the machine
// name is CHROMEBOOK, then ${MACHINE_NAME,6,4} gets replaced by the 4
// characters starting after the 6th position, in other words, BOOK. The
// position is zero-based.
//
// Supported on: chrome_os
message PrintersProto {
  optional PolicyOptions policy_options = 1;
  optional StringList Printers = 2;
}

// Printer configuration access policy.
//
// Setting the policy designates which access policy applies to bulk printer
// configuration, controlling which printers from PrintersBulkConfiguration are
// available for users.
//
// * BlocklistRestriction (value 0) uses PrintersBulkBlocklist to restrict
// access to the specified printers
//
// * AllowlistPrintersOnly (value 1) uses PrintersBulkAllowlist to designate
// only those printers which are selectable
//
// * AllowAll (value 2) displays all printers
//
// Leaving the policy unset puts AllowAll in use.
//
// Valid values:
//   0: All printers are shown except those in the blocklist.
//   1: Only printers in the allowlist are shown to users
//   2: Allow all printers from the configuration file.
//
// Supported on: chrome_os
message PrintersBulkAccessModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PrintersBulkAccessMode = 2;
}

// Enabled enterprise printers
//
// If AllowlistPrintersOnly is chosen for PrintersBulkAccessMode, then setting
// PRINTERS_BULK_ALLOWLIST specifies which printers users can use. Only the
// printers with IDs matching the values in this policy are available to the
// user. The IDs must correspond to the "id" or "guid" fields in the file
// specified in PrintersBulkConfiguration.
//
// Supported on: chrome_os
message PrintersBulkAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PrintersBulkAllowlist = 2;
}

// Disabled enterprise printers
//
// If BlocklistRestriction is chosen for PrintersBulkAccessMode, then setting
// PrintersBulkBlocklist specifies which printers users can't use. All printers
// are provided to the user, except for the IDs listed in this policy. The IDs
// must correspond to the "id" or "guid" fields in the file specified in
// PrintersBulkConfiguration.
//
// Supported on: chrome_os
message PrintersBulkBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PrintersBulkBlocklist = 2;
}

// Enterprise printer configuration file
//
// Setting this policy configure enterprise printers. Its format matches the
// Printers dictionary, with an additional required "id" or "guid" field for
// each printer for allow listing or deny listing. The file size can't exceed
// 5MB and is in JSON format. A file with about 21,000 printers encodes as a 5MB
// file. The cryptographic hash helps verify download integrity. The file is
// downloaded, cached, and redownloaded when the URL or the hash changes. Google
// ChromeOS downloads the file for printer configurations and makes printers
// available along with PrintersBulkAccessMode, PrintersBulkAllowlist, and
// PrintersBulkBlocklist.
//
// This policy has no effect on whether users can configure printers on
// individual devices. It is intended to be supplementary to the configuration
// of printers by individual users.
//
// If you set the policy, users can't change it.
//
// Supported on: chrome_os
message PrintersBulkConfigurationProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintersBulkConfiguration = 2;
}

// Extensions allowed to skip confirmation dialog when sending print jobs via
// chrome.printing API
//
// This policy specifies the allowed extensions to skip print job confirmation
// dialog when they use the Printing API function chrome.printing.submitJob()
// for sending a print job.
//
// If an extension is not in the list, or the list is not set, the print job
// confirmation dialog will be shown to the user for every
// chrome.printing.submitJob() function call.
//
// Supported on: chrome_os
message PrintingAPIExtensionsAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PrintingAPIExtensionsAllowlist = 2;
}

// Extensions allowed to skip confirmation dialog when sending print jobs via
// chrome.printing API
//
// This policy specifies the allowed extensions to skip print job confirmation
// dialog when they use the Printing API function chrome.printing.submitJob()
// for sending a print job.
//
// If an extension is not in the list, or the list is not set, the print job
// confirmation dialog will be shown to the user for every
// chrome.printing.submitJob() function call.
//
// This policy is deprecated, please use PrintingAPIExtensionsAllowlist instead.
//
// Supported on:
message PrintingAPIExtensionsWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList PrintingAPIExtensionsWhitelist = 2;
}

// Restrict background graphics printing mode
//
// Restricts background graphics printing mode. Unset policy is treated as no
// restriction.
//
// Valid values:
//   any: Allow printing both with and without background graphics
//   enabled: Allow printing only with background graphics
//   disabled: Allow printing only without background graphics
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PrintingAllowedBackgroundGraphicsModesProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintingAllowedBackgroundGraphicsModes = 2;
}

// Restrict printing color mode
//
// Setting the policy sets printing to color only, monochrome only, or no color
// mode restriction. Leaving the policy unset results in no restriction.
//
// Valid values:
//   any: Allow all color modes
//   color: Color printing only
//   monochrome: Monochrome printing only
//
// Supported on: chrome_os
message PrintingAllowedColorModesProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintingAllowedColorModes = 2;
}

// Restrict printing duplex mode
//
// Setting the policy restricts printing duplex mode.
//
// Leaving the policy unset or empty results in no restriction.
//
// Valid values:
//   any: Allow all duplex modes
//   simplex: Simplex printing only
//   duplex: Duplex printing only
//
// Supported on: chrome_os
message PrintingAllowedDuplexModesProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintingAllowedDuplexModes = 2;
}

// Restrict PIN printing mode
//
// Restricts PIN printing mode. Unset policy is treated as no restriction. If
// the mode is unavailable this policy is ignored. Note that PIN printing
// feature is enabled only for printers that use one of IPPS, HTTPS, USB or IPP-
// over-USB protocols.
//
// Valid values:
//   any: Allow printing both with and without PIN
//   pin: Allow printing only with PIN
//   no_pin: Allow printing only without PIN
//
// Supported on: chrome_os
message PrintingAllowedPinModesProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintingAllowedPinModes = 2;
}

// Default background graphics printing mode
//
// Overrides default background graphics printing mode.
//
// Valid values:
//   enabled: Enable background graphics printing mode by default
//   disabled: Disable background graphics printing mode by default
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PrintingBackgroundGraphicsDefaultProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintingBackgroundGraphicsDefault = 2;
}

// Default printing color mode
//
// Setting the policy overrides the default printing color mode. If the mode is
// unavailable, this policy is ignored.
//
// Valid values:
//   color: Enable color printing
//   monochrome: Enable monochrome printing
//
// Supported on: chrome_os
message PrintingColorDefaultProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintingColorDefault = 2;
}

// Default printing duplex mode
//
// Setting the policy overrides the default printing duplex mode. If the mode is
// unavailable, this policy is ignored.
//
// Valid values:
//   simplex: Enable simplex printing
//   short-edge: Enable short edge duplex printing
//   long-edge: Enable long edge duplex printing
//
// Supported on: chrome_os
message PrintingDuplexDefaultProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintingDuplexDefault = 2;
}

// Enable printing
//
// Setting the policy to Enabled or leaving it unset lets users print in Google
// Chrome, and users can't change this setting.
//
// Setting the policy to Disabled means users can't print from Google Chrome.
// Printing is off in the three dots menu, extensions, and JavaScript
// applications.
//
// Valid values:
//   True: Enable printing
//   False: Disable printing
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message PrintingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrintingEnabled = 2;
}

// Enable Printing LPAC Sandbox
//
// Setting the policy to Enabled or leaving it unset enables the LPAC Sandbox
// for printing services whenever the system configuration supports it.
//
// Setting the policy to Disabled has a detrimental effect on Google Chrome's
// security as services used for printing might run in a weaker sandbox
// configuration.
//
// Only turn off the policy if there are compatibility issues with third party
// software that prevent printing services from operating correctly inside the
// LPAC Sandbox.
//
// Valid values:
//   True: Enable LPAC Sandbox for printing services
//   False: Disable LPAC Sandbox for printing services
//
// Supported on: win
message PrintingLPACSandboxEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrintingLPACSandboxEnabled = 2;
}

// Maximal number of sheets allowed to use for a single print job
//
// Specifies the maximal number of sheets user is allowed to print for a single
// print job.
//
// If not set, no limitations are applied and user can print any documents.
//
// Supported on: chrome_os
message PrintingMaxSheetsAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional int64 PrintingMaxSheetsAllowed = 2;
}

// Default printing page size
//
// Overrides default printing page size.
//
// name should contain one of the listed formats or 'custom' if required paper
// size is not in the list. If 'custom' value is provided custom_size property
// should be specified. It describes the desired height and width in
// micrometers. Otherwise custom_size property shouldn't be specified. Policy
// that violates these rules is ignored.
//
// If the page size is unavailable on the printer chosen by the user this policy
// is ignored.
//
// Value schema:
// {
//     "properties": {
//         "custom_size": {
//             "properties": {
//                 "height": {
//                     "description": "Height of the page in micrometers",
//                     "type": "integer"
//                 },
//                 "width": {
//                     "description": "Width of the page in micrometers",
//                     "type": "integer"
//                 }
//             },
//             "required": [
//                 "width",
//                 "height"
//             ],
//             "type": "object"
//         },
//         "name": {
//             "enum": [
//                 "custom",
//                 "asme_f_28x40in",
//                 "iso_2a0_1189x1682mm",
//                 "iso_a0_841x1189mm",
//                 "iso_a10_26x37mm",
//                 "iso_a1_594x841mm",
//                 "iso_a2_420x594mm",
//                 "iso_a3_297x420mm",
//                 "iso_a4-extra_235.5x322.3mm",
//                 "iso_a4-tab_225x297mm",
//                 "iso_a4_210x297mm",
//                 "iso_a5-extra_174x235mm",
//                 "iso_a5_148x210mm",
//                 "iso_a6_105x148mm",
//                 "iso_a7_74x105mm",
//                 "iso_a8_52x74mm",
//                 "iso_a9_37x52mm",
//                 "iso_b0_1000x1414mm",
//                 "iso_b10_31x44mm",
//                 "iso_b1_707x1000mm",
//                 "iso_b2_500x707mm",
//                 "iso_b3_353x500mm",
//                 "iso_b4_250x353mm",
//                 "iso_b5-extra_201x276mm",
//                 "iso_b5_176x250mm",
//                 "iso_b6_125x176mm",
//                 "iso_b6c4_125x324mm",
//                 "iso_b7_88x125mm",
//                 "iso_b8_62x88mm",
//                 "iso_b9_44x62mm",
//                 "iso_c0_917x1297mm",
//                 "iso_c10_28x40mm",
//                 "iso_c1_648x917mm",
//                 "iso_c2_458x648mm",
//                 "iso_c3_324x458mm",
//                 "iso_c4_229x324mm",
//                 "iso_c5_162x229mm",
//                 "iso_c6_114x162mm",
//                 "iso_c6c5_114x229mm",
//                 "iso_c7_81x114mm",
//                 "iso_c7c6_81x162mm",
//                 "iso_c8_57x81mm",
//                 "iso_c9_40x57mm",
//                 "iso_dl_110x220mm",
//                 "jis_exec_216x330mm",
//                 "jpn_chou2_111.1x146mm",
//                 "jpn_chou3_120x235mm",
//                 "jpn_chou4_90x205mm",
//                 "jpn_hagaki_100x148mm",
//                 "jpn_kahu_240x322.1mm",
//                 "jpn_kaku2_240x332mm",
//                 "jpn_oufuku_148x200mm",
//                 "jpn_you4_105x235mm",
//                 "na_10x11_10x11in",
//                 "na_10x13_10x13in",
//                 "na_10x14_10x14in",
//                 "na_10x15_10x15in",
//                 "na_11x12_11x12in",
//                 "na_11x15_11x15in",
//                 "na_12x19_12x19in",
//                 "na_5x7_5x7in",
//                 "na_6x9_6x9in",
//                 "na_7x9_7x9in",
//                 "na_9x11_9x11in",
//                 "na_a2_4.375x5.75in",
//                 "na_arch-a_9x12in",
//                 "na_arch-b_12x18in",
//                 "na_arch-c_18x24in",
//                 "na_arch-d_24x36in",
//                 "na_arch-e_36x48in",
//                 "na_b-plus_12x19.17in",
//                 "na_c5_6.5x9.5in",
//                 "na_c_17x22in",
//                 "na_d_22x34in",
//                 "na_e_34x44in",
//                 "na_edp_11x14in",
//                 "na_eur-edp_12x14in",
//                 "na_f_44x68in",
//                 "na_fanfold-eur_8.5x12in",
//                 "na_fanfold-us_11x14.875in",
//                 "na_foolscap_8.5x13in",
//                 "na_govt-legal_8x13in",
//                 "na_govt-letter_8x10in",
//                 "na_index-3x5_3x5in",
//                 "na_index-4x6-ext_6x8in",
//                 "na_index-4x6_4x6in",
//                 "na_index-5x8_5x8in",
//                 "na_invoice_5.5x8.5in",
//                 "na_ledger_11x17in",
//                 "na_legal-extra_9.5x15in",
//                 "na_legal_8.5x14in",
//                 "na_letter-extra_9.5x12in",
//                 "na_letter-plus_8.5x12.69in",
//                 "na_letter_8.5x11in",
//                 "na_number-10_4.125x9.5in",
//                 "na_number-11_4.5x10.375in",
//                 "na_number-12_4.75x11in",
//                 "na_number-14_5x11.5in",
//                 "na_personal_3.625x6.5in",
//                 "na_super-a_8.94x14in",
//                 "na_super-b_13x19in",
//                 "na_wide-format_30x42in",
//                 "om_dai-pa-kai_275x395mm",
//                 "om_folio-sp_215x315mm",
//                 "om_invite_220x220mm",
//                 "om_italian_110x230mm",
//                 "om_juuro-ku-kai_198x275mm",
//                 "om_large-photo_200x300",
//                 "om_pa-kai_267x389mm",
//                 "om_postfix_114x229mm",
//                 "om_small-photo_100x150mm",
//                 "prc_10_324x458mm",
//                 "prc_16k_146x215mm",
//                 "prc_1_102x165mm",
//                 "prc_2_102x176mm",
//                 "prc_32k_97x151mm",
//                 "prc_3_125x176mm",
//                 "prc_4_110x208mm",
//                 "prc_5_110x220mm",
//                 "prc_6_120x320mm",
//                 "prc_7_160x230mm",
//                 "prc_8_120x309mm",
//                 "roc_16k_7.75x10.75in",
//                 "roc_8k_10.75x15.5in",
//                 "jis_b0_1030x1456mm",
//                 "jis_b1_728x1030mm",
//                 "jis_b2_515x728mm",
//                 "jis_b3_364x515mm",
//                 "jis_b4_257x364mm",
//                 "jis_b5_182x257mm",
//                 "jis_b6_128x182mm",
//                 "jis_b7_91x128mm",
//                 "jis_b8_64x91mm",
//                 "jis_b9_45x64mm",
//                 "jis_b10_32x45mm"
//             ],
//             "type": "string"
//         }
//     },
//     "required": [
//         "name"
//     ],
//     "type": "object"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PrintingPaperSizeDefaultProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintingPaperSizeDefault = 2;
}

// Default PIN printing mode
//
// Overrides default PIN printing mode. If the mode is unavailable this policy
// is ignored.
//
// Valid values:
//   pin: Enable PIN printing by default
//   no_pin: Disable PIN printing by default
//
// Supported on: chrome_os
message PrintingPinDefaultProto {
  optional PolicyOptions policy_options = 1;
  optional string PrintingPinDefault = 2;
}

// Send username and filename to native printers
//
// Send username and filename to native printers server with every print job.
// The default is not to send.
//
// Setting this policy to true also disables printers that use protocols other
// than IPPS, USB, or IPP-over-USB since username and filename shouldn't be sent
// over the network openly.
//
// Valid values:
//   True: Enable sending username and filename to native printers
//   False: Disable sending username and filename to native printers
//
// Supported on: chrome_os
message PrintingSendUsernameAndFilenameEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrintingSendUsernameAndFilenameEnabled = 2;
}

// Choose whether the Privacy Sandbox ad measurement setting can be disabled
//
// A policy to control whether the Privacy Sandbox Ad measurement setting can be
// disabled for your users.
//
// If you set this policy to Disabled, then the Ad measurement setting will be
// turned off for your users.
// If you set this policy to Enabled or keep it unset, your users will be able
// to turn on or off the Privacy Sandbox Ad measurement setting on their device.
//
// This policy is deprecated as of Google Chrome version 144 with the
// deprecation of the Attribution Reporting API.
//
// Valid values:
//   True: Allow users to turn on or off the Privacy Sandbox Ad measurement
// setting on their device.
//   False: Disable Privacy Sandbox Ad measurement setting for your users.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message PrivacySandboxAdMeasurementEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrivacySandboxAdMeasurementEnabled = 2;
}

// Choose whether the Privacy Sandbox Ad topics setting can be disabled
//
// A policy to control whether the Privacy Sandbox Ad topics setting can be
// disabled for your users.
//
// If you set this policy to Disabled, then the Ad topics setting will be turned
// off for your users.
// If you set this policy to Enabled or keep it unset, your users will be able
// to turn on or off the Privacy Sandbox Ad topics setting on their device.
//
// This policy is deprecated as of Google Chrome version 144 with the
// deprecation of Topics API.
//
// Valid values:
//   True: Allow users to to turn on or off the Privacy Sandbox Ad topics
// setting on their device.
//   False: Disable Privacy Sandbox Ad topics setting for your users.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message PrivacySandboxAdTopicsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrivacySandboxAdTopicsEnabled = 2;
}

// Choose whether the Privacy Sandbox Fingerprinting Protection feature is to be
// enabled in Incognito mode.
//
// A policy to control whether the Privacy Sandbox Fingerprinting Protection
// setting is to be enabled in Incognito mode or disabled for your users.
//
// If you set this policy to Disabled, then the Fingerprinting Protection
// feature setting will be turned off for your users.
// If you set this policy to Enabled, your users will have the Fingerprinting
// Protection feature setting turned on in Incognito mode.
// If the policy is not set, users will be able to turn on or off the
// Fingerprinting Protection feature for Incognito mode in their UI settings.
// The default state will be false or disabled, meaning the Fingerprinting
// Protection feature will be turned off.
//
// Valid values:
//   True: Enable the Privacy Sandbox Fingerprinting Protection feature in
// Incognito mode.
//   False: Disable the Privacy Sandbox Fingerprinting Protection feature in
// Incognito mode.
//   None: Allow users to turn on or turn off the Privacy Sandbox Fingerprinting
// Protection setting in Incognito mode on their device.
//
// Supported on:
message PrivacySandboxFingerprintingProtectionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrivacySandboxFingerprintingProtectionEnabled = 2;
}

// Choose whether the Privacy Sandbox IP Protection feature should be enabled.
//
// A policy to control whether the Privacy Sandbox IP Protection feature should
// be enabled.
//
// IP Protection is a feature that limits availability of a user's original IP
// address for certain third-party network requests made while browsing in
// Incognito mode, enhancing protections against cross-site tracking during
// Incognito browsing sessions.
//
// If the policy is set to Disabled, then IP Protection will be disabled and
// users won't be able to enable the feature via UI settings.
// If the policy is set to Enabled, then IP Protection will be enabled and users
// won't be able to disable the feature via UI settings.
// If the policy is not set, IP Protection will be enabled by default and users
// will be able to control the feature on their device via UI settings.
//
// Some considerations regarding whether enterprises should disable IP
// Protection include:
//
// - DNS lookups won't be performed for requests that are proxied, which may
// impact DNS-based monitoring or filtering.
//
// - Enterprise applications may experience breakage when used in Incognito mode
// if they rely on requests to domains (or subdomains of those domains) on the
// Masked Domain List (https://github.com/GoogleChrome/ip-
// protection/blob/main/Masked-Domain-List.md) and require those requests to
// come from specific IP address ranges.
//
// - Traffic might not be proxied in Incognito mode under certain conditions,
// for example when users launch Incognito mode from a Chrome profile they
// aren't signed in to. In general the feature requires the user to have been
// signed in to Chrome with a personal Google account when launching Incognito
// mode.
//
// - The list of domains on the Masked Domain List may change over time, with
// new versions being pushed to users automatically. For more information on the
// Masked Domain List, see: https://github.com/GoogleChrome/ip-
// protection/blob/main/README.md#identifying-domains-and-the-masked-domain-
// list-mdl.
//
// For more information on IP Protection, see:
// https://github.com/GoogleChrome/ip-protection/blob/main/README.md.
//
// IP Protection will be launched no sooner than M139.
//
// Valid values:
//   False: Disable the IP Protection feature.
//   True: Enable the IP Protection feature.
//   None: Allow users to turn on or turn off the IP Protection setting on their
// device. The feature will be enabled by default.
//
// Supported on:
message PrivacySandboxIpProtectionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrivacySandboxIpProtectionEnabled = 2;
}

// Choose whether the Privacy Sandbox prompt can be shown to your users
//
// This policy is deprecated because the Privacy Sandbox prompt configuration is
// no longer supported.
//
// A policy to control whether your users see the Privacy Sandbox prompt.
// The prompt is a user-blocking flow which informs your users of the Privacy
// Sandbox settings. See https://privacysandbox.com for details about Chrome’s
// effort to deprecate third-party cookies.
//
// If you set this policy to Disabled, then Google Chrome won’t show the Privacy
// Sandbox prompt.
// If you set this policy to Enabled or keep it unset, then Google Chrome
// determines whether the Privacy Sandbox prompt can be shown or not and then
// show it if possible.
//
// If any of the following policies are set, it’s required to set this policy to
// Disabled:
// PrivacySandboxAdTopicsEnabled
// PrivacySandboxSiteEnabledAdsEnabled
// PrivacySandboxAdMeasurementEnabled
//
// Valid values:
//   True: Allow Google Chrome to determine whether to show the Privacy Sandbox
// prompt.
//   False: Do not show the Privacy Sandbox prompt to users.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message PrivacySandboxPromptEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrivacySandboxPromptEnabled = 2;
}

// Choose whether the Privacy Sandbox Site-suggested ads setting can be disabled
//
// A policy to control whether the Privacy Sandbox Site-suggested ads setting
// can be disabled for your users.
//
// If you set this policy to Disabled, then the Site-suggested ads setting will
// be turned off for your users.
// If you set this policy to Enabled or keep it unset, your users will be able
// to turn on or off the Privacy Sandbox Site-suggested ads setting on their
// device.
//
// This policy is deprecated as of Google Chrome version 144 with the
// deprecation of the Protected Audience API.
//
// Valid values:
//   True: Allow users to turn on or off the Privacy Sandbox Site-suggested ads
// setting on their device.
//   False: Disable Privacy Sandbox Site-suggested ads setting for your users.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message PrivacySandboxSiteEnabledAdsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrivacySandboxSiteEnabledAdsEnabled = 2;
}

// Enable privacy screen
//
// Enable/disable the privacy screen feature.
//
// If this policy is set to True, privacy screen will always be enabled.
//
// If this policy is set to False, privacy screen will always be disabled.
//
// When this policy is set, the user cannot override the value.
//
// If this policy is left unset, privacy screen is disabled initially but can be
// controlled by the user.
//
// Valid values:
//   True: Always enable the privacy screen
//   False: Always disable the privacy screen
//   None: Allow the user to decide
//
// Supported on: chrome_os
message PrivacyScreenEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrivacyScreenEnabled = 2;
}

// Specifies whether to apply restrictions to requests to more-private network
// endpoints
//
// When this policy is set to Enabled, any time when a warning is supposed to be
// displayed in Chrome DevTools due to Private Network Access checks failing,
// the
// main request will be blocked instead.
//
// When this policy is set to Disabled or unset, all Private Network Access
// warnings will not
// be enforced and the requests will not be blocked.
//
// See https://wicg.github.io/private-network-access/ for Private Network Access
// restrictions.
//
// Valid values:
//   True: Apply restrictions to requests to more-private network endpoints
//   False: Use default behavior when determining if websites can make requests
// to network endpoints
//
// Supported on:
message PrivateNetworkAccessRestrictionsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PrivateNetworkAccessRestrictionsEnabled = 2;
}

// Enable Process Isolation
//
// This policy controls the Process Isolation settings for Google Chrome.
//
// Enabling Process Isolation improves the security of Google Chrome by
// preventing authorized applications on the system from tampering with or
// reading the contents of Google Chrome's running processes. This helps prevent
// other applications on the system from gaining access to Google Chrome's
// encrypted data.
//
// Enabling Process Isolation may cause incompatibilities with third party
// applications that rely on being able to inject or tamper with Google Chrome's
// processes, such as antivirus, screen reader or window manager applications.
//
// Setting the policy to Enabled turns on process isolation in Google Chrome.
//
// Setting the policy to Disabled turns off process isolation in Google Chrome.
//
// If this policy is unset, Google Chrome will follow the default rollout
// process for the Process Isolation feature, which means that the feature will
// be gradually rolled out to an increasing number of users.
//
// Note: This policy is applied when Google Chrome starts. If the policy is
// changed while Google Chrome is running, the new setting will take effect on
// the next restart.
//
// Valid values:
//   True: Enable Process Isolation.
//   False: Disable Process Isolation.
//   None: Process Isolation may be used depending on feature launch process.
//
// Supported on: win
message ProcessIsolationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ProcessIsolationEnabled = 2;
}

// Profile Label
//
// This policy controls a label used to identify a signed in profile. This label
// will be shown in various locations to help users identify the profile such as
// next to the toolbar profile icon.
// This label will also be used as a default name for newly created profiles
// that can be modified by the users.
//
// If this policy is left unset the default label, either "Work" or "School"
// will be used.
//
// If this policy is set to "Label the profile as Work (0)", the "Work" label
// will be used.
//
// If this policy is set to "Label the profile as School (1)", the "School"
// label will be used.
//
// This policy will be overridden by the CustomProfileLabel policy if that
// policy is set.
//
// Valid values:
//   0: Work
//   1: School
//
// Supported on:
message ProfileLabelProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ProfileLabel = 2;
}

// Profile picker availability on startup
//
// Specifies whether the profile picker is enabled, disabled or forced at the
// browser startup.
//
// By default the profile picker is not shown if the browser starts in guest or
// incognito mode, a profile directory and/or urls are specified by command
// line, an app is explicitly requested to open, the browser was launched by a
// native notification, there is only one profile available or the policy
// ForceBrowserSignin is set to true.
//
// If 'Enabled' (0) is selected or the policy is left unset, the profile picker
// will be shown at startup by default, but users will be able to enable/disable
// it.
//
// If 'Disabled' (1) is selected, the profile picker will never be shown, and
// users will not be able to change the setting.
//
// If 'Forced' (2) is selected, the profile picker cannot be suppressed by the
// user. The profile picker will be shown even if there is only one profile
// available.
//
// Valid values:
//   0: Profile picker available at startup
//   1: Profile picker disabled at startup
//   2: Profile picker forced at startup
//
// Supported on: fuchsia, linux, mac, win
message ProfilePickerOnStartupAvailabilityProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ProfilePickerOnStartupAvailability = 2;
}

// Prompt users to re-authenticate to the profile
//
// When set to DoNotPrompt or left unset, Google Chrome does not automatically
// prompt the user to re-authenticate to the browser.
//
// When set to PromptInTab, when the user's authentication expires, immediately
// open a new tab with the Google login page. This only happens if using Chrome
// Sync.
//
// Valid values:
//   0: Do not prompt for reauth
//   1: Prompt for reauth in a tab
//
// Supported on: linux, mac, win
message ProfileReauthPromptProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ProfileReauthPrompt = 2;
}

// Profile separation data migration settings
//
// This policy controls whether users are allowed to bring existing browsing
// data into a managed profile created after a managed account signs into the
// content area.
//
// If this policy is unset or set to UserOptInData (value 1), the user can
// choose whether to bring existing browsing data into the managed profile. The
// checkbox in the profile creation dialog will be visible and unchecked by
// default.
//
// If this policy is set to UserOptOutData (value 2), the user can choose
// whether to bring existing browsing data into the managed profile. The
// checkbox in the profile creation dialog will be visible and checked by
// default. This option is only allowed on managed devices.
//
// If this policy is set to AlwaysSeparateData (value 3), the user cannot bring
// any existing browsing data into the managed profile. The checkbox in the
// profile creation dialog will not be visible.
//
// Bringing existing browsing data into the managed profile means that the
// current profile will become managed. No new profile will be created.
//
// Not bringing existing browsing data into the managed profile means that a new
// clean profile will be created. The existing browsing data will stay in an
// unmanaged profile which will still be accessible to the user via the profile
// picker.
//
// Valid values:
//   1: Let users decide to bring existing browsing data into their managed
// profile
//   2: Suggest to users to bring their existing data in the managed profile and
// give them a choice not to
//   3: Users cannot bring existing browsing data in their managed profile
//
// Supported on: ios, linux, mac, win
message ProfileSeparationDataMigrationSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ProfileSeparationDataMigrationSettings = 2;
}

// Enterprise profile separation secondary domain allowlist
//
// If this policy is unset, account logins will not be required to create a new
// separate profile.
//
// If this policy is set, account logins from the listed domains will not be
// required to create a new separate profile.
//
// This policy can be set to an empty string so that all account logins are
// required to create a new separate profile.
//
// Supported on: linux, mac, win
message ProfileSeparationDomainExceptionListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ProfileSeparationDomainExceptionList = 2;
}

// Enterprise profile separation settings
//
// This policy controls the behavior of the browser after a managed account
// signs into the content area.
//
// This policy overrides ManagedAccountsSigninRestriction.
//
// If this policy is set to Suggested, after a managed account sign in, the user
// will be be asked to continue using a managed profile as if it was enforced.
// If they refuse, the user may continue their browsing in an unmanaged
// environment.
//
// If this policy is set to Enforced, after a managed account sign in, the user
// will be required to continue using a managed profile. If they refuse, they
// will be signed out of their account. This enforcement is not affected by the
// SigninInterceptionEnabled policy.
//
// If this policy is set to Disabled or unset, after a managed account sign in,
// the user may see a bubble asking them to create a new profile. The bubble can
// be dismissed and the user may continue their browsing in an unmanaged
// environment. The bubble is controlled by the SigninInterceptionEnabled
// policy.
//
// This policy has no effect when set on a machine level.
//
// This policy does not apply to or function within Incognito mode.
//
// Valid values:
//   0: Suggests profile separation
//   1: Enforce profile separation
//   2: Disables profile separation
//
// Supported on: linux, mac, win
message ProfileSeparationSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ProfileSeparationSettings = 2;
}

// Enable Screencast dogfood for Family Link users
//
// This policy enables Screencast feature for Family Link users and gives it
// permission to create and transcribe screen recording and upload to Drive.
// This policy does not affect other types of users.
// This policy does not affect ProjectorEnabled policy for enterprise users.
//
// If the policy is enabled, Screencast dogfood will be enabled for Family Link
// users.
// If the policy is disabled, Screencast dogfood will be disabled for Family
// Link users.
// If the policy is not set, Screencast dogfood will be by default disabled for
// Family Link users.
//
// Valid values:
//   True: Enable Screencast dogfood for Family Link users
//   False: Disable Screencast dogfood for Family Link users
//
// Supported on: chrome_os
message ProjectorDogfoodForFamilyLinkEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ProjectorDogfoodForFamilyLinkEnabled = 2;
}

// Enable Screencast
//
// This policy gives Screencast permission to create and transcribe screen
// recording and upload to Drive for enterprise users.
// This policy does not affect Family Link users.
// This policy does not affect ProjectorDogfoodForFamilyLinkEnabled policy for
// Family Link users.
//
// If the policy is unset or enabled, Screencast will be enabled.
// If the policy is disabled, Screencast will be disabled.
//
// Valid values:
//   True: Enable Screencast
//   False: Disable Screencast
//
// Supported on: chrome_os
message ProjectorEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ProjectorEnabled = 2;
}

// Enable showing full-tab promotional content
//
// Setting the policy to True or leaving it unset lets Google Chrome show users
// product information as full-tab content.
//
// Setting the policy to False prevents Google Chrome from showing product
// information as full-tab content.
//
// Setting the policy controls the presentation of the welcome pages that help
// users sign in to Google Chrome, set Google Chrome as users' default browser,
// or otherwise inform them of product features.
//
// This is deprecated - use PromotionsEnabled instead.
//
// Valid values:
//   True: Enable showing full-tab promotional content
//   False: Disable showing full-tab promotional content
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PromotionalTabsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PromotionalTabsEnabled = 2;
}

// Enable showing promotional content
//
// Setting the policy to True or leaving it unset lets Google Chrome show users
// product promotional content.
//
// Setting the policy to False prevents Google Chrome from showing product
// promotional content.
//
// Setting the policy controls the presentation of promotional content,
// including the welcome pages that help users sign in to Google Chrome, set
// Google Chrome as users' default browser, or otherwise inform them of product
// features.
//
// Valid values:
//   True: Enable showing promotional content
//   False: Disable showing promotional content
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PromotionsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool PromotionsEnabled = 2;
}

// Ask where to save each file before downloading
//
// Setting the policy to Enabled means users are asked where to save each file
// before downloading. Setting the policy to Disabled has downloads start
// immediately, and users aren't asked where to save the file.
//
// Leaving the policy unset lets users change this setting.
//
// Valid values:
//   True: Ask the user where to save the file before downloading
//   False: Do not ask the user (downloads start immediately)
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message PromptForDownloadLocationProto {
  optional PolicyOptions policy_options = 1;
  optional bool PromptForDownloadLocation = 2;
}

// Prompt when multiple certificates match
//
// This policy controls whether the user is prompted to select a client
// certificate when more than one certificate matches
// AutoSelectCertificateForUrls.
// If this policy is set to Enabled, the user is prompted to select a client
// certificate whenever the auto-selection policy matches multiple certificates.
// If this policy is set to Disabled or not set, the user may only be prompted
// when no certificate matches the auto-selection.
//
// Valid values:
//   True: Prompt the user to select the client certificate whenever the auto-
// selection policy matches multiple certificates.
//   False: Only prompt the user when no certificate matches the auto-selection.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message PromptOnMultipleMatchingCertificatesProto {
  optional PolicyOptions policy_options = 1;
  optional bool PromptOnMultipleMatchingCertificates = 2;
}

// Allows web pages to use identifiers for the purpose of protected content
// playback
//
// If the policy is set to true or unset, the use of protected content
// identifiers is allowed, which can help enable higher quality of protected
// content playback.
//
// If the policy is set to false, protected content identifiers are not allowed
// to be used.
//
// Valid values:
//   True: Allow the use of protected content identifiers with sites, which can
// help enable higher quality of protected content playback.
//   False: Disable the use of protected content identifiers with sites, which
// might lead to lower quality of protected content playback.
//
// Supported on: android, chrome_os, win
message ProtectedContentIdentifiersAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool ProtectedContentIdentifiersAllowed = 2;
}

// Enables the provisioning of client certificates for managed browsers
//
// Setting this policy to Enabled (value 1) will make the Google Chrome request
// a client certificate from the device management server for a managed browser
// session. This certificate will be made available for, e.g., mTLS connections.
//
// Setting this policy to Disabled (value 0), or leaving unset will prevent
// Google Chrome from requesting the client certificate. If a browser's managed
// client certificate had already been provisioned, due to this policy being
// enabled before, it will not be deleted, but it won't be available for mTLS
// connections and won't be renewed when it expires.
//
// Valid values:
//   0: Disable client certificate provisioning for browsers
//   1: Enable client certificate provisioning for browsers
//
// Supported on: android, ios, linux, mac, win
message ProvisionManagedClientCertificateForBrowserProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ProvisionManagedClientCertificateForBrowser = 2;
}

// Enables the provisioning of client certificates for a managed user or profile
//
// Setting this policy to Enabled (value 1) will make the browser request a
// client certificate from the device management server for a managed user or
// profile. This certificate will be made available for, e.g., mTLS connections.
//
// Setting this policy to Disabled (value 0) will prevent the browser from
// requesting the client certificate. If a profile's managed client certificate
// had already been provisioned, due to this policy being enabled before, it
// will not be deleted, but it won't be available for mTLS connections and won't
// be renewed when it expires.
//
// Valid values:
//   0: Disable client certificate provisioning
//   1: Enable client certificate provisioning
//
// Supported on: android, chrome_os, ios, linux, mac, win
message ProvisionManagedClientCertificateForUserProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ProvisionManagedClientCertificateForUser = 2;
}

// Allows the app to use provisional notification authorization on iOS
//
// If the policy is set to Enabled or left unset, the app may use iOS's
// "Provisional" notification authorization to present notifications in the iOS
// Notification Center.
//
// If the policy is set to Disabled, the app will not use provisional
// notifications.
//
// Valid values:
//   True: Allow the app to use provisional notification authorization
//   False: Do not allow the app to use provisional notification authorization
//
// Supported on: ios
message ProvisionalNotificationsAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool ProvisionalNotificationsAllowed = 2;
}

// Proxy bypass rules
//
// This policy is deprecated, please use ProxySettings instead.
//
// Setting the policy means Google Chrome bypasses any proxy for the list of
// hosts given here. This policy only takes effect if the ProxySettings policy
// isn't specified and you specified either fixed_servers or pac_script for
// ProxyMode.
//
// Leave this policy unset if you selected any other mode for setting proxy
// policies.
//
// Note: For more detailed examples, visit The Chromium Projects (
// https://www.chromium.org/developers/design-documents/network-settings#TOC-
// Command-line-options-for-proxy-sett ).
//
// Supported on: android, chrome_os, linux, mac, win
message ProxyBypassListProto {
  optional PolicyOptions policy_options = 1;
  optional string ProxyBypassList = 2;
}

// Choose how to specify proxy server settings
//
// This policy is deprecated, please use ProxySettings instead.
//
// Setting the policy to Enabled lets you specify the proxy server Chrome uses
// and prevents users from changing proxy settings. Chrome and ARC-apps ignore
// all proxy-related options specified from the command line. The policy only
// takes effect if the ProxySettings policy isn't specified.
//
// Other options are ignored if you choose:
// * direct = Never use a proxy server and always connect directly
// * system = Use system proxy settings
// * auto_detect = Auto detect the proxy server
//
// If you choose to use:
// * fixed_servers = Fixed proxy servers. You can specify further options with
// ProxyServer and ProxyBypassList. Only the HTTP proxy server with the highest
// priority is available for ARC-apps.
// * pac_script =  A .pac proxy script. Use ProxyPacUrl to set the URL to a
// proxy .pac file.
//
// Leaving the policy unset lets users choose the proxy settings.
//
// Note: For detailed examples, visit The Chromium Projects (
// https://www.chromium.org/developers/design-documents/network-settings#TOC-
// Command-line-options-for-proxy-sett ).
//
// Valid values:
//   direct: Never use a proxy
//   auto_detect: Auto detect proxy settings
//   pac_script: Use a .pac proxy script
//   fixed_servers: Use fixed proxy servers
//   system: Use system proxy settings
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ProxyModeProto {
  optional PolicyOptions policy_options = 1;
  optional string ProxyMode = 2;
}

// Proxy override rules
//
// Configures rules that select which proxy the browser uses based on the
// destination URL and specific network conditions.
//
// This policy takes precedence over the ProxySettings policy, the chrome.proxy
// extension API, and manual user settings. If no rules in this policy match,
// the browser falls back to the settings defined in ProxySettings.
//
// The browser evaluates entries in the ProxyOverrideRules list in sequence. A
// rule is applied only if all of the following criteria are met:
//
// * Match: At least one URL pattern in DestinationMatchers is matched.
//
// * Exclude: No URL patterns in ExcludeDestinationMatchers are matched.
//
// * Conditions: If Conditions is specified, all listed conditions must be
// satisfied. If unset, this requirement is ignored.
//
// URL patterns for matchers are documented at https://chromium.googlesource.com
// /chromium/src/+/HEAD/net/docs/proxy.md#proxy-config-url-patterns.
//
// The ProxyList field defines a failover list. The first reachable entry is
// used; invalid entries are ignored. You can use PAC-style strings or URL-like
// specifiers:
//
// PAC-style strings:
//
// * DIRECT
//
// * PROXY host:port
//
// * HTTPS host:port
//
// * SOCKS4 host:port
//
// * SOCKS5 host:port
//
// URL-like specifiers:
//
// * http://host:port
//
// * https://host:port
//
// * socks4://host:port
//
// * socks5://host:port
//
// The DnsProbe condition checks if a Host resolves to an IP address.
//
// * Supports hostnames (e.g., example.com) or URI-style strings (e.g.,
// https://example.com:123). Using a secure scheme (https) may trigger an HTTPS
// record request (see RFC 9460).
//
// * Set to "resolved" to meet the condition upon successful resolution, or
// "not_found" to meet the condition if resolution fails.
//
// The application of this policy on managed devices is influenced by the
// EnableProxyOverrideRulesForAllUsers machine-level policy on the platforms
// where it is supported. By default, it prevents the usage of override rules
// configured by unaffiliated users.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "Conditions": {
//                 "items": {
//                     "properties": {
//                         "DnsProbe": {
//                             "properties": {
//                                 "Host": {
//                                     "type": "string"
//                                 },
//                                 "Result": {
//                                     "enum": [
//                                         "resolved",
//                                         "not_found"
//                                     ],
//                                     "type": "string"
//                                 }
//                             },
//                             "type": "object"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "DestinationMatchers": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "ExcludeDestinationMatchers": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "ProxyList": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, linux, mac, win
message ProxyOverrideRulesProto {
  optional PolicyOptions policy_options = 1;
  optional string ProxyOverrideRules = 2;
}

// URL to a proxy .pac file
//
// This policy is deprecated, please use ProxySettings instead.
//
// Setting the policy lets you specify a URL to a proxy .pac file. This policy
// only takes effect if the ProxySettings policy isn't specified and you
// selected pac_script with ProxyMode.
//
// Leave this policy unset if you selected any other mode for setting proxy
// policies.
//
// Note: For detailed examples, visit The Chromium Projects (
// https://www.chromium.org/developers/design-documents/network-settings#TOC-
// Command-line-options-for-proxy-sett ).
//
// Supported on: android, chrome_os, linux, mac, win
message ProxyPacUrlProto {
  optional PolicyOptions policy_options = 1;
  optional string ProxyPacUrl = 2;
}

// Configure Proxy Provisioning Domains
//
// Configures a list of Provisioning Domains (PvDs) that Google Chrome will use
// to fetch proxy configurations dynamically.
//
// This policy allows specifying a list of domain names or resource URIs
// representing Provisioning Domains as defined in RFC 8801 ("Discovering
// Provisioning Domain Names and Data"). For each PvD, the browser resolves the
// corresponding JSON configuration by making an HTTPS request to the well-known
// endpoint path: "https://[pvd_id]/.well-known/pvd".
//
// Each entry in the list specifies:
//
// * pvd_id: The identifier of the Provisioning Domain (a domain name).
//
// * auth_config: The optional authentication configuration. If unconfigured or
// set to "none", no authentication is performed. When set to
// "profile_bearer_token", the browser retrieves an OAuth2 access token with
// provided scope for the signed-in primary account and attaches it in the
// "Authorization" header as a "Bearer" token.
//
// * extra_headers: An optional list of custom HTTP headers to include when
// querying the PvD endpoint. Dynamic values can be injected, such as
// "profile_id" (which represents a stable, unique identifier of the browser
// profile on the device, enabling per-profile configuration targeting) or
// "accept_language" (representing the browser's preferred languages).
//
// The fetched configurations are parsed according to the RFC 8801 schema. Only
// proxy configuration-related routing rules and proxies from the PvD's JSON
// payload are applied. If this policy is unset, no Provisioning Domains will be
// queried or used to fetch proxy configurations.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "auth_config": {
//                 "description": "Authentication configuration for the PvD.",
//                 "properties": {
//                     "scope": {
//                         "description": "The OAuth scope or purpose
// identifier. Only relevant when type is profile_bearer_token.",
//                         "type": "string"
//                     },
//                     "type": {
//                         "description": "The type of authentication.\n\n*
// 'none': No authentication is performed.\n\n* 'profile_bearer_token':
// Instructs the browser to fetch an OAuth2 access token for the signed-in
// primary account and attach it in the \"Authorization\" header as a \"Bearer\"
// token.",
//                         "enum": [
//                             "none",
//                             "profile_bearer_token"
//                         ],
//                         "type": "string"
//                     }
//                 },
//                 "type": "object"
//             },
//             "extra_headers": {
//                 "items": {
//                     "description": "Additional HTTP headers to include in the
// fetch request.",
//                     "properties": {
//                         "key": {
//                             "description": "The key of the header.",
//                             "type": "string"
//                         },
//                         "value": {
//                             "description": "The value of the header, which
// can contain placeholders that the browser will expand dynamically:\n\n*
// '${profile_id}': Expands to a stable, unique identifier representing the
// specific browser profile on the device (as generated by the browser's Profile
// ID Service).\n\n* '${accept_language}': Expands to the browser's current
// preferred languages.",
//                             "type": "string"
//                         }
//                     },
//                     "required": [
//                         "key",
//                         "value"
//                     ],
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "pvd_id": {
//                 "description": "The PvD ID of the Provisioning Domain. The
// full URL of the PvD will be https://[PvD-ID]/.well-known/pvd.",
//                 "type": "string"
//             }
//         },
//         "required": [
//             "pvd_id"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, ios, linux, mac, win
message ProxyProvisioningDomainsProto {
  optional PolicyOptions policy_options = 1;
  optional string ProxyProvisioningDomains = 2;
}

// Address or URL of proxy server
//
// This policy is deprecated, please use ProxySettings instead.
//
// Setting the policy lets you specify the URL of the proxy server. This policy
// only takes effect if the ProxySettings policy isn't specified and you
// selected fixed_servers with ProxyMode.
//
// Leave this policy unset if you selected any other mode for setting proxy
// policies.
//
// Note: For detailed examples, visit The Chromium Projects (
// https://www.chromium.org/developers/design-documents/network-settings#TOC-
// Command-line-options-for-proxy-sett ).
//
// Supported on: android, chrome_os, linux, mac, win
message ProxyServerProto {
  optional PolicyOptions policy_options = 1;
  optional string ProxyServer = 2;
}

// Choose how to specify proxy server settings
//
// This policy is deprecated, use ProxyMode instead.
//
// Allows you to specify the proxy server used by Google Chrome and prevents
// users from changing proxy settings.
//
// This policy only takes effect  if the ProxySettings policy has not been
// specified.
//
// If you choose to never use a proxy server and always connect directly, all
// other options are ignored.
//
// If you choose to use system proxy settings or auto detect the proxy server,
// all other options are ignored.
//
// If you choose manual proxy settings, you can specify further options in
// 'Address or URL of proxy server', 'URL to a proxy .pac file' and 'Comma-
// separated list of proxy bypass rules'. Only the HTTP proxy server with the
// highest priority is available for ARC-apps.
//
// For detailed examples, visit:
// https://www.chromium.org/developers/design-documents/network-settings#TOC-
// Command-line-options-for-proxy-sett.
//
// If you enable this setting, Google Chrome ignores all proxy-related options
// specified from the command line.
//
// Leaving this policy not set will allow the users to choose the proxy settings
// on their own.
//
// Valid values:
//   0: Never use a proxy
//   1: Auto detect proxy settings
//   2: Manually specify proxy settings
//   3: Use system proxy settings
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ProxyServerModeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ProxyServerMode = 2;
}

// Proxy settings
//
// Setting the policy configures the proxy settings for Chrome and ARC-apps,
// which ignore all proxy-related options specified from the command line.
//
// Leaving the policy unset lets users choose their proxy settings.
//
// Setting the ProxySettings policy accepts the following fields:
//
// * ProxyMode, which lets you specify the proxy server Chrome uses and prevents
// users from changing proxy settings
//
// * ProxyPacUrl, a URL to a proxy .pac file, or a PAC script encoded as a data
// URL with MIME type application/x-ns-proxy-autoconfig
//
// * ProxyPacMandatory, which prevents the network stack from falling back to
// direct connections with invalid or unavailable PAC script
//
// * ProxyServer, a URL of the proxy server
//
// * ProxyBypassList, a list of hosts for which the proxy will be bypassed
//
// The ProxyServerMode field is deprecated in favor of the ProxyMode field. For
// ProxyMode, if you choose the value:
//
// * direct, a proxy is never used and all other fields are ignored.
//
// * system, the systems's proxy is used and all other fields are ignored.
//
// * auto_detect, all other fields are ignored.
//
// * fixed_servers, the ProxyServer and ProxyBypassList fields are used.
//
// * pac_script, the ProxyPacUrl, ProxyPacMandatory and ProxyBypassList fields
// are used.
//
// Note: For more detailed examples, visit The Chromium Projects (
// https://www.chromium.org/developers/design-documents/network-
// settings/#command-line-options-for-proxy-settings ).
//
// Value schema:
// {
//     "properties": {
//         "ProxyBypassList": {
//             "type": "string"
//         },
//         "ProxyMode": {
//             "enum": [
//                 "direct",
//                 "auto_detect",
//                 "pac_script",
//                 "fixed_servers",
//                 "system"
//             ],
//             "type": "string"
//         },
//         "ProxyPacMandatory": {
//             "type": "boolean"
//         },
//         "ProxyPacUrl": {
//             "type": "string"
//         },
//         "ProxyServer": {
//             "type": "string"
//         },
//         "ProxyServerMode": {
//             "enum": [
//                 0,
//                 1,
//                 2,
//                 3
//             ],
//             "type": "integer"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ProxySettingsProto {
  optional PolicyOptions policy_options = 1;
  optional string ProxySettings = 2;
}

// Enable QR Code Generator
//
// This policy enables the QR Code generator feature in Google Chrome.
//
// If you enable this policy or don't configure it, the QR Code Generator
// feature is enabled.
//
// If you disable this policy, the QR Code Generator feature is disabled.
//
// Valid values:
//   True: The QR Code Generator feature is enabled.
//   False: The QR Code Generator feature is disabled.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message QRCodeGeneratorEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool QRCodeGeneratorEnabled = 2;
}

// Allow QUIC protocol
//
// Setting the policy to Enabled or leaving it unset allows the use of QUIC
// protocol in Google Chrome.
//
// Setting the policy to Disabled disallows the use of QUIC protocol.
//
// Valid values:
//   True: Allow QUIC
//   False: Disallow QUIC
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message QuicAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool QuicAllowed = 2;
}

// Enable Quick Answers Definition
//
// This policy gives Quick Answers permission to access selected content and
// send the info to the server to get definition results.
//
// If the policy is enabled or not set, Quick Answers Definition will be
// enabled.
// If the policy is disabled, Quick Answers Definition will be disabled.
//
// Valid values:
//   True: Enable Quick Answers Definition
//   False: Disable Quick Answers Definition
//
// Supported on: chrome_os
message QuickAnswersDefinitionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool QuickAnswersDefinitionEnabled = 2;
}

// Enable Quick Answers
//
// This policy gives Quick Answers permission to access selected content and
// send the info to the server.
//
// If the policy is enabled, Quick Answers will be enabled.
// If the policy is disabled, Quick Answers will be disabled.
// If the policy is not set, users can decide whether to enable or disable Quick
// Answers.
//
// Valid values:
//   True: Enable Quick Answers
//   False: Disable Quick Answers
//
// Supported on: chrome_os
message QuickAnswersEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool QuickAnswersEnabled = 2;
}

// Enable Quick Answers Translation
//
// This policy gives Quick Answers permission to access selected content and
// send the info to the server to get translation results.
//
// If the policy is enabled or not set, Quick Answers translation will be
// enabled.
// If the policy is disabled, Quick Answers translation will be disabled.
//
// Valid values:
//   True: Enable Quick Answers Translation
//   False: Disable Quick Answers Translation
//
// Supported on: chrome_os
message QuickAnswersTranslationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool QuickAnswersTranslationEnabled = 2;
}

// Enable Quick Answers Unit Conversion
//
// This policy gives Quick Answers permission to access selected content and
// send the info to the server to get unit conversion results.
//
// If the policy is enabled or not set, Quick Answers unit conversion will be
// enabled.
// If the policy is disabled, Quick Answers unit conversion will be disabled.
//
// Valid values:
//   True: Enable Quick Answers Unit Conversion
//   False: Disable Quick Answers Unit Conversion
//
// Supported on: chrome_os
message QuickAnswersUnitConversionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool QuickAnswersUnitConversionEnabled = 2;
}

// Force downloading of Office documents (e.g. .docx) instead of opening them in
// the Basic Editor
//
// When enabled, this policy forces navigations to any Office documents with a
// MIME type normally handled by the Basic Editor to download the file.
//
// If the policy is disabled then these documents will instead be automatically
// opened in the Basic Editor.
//
// Leaving this policy unset for regular users is functionally equivalent to it
// being enabled (i.e. files will be downloaded); leaving the policy unset for
// enterprise users is functionally equivalent to it being disabled (i.e. files
// will be opened in the Basic Editor).
//
// Valid values:
//   True: When navigating to Office documents handled by Basic Editor, force
// them to be downloaded
//   False: When navigating to Office documents handled by Basic Editor, open
// them in Basic Editor
//
// Supported on: chrome_os
message QuickOfficeForceFileDownloadEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool QuickOfficeForceFileDownloadEnabled = 2;
}

// Configure allowed quick unlock modes
//
// Setting the policy controls which quick unlock modes can unlock the lock
// screen.
//
// To allow:
//
// * Every quick unlock mode, use ["all"] (includes modes added in the future).
//
// * Only PIN unlock, use ["PIN"].
//
// * PIN and fingerprint, use ["PIN", "FINGERPRINT"].
//
// If the policy is unset or set to an empty list, no quick unlock modes are
// available for managed devices.
//
// Valid values:
//   all: All
//   PIN: PIN
//   FINGERPRINT: Fingerprint
//
// Supported on: chrome_os
message QuickUnlockModeAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList QuickUnlockModeAllowlist = 2;
}

// Configure allowed quick unlock modes
//
// Setting the policy controls which quick unlock modes can unlock the lock
// screen.
//
// To allow:
//
// * Every quick unlock mode, use ["all"] (includes modes added in the future).
//
// * Only PIN unlock, use ["PIN"].
//
// * PIN and fingerprint, use ["PIN", "FINGERPRINT"].
//
// If the policy is unset or set to an empty list, no quick unlock modes are
// available for managed devices.
//
// This policy is deprecated, please use QuickUnlockModeAllowlist instead
//
// Valid values:
//   all: All
//   PIN: PIN
//   FINGERPRINT: Fingerprint
//
// Supported on:
message QuickUnlockModeWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList QuickUnlockModeWhitelist = 2;
}

// Set how often user has to enter password to use quick unlock
//
// Setting the policy controls how often the lock screen requests the password
// for quick unlock. Each time the lock screen appears, if the last password
// entry occurred before the time window specified by the value chosen, quick
// unlock won't be available. If users stay on the lock screen past this amount
// of time, a password is requested next time they enter the wrong code or re-
// enter the lock screen, whichever comes first.
//
// Leaving the policy unset means users using quick unlock enter their password
// on the lock screen daily.
//
// Valid values:
//   0: Password entry is required every six hours
//   1: Password entry is required every twelve hours
//   2: Password entry is required every two days (48 hours)
//   3: Password entry is required every week (168 hours)
//
// Supported on: chrome_os
message QuickUnlockTimeoutProto {
  optional PolicyOptions policy_options = 1;
  optional int64 QuickUnlockTimeout = 2;
}

// Enable RC4 cipher suites in TLS
//
// This policy was removed in M53 after RC4 was removed from Google Chrome.
//
// If the policy is not set, or is set to false, then RC4 cipher suites in TLS
// will not be enabled. Otherwise it may be set to true to retain compatibility
// with an outdated server. This is a stopgap measure and the server should be
// reconfigured.
//
// Supported on:
message RC4EnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool RC4Enabled = 2;
}

// Check RSA key usage for server certificates issued by local trust anchors
//
// The X.509 key usage extension declares how the key in a certificate may be
// used. Such instructions ensure certificates are not used in an unintended
// context, which protects against a class of cross-protocol attacks on HTTPS
// and
// other protocols. For this to work, HTTPS clients must check that server
// certificates match the connection's TLS parameters.
//
// Starting in Google Chrome 124, this
// check is always enabled.
//
// Google Chrome 123 and earlier have the
// following behavior:
//
// If this policy is set to enabled,
// Google Chrome will perform this check.
// This helps prevent attacks where an attacker manipulates the browser into
// interpreting a key in ways that the certificate owner did not intend.
//
// If this policy is set to disabled,
// Google Chrome will skip this check in
// HTTPS connections that both negotiate TLS 1.2 and use an RSA certificate that
// chains to a local trust anchor. Examples of local trust anchors include
// policy-provided or user-installed root certificates. In all other cases, the
// check is performed independent of this policy's setting.
//
// If the policy is not configured,
// Google Chrome will behave as if the
// policy is enabled.
//
// Connections which fail this check will fail with the error
// ERR_SSL_KEY_USAGE_INCOMPATIBLE. Sites which fail with this error likely have
// a
// misconfigured certificate. Modern ECDHE_RSA cipher suites use the
// "digitalSignature" key usage option, while legacy RSA decryption cipher
// suites
// use the "keyEncipherment" key usage option. If unsure, adminstrators should
// include both in RSA certificates meant for HTTPS.
//
// Valid values:
//   True: Enable RSA key usage checking
//   False: Disable RSA key usage checking
//   None: Use the default setting for RSA key usage checking
//
// Supported on:
message RSAKeyUsageForLocalAnchorsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool RSAKeyUsageForLocalAnchorsEnabled = 2;
}

// Account recovery
//
// Specifies whether the account recovery service is activated for your users on
// Google ChromeOS devices.
//
// When the policy is enabled, the user data recovery is activated. When the
// policy is disabled or not set, the user data recovery is not activated.
// Setting the policy level to recommended lets users change the account
// recovery activation through the settings page. Setting the policy level to
// mandatory means users can't change the account recovery activation.
//
// On the policy value change the update process is completed on the next login
// to Google ChromeOS device, after the new policy value was fetched.
//
// Note: This setting only applies to new accounts that get added on Google
// ChromeOS devices.
//
// Valid values:
//   True: Activate account recovery
//   False: Deactivate account recovery
//
// Supported on: chrome_os
message RecoveryFactorBehaviorProto {
  optional PolicyOptions policy_options = 1;
  optional bool RecoveryFactorBehavior = 2;
}

// Control Accept-Language Reduction
//
// The Accept-Language HTTP request header and the JavaScript
// navigator.languages getter are planned for reduction for privacy reasons.
// To facilitate testing and ensure compatibility, this policy allows you to
// enable or disable the Accept-Language Reduction feature.
//
// If this policy is set to enabled or left unset, Accept-Language Reduction
// will be applied through field trials.
// If this policy is set to disabled, field trials will not be able to activate
// Accept-Language Reduction.
//
// For more information about this feature, please visit:
// https://github.com/explainers-by-googlers/reduce-accept-language.
//
// NOTE: Only newly-started renderer processes will reflect changes to this
// policy while the browser is running.
//
// Valid values:
//   True: Enable Accept-Language Reduction
//   False: Disable Accept-Language Reduction
//
// Supported on: android, chrome_os, linux, mac, win
message ReduceAcceptLanguageEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ReduceAcceptLanguageEnabled = 2;
}

// Register protocol handlers
//
// Setting the policy (as recommended only) lets you register a list of protocol
// handlers, which merge with the ones that the user registers, putting both
// sets in use. Set the property "protocol" to the scheme, such as "mailto", and
// set the property "URL" to the URL pattern of the application that handles the
// scheme specified in the "protocol" field. The pattern can include a "%s"
// placeholder, which the handled URL replaces.
//
// Users can't remove a protocol handler registered by policy. However, by
// installing a new default handler, they can change the protocol handlers
// installed by policy.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "default": {
//                 "description": "A boolean flag indicating if the protocol
// handler should be set as the default.",
//                 "type": "boolean"
//             },
//             "protocol": {
//                 "description": "The protocol for the protocol handler.",
//                 "type": "string"
//             },
//             "url": {
//                 "description": "The URL of the protocol handler.",
//                 "type": "string"
//             }
//         },
//         "required": [
//             "protocol",
//             "url"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
//
// Note: this policy must have a RECOMMENDED PolicyMode set in PolicyOptions.
message RegisteredProtocolHandlersProto {
  optional PolicyOptions policy_options = 1;
  optional string RegisteredProtocolHandlers = 2;
}

// Enable Related Website Sets
//
// This policy allows to control the Related Website Sets feature enablement.
//
// This policy overrides the FirstPartySetsEnabled policy.
//
// When this policy is unset or set to True, the Related Website Sets feature is
// enabled.
//
// When this policy is set to False, the Related Website Sets feature is
// disabled.
//
// This policy is deprecated as of Google Chrome version 144 with the
// deprecation of Related Website Sets.
//
// Valid values:
//   True: Enable Related Website Sets
//   False: Disable Related Website Sets
//
// Supported on:
message RelatedWebsiteSetsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool RelatedWebsiteSetsEnabled = 2;
}

// Override Related Website Sets.
//
// This policy provides a way to override the list of sets the browser uses for
// Related Website Sets features.
//
// This policy overrides the FirstPartySetsOverrides policy.
//
// Each set in the browser's list of Related Website Sets must meet the
// requirements of a Related Website Set.
// A Related Website Set must contain a primary site and one or more member
// sites.
// A set can also contain a list of service sites that it owns, as well as a map
// from a site to all of its ccTLD variants.
// See https://github.com/WICG/first-party-sets for more information on how
// Google Chrome uses Related Website Sets.
//
//
// All sites in a Related Website Set must be a registrable domain served over
// HTTPS. Each site in a Related Website Set must also be unique,
// meaning a site cannot be listed more than once in a Related Website Set.
//
// When this policy is given an empty dictionary, the browser uses the public
// list of Related Website Sets.
//
// For all sites in a Related Website Set from the replacements list, if a site
// is also present
// on a Related Website Set in the browser's list, then that site will be
// removed from the browser's Related Website Set.
// After this, the policy's Related Website Set will be added to the browser's
// list of Related Website Sets.
//
// For all sites in a Related Website Set from the additions list, if a site is
// also present
// on a Related Website Set in the browser's list, then the browser's Related
// Website Set will be updated so that the
// new Related Website Set can be added to the browser's list. After the
// browser's list has been updated,
// the policy's Related Website Set will be added to the browser's list of
// Related Website Sets.
//
// The browser's list of Related Website Sets requires that for all sites in its
// list, no site is in
// more than one set. This is also required for both the replacements list
// and the additions list. Similarly, a site cannot be in both the
// replacements list and the additions list.
//
// Wildcards (*) are not supported as a policy value, nor within any Related
// Website Set in these lists.
//
// All sets provided by the policy must be valid Related Website Sets, if they
// aren't then an
// appropriate error will be outputted.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// This policy is deprecated as of Google Chrome version 144 with the
// deprecation of Related Website Sets.
//
// Value schema:
// {
//     "properties": {
//         "additions": {
//             "items": {
//                 "properties": {
//                     "associatedSites": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "ccTLDs": {
//                         "additionalProperties": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "type": "object"
//                     },
//                     "primary": {
//                         "type": "string"
//                     },
//                     "serviceSites": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "required": [
//                     "primary",
//                     "associatedSites"
//                 ],
//                 "type": "object"
//             },
//             "type": "array"
//         },
//         "replacements": {
//             "items": {
//                 "properties": {
//                     "associatedSites": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     },
//                     "ccTLDs": {
//                         "additionalProperties": {
//                             "items": {
//                                 "type": "string"
//                             },
//                             "type": "array"
//                         },
//                         "type": "object"
//                     },
//                     "primary": {
//                         "type": "string"
//                     },
//                     "serviceSites": {
//                         "items": {
//                             "type": "string"
//                         },
//                         "type": "array"
//                     }
//                 },
//                 "required": [
//                     "primary",
//                     "associatedSites"
//                 ],
//                 "type": "object"
//             },
//             "type": "array"
//         }
//     },
//     "type": "object"
// }
//
// Supported on:
message RelatedWebsiteSetsOverridesProto {
  optional PolicyOptions policy_options = 1;
  optional string RelatedWebsiteSetsOverrides = 2;
}

// Relaunch fast if outdated
//
// Specifies the minimum release age beyond which relaunch notifications are
// more aggressive. The age is calculated from the time the currently-running
// version was last served to clients.
//
// If a browser relaunch or device restart is needed to finalize a pending
// update and the current version has been outdated for more than the number of
// days specified by this setting, the RelaunchNotificationPeriod policy is
// overridden to 2 hours. If the RelaunchNotification policy is set to 1
// ('Required'), users will be forced to relaunch or restart at the end of the
// period.
//
// If not set, or if the release age cannot be determined, the
// RelaunchNotificationPeriod policy will be used for all updates.
//
// Supported on: chrome_os, linux, mac, win
message RelaunchFastIfOutdatedProto {
  optional PolicyOptions policy_options = 1;
  optional int64 RelaunchFastIfOutdated = 2;
}

// Set the time of the first user relaunch notification
//
// Allows you to set the time period, in milliseconds, between the first
// notification that a Google ChromeOS device must be restarted to apply a
// pending update and the end of the time period specified by the
// RelaunchNotificationPeriod policy.
//
// If not set, the default period of 259200000 milliseconds (three days) is used
// for Google ChromeOS devices.
//
// For rollback and other Google ChromeOS updates that will powerwash the
// device, the user is always notified immediately when the update is available,
// independently of the value of this policy.
//
// Supported on: chrome_os
message RelaunchHeadsUpPeriodProto {
  optional PolicyOptions policy_options = 1;
  optional int64 RelaunchHeadsUpPeriod = 2;
}

// Notify a user that a browser relaunch or device restart is recommended or
// required
//
// Notify users that Google Chrome must be relaunched or Google ChromeOS must be
// restarted to apply a pending update.
//
// This policy setting enables notifications to inform the user that a browser
// relaunch or device restart is recommended or required. If not set, Google
// Chrome indicates to the user that a relaunch is needed via subtle changes to
// its menu, while Google ChromeOS indicates such via a notification in the
// system tray. If set to 'Recommended', a recurring warning will be shown to
// the user that a relaunch is recommended. The user can dismiss this warning to
// defer the relaunch. If set to 'Required', a recurring warning will be shown
// to the user indicating that a browser relaunch will be forced once the
// notification period passes. The default period is seven days for Google
// Chrome and four days for Google ChromeOS, and may be configured via the
// RelaunchNotificationPeriod policy setting.
//
// The user's session is restored following the relaunch/restart.
//
// Valid values:
//   1: Show a recurring prompt to the user indicating that a relaunch is
// recommended
//   2: Show a recurring prompt to the user indicating that a relaunch is
// required
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RelaunchNotificationProto {
  optional PolicyOptions policy_options = 1;
  optional int64 RelaunchNotification = 2;
}

// Set the time period for update notifications
//
// Allows you to set the time period, in milliseconds, over which users are
// notified that Google Chrome must be relaunched or that a Google ChromeOS
// device must be restarted to apply a pending update.
//
// Over this time period, the user will be repeatedly informed of the need for
// an update. For Google ChromeOS devices, a restart notification appears in the
// system tray according to the RelaunchHeadsUpPeriod policy. For Google Chrome
// browsers, the app menu changes to indicate that a relaunch is needed once one
// third of the notification period passes. This notification changes color once
// two thirds of the notification period passes, and again once the full
// notification period has passed. The additional notifications enabled by the
// RelaunchNotification policy follow this same schedule.
//
// If not set, the default period of 604800000 milliseconds (one week) is used.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RelaunchNotificationPeriodProto {
  optional PolicyOptions policy_options = 1;
  optional int64 RelaunchNotificationPeriod = 2;
}

// Set the time interval for relaunch
//
// Specify a target time window for the end of the relaunch notification period.
//
// Users are notified of the need for a browser relaunch or device restart based
// on the RelaunchNotification and RelaunchNotificationPeriod policy settings.
// Browsers and devices are forcibly restarted at the end of the notification
// period when the RelaunchNotification policy is set to 'Required'. This
// RelaunchWindow policy can be used to defer the end of the notification period
// so that it falls within a specific time window.
//
// If this policy is not set, the default target time window for Google ChromeOS
// is between 2 AM and 4 AM. The default target time window for Google Chrome is
// the whole day (i.e., the end of the notification period is never deferred).
//
// Note: Though the policy can accept multiple items in entries, all but the
// first item are ignored.
// Warning: Setting this policy may delay application of software updates.
//
// Value schema:
// {
//     "properties": {
//         "entries": {
//             "items": {
//                 "properties": {
//                     "duration_mins": {
//                         "description": "Time period (minutes) that specifies
// the length of the relaunch window.",
//                         "maximum": 1440,
//                         "minimum": 1,
//                         "type": "integer"
//                     },
//                     "start": {
//                         "description": "Time interpreted in local wall-clock
// 24h format.",
//                         "properties": {
//                             "hour": {
//                                 "maximum": 23,
//                                 "minimum": 0,
//                                 "type": "integer"
//                             },
//                             "minute": {
//                                 "maximum": 59,
//                                 "minimum": 0,
//                                 "type": "integer"
//                             }
//                         },
//                         "required": [
//                             "hour",
//                             "minute"
//                         ],
//                         "type": "object"
//                     }
//                 },
//                 "required": [
//                     "start",
//                     "duration_mins"
//                 ],
//                 "type": "object"
//             },
//             "type": "array"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RelaunchWindowProto {
  optional PolicyOptions policy_options = 1;
  optional string RelaunchWindow = 2;
}

// Enable firewall traversal from remote access client
//
// This policy is no longer supported.
// Enables usage of STUN and relay servers when connecting to a remote client.
//
// If this setting is enabled, then this machine can discover and connect to
// remote host machines even if they are separated by a firewall.
//
// If this setting is disabled and outgoing UDP connections are filtered by the
// firewall, then this machine can only connect to host machines within the
// local network.
//
// Supported on:
message RemoteAccessClientFirewallTraversalProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessClientFirewallTraversal = 2;
}

// Enable or disable PIN-less authentication for remote access hosts
//
// Setting the policy to Enabled or leaving it unset lets users pair clients and
// hosts at connection time, eliminating the need to enter a PIN every time.
//
// Setting the policy to Disabled makes this feature unavailable.
//
// Valid values:
//   True: Enable PIN-less authentication for the remote access host
//   False: Disable PIN-less authentication for the remote access host
//
// Supported on: fuchsia, linux, mac, win
message RemoteAccessHostAllowClientPairingProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowClientPairing = 2;
}

// Enable file transfer capability in enterprise remote support sessions
//
// If this policy is enabled, admin-initiated enterprise remote support sessions
// will allow the transfer of files between the client and the host.
//
// This policy does not affect remote access scenarios.
//
// Leaving this policy unset or setting to Disabled disallows file transfer.
//
// Valid values:
//   True: Enable file transfer in remote support connections from enterprise
// admins
//   False: Disable file transfer in remote support connections from enterprise
// admins
//
// Supported on: chrome_os
message RemoteAccessHostAllowEnterpriseFileTransferProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowEnterpriseFileTransfer = 2;
}

// Allow enterprise remote support connections to this machine
//
// If this policy is disabled, remote support sessions cannot be started using
// the admin console.
//
// This policy does not affect remote access scenarios.
//
// This policy prevents enterprise admins from connecting to managed Google
// ChromeOS devices.
//
// This policy has no effect if enabled, left empty, or is not set.
//
// Valid values:
//   True: Allow remote support connections from enterprise admins to this
// machine
//   False: Prevent remote support connections from enterprise admins to this
// machine
//
// Supported on: chrome_os
message RemoteAccessHostAllowEnterpriseRemoteSupportConnectionsProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowEnterpriseRemoteSupportConnections = 2;
}

// Allow remote access users to transfer files to/from the host
//
// Setting the policy to Enabled or leaving it unset allows users connected to a
// remote access host to transfer files between the client and the host. This
// doesn't apply to remote assistance connections, which don't support file
// transfer.
//
// Setting the policy to Disabled disallows file transfer.
//
// Valid values:
//   True: Enable remote access users to transfer files to and from the remote
// host
//   False: Disable remote access users from transferring files to and from the
// remote host
//
// Supported on: fuchsia, linux, mac, win
message RemoteAccessHostAllowFileTransferProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowFileTransfer = 2;
}

// Allow gnubby authentication for remote access hosts
//
// Setting the policy to Enabled means gnubby authentication requests will be
// proxied across a remote host connection.
//
// Setting the policy to Disabled or leaving it unset means gnubby
// authentication requests won't be proxied.
//
// Note that this feature requires additional components which are not available
// outside of the Google network environment in order to work properly.
//
// Valid values:
//   True: Enable gnubby authentication for the remote access host
//   False: Disable gnubby authentication for the remote access host
//
// Supported on: fuchsia, linux, mac, win
message RemoteAccessHostAllowGnubbyAuthProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowGnubbyAuth = 2;
}

// Allow PIN and pairing authentication methods for remote access hosts
//
// Setting the policy to Enabled allows the remote access host to use PIN and
// pairing authentications when accepting client connections.
//
// Setting the policy to Disabled disallows PIN or pairing authentications.
//
// Leaving it unset lets the host decide whether PIN and/or pairing
// authentications can be used.
//
// Note: If the setting results in no mutually supported authentication methods
// by both the host and the client, then the connection will be rejected.
//
// Valid values:
//   True: Allows the remote access host to use PIN and pairing authentications
// when accepting client connections
//   False: Disallows the remote access host to use PIN and pairing
// authentications when accepting client connections
//   None: Allows the remote access host to decide
//
// Supported on: linux, mac, win
message RemoteAccessHostAllowPinAuthenticationProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowPinAuthentication = 2;
}

// Enable the use of relay servers by the remote access host
//
// If RemoteAccessHostFirewallTraversal is set to Enabled, setting
// RemoteAccessHostAllowRelayedConnection to Enabled or leaving it unset allows
// the use of remote clients to use relay servers to connect to this machine
// when a direct connection is not available, for example, because of firewall
// restrictions.
//
// Setting the policy to Disabled doesn't turn remote access off, but only
// allows connections from the same network (not NAT traversal or relay).
//
// Valid values:
//   True: Enable the use of relay servers by the remote access host
//   False: Disable the use of relay servers by the remote access host
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RemoteAccessHostAllowRelayedConnectionProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowRelayedConnection = 2;
}

// Allow remote access connections to this machine
//
// If this policy is Disabled, the remote access host service cannot be started
// or configured to accept incoming connections.  This policy does not affect
// remote support scenarios.
//
// This policy has no effect if it is set to Enabled, left empty, or is not set.
//
// Valid values:
//   True: Allow remote access connections to this machine
//   False: Prevent remote access connections to this machine
//
// Supported on: fuchsia, linux, mac, win
message RemoteAccessHostAllowRemoteAccessConnectionsProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowRemoteAccessConnections = 2;
}

// Allow remote support connections to this machine
//
// If this policy is disabled, the remote support host cannot be started or
// configured to accept incoming connections.
//
// This policy does not affect remote access scenarios.
//
// This policy does not prevent enterprise admins from connecting to managed
// Google ChromeOS devices.
//
// This policy has no effect if enabled, left empty, or is not set.
//
// Valid values:
//   True: Allow remote support connections to this machine
//   False: Prevent remote support connections to this machine
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RemoteAccessHostAllowRemoteSupportConnectionsProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowRemoteSupportConnections = 2;
}

// Allow remote users to interact with elevated windows in remote assistance
// sessions
//
// Setting the policy to Enabled means the remote assistance host runs in a
// process with uiAccess permissions. This lets remote users interact with
// elevated windows on the local user's desktop.
//
// Setting the policy to Disabled or leaving it unset means the remote
// assistance host runs in the user's context, and remote users can't interact
// with elevated windows on the desktop.
//
// Valid values:
//   True: Enable remote user interaction with elevated windows in remote
// assistance sessions
//   False: Disable remote user interaction with elevated windows in remote
// assistance sessions
//
// Supported on: win
message RemoteAccessHostAllowUiAccessForRemoteAssistanceProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowUiAccessForRemoteAssistance = 2;
}

// Allow remote access users to open host-side URLs in their local client
// browser
//
// Setting the policy to Enabled or leaving it unset may allow users connected
// to a remote access host to open host-side URLs in their local client browser.
//
// Setting the policy to Disabled will prevent the remote access host from
// sending URLs to the client.
//
// This setting doesn't apply to remote assistance connections as the feature is
// not supported for that connection mode.
//
// Note: This feature is not yet generally available so enabling it does not
// mean that the feature will be visible in the client UI.
//
// Valid values:
//   True: Enable remote access users to open host-side URLs in their local
// client browser
//   False: Disable remote access users from opening host-side URLs in their
// local client browser
//
// Supported on: linux, mac, win
message RemoteAccessHostAllowUrlForwardingProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostAllowUrlForwarding = 2;
}

// Configure the required domain name for remote access clients
//
// This policy is deprecated. Please use RemoteAccessHostClientDomainList
// instead.
//
// Supported on: chrome_os, linux, mac, win
message RemoteAccessHostClientDomainProto {
  optional PolicyOptions policy_options = 1;
  optional string RemoteAccessHostClientDomain = 2;
}

// Configure the required domain names for remote access clients
//
// Setting the policy specifies the client domain names that are imposed on
// remote access clients, and users can't change them. Only clients from one of
// the specified domains can connect to the host.
//
// Setting the policy to an empty list or leaving it unset applies the default
// policy for the connection type. For remote assistance, this allows clients
// from any domain to connect to the host. For anytime remote access, only the
// host owner can connect.
//
// See also RemoteAccessHostDomainList.
//
// Note: This setting overrides RemoteAccessHostClientDomain, if present.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RemoteAccessHostClientDomainListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList RemoteAccessHostClientDomainList = 2;
}

// The maximum size, in bytes, that can be transferred between client and host
// via clipboard synchronization
//
// If this policy is set, clipboard data sent to and from the host will be
// truncated to the limit set by this policy.
//
// If a value of 0 is set, then clipboard sync is disabled.
//
// This policy affects both remote access and remote support scenarios.
//
// This policy has no effect if it is not set.
//
// Setting the policy to a value that is not within the min/max range may
// prevent the host from starting.
//
// Please note that the actual upper bound for the clipboard size is based on
// the maximum WebRTC data channel message size which this policy does not
// control.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RemoteAccessHostClipboardSizeBytesProto {
  optional PolicyOptions policy_options = 1;
  optional int64 RemoteAccessHostClipboardSizeBytes = 2;
}

// Policy overrides for Debug builds of the remote access host
//
// Overrides policies on Debug builds of the remote access host.
//
// The value is parsed as a JSON dictionary of policy name to policy value
// mappings.
//
// Supported on:
message RemoteAccessHostDebugOverridePoliciesProto {
  optional PolicyOptions policy_options = 1;
  optional string RemoteAccessHostDebugOverridePolicies = 2;
}

// Configure the required domain name for remote access hosts
//
// This policy is deprecated. Please use RemoteAccessHostDomainList instead.
//
// Supported on: chrome_os, linux, mac, win
message RemoteAccessHostDomainProto {
  optional PolicyOptions policy_options = 1;
  optional string RemoteAccessHostDomain = 2;
}

// Configure the required domain names for remote access hosts
//
// Setting the policy specifies the host domain names that are imposed on remote
// access hosts, and users can't change them. Hosts can be shared only using
// accounts registered on one of the specified domain names.
//
// Setting the policy to an empty list or leaving it unset means hosts can be
// shared using any account.
//
// See also RemoteAccessHostClientDomainList.
//
// Note: This setting will override RemoteAccessHostDomain, if present.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RemoteAccessHostDomainListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList RemoteAccessHostDomainList = 2;
}

// Enable connection-related UI on the host desktop when a connection is active
//
// If this policy is disabled, connection related UI (e.g. the disconnect
// window) will not be shown for non-curtained remote access connections.
// Curtained remote access sessions and remote support sessions are not affected
// by this policy.
//
// This policy has no effect if it is set to true, left empty, or is not set.
//
// Valid values:
//   True: Enable connection-related UI on the remote host desktop when a
// connection is active
//   False: Disable connection-related UI on the remote host desktop when a
// connection is active
//
// Supported on: fuchsia, linux, mac, win
message RemoteAccessHostEnableUserInterfaceProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostEnableUserInterface = 2;
}

// Enable firewall traversal from remote access host
//
// Setting the policy to Enabled or leaving it unset allows the usage of STUN
// servers, letting remote clients discover and connect to this machine, even if
// separated by a firewall.
//
// Setting the policy to Disabled when outgoing UDP connections are filtered by
// the firewall means the machine only allows connections from client machines
// within the local network.
//
// Valid values:
//   True: Enable firewall traversal from remote access host
//   False: Disable firewall traversal from remote access host
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RemoteAccessHostFirewallTraversalProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostFirewallTraversal = 2;
}

// Require that the name of the local user and the remote access host owner
// match
//
// Setting the policy to Enabled has the remote access host compare the name of
// the local user the host is associated with and the name of the Google Account
// registered as the host owner ("johndoe," if the host is owned by
// "johndoe@example.com"). This host won't start if the host owner's name
// differs from the name of the local user that the host is associated with. To
// enforce that the owner's Google Account is associated with a specific domain,
// use the policy with RemoteAccessHostDomain.
//
// Setting the policy to Disabled or leaving it unset means the remote access
// host can be associated with any local user.
//
// Valid values:
//   True: Require matching local user and remote access host owner
//   False: Do not require matching local user and remote access host owner
//
// Supported on: linux, mac
message RemoteAccessHostMatchUsernameProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostMatchUsername = 2;
}

// Maximum session duration allowed for remote access connections
//
// If this policy is set, remote access connections will automatically
// disconnect after the number of minutes defined in the policy have elapsed.
// This does not prevent the client from reconnecting after the maximum session
// duration has been reached. Setting the policy to a value that is not within
// the min/max range may prevent the host from starting. This policy does not
// affect remote support scenarios.
//
// This policy has no effect if it is not set. In this case, remote access
// connections will have no maximum duration on this machine.
//
// Supported on: fuchsia, linux, mac, win
message RemoteAccessHostMaximumSessionDurationMinutesProto {
  optional PolicyOptions policy_options = 1;
  optional int64 RemoteAccessHostMaximumSessionDurationMinutes = 2;
}

// Enable curtaining of remote access hosts
//
// Setting the policy to Enabled turns off remote access hosts' physical input
// and output devices during a remote connection.
//
// Setting the policy to Disabled or leaving it unset lets both local and remote
// users interact with the host while it's shared.
//
// Valid values:
//   True: Enable curtaining of the remote access host
//   False: Disable curtaining of the remote access host
//
// Supported on: fuchsia, linux, mac, win
message RemoteAccessHostRequireCurtainProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostRequireCurtain = 2;
}

// Enable two-factor authentication for remote access hosts
//
// Enables two-factor authentication for remote access hosts instead of a user-
// specified PIN.
//
// If this setting is enabled, then users must provide a valid two-factor code
// when accessing a host.
//
// If this setting is disabled or not set, then two-factor will not be enabled
// and the default behavior of having a user-defined PIN will be used.
//
// Supported on:
message RemoteAccessHostRequireTwoFactorProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteAccessHostRequireTwoFactor = 2;
}

// Configure the TalkGadget prefix for remote access hosts
//
// Configures the TalkGadget prefix that will be used by remote access hosts and
// prevents users from changing it.
//
// If specified, this prefix is prepended to the base TalkGadget name to create
// a full domain name for the TalkGadget. The base TalkGadget domain name is
// '.talkgadget.google.com'.
//
// If this setting is enabled, then hosts will use the custom domain name when
// accessing the TalkGadget instead of the default domain name.
//
// If this setting is disabled or not set, then the default TalkGadget domain
// name ('chromoting-host.talkgadget.google.com') will be used for all hosts.
//
// Remote access clients are not affected by this policy setting. They will
// always use 'chromoting-client.talkgadget.google.com' to access the
// TalkGadget.
//
// Supported on:
message RemoteAccessHostTalkGadgetPrefixProto {
  optional PolicyOptions policy_options = 1;
  optional string RemoteAccessHostTalkGadgetPrefix = 2;
}

// URL where remote access clients should obtain their authentication token
//
// Setting the policy means the remote access host requires authenticating
// clients to get an authentication token from this URL to connect.
//
// This feature is disabled if empty or not set.
//
// Note: This policy must be used with RemoteAccessHostTokenValidationUrl.
//
// Supported on: fuchsia
message RemoteAccessHostTokenUrlProto {
  optional PolicyOptions policy_options = 1;
  optional string RemoteAccessHostTokenUrl = 2;
}

// Client certificate for connecting to RemoteAccessHostTokenValidationUrl
//
// Setting the policy means the remote access host uses a client certificate
// with the given issuer CN to authenticate to
// RemoteAccessHostTokenValidationUrl. To use any available client certificate,
// set it to *. This feature is disabled if empty or not set.
//
// Supported on: fuchsia
message RemoteAccessHostTokenValidationCertificateIssuerProto {
  optional PolicyOptions policy_options = 1;
  optional string RemoteAccessHostTokenValidationCertificateIssuer = 2;
}

// URL for validating remote access client authentication token
//
// Setting the policy means the remote access host uses this URL to validate
// authentication tokens from remote access clients to accept connections. This
// feature is disabled if empty or not set.
//
// Note: Use the policy with RemoteAccessHostTokenUrl.
//
// Supported on: fuchsia
message RemoteAccessHostTokenValidationUrlProto {
  optional PolicyOptions policy_options = 1;
  optional string RemoteAccessHostTokenValidationUrl = 2;
}

// Restrict the UDP port range used by the remote access host
//
// Setting the policy restricts the UDP port range used by the remote access
// host in this machine.
//
// Leaving the policy unset or set to an empty string means the remote access
// host can use any available port.
//
// Note: If RemoteAccessHostFirewallTraversal is Disabled, the remote access
// host will use UDP ports in the 12400-12409 range.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RemoteAccessHostUdpPortRangeProto {
  optional PolicyOptions policy_options = 1;
  optional string RemoteAccessHostUdpPortRange = 2;
}

// Allow remote debugging
//
// Controls whether users may use remote debugging.
//
// If this policy is set to Enabled or not set, users may use remote debugging
// by specifying --remote-debugging-port and --remote-debugging-pipe command
// line switches.
//
// If this policy is set to Disabled, users are not allowed to use remote
// debugging.
//
// Valid values:
//   True: Allow use of the remote debugging
//   False: Do not allow use of the remote debugging
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RemoteDebuggingAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool RemoteDebuggingAllowed = 2;
}

// Enable Renderer App Container
//
// Setting the policy to Enabled or leaving it unset means Renderer App
// Container configuration will be enabled on supported platforms.
//
// Setting the policy to Disabled has a detrimental effect on the security and
// stability of Google Chrome as it will weaken the sandbox that renderer
// processes use. Only turn off the policy if there are compatibility issues
// with third-party software that must run inside renderer processes.
//
// Note: Read more about Process mitigation policies ( https://chromium.googleso
// urce.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-
// policies ).
//
// Valid values:
//   True: Enable the Renderer App Container sandbox
//   False: Disable the Renderer App Container sandbox
//
// Supported on: win
message RendererAppContainerEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool RendererAppContainerEnabled = 2;
}

// Enable Renderer Code Integrity
//
// Setting the policy to Enabled or leaving it unset turns Renderer Code
// Integrity on.
//
// Setting the policy to Disabled has a detrimental effect on Google Chrome's
// security and stability as unknown and potentially hostile code can load
// inside Google Chrome's renderer processes. Only turn off the policy if there
// are compatibility issues with third-party software that must run inside
// Google Chrome's renderer processes.
//
// This policy was removed in Chrome 118 and is ignored if set.
//
// Note: Read more about Process mitigation policies ( https://chromium.googleso
// urce.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-
// policies ).
//
// Valid values:
//   True: Enable Renderer Code Integrity
//   False: Disable Renderer Code Integrity
//
// Supported on:
message RendererCodeIntegrityEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool RendererCodeIntegrityEnabled = 2;
}

// App inventory reporting
//
// Reports app inventory data for affiliated users.
//
// Setting the policy controls app install, launch and uninstall event reporting
// for specified app types.
// If unset, no app events will be reported.
//
// Valid values:
//   chrome_apps_and_extensions: Chrome apps and extensions
//   progressive_web_apps: Progressive Web Apps
//   android_apps: Android applications
//   linux_apps: Linux applications
//   system_apps: System applications
//   games: Games
//   browser: Browser
//
// Supported on: chrome_os
message ReportAppInventoryProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ReportAppInventory = 2;
}

// App usage reporting
//
// Reports app usage telemetry data for affiliated users.
//
// Setting the policy controls app usage telemetry reporting for specified app
// types.
// If unset, no app usage telemetry will be reported.
//
// Valid values:
//   chrome_apps_and_extensions: Chrome apps and extensions
//   progressive_web_apps: Progressive Web Apps
//   android_apps: Android applications
//   linux_apps: Linux applications
//   system_apps: System applications
//   games: Games
//   browser: Browser
//
// Supported on: chrome_os
message ReportAppUsageProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ReportAppUsage = 2;
}

// App usage telemetry collection rate in milliseconds.
//
// Rate at which app usage telemetry is collected on enrolled devices for
// affiliated users. The minimum allowed is 5 minutes.
//
// If not set, the default rate of 15 minutes applies.
//
// Supported on: chrome_os
message ReportAppUsageCollectionRateMsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ReportAppUsageCollectionRateMs = 2;
}

// Report information about status of Android
//
// If Android apps are on, then setting the policy to True has enrolled devices
// report Android status information.
//
// Setting the policy to Disabled or leaving it unset means enrolled devices
// don't report Android status information
//
// Valid values:
//   True: Enable Android reporting
//   False: Disable Android reporting
//
// Supported on: chrome_os
message ReportArcStatusEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ReportArcStatusEnabled = 2;
}

// Report information about usage of Linux apps
//
// If Linux app support is on, setting the policy to Enabled sends information
// about Linux apps usage back to the server.
//
// Setting the policy to Disabled or leaving it unset means no usage information
// is reported.
//
// Valid values:
//   True: Enable Linux apps usage reporting
//   False: Disable Linux apps usage reporting
//
// Supported on: chrome_os
message ReportCrostiniUsageEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ReportCrostiniUsageEnabled = 2;
}

// Report Extensions and Plugins information
//
// This policy controls whether to report extensions and plugins information.
//
// When the policy CloudReportingEnabled is left unset or set to disabled, this
// policy will be ignored.
//
// When this policy is left unset or set to True, extension and plugins data are
// gathered.
// When this policy is set to False, extensions and plugins data are not
// gathered.
//
// This policy is only effective when the machine is enrolled with
// CloudManagementEnrollmentToken for Google Chrome.
// This policy is always effective for Google ChromeOS.
//
// Valid values:
//   True: Enable reporting of extension and plugin information
//   False: Disable reporting of extension and plugin information
//
// Supported on: linux, mac, win
message ReportExtensionsAndPluginsDataProto {
  optional PolicyOptions policy_options = 1;
  optional bool ReportExtensionsAndPluginsData = 2;
}

// Report Machine Identification information
//
// This policy controls whether to report information that can be used to
// identify machines, such as machine name and network addresses.
//
// When the policy CloudReportingEnabled is left unset or set to disabled, this
// policy will be ignored.
//
// When this policy is left unset or set to True, information that can be used
// to identify machines is gathered.
// When this policy is set to False, information that can be used to identify
// machines is not gathered.
//
// This policy is only effective when the machine is enrolled with
// CloudManagementEnrollmentToken for Google Chrome.
//
// Valid values:
//   True: Enable reporting of machine identification information
//   False: Disable reporting of machine identification information
//
// Supported on: linux, mac, win
message ReportMachineIDDataProto {
  optional PolicyOptions policy_options = 1;
  optional bool ReportMachineIDData = 2;
}

// Report Google Chrome Policy Information
//
// This policy controls whether to report policy data and time of policy fetch.
//
// When the policy CloudReportingEnabled is left unset or set to disabled, this
// policy will be ignored.
//
// When this policy is left unset or set to True, policy data and time of policy
// fetch are gathered.
// When this policy is set to False, policy data and time of policy fetch are
// not gathered.
//
// This policy is only effective when the machine is enrolled with
// CloudManagementEnrollmentToken for Google Chrome.
// This policy is always effective for Google ChromeOS.
//
// Valid values:
//   True: Enable reporting of policy data
//   False: Disable reporting of policy data
//
// Supported on: linux, mac, win
message ReportPolicyDataProto {
  optional PolicyOptions policy_options = 1;
  optional bool ReportPolicyData = 2;
}

// Report Safe Browsing information
//
// This policy controls whether to report Safe Browsing information including
// the number of Safe Browsing warning and the number of safe browsering warning
// click through.
//
// When the policy CloudReportingEnabled is left unset or set to disabled, this
// policy will be ignored.
//
// When this policy is left unset or set to True, Safe Browsing data are
// gathered.
// When this policy is set to False, Safe Browsing data are not gathered.
//
// This policy is only effective when the machine is enrolled with
// CloudManagementEnrollmentToken for Google Chrome.
// This policy is always effective for Google ChromeOS.
//
// Supported on:
message ReportSafeBrowsingDataProto {
  optional PolicyOptions policy_options = 1;
  optional bool ReportSafeBrowsingData = 2;
}

// Report User Identification information
//
// This policy controls whether to report information that can be used to
// identify users, such as OS login, Google Chrome Profile login, Google Chrome
// Profile name, Google Chrome Profile path and Google Chrome executable path.
//
// When the policy CloudReportingEnabled is left unset or set to disabled, this
// policy will be ignored.
//
// When this policy is left unset or set to True, information that can be used
// to identify users is gathered.
// When this policy is set to False, information that can be used to identify
// users is not gathered.
//
// This policy is only effective when the machine is enrolled with
// CloudManagementEnrollmentToken for Google Chrome.
// This policy is always effective for Google ChromeOS.
//
// Valid values:
//   True: Enable reporting of user identification information
//   False: Disable reporting of user identification information
//
// Supported on: linux, mac, win
message ReportUserIDDataProto {
  optional PolicyOptions policy_options = 1;
  optional bool ReportUserIDData = 2;
}

// Report OS and Google Chrome Version Information
//
// This policy controls whether to report version information, such as OS
// version, OS platform, OS architecture, Google Chrome version and Google
// Chrome channel.
//
// When the policy CloudReportingEnabled is left unset or set to disabled, this
// policy will be ignored.
//
// When this policy is left unset or set to True, version information is
// gathered.
// When this policy is set to False, version information is not gathered.
//
// This policy is only effective when the machine is enrolled with
// CloudManagementEnrollmentToken for Google Chrome.
// This policy is always effective for Google ChromeOS.
//
// Valid values:
//   True: Enable reporting of version information
//   False: Disable reporting of version information
//
// Supported on: linux, mac, win
message ReportVersionDataProto {
  optional PolicyOptions policy_options = 1;
  optional bool ReportVersionData = 2;
}

// Website activity reporting allowlist
//
// Allowlist that controls website activity reporting for affiliated users.
//
// Setting the policy controls website URL opened and closed event reporting for
// allowlisted URLs.
// If unset, no website events will be reported.
// For detailed information on valid URL patterns, see
// https://chromeenterprise.google/policies/url-patterns/. Only HTTP and HTTPS
// URL schemes are allowed for this policy.
//
// Supported on: chrome_os
message ReportWebsiteActivityAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ReportWebsiteActivityAllowlist = 2;
}

// Website telemetry reporting
//
// Reports website telemetry data for allowed URLs specified by the
// ReportWebsiteTelemetryAllowlist policy for affiliated users.
//
// Setting the policy controls website telemetry reporting for specified
// telemetry data types.
// If unset, no website telemetry data will be reported.
//
// Valid values:
//   usage: Usage
//
// Supported on: chrome_os
message ReportWebsiteTelemetryProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ReportWebsiteTelemetry = 2;
}

// Website telemetry reporting allowlist
//
// Allowlist that controls website telemetry reporting for affiliated users.
// Telemetry data types being reported are controlled by the
// ReportWebsiteTelemetry policy.
//
// Setting the policy controls website telemetry reporting for allowlisted URLs.
// If unset, no website telemetry will be reported.
// For detailed information on valid URL patterns, see
// https://chromeenterprise.google/policies/url-patterns/. Only HTTP and HTTPS
// URL schemes are allowed for this policy.
//
// Supported on: chrome_os
message ReportWebsiteTelemetryAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ReportWebsiteTelemetryAllowlist = 2;
}

// Website telemetry collection rate in milliseconds.
//
// Rate at which website telemetry data is collected on enrolled devices for
// affiliated users. The minimum allowed is 5 minutes.
//
// If not set, the default rate of 15 minutes applies.
//
// Supported on: chrome_os
message ReportWebsiteTelemetryCollectionRateMsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ReportWebsiteTelemetryCollectionRateMs = 2;
}

// Require online OCSP/CRL checks for local trust anchors
//
// Setting the policy to True means Google Chrome always performs revocation
// checking for successfully validated server certificates signed by locally
// installed CA certificates. If Google Chrome can't get revocation status
// information, Google Chrome treats these certificates as revoked (hard-fail).
//
// Setting the policy to False or leaving it unset means Google Chrome uses
// existing online revocation-checking settings.
//
// On macOS, this policy has no effect if the ChromeRootStoreEnabled policy is
// set to False.
//
// Valid values:
//   True: Perform revocation checks for successfully validated server
// certificates signed by locally installed CA certificates
//   False: Use existing online revocation-checking settings
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RequireOnlineRevocationChecksForLocalAnchorsProto {
  optional PolicyOptions policy_options = 1;
  optional bool RequireOnlineRevocationChecksForLocalAnchors = 2;
}

// Required Client Certificates
//
// Specifies client certificates that should be enrolled using the device
// management
// protocol.
//
// The EC key algorithm option is supported since Google ChromeOS version 132.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "cert_profile_id": {
//                 "description": "The identifier for this client certificate.",
//                 "type": "string"
//             },
//             "enable_remote_attestation_check": {
//                 "description": "Enable an additional security check based on
// remote attestation (optional, default: True).",
//                 "type": "boolean"
//             },
//             "key_algorithm": {
//                 "description": "The algorithm for key pair generation. The EC
// option is supported since version 132.",
//                 "enum": [
//                     "rsa",
//                     "ec"
//                 ],
//                 "type": "string"
//             },
//             "name": {
//                 "description": "The name of the certificate profile.",
//                 "type": "string"
//             },
//             "policy_version": {
//                 "description": "The client should not interpret this data and
// should forward it verbatim. The DMServer uses policy_version to verify that
// the policy view of DMServer matches the view of ChromeOS device.",
//                 "type": "string"
//             },
//             "protocol_version": {
//                 "description": "Version of the certificate provisioning
// protocol. Defaults to 1. 1 is the 'static' protocol. 2 is the 'dynamic'
// protocol.",
//                 "type": "integer"
//             },
//             "renewal_period_seconds": {
//                 "description": "Number of seconds before expiration of a
// certificate when renewal should be triggered",
//                 "type": "integer"
//             }
//         },
//         "required": [
//             "cert_profile_id",
//             "key_algorithm"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os
message RequiredClientCertificateForUserProto {
  optional PolicyOptions policy_options = 1;
  optional string RequiredClientCertificateForUser = 2;
}

// Action on startup
//
// Setting the policy lets you specify system behavior on startup. Turning this
// setting off amounts to leaving it unset as Google Chrome must have specified
// start up behavior.
//
// If you set the policy, users can't change it in Google Chrome. If not set,
// users can change it.
//
// Setting this policy to RestoreOnStartupIsLastSession or
// RestoreOnStartupIsLastSessionAndURLs turns off some settings that rely on
// sessions or that perform actions on exit, such as clearing browsing data on
// exit or session-only cookies.
//
// If this policy is set to RestoreOnStartupIsLastSessionAndURLs, browser will
// restore previous session and open a separate window to show URLs that are set
// from RestoreOnStartupURLs. Note that users can choose to keep those URLs open
// and they will also be restored in the future session.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   5: Open New Tab Page
//   1: Restore the last session
//   4: Open a list of URLs
//   6: Open a list of URLs and restore the last session
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RestoreOnStartupProto {
  optional PolicyOptions policy_options = 1;
  optional int64 RestoreOnStartup = 2;
}

// URLs to open on startup
//
// If RestoreOnStartup is set to RestoreOnStartupIsURLs, then setting
// RestoreOnStartupURLs to a list of URLs specify which URLs open.
//
// If not set, the New Tab page opens on start up.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message RestoreOnStartupURLsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList RestoreOnStartupURLs = 2;
}

// Restrict accounts that are visible in Google Chrome
//
// Contains a list of patterns which are used to control the visibility of
// accounts in Google Chrome.
//
// Each Google account on the device will be compared to patterns stored in this
// policy to determine the account visibility in Google Chrome. The account will
// be visible if its name matches any pattern on the list. Otherwise, the
// account will be hidden.
//
// Use the wildcard character '*' to match zero or more arbitrary characters.
// The escape character is '\', so to match actual '*' or '\' characters, put a
// '\' in front of them.
//
// If this policy is not set, all Google accounts on the device will be visible
// in Google Chrome.
//
// Supported on: android, ios
message RestrictAccountsToPatternsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList RestrictAccountsToPatterns = 2;
}

// Restrict Background Fetch API when called from a Service Worker
//
// This policy controls whether background fetch requests from Service Workers
// are restricted. If a feature that downloads files in the background is
// affected, this policy may be relevant.
//
// If this policy is set to Enabled, or left unset, the restriction is active,
// and background fetch requests from Service Worker contexts may be blocked.
//
// If this policy is set to Disabled, the restriction is bypassed, allowing all
// Service Workers to make background fetch requests.
//
// This enterprise policy is temporary, and will be removed after M152.
//
// Valid values:
//   True: Enabled: Background Fetch from Service Workers is restricted.
//   False: Disabled: Background Fetch from Service Workers is allowed without
// restrictions.
//
// Supported on: android, chrome_os, linux, mac, win
message RestrictBackgroundFetchFromServiceWorkerEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool RestrictBackgroundFetchFromServiceWorkerEnabled = 2;
}

// Restrict CPU core sharing for renderer process
//
// This policy mitigates side-channel cross process memory attacks by isolating
// the renderer process on the CPU core and preventing other processes from
// sharing the same core. The mitigation is supported on Microsoft® Windows® 11
// 24H2 and above. If the OS does not have the required scheduling support, this
// policy will have no effect. This policy may slow down performance in some
// demanding scenarios similar to disabling hyperthreading. For more information
// refer https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-
// process_mitigation_side_channel_isolation_policy
// If this policy is enabled, all other processes will not be scheduled on the
// same CPU core when the renderer process is running.
// If this policy is disabled, all other processes can be scheduled on the same
// CPU core if a renderer process is running on it.
// If this policy is not set, all other processes can be scheduled on the same
// CPU core if a renderer process is running on the core. This may vary
// depending on Google Chrome release, currently running field trials, and
// platform.
//
// Valid values:
//   True: All other processes will not scheduled on the same CPU core when
// renderer process is running on it.
//   False: All other processes can be scheduled on the same CPU core when
// renderer process is running on it.
//   None: Allow the user to decide
//
// Supported on: win
message RestrictCoreSharingOnRendererProto {
  optional PolicyOptions policy_options = 1;
  optional bool RestrictCoreSharingOnRenderer = 2;
}

// Restrict eligible Google accounts for saving PDF files to Google Drive from
// the Google Chrome PDF Viewer
//
// Contains a regular expression to determine eligible Google accounts for
// saving PDF files to Google Drive from the Google Chrome PDF Viewer.
//
// An error is displayed if a user tries to upload a PDF file to Google Drive
// using an account that does not match this pattern.
//
// If this policy is left not set or blank, then the user can use any Google
// account to save PDF files to Google Drive.
//
// Supported on: chrome_os, linux, mac, win
message RestrictPdfSaveToGoogleDriveAccountsToPatternProto {
  optional PolicyOptions policy_options = 1;
  optional string RestrictPdfSaveToGoogleDriveAccountsToPattern = 2;
}

// Restrict which Google accounts are allowed to be set as browser primary
// accounts in Google Chrome
//
// Contains a regular expression which is used to determine which Google
// accounts can be set as browser primary accounts in Google Chrome (i.e. the
// account that is chosen during the Sync opt-in flow).
//
// An appropriate error is displayed if a user tries to set a browser primary
// account with a username that does not match this pattern.
//
// If this policy is left not set or blank, then the user can set any Google
// account as a browser primary account in Google Chrome.
//
// Supported on: fuchsia, linux, mac, win
message RestrictSigninToPatternProto {
  optional PolicyOptions policy_options = 1;
  optional string RestrictSigninToPattern = 2;
}

// Restrict YouTube cookies deletion
//
// Prevents the manual deletion of YouTube cookies.
//
// This policy is intended to prevent users from accessing unauthorized YouTube
// after manually clearing their YouTube cookies from the site settings page.
//
// Setting the policy to Enabled prevents YouTube cookies from being manually
// deleted.
//
// Setting the policy to Disabled or not set allows YouTube cookies to be
// deleted normally.
//
// Note: This policy only prevents manual deletion from the site settings UI. It
// does not prevent automated deletion by the ClearBrowsingDataOnExitList or
// BrowsingDataLifetime policies. Furthermore, if the
// AllowDeletingBrowserHistory policy is enabled, users can still clear all
// their cookies via the Clear Browsing Data dialog.
//
// Valid values:
//   True: Restrict YouTube cookies deletion
//   False: Do not restrict YouTube cookies deletion
//
// Supported on: chrome_os, linux, mac, win
message RestrictYouTubeCookiesDeletionProto {
  optional PolicyOptions policy_options = 1;
  optional bool RestrictYouTubeCookiesDeletion = 2;
}

// Configure the list of extension IDs exempt from the restricted managed guest
// session clean-up procedure
//
// The policy only applies to managed guest sessions.
// Setting the policy specifies a list of extension IDs that are exempt from the
// restricted managed guest session clean-up procedure (see
// DeviceRestrictedManagedGuestSessionEnabled).
// Leaving the policy unset means no extensions are exempt from the reset
// procedure.
//
// Supported on: chrome_os
message RestrictedManagedGuestSessionExtensionCleanupExemptListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList RestrictedManagedGuestSessionExtensionCleanupExemptList = 2;
}

// Set the roaming profile directory
//
// Configures the directory that Google Chrome will use for storing the roaming
// copy of the profiles.
//
// If you set this policy, Google Chrome will use the provided directory to
// store the roaming copy of the profiles if the RoamingProfileSupportEnabled
// policy has been enabled. If the RoamingProfileSupportEnabled policy is
// disabled or left unset the value stored in this policy is not used.
//
// See https://www.chromium.org/administrators/policy-list-3/user-data-
// directory-variables for a list of variables that can be used.
//
// On non-Windows platforms, this policy must be set for roaming profiles to
// work.
//
// On Windows, if this policy is left unset, the default roaming profile path
// will be used.
//
// Supported on: linux, mac, win
message RoamingProfileLocationProto {
  optional PolicyOptions policy_options = 1;
  optional string RoamingProfileLocation = 2;
}

// Enable the creation of roaming copies for Google Chrome profile data
//
// If you enable this setting, the settings stored in Google Chrome profiles
// like bookmarks, autofill data, passwords, etc. will also be written to a file
// stored in the Roaming user profile folder or a location specified by the
// Administrator through the RoamingProfileLocation policy. Enabling this policy
// disables cloud sync.
//
// If this policy is disabled or left not set only the regular local profiles
// will be used.
//
// Valid values:
//   True: Enable creation of roaming profiles
//   False: Disable creation of roaming profiles
//
// Supported on: fuchsia, linux, mac, win
message RoamingProfileSupportEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool RoamingProfileSupportEnabled = 2;
}

// Extend Flash content setting to all content (deprecated)
//
// This policy has been removed since Google Chrome version 89 because Flash has
// been deprecated.
//
// Setting the policy to True runs all Flash content embedded on websites that
// allow Flash, including content from other origins or small content.
//
// Setting the policy to False or leaving it unset might block Flash content
// from other origins or small content.
//
// Note: To control which websites can run Flash, see these policies:
// DefaultPluginsSetting, PluginsAllowedForUrls, and PluginsBlockedForUrls.
//
// Valid values:
//   True: Run all Flash content
//   False: Allow certain Flash content to be blocked
//
// Supported on:
message RunAllFlashInAllowModeProto {
  optional PolicyOptions policy_options = 1;
  optional bool RunAllFlashInAllowMode = 2;
}

// Limit the time for which a user authenticated via SAML can log in offline
//
// During login, Google ChromeOS can authenticate against a server (online) or
// using a cached password (offline).
//
// When this policy is set to a value of -1, the user can authenticate offline
// indefinitely. When this policy is set to any other value, it specifies the
// length of time since the last online authentication after which the user must
// use online authentication again.
//
// Leaving this policy not set will make Google ChromeOS use a default time
// limit of 14 days after which the user must use online authentication again.
//
// This policy affects only users who authenticated using SAML.
//
// The policy value should be specified in seconds.
//
// Supported on: chrome_os
message SAMLOfflineSigninTimeLimitProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SAMLOfflineSigninTimeLimit = 2;
}

// Allow proceeding from the SSL warning page
//
// Setting the policy to Enabled or leaving it unset lets users click through
// warning pages Google Chrome shows when users navigate to sites that have SSL
// errors.
//
// Setting the policy to Disabled prevent users from clicking through any
// warning pages.
//
// Valid values:
//   True: Allow users to click through SSL warning pages
//   False: Prevent users from clicking through SSL warning pages
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SSLErrorOverrideAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SSLErrorOverrideAllowed = 2;
}

// Allow proceeding from the SSL warning page on specific origins
//
// If SSLErrorOverrideAllowed is Disabled, setting the policy lets you set a
// list of origin patterns that specify the sites where a user can click through
// warning pages Google Chrome shows when users navigate to sites that have SSL
// errors. Users will not be able to click through SSL warning pages on origins
// that are not on this list.
//
// If SSLErrorOverrideAllowed is Enabled or unset, this policy does nothing.
//
// Leaving the policy unset means SSLErrorOverrideAllowed applies for all sites.
//
// For detailed information on valid input patterns, please see
// https://chromeenterprise.google/policies/url-patterns/. * is not an accepted
// value for this policy. This policy only matches based on origin, so any path
// in the URL pattern is ignored.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SSLErrorOverrideAllowedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SSLErrorOverrideAllowedForOrigins = 2;
}

// Minimum TLS version to fallback to
//
// This policy was removed in M53 after TLS version fallback was removed from
// Google Chrome.
//
// When a TLS handshake fails, Google Chrome would previously retry the
// connection with a lesser version of TLS in order to work around bugs in HTTPS
// servers. This setting configures the version at which this fallback process
// will stop. If a server performs version negotiation correctly (i.e. without
// breaking the connection) then this setting doesn't apply. Regardless, the
// resulting connection must still comply with SSLVersionMin.
//
// If this policy is not configured or if it is set to "tls1.2" then Google
// Chrome no longer performs this fallback. Note this does not disable support
// for older TLS versions, only whether Google Chrome will work around buggy
// servers which cannot negotiate versions correctly.
//
// Otherwise, if compatibility with a buggy server must be maintained, this
// policy may be set to "tls1.1". This is a stopgap measure and the server
// should be rapidly fixed.
//
// Valid values:
//   tls1.1: TLS 1.1
//   tls1.2: TLS 1.2
//
// Supported on:
message SSLVersionFallbackMinProto {
  optional PolicyOptions policy_options = 1;
  optional string SSLVersionFallbackMin = 2;
}

// Maximum SSL version enabled
//
// This policy was removed in M75 after the max TLS version policy was removed
// from Google Chrome.
//
// If this policy is not configured then Google Chrome uses the default maximum
// version.
//
// Otherwise it may be set to one of the following values: "tls1.2" or "tls1.3".
// When set, Google Chrome will not use SSL/TLS versions greater than the
// specified version. An unrecognized value will be ignored.
//
// Valid values:
//   tls1.2: TLS 1.2
//   tls1.3: TLS 1.3
//
// Supported on:
message SSLVersionMaxProto {
  optional PolicyOptions policy_options = 1;
  optional string SSLVersionMax = 2;
}

// Minimum SSL version enabled
//
// Setting the policy to a valid value means Google Chrome won't use SSL/TLS
// versions less than the specified version. Unrecognized values are ignored.
//
// If this policy is not set, then Google Chrome will show an error for TLS 1.0
// and TLS 1.1, but the user will be able to bypass it.
//
// If this policy is set to "tls1.2", the user will not be able to bypass this
// error.
//
// Support for setting this policy to "tls1" or "tls1.1" was removed in version
// 91. Suppressing the TLS 1.0/1.1 warning is no longer supported.
//
// Valid values:
//   tls1: TLS 1.0
//   tls1.1: TLS 1.1
//   tls1.2: TLS 1.2
//
// Supported on:
message SSLVersionMinProto {
  optional PolicyOptions policy_options = 1;
  optional string SSLVersionMin = 2;
}

// Specifies a list of SaaS domains that will be reported for managed browser
//
// This policy controls Google Chrome reporting of SaaS domain visits and
// content transfers for a managed browser.
//
// When the policy is set, the URLs matching SaaS domains will be used to
// generate report. Unmatched URLs will be ignored.
//
// When the policy is not set or set to an empty list, no report will be
// generated.
//
// The matching patterns use a similar format to those for the 'URLBlocklist'
// policy, which are documented at
// https://support.google.com/chrome/a?p=url_blocklist_filter_format. With a few
// exceptions below:
//
// * URL host must match the hostname or be a subdomain of the hostname of one
// of the domains from the SaaS sites list.
//
// * URL path must start with the path from the matched SaaS sites list entry.
//
// * The URL scheme, port, query are disregarded during the matching process.
//
// This policy value is populated by the cloud policy infrastructure and admins
// can't set it directly.
//
// Supported on: android, linux, mac, win
message SaasUsageReportingDomainUrlsForBrowsersProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SaasUsageReportingDomainUrlsForBrowsers = 2;
}

// Specifies a list of SaaS domains that will be reported for managed profile
//
// This policy controls Google Chrome reporting of SaaS domain visits and
// content transfers for a managed profile.
//
// When the policy is set, the URLs matching SaaS domains will be used to
// generate report. Unmatched URLs will be ignored.
//
// When the policy is not set or set to an empty list, no report will be
// generated.
//
// The matching patterns use a similar format to those for the 'URLBlocklist'
// policy, which are documented at
// https://support.google.com/chrome/a?p=url_blocklist_filter_format. With a few
// exceptions below:
//
// * URL host must match the hostname or be a subdomain of the hostname of one
// of the domains from the SaaS sites list.
//
// * URL path must start with the path from the matched SaaS sites list entry.
//
// * The URL scheme, port, query are disregarded during the matching process.
//
// This policy can only be set as a cloud user policy.
//
// This policy value is populated by the cloud policy infrastructure and admins
// can't set it directly.
//
// Supported on: android, chrome_os, linux, mac, win
message SaasUsageReportingDomainUrlsForProfilesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SaasUsageReportingDomainUrlsForProfiles = 2;
}

// Configure the list of domains on which Safe Browsing will not trigger
// warnings.
//
// Setting the policy to Enabled means Safe Browsing will trust the domains you
// designate. It won't check them for dangerous resources such as phishing,
// malware, or unwanted software. Safe Browsing's download protection service
// won't check downloads hosted on these domains. Its password protection
// service won't check for password reuse.
//
// Leaving the policy unset means default Safe Browsing protection applies to
// all resources.
//
// This policy does not support regular expressions; however, subdomains of a
// given domain are allowlisted. Fully qualified domain names (FQDNs) are not
// required.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SafeBrowsingAllowlistDomainsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SafeBrowsingAllowlistDomains = 2;
}

// Allow download deep scanning for Safe Browsing-enabled users
//
// When this policy is enabled or left unset, Google Chrome can send suspicious
// downloads from Safe Browsing-enabled users to Google to scan for malware, or
// prompt users to provide a password for encrypted archives.
// When this policy is disabled, this scanning will not be performed.
// This policy does not impact download content analysis configured by Chrome
// Enterprise Connectors.
//
// Valid values:
//   True: Enable Safe Browsing download deep scans
//   False: Disable Safe Browsing download deep scans
//
// Supported on: chrome_os, linux, mac, win
message SafeBrowsingDeepScanningEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SafeBrowsingDeepScanningEnabled = 2;
}

// Enable Safe Browsing
//
// This policy is deprecated in Google Chrome 83, please use
// SafeBrowsingProtectionLevel instead.
//
// Setting the policy to Enabled keeps Chrome's Safe Browsing feature on.
// Setting the policy to Disabled keeps Safe Browsing off.
//
// If you set this policy, users can't change it or override the "Enable
// phishing and malware protection" setting in Chrome. If not set, "Enable
// phishing and malware protection" is set to True, but the user can change it.
//
// See more about Safe Browsing ( https://developers.google.com/safe-browsing ).
//
// If the policy SafeBrowsingProtectionLevel is set, the value of the policy
// SafeBrowsingEnabled is ignored.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   True: Enable Safe Browsing
//   False: Disable Safe Browsing
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, ios, linux, mac, win
message SafeBrowsingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SafeBrowsingEnabled = 2;
}

// Enable Safe Browsing Extended Reporting
//
// Setting the policy to Enabled turns on Google Chrome's Safe Browsing Extended
// Reporting, which sends some system information and page content to Google
// servers to help detect dangerous apps and sites.
//
// Setting the policy to Disabled means reports are never sent.
//
// If you set this policy, users can't change it. If not set, users can decide
// whether to send reports or not.
//
// See more about Safe Browsing ( https://developers.google.com/safe-browsing ).
//
// Valid values:
//   True: Enable reporting of system information and page content to help
// improve Safe Browsing
//   False: Disable reporting of system information and page content which are
// used to help improve Safe Browsing
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SafeBrowsingExtendedReportingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SafeBrowsingExtendedReportingEnabled = 2;
}

// Allow users to opt in to Safe Browsing extended reporting
//
// This policy is deprecated in M82 and removed in M85, use
// SafeBrowsingExtendedReportingEnabled instead. Disabling
// SafeBrowsingExtendedReportingOptInAllowed is equivalent to disabling
// SafeBrowsingExtendedReportingEnabled. Enabling
// SafeBrowsingExtendedReportingOptInAllowed or leaving this setting unset is
// equivalent to leaving SafeBrowsingExtendedReportingEnabled unset.
//
// Setting this policy to false stops users from choosing to send some system
// information and page content to Google servers. If this setting is true or
// not configured, then users will be allowed to send some system information
// and page content to Safe Browsing to help detect dangerous apps and sites.
//
// See https://developers.google.com/safe-browsing for more info on Safe
// Browsing.
//
// Supported on:
message SafeBrowsingExtendedReportingOptInAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SafeBrowsingExtendedReportingOptInAllowed = 2;
}

// Enable Safe Browsing for trusted sources
//
// Setting the policy to Enabled or leaving it unset means downloaded files are
// sent to be analyzed by Safe Browsing, even when it's from a trusted source.
//
// Setting the policy to Disabled means downloaded files won't be sent to be
// analyzed by Safe Browsing when it's from a trusted source.
//
// These restrictions apply to downloads triggered from webpage content, as well
// as the Download link menu option. These restrictions don't apply to the save
// or download of the currently displayed page or to saving as PDF from the
// printing options.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// Valid values:
//   True: Perform Safe Browsing checks on all downloaded files
//   False: Skip Safe Browsing checks for files download from trusted sources
//
// Supported on: win
message SafeBrowsingForTrustedSourcesEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SafeBrowsingForTrustedSourcesEnabled = 2;
}

// Safe Browsing Protection Level
//
// Allows you to control whether Google Chrome's Safe Browsing feature is
// enabled and the mode it operates in.
//
// If this policy is set to 'NoProtection' (value 0), Safe Browsing is never
// active.
//
// If this policy is set to 'StandardProtection' (value 1, which is the
// default), Safe Browsing is always active in the standard mode.
//
// If this policy is set to 'EnhancedProtection' (value 2), Safe Browsing is
// always active in the enhanced mode, which provides better security, but
// requires sharing more browsing information with Google.
//
// If you set this policy as mandatory, users cannot change or override the Safe
// Browsing setting in Google Chrome.
//
// If this policy is left not set, Safe Browsing will operate in Standard
// Protection mode but users can change this setting.
//
// See https://support.google.com/chrome?p=safe_browsing_preferences for more
// info on Safe Browsing.
//
// Valid values:
//   0: Safe Browsing is never active.
//   1: Safe Browsing is active in the standard mode.
//   2: Safe Browsing is active in the enhanced mode. This mode provides better
// security, but requires sharing more browsing information with Google.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message SafeBrowsingProtectionLevelProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SafeBrowsingProtectionLevel = 2;
}

// Allow Safe Browsing Proxied Real Time Checks
//
// This controls whether Safe Browsing's standard protection mode is allowed to
// send partial hashes of URLs to Google through a proxy via Oblivious HTTP
// in order to determine whether they are safe to visit.
//
// The proxy allows browsers to upload partial hashes of URLs to Google
// without them being linked to the user's IP address. The policy also allows
// browsers to upload the partial hashes of URLs with higher frequency for
// better Safe Browsing protection quality.
//
// This policy will be ignored if Safe Browsing is disabled or set to enhanced
// protection mode.
//
// Setting the policy to Enabled or leaving it unset allows the
// higher-protection proxied lookups.
//
// Setting the policy to Disabled disallows the higher-protection proxied
// lookups. Partial hashes of URLs will be uploaded to Google directly with much
// lower frequency, which will degrade protection.
//
// Valid values:
//   True: Allow higher-protection proxied lookups
//   False: Don't allow higher-protection proxied lookups
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message SafeBrowsingProxiedRealTimeChecksAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SafeBrowsingProxiedRealTimeChecksAllowed = 2;
}

// Allow Safe Browsing Surveys
//
// When this policy is enabled or left unset, the user may receive surveys
// related to Safe Browsing.
// When this policy is disabled, the user will not receive surveys related to
// Safe Browsing.
//
// Valid values:
//   True: Enable receiving Safe Browsing surveys
//   False: Disable receiving Safe Browsing surveys
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SafeBrowsingSurveysEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SafeBrowsingSurveysEnabled = 2;
}

// Configure the list of domains on which Safe Browsing will not trigger
// warnings.
//
// This policy is deprecated, please use SafeBrowsingAllowlistDomains instead.
//
// Setting the policy to Enabled means Safe Browsing will trust the domains you
// designate. It won't check them for dangerous resources such as phishing,
// malware, or unwanted software. Safe Browsing's download protection service
// won't check downloads hosted on these domains. Its password protection
// service won't check for password reuse.
//
// Setting the policy to Disabled or leaving it unset means default Safe
// Browsing protection applies to all resources.
//
// On Microsoft® Windows®, this functionality is only available on instances
// that are joined to a Microsoft® Active Directory® domain, running on Windows
// 10 Pro, or enrolled in Chrome Enterprise Core. On macOS, this functionality
// is only available on instances that are managed via MDM, or joined to a
// domain via MCX.
//
// Supported on:
message SafeBrowsingWhitelistDomainsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SafeBrowsingWhitelistDomains = 2;
}

// Control SafeSites adult content filtering.
//
// Setting the policy controls the SafeSites URL filter, which uses the Google
// Safe Search API to classify URLs as pornographic or not.
//
// When this policy is set to:
//
// * Do not filter sites for adult content, or not set, sites aren't filtered
//
// * Filter sites for adult content, pornographic sites are filtered
//
// The policy applies to both the URL the user navigates to and to iframes. The
// URLAllowlist policy takes precedence over this policy and can be used to
// override verdicts from the Google Safe Search API.
//
// Valid values:
//   0: Do not filter sites for adult content
//   1: Filter sites for adult content
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SafeSitesFilterBehaviorProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SafeSitesFilterBehavior = 2;
}

// Allow Same Origin Tab capture by these origins
//
// Setting the policy lets you set a list of URL patterns that can capture tabs
// with their same Origin.
//
// Leaving the policy unset means that sites will not be considered for an
// override at this level of capture.
//
// Note that windowed Chrome Apps with the same origin as this site will still
// be allowed to be captured.
//
// If a site matches a URL pattern in this policy, the following policies will
// not be considered: TabCaptureAllowedByOrigins, WindowCaptureAllowedByOrigins,
// ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.  This policy only
// matches based on origin, so any path in the URL pattern is ignored.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SameOriginTabCaptureAllowedByOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SameOriginTabCaptureAllowedByOrigins = 2;
}

// Password synchronization between third-party SSO providers and Chrome devices
//
// Enables SAML password sync between multiple Chrome devices by monitoring the
// value of password sync token and sending a user through the online re-
// authentication if password was updated and needs to be synchronized.
//
// Enables a page at chrome://password-change that lets SAML users change their
// SAML passwords while in-session, which ensures that the SAML password and the
// device lockscreen password are kept in-sync.
//
// This policy also enables notifications that warn SAML users if their SAML
// passwords are soon to expire so that they can deal with this immediately by
// doing an in-session password change.
// But, these notifications will only be shown if password expiry information is
// sent to the device by the SAML identity provider during the SAML login flow.
//
// Setting this policy to Disabled or not set, SAML password can't be changed at
// chrome://password-change and there won't be any notification when SAML
// passwords are soon to expire.
//
// Valid values:
//   True: Trigger authentication flows to synchronize passwords with SSO
// providers
//   False: Do not trigger authentication flows for password synchronization
//
// Supported on: chrome_os
message SamlInSessionPasswordChangeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SamlInSessionPasswordChangeEnabled = 2;
}

// Limit the time for which a user authenticated via SAML can log in offline at
// the lock screen
//
// While logging in through the lock screen, Google ChromeOS can authenticate
// against a server (online) or using a cached password (offline).
//
// When this policy is set to -2, it will match the value of the login screen
// offline signin time limit which comes from SAMLOfflineSigninTimeLimit.
//
// When the policy is unset or set to a value of -1, it will not enforce online
// authentication on the lock screen and will allow the user to use offline
// authentication unless a different reason than this policy enforces an online
// authentication.
//
// If the policy is set to a value of 0, online authentication will always be
// required.
//
// When this policy is set to any other value, it specifies the number of days
// since the last online authentication after which the user must use online
// authentication again in the next login through the lock screen.
//
// This policy affects users who authenticated using SAML.
//
// The policy value should be specified in days.
//
// Supported on: chrome_os
message SamlLockScreenOfflineSigninTimeLimitDaysProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SamlLockScreenOfflineSigninTimeLimitDays = 2;
}

// How many days in advance to notify SAML users when their password is due to
// expire
//
// This policy has no effect unless SamlInSessionPasswordChangeEnabled is true.
// If that policy is true, and this policy is set to (for example) 14, that
// means SAML users will be notified 14 days in advance that their password is
// due to expire on a certain date.
// Then they can deal with this immediately by doing an in-session password
// change and updating their password before it expires.
// But, these notifications will only be shown if password expiry information is
// sent to the device by the SAML identity provider during the SAML login flow.
// Setting this policy to zero means the users will not be notified in advance -
// they will only be notified once the password has already expired.
//
// If this policy is set, the user cannot change or override it.
//
// Supported on: chrome_os
message SamlPasswordExpirationAdvanceWarningDaysProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SamlPasswordExpirationAdvanceWarningDays = 2;
}

// Allow Chrome to block navigations toward external protocols in sandboxed
// iframes
//
// Chrome will block navigations toward external protocols inside
// sandboxed iframe. See https://chromestatus.com/features/5680742077038592.
//
// When True, this lets Chrome blocks those navigations.
//
// When False, this prevents Chrome from blocking those navigations.
//
// This defaults to True: security feature enabled.
//
// This can be used by administrators who need more time to update their
// internal website affected by this new restriction. This Enterprise policy is
// temporary; it's intended to be removed after Google Chrome version 117.
//
// Valid values:
//   True: Allow Chrome to block navigations to external protocols inside
// sandboxed iframe
//   False: Prevent Chrome to block navigations to external protocols inside
// sandboxed iframe
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SandboxExternalProtocolBlockedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SandboxExternalProtocolBlocked = 2;
}

// Disable saving browser history
//
// Setting the policy to Enabled means browsing history is not saved, tab
// syncing is off and users can't change this setting.
//
// Setting the policy to Disabled or leaving it unset saves browsing history.
//
// Valid values:
//   True: Disable saving browser history
//   False: Enable saving browser history
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message SavingBrowserHistoryDisabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SavingBrowserHistoryDisabled = 2;
}

// Select task scheduler configuration
//
// Setting the policy instructs Google ChromeOS to use the task scheduler
// configuration identified by the specified name. This policy can be set to
// Conservative or Performance, which tune the task scheduler for stability or
// maximum performance, respectively.
//
// If unset, users make their own choice.
//
// Valid values:
//   conservative: Optimize for stability.
//   performance: Optimize for performance.
//
// Supported on: chrome_os
message SchedulerConfigurationProto {
  optional PolicyOptions policy_options = 1;
  optional string SchedulerConfiguration = 2;
}

// Screen brightness percent
//
// Setting the policy specifies screen brightness percent, turning
// autobrightness features off. Initial screen brightness adjusts to the policy
// value, but users can change it.
//
// Leaving the policy unset doesn't affect user screen controls or
// autobrightness features.
//
// Note: The policy values should be specified in percents from 0 to 100.
//
// Value schema:
// {
//     "properties": {
//         "BrightnessAC": {
//             "description": "Screen brightness percent when running on AC
// power",
//             "maximum": 100,
//             "minimum": 0,
//             "type": "integer"
//         },
//         "BrightnessBattery": {
//             "description": "Screen brightness percent when running on battery
// power",
//             "maximum": 100,
//             "minimum": 0,
//             "type": "integer"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message ScreenBrightnessPercentProto {
  optional PolicyOptions policy_options = 1;
  optional string ScreenBrightnessPercent = 2;
}

// Allow or deny screen capture
//
// If enabled or not configured (default), a Web page can use
// screen-share APIs (e.g., getDisplayMedia() or the Desktop Capture extension
// API)
// to prompt the user to select a tab, window or desktop to capture.
//
// When this policy is disabled, any calls to screen-share APIs will fail
// with an error; however this policy is not considered (and a site will be
// allowed to use screen-share APIs) if the site matches an origin pattern in
// any of the following policies:
// ScreenCaptureAllowedByOrigins,
// WindowCaptureAllowedByOrigins,
// TabCaptureAllowedByOrigins,
// SameOriginTabCaptureAllowedByOrigins.
//
// Valid values:
//   True: Allow sites to prompt the user to share a video stream of their
// screen
//   False: Do not allow sites to prompt the user to share a video stream of
// their screen
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ScreenCaptureAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool ScreenCaptureAllowed = 2;
}

// Allow Desktop, Window, and Tab capture by these origins
//
// Setting the policy lets you set a list of URL patterns that can use Desktop,
// Window, and Tab Capture.
//
// Leaving the policy unset means that sites will not be considered for an
// override at this level of Capture.
//
// This policy is not considered if a site matches a URL pattern in any of the
// following policies: WindowCaptureAllowedByOrigins,
// TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins.
//
// If a site matches a URL pattern in this policy, the ScreenCaptureAllowed will
// not be considered.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.  This policy only
// matches based on origin, so any path in the URL pattern is ignored.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ScreenCaptureAllowedByOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ScreenCaptureAllowedByOrigins = 2;
}

// Set location to store screen captures
//
// Sets the directory where Screen Captures (both screenshot and screen
// recordings) are being saved.
// If the policy is set as recommended, the value will be used by default, but
// user will be able to change it.
// Otherwise the user can't change it and the captures are always saved to the
// defined directory.
//
// The policy uses same format as DownloadDirectory policy
// The location could be set to either local filesystem or Google Drive (with
// '${google_drive}' prefix) or Microsoft OneDrive (with '${microsoft_onedrive}'
// prefix).
// If the policy is set to empty string, it'll force the screen captures to be
// stored in the local "Downloads" directory.
// See a list of variables you can use (
// https://www.chromium.org/administrators/policy-list-3/user-data-directory-
// variables ).
//
// Leaving the policy unset means Google ChromeOS uses the default "Downloads"
// directory to store screen captures, and users can change it.
//
// Supported on: chrome_os
message ScreenCaptureLocationProto {
  optional PolicyOptions policy_options = 1;
  optional string ScreenCaptureLocation = 2;
}

// Allow screen capture without prior user gesture
//
// For security reasons, the
// getDisplayMedia() web API requires
// a prior user gesture ("transient activation") to be called or will otherwise
// fail.
//
// With this policy set, admins can specify origins on which this API can be
// called without prior user gesture.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/. * is
// not an accepted value for this policy.
//
// If this policy is unset, all origins will require a prior user gesture to
// call
// this API.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message ScreenCaptureWithoutGestureAllowedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ScreenCaptureWithoutGestureAllowedForOrigins = 2;
}

// Screen dim delay when running on AC power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// Specifies the length of time without user input after which the screen is
// dimmed when running on AC power.
//
// When this policy is set to a value greater than zero, it specifies the length
// of time that the user must remain idle before Google ChromeOS dims the
// screen.
//
// When this policy is set to zero, Google ChromeOS does not dim the screen when
// the user becomes idle.
//
// When this policy is unset, a default length of time is used.
//
// The policy value should be specified in milliseconds. Values are clamped to
// be less than or equal the screen off delay (if set) and the idle delay.
//
// Supported on: chrome_os
message ScreenDimDelayACProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ScreenDimDelayAC = 2;
}

// Screen dim delay when running on battery power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// Specifies the length of time without user input after which the screen is
// dimmed when running on battery power.
//
// When this policy is set to a value greater than zero, it specifies the length
// of time that the user must remain idle before Google ChromeOS dims the
// screen.
//
// When this policy is set to zero, Google ChromeOS does not dim the screen when
// the user becomes idle.
//
// When this policy is unset, a default length of time is used.
//
// The policy value should be specified in milliseconds. Values are clamped to
// be less than or equal the screen off delay (if set) and the idle delay.
//
// Supported on: chrome_os
message ScreenDimDelayBatteryProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ScreenDimDelayBattery = 2;
}

// Screen lock delay when running on AC power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use ScreenLockDelays instead.
//
// Specifies the length of time without user input after which the screen is
// locked when running on AC power.
//
// When this policy is set to a value greater than zero, it specifies the length
// of time that the user must remain idle before Google ChromeOS locks the
// screen.
//
// When this policy is set to zero, Google ChromeOS does not lock the screen
// when the user becomes idle.
//
// When this policy is unset, a default length of time is used.
//
// The recommended way to lock the screen on idle is to enable screen locking on
// suspend and have Google ChromeOS suspend after the idle delay. This policy
// should only be used when screen locking should occur a significant amount of
// time sooner than suspend or when suspend on idle is not desired at all.
//
// The policy value should be specified in milliseconds. Values are clamped to
// be less than the idle delay.
//
// Supported on: chrome_os
message ScreenLockDelayACProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ScreenLockDelayAC = 2;
}

// Screen lock delay when running on battery power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use ScreenLockDelays instead.
//
// Specifies the length of time without user input after which the screen is
// locked when running on battery power.
//
// When this policy is set to a value greater than zero, it specifies the length
// of time that the user must remain idle before Google ChromeOS locks the
// screen.
//
// When this policy is set to zero, Google ChromeOS does not lock the screen
// when the user becomes idle.
//
// When this policy is unset, a default length of time is used.
//
// The recommended way to lock the screen on idle is to enable screen locking on
// suspend and have Google ChromeOS suspend after the idle delay. This policy
// should only be used when screen locking should occur a significant amount of
// time sooner than suspend or when suspend on idle is not desired at all.
//
// The policy value should be specified in milliseconds. Values are clamped to
// be less than the idle delay.
//
// Supported on: chrome_os
message ScreenLockDelayBatteryProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ScreenLockDelayBattery = 2;
}

// Screen lock delays
//
// Setting the policy specifies the length of time in milliseconds without user
// input after which the screen locks when running on AC power or battery.
// Values are clamped to be less than the idle delay in
// PowerManagementIdleSettings.
//
// When set to zero, Google ChromeOS doesn't lock the screen when the user
// becomes idle. If unset, a default time is used.
//
// Recommendation: Lock the screen on idle by turning on screen locking on
// suspend and have Google ChromeOS suspend after the idle delay. Only use this
// policy when screen locking should occur a significant amount of time sooner
// than suspend or when you don't want suspend on idle.
//
// Value schema:
// {
//     "properties": {
//         "AC": {
//             "description": "The length of time without user input after which
// the screen is locked when running on AC power, in milliseconds",
//             "minimum": 0,
//             "type": "integer"
//         },
//         "Battery": {
//             "description": "The length of time without user input after which
// the screen is locked when running on battery, in milliseconds",
//             "minimum": 0,
//             "type": "integer"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message ScreenLockDelaysProto {
  optional PolicyOptions policy_options = 1;
  optional string ScreenLockDelays = 2;
}

// Set screen magnifier type
//
// Setting the policy to None turns the screen magnifier off.
//
// If you set the policy, users can't change it. If not set, the screen
// magnifier is off at first, but users can turn it on any time.
//
// Valid values:
//   0: Screen magnifier disabled
//   1: Full-screen magnifier enabled
//   2: Docked magnifier enabled
//
// Supported on: chrome_os
message ScreenMagnifierTypeProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ScreenMagnifierType = 2;
}

// Screen off delay when running on AC power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// Specifies the length of time without user input after which the screen is
// turned off when running on AC power.
//
// When this policy is set to a value greater than zero, it specifies the length
// of time that the user must remain idle before Google ChromeOS turns off the
// screen.
//
// When this policy is set to zero, Google ChromeOS does not turn off the screen
// when the user becomes idle.
//
// When this policy is unset, a default length of time is used.
//
// The policy value should be specified in milliseconds. Values are clamped to
// be less than or equal the idle delay.
//
// Supported on: chrome_os
message ScreenOffDelayACProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ScreenOffDelayAC = 2;
}

// Screen off delay when running on battery power
//
// Note that this policy is deprecated and will be removed in Google ChromeOS
// version 85. Please use PowerManagementIdleSettings instead.
//
// Specifies the length of time without user input after which the screen is
// turned off when running on battery power.
//
// When this policy is set to a value greater than zero, it specifies the length
// of time that the user must remain idle before Google ChromeOS turns off the
// screen.
//
// When this policy is set to zero, Google ChromeOS does not turn off the screen
// when the user becomes idle.
//
// When this policy is unset, a default length of time is used.
//
// The policy value should be specified in milliseconds. Values are clamped to
// be less than or equal the idle delay.
//
// Supported on: chrome_os
message ScreenOffDelayBatteryProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ScreenOffDelayBattery = 2;
}

// User screensaver lock screen enabled.
//
// Configures the user screensaver for the lock screen.
//
// If this policy is set to true, the Google ChromeOS device will show a
// screensaver when it is idle in the lock screen.
//
// If this policy is set to false, or unset, the screensaver will not be
// displayed in the lock screen.
//
// The user screensaver displays the images referenced by the
// ScreensaverLockScreenImages policy. If ScreensaverLockScreenImages is unset,
// or it is set to an empty list, or to a list without any valid images, the
// screensaver for the lock screen will not be displayed.
//
// The idle timeout to start the screensaver, and the interval that an image is
// displayed can be modified with the ScreensaverLockScreenIdleTimeoutSeconds,
// and the ScreensaverLockScreenDisplayIntervalSeconds policies respectively. If
// any of these policies are unset, their default values will be use instead.
//
// Valid values:
//   True: Enable the screensaver in the lock screen.
//   False: Do not enable the screensaver in the lock screen.
//
// Supported on: chrome_os
message ScreensaverLockScreenEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ScreensaverLockScreenEnabled = 2;
}

// User screensaver lock screen idle timeout.
//
// Configures the time in seconds that the device will wait idle before showing
// the screensaver for the lock screen.
//
// Valid values range from 1 second to 9999 seconds. Leaving the policy unset
// means Google ChromeOS uses the default value of 7 seconds.
//
// This policy will not have any effect when the ScreensaverLockScreenEnabled
// policy is set to false.
//
// Supported on: chrome_os
message ScreensaverLockScreenIdleTimeoutSecondsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ScreensaverLockScreenIdleTimeoutSeconds = 2;
}

// User screensaver lock screen image display interval.
//
// Configures the interval in seconds to display an image when the screensaver
// for the lock screen has multiple images to display.
//
// Valid values range from 1 second to 9999 seconds. Leaving the policy unset
// means Google ChromeOS uses the default value of 60 seconds.
//
// This policy will not have any effect when the ScreensaverLockScreenEnabled
// policy is set to false.
//
// Supported on: chrome_os
message ScreensaverLockScreenImageDisplayIntervalSecondsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ScreensaverLockScreenImageDisplayIntervalSeconds = 2;
}

// User screensaver lock screen image source.
//
// Configures the list of images to display in the screensaver for the lock
// screen.
//
// Each item must be a URL referencing an image file. The image format must be
// JPEG, and the file size must not exceed 8MB. Invalid URLs and unsupported
// images will be ignored. The Google ChromeOS device will download these
// images, and keep them in a local cache.
//
// The number of images to display in the screensaver is limited to 25. Only the
// first 25 URL entries from the list will be used.
//
// This policy will not have any effect if the ScreensaverLockScreenEnabled
// policy is set to false.
//
// If this policy is unset, or the list does not contain any valid image
// references, the screensaver for the lock screen will not be displayed,
// regardless of the value set in the ScreensaverLockScreenEnabled policy.
//
// Supported on: chrome_os
message ScreensaverLockScreenImagesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ScreensaverLockScreenImages = 2;
}

// Enable scrolling to text specified in URL fragments
//
// This feature allows for hyperlinks and address bar URL navigations to target
// specific text within a web page, which will be scrolled to once the loading
// of the web page is complete.
//
// If you enable or don't configure this policy, web page scrolling to specific
// text fragments via URL will be enabled.
//
// If you disable this policy, web page scrolling to specific text fragments via
// URL will be disabled.
//
// Valid values:
//   True: Allow sites to scroll to specific text fragments via URL
//   False: Do not allow sites to scroll to specific text fragments via URL
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ScrollToTextFragmentEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ScrollToTextFragmentEnabled = 2;
}

// Enable content sharing with Google AI Mode and Lens integrations
//
// This policy controls sharing of page and file content with Google AI Mode and
// Lens through Google Chrome side panel or tabs.
//
// Note that this policy doesn't affect Google AI Mode on the web. It only
// controls how users can share information with it when using Google Chrome.
//
// 0 = users can share page or file content with Google AI Mode.
//
// 1 = users cannot share page or file content with Google AI Mode. The entry
// points for sharing context and the side panel will be disabled or hidden.
//
// This policy will be ignored when Google Search is not users' default search
// engine as the feature is disabled.
//
// This policy is independent of the AIModeSettings policy. The AIModeSettings
// policy only controls entry points on omnibox or NTP search box, while this
// policy controls context sharing through side panel or tabs.
//
// This policy also doesn't control Google Gemini integration which can be
// disabled by GeminiSettings.
//
// If this policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow content sharing with Google AI Mode integrations.
//   1: Do not allow content sharing with Google AI Mode integrations.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message SearchContentSharingSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SearchContentSharingSettings = 2;
}

// Enable search suggestions
//
// Setting the policy to True turns on search suggestions in Google Chrome's
// address bar. Setting the policy to False turns off these search suggestions.
//
// Suggestions based on bookmarks or history are unaffected by the policy.
//
// If you set the policy, users can't change it. If not set, search suggestions
// are on at first, but users can turn them off any time.
//
// Valid values:
//   True: Enable search suggestions
//   False: Disable search suggestions
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message SearchSuggestEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SearchSuggestEnabled = 2;
}

// Allow Sign-in To Additional Google Accounts
//
// This setting allows users to switch between Google Accounts within the
// content area of their browser window and in Android applications, after they
// sign into their Google ChromeOS device.
//
// If this policy is set to false, signing in to a different Google Account from
// a non-Incognito browser content area and Android applications will not be
// allowed.
//
// If this policy is unset or set to true, the default behavior will be used:
// signing in to a different Google Account from the browser content area and
// Android applications will be allowed, except for child accounts where it will
// be blocked for non-Incognito content area.
//
// In case signing in to a different account shouldn't be allowed via the
// Incognito mode, consider blocking that mode using the
// IncognitoModeAvailability policy.
//
// Note that users will be able to access Google services in an unauthenticated
// state by blocking their cookies.
//
// Valid values:
//   True: Enable signing in with additional Google accounts
//   False: Disable signing in with additional Google accounts
//
// Supported on: chrome_os
message SecondaryGoogleAccountSigninAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SecondaryGoogleAccountSigninAllowed = 2;
}

// Add restrictions on a managed account's usage as a secondary account on
// ChromeOS
//
// Removed in M122 - this is a server-side-only policy that never used the
// ChromeOS policy infrastructure for its propagation.
// If this policy is set to 'all' or not set, all usages of managed accounts are
// allowed. This may result in a managed account being a secondary account,
// which would only receive policies when the account is signed-in as a primary
// account in a browser Profile.
// Policies set to the account won't be enforced in the following scenarios:
// -  Being a secondary account at the OS level (Account Settings)
// -  Being a secondary account in a browser Profile
//
// If this policy is set to 'primary_account_signin' on an account, this account
// will be allowed to sign in as a primary account only. It won't be allowed to
// sign in as a secondary account.
//
// Valid values:
//   all: All usages of managed accounts are allowed
//   primary_account_signin: Block addition of a managed account as Secondary
// Account on ChromeOS (in-session)
//
// Supported on:
message SecondaryGoogleAccountUsageProto {
  optional PolicyOptions policy_options = 1;
  optional string SecondaryGoogleAccountUsage = 2;
}

// URLs/domains automatically permitted direct Security Key attestation
//
// Setting the policy specifies WebAuthn RP IDs for which no prompt appears when
// attestation certificates from security keys are requested. A signal is also
// sent to the security key indicating that enterprise attestation may be used.
// Without this, when sites request attestation of security keys, users are
// prompted in Google Chrome version 65 and later.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SecurityKeyPermitAttestationProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SecurityKeyPermitAttestation = 2;
}

// Automatically select client certificates matching filters for Google Chrome
// security signal reports.
//
// Configures filters to select which client certificates are included in Google
// Chrome security signal reports. These reports send browser and device posture
// information to Google Workspace, which administrators can use to configure
// Context-Aware Access (CAA) rules.
//
// This policy allows you to define filters based on client certificate
// attributes, such as the ISSUER and/or SUBJECT distinguished names. Google
// Chrome will only include certificates in the signal reports if they match at
// least one of the filters specified.
//
// Examples for the usage of the $SELECTOR section:
//
// * When $SELECTOR is set to { "ISSUER": { "CN": "$ISSUER_CN" } }, only client
// certificates issued by a certificate with the CommonName $ISSUER_CN are
// selected.
//
// * When $SELECTOR contains both the "ISSUER" and the "SUBJECT" sections, only
// client certificates that satisfy both conditions are selected.
//
// * When $SELECTOR contains a "SUBJECT" section with the "O" value, a
// certificate needs at least one organization matching the specified value to
// be selected.
//
// * When $SELECTOR contains a "SUBJECT" section with a "OU" value, a
// certificate needs at least one organizational unit matching the specified
// value to be selected.
//
// * When $SELECTOR is set to {}, empty details are ignored for this policy.
//
// Leaving the policy unset means there's no selection of client certificates
// during signal reporting.
//
// *Important:* This policy only takes effect if the
// UserSecuritySignalsReporting policy is enabled, which controls the overall
// feature for sending security signals from Chrome.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "ISSUER": {
//                 "properties": {
//                     "CN": {
//                         "type": "string"
//                     },
//                     "L": {
//                         "type": "string"
//                     },
//                     "O": {
//                         "type": "string"
//                     },
//                     "OU": {
//                         "type": "string"
//                     }
//                 },
//                 "type": "object"
//             },
//             "SUBJECT": {
//                 "properties": {
//                     "CN": {
//                         "type": "string"
//                     },
//                     "L": {
//                         "type": "string"
//                     },
//                     "O": {
//                         "type": "string"
//                     },
//                     "OU": {
//                         "type": "string"
//                     }
//                 },
//                 "type": "object"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: linux, mac, win
message SecuritySignalsClientCertificatesSelectorsProto {
  optional PolicyOptions policy_options = 1;
  optional string SecuritySignalsClientCertificatesSelectors = 2;
}

// Action on security token removal (e.g., smart card) for Google ChromeOS.
//
// Specifies what happens when a user who is authenticating via a security token
// (e.g., with a smart card) removes that token while in a session. IGNORE:
// Nothing happens. LOCK: The screen is locked until the user authenticates
// again. LOGOUT: The session is ended and the user is logged out. If this
// policy is not set, it defaults to IGNORE.
//
// Valid values:
//   IGNORE: No action happens.
//   LOGOUT: Log the user out.
//   LOCK: Lock the current session.
//
// Supported on: chrome_os
message SecurityTokenSessionBehaviorProto {
  optional PolicyOptions policy_options = 1;
  optional string SecurityTokenSessionBehavior = 2;
}

// Duration of the notification on smart card removal for Google ChromeOS.
//
// This policy only takes effect when the policy SecurityTokenSessionBehavior is
// set to LOCK or LOGOUT, and a user who authenticates via a smart card removes
// that smart card. Then, this policy specifies for how many seconds a
// notification which informs the user of the impending action is displayed.
// This notification is blocking the screen. The action will only happen after
// this notification expires. The user can prevent the action from happening by
// re-inserting the smart card before the notification expires. If this policy
// is set to zero, no notification will be displayed and the action happens
// immediately.
//
// Supported on: chrome_os
message SecurityTokenSessionNotificationSecondsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SecurityTokenSessionNotificationSeconds = 2;
}

// Controls whether the new HTML parser behavior for the &lt;select&gt; element
// is enabled
//
// The HTML parser is being changed to allow additional HTML tags inside the
// &lt;select&gt; element. This policy allows the old HTML parser behavior to be
// used until M138.
//
// If this policy is enabled or not set, then the HTML parser will allow
// additional tags inside the &lt;select&gt; element.
//
// If this policy is disabled, then the HTML parser will restrict which tags can
// be put inside the &lt;select&gt; element.
//
// Valid values:
//   True: New HTML parser behavior which allows more tags will be enabled.
//   False: New HTML parser behavior which allows more tags will be disabled.
//
// Supported on:
message SelectParserRelaxationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SelectParserRelaxationEnabled = 2;
}

// Enable select to speak
//
// Enable the select to speak accessibility feature.
//
// If this policy is set to true, the select to speak will always be enabled.
//
// If this policy is set to false, the select to speak will always be disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the select to speak is disabled initially but
// can be enabled by the user anytime.
//
// Valid values:
//   True: Enable select to speak
//   False: Disable select to speak
//   None: Allow the user to decide
//
// Supported on: chrome_os
message SelectToSpeakEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SelectToSpeakEnabled = 2;
}

// Control the new behavior for event dispatching on disabled form controls
//
// Event dispatching on disabled form controls is being changed in chromium in
// order to improve compatibility with other browsers and to improve developer
// experience.
//
// This change makes MouseEvents get dispatched on disabled form control
// elements except click, mouseup, and mousedown. The new events will include
// mousemove, mouseenter, and mouseleave for example.
//
// This change also truncates the event path of click, mouseup, and mousedown
// when they are dispatched on children of disabled form controls so they are
// not dispatched on the disabled form control or any of its ancestors.
//
// The new behavior may break some websites.
//
// If this policy is enabled, then the new behavior will be used.
//
// If this policy is disabled, then the old behavior will be used.
//
// If this policy is not set, then the new behavior will be used just like the
// rest of chromium users.
//
// Valid values:
//   True: New event dispatching on disabled form controls behavior will be
// used.
//   False: Old event dispatching on disabled form controls behavior will be
// used.
//   None: New event dispatching on disabled form controls behavior will be used
// by default.
//
// Supported on:
message SendMouseEventsDisabledFormControlsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SendMouseEventsDisabledFormControlsEnabled = 2;
}

// Allow access to sensors on these sites
//
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can access sensors like motion and light sensors.
//
// Leaving the policy unset means DefaultSensorsSetting applies for all sites,
// if it's set. If not, the user's personal setting applies.
//
// If the same URL pattern exists in both this policy and the
// SensorsBlockedForUrls policy, the latter is prioritized and access to motion
// or light sensors will be blocked.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SensorsAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SensorsAllowedForUrls = 2;
}

// Block access to sensors on these sites
//
// Setting the policy lets you set a list of URL patterns that specify the sites
// that can't access sensors like motion and light sensors.
//
// Leaving the policy unset means DefaultSensorsSetting applies for all sites,
// if it's set. If not, the user's personal setting applies.
//
// If the same URL pattern exists in both this policy and the
// SensorsAllowedForUrls policy, this policy is prioritized and access to motion
// or light sensors will be blocked.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SensorsBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SensorsBlockedForUrls = 2;
}

// Automatically grant permission to sites to connect all serial ports.
//
// Setting the policy allows you to list sites which are automatically granted
// permission to access all available serial ports.
//
// The URLs must be valid, otherwise the policy is ignored. Only the origin
// (scheme, host and port) of the URL is considered.
//
// On Google ChromeOS, this policy only applies to affiliated users.
//
// This policy overrides DefaultSerialGuardSetting, SerialAskForUrls,
// SerialBlockedForUrls and the user's preferences.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SerialAllowAllPortsForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SerialAllowAllPortsForUrls = 2;
}

// Automatically grant permission to sites to connect to USB serial devices.
//
// Setting the policy allows you to list sites which are automatically granted
// permission to access USB serial devices with vendor and product IDs matching
// the vendor_id and product_id fields. Omitting the product_id field allows the
// given sites permission to access devices with a vendor ID matching the
// vendor_id field and any product ID.
//
// The URLs must be valid, otherwise the policy is ignored. Only the origin
// (scheme, host and port) of the URL is considered.
//
// On ChromeOS, this policy only applies to affiliated users.
//
// This policy overrides DefaultSerialGuardSetting, SerialAskForUrls,
// SerialBlockedForUrls and the user's preferences.
//
// This policy only affects access to USB devices through the Web Serial API. To
// grant access to USB devices through the WebUSB API see the
// WebUsbAllowDevicesForUrls policy.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "devices": {
//                 "items": {
//                     "properties": {
//                         "product_id": {
//                             "maximum": 65535,
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "vendor_id": {
//                             "maximum": 65535,
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "required": [
//                         "vendor_id"
//                     ],
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "urls": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             }
//         },
//         "required": [
//             "devices",
//             "urls"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SerialAllowUsbDevicesForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional string SerialAllowUsbDevicesForUrls = 2;
}

// Allow the Serial API on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can ask users to grant them access to a serial port.
//
// Leaving the policy unset means DefaultSerialGuardSetting applies for all
// sites, if it's set. If not, users' personal settings apply.
//
// For URL patterns which do not match the policy SerialBlockedForUrls (if there
// is a match), DefaultSerialGuardSetting (if set), or the users' personal
// settings take precedence, in that order.
//
// If URL patterns conflict with SerialBlockedForUrls they will be ignored.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SerialAskForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SerialAskForUrls = 2;
}

// Block the Serial API on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can't ask users to grant them access to a serial port.
//
// Leaving the policy unset means DefaultSerialGuardSetting applies for all
// sites, if it's set. If not, the user's personal setting applies.
//
// For URL patterns which do not match the policy SerialAskForUrls (if there is
// a match), DefaultSerialGuardSetting (if set), or the users' personal settings
// take precedence, in that order.
//
// If URL patterns conflict with SerialAskForUrls this policy will take
// precedence.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SerialBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SerialBlockedForUrls = 2;
}

// Allow ServiceWorker to dispatch navigation requests without waiting for its
// startup
//
// https://github.com/WICG/service-worker-auto-preload
// The ServiceWorkerAutoPreload feature dispatches a network request for a main
// resource at the same time it begins the ServiceWorker bootstrap process.
//
// Setting the policy to Enabled or leaving it unset means
// Google Chrome enables ServiceWorkerAutoPreload. The navigation request is
// automatically dispatched while starting the ServiceWorker in some scenarios,
// e.g. ServiceWorker is not running,
//
// If it is disabled, Google Chrome will not enable ServiceWorkerAutoPreload.
// The navigation request is dispatched always after starting the ServiceWorker.
//
// This policy is a temporary measure to control the feature and will be removed
// in M154.
//
// Valid values:
//   True: Enable ServiceWorkerAutoPreload
//   False: Disable ServiceWorkerAutoPreload
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ServiceWorkerAutoPreloadEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ServiceWorkerAutoPreloadEnabled = 2;
}

// Allow ServiceWorker to control srcdoc iframes
//
// https://github.com/w3c/ServiceWorker/issues/765 asks srcdoc iframe with
// the "allow-same-origin" sandbox attribute to be under ServiceWorker control.
//
// Setting the policy to Enabled or leaving it unset means
// Google Chrome makes srcdoc iframes
// with "allow-same-origin" sandbox attributes to be under ServiceWorker
// control.
//
// Setting the policy to Disabled leaves the srcdoc iframe not controlled by
// ServiceWorker.
//
// This policy is intended to be temporary and will be removed in 2026.
//
// Valid values:
//   True: ServiceWorker can control srcdoc iframes
//   False: ServiceWorker won't control srcdoc iframes
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ServiceWorkerToControlSrcdocIframeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ServiceWorkerToControlSrcdocIframeEnabled = 2;
}

// Limit the length of a user session
//
// When this policy is set, it specifies the length of time after which a user
// is automatically logged out, terminating the session. The user is informed
// about the remaining time by a countdown timer shown in the system tray.
//
// When this policy is not set, the session length is not limited.
//
// If you set this policy, users cannot change or override it.
//
// The policy value should be specified in milliseconds. Values are clamped to a
// range of 30 seconds to 24 hours.
//
// Supported on: chrome_os
message SessionLengthLimitProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SessionLengthLimit = 2;
}

// Set the recommended locales for a managed session
//
// Setting the policy (as recommended only) moves recommended locales for a
// managed session to the top of the list, in the order in which they appear in
// the policy. The first recommended locale is preselected.
//
// If not set, the current UI locale is preselected.
//
// For more than one recommended locale, the assumption is that users want to
// choose among these locales. Locale and keyboard layout selection is prominent
// when starting a managed session. Otherwise, the assumption is that most users
// want the preselected locale. Locale and keyboard layout selection is less
// prominent when starting a managed session.
//
// If you set the policy and turn automatic sign-in on (see the
// DeviceLocalAccountAutoLoginId and DeviceLocalAccountAutoLoginDelay policies),
// the managed session uses the first recommended locale and the most popular
// matching keyboard layout.
//
// The preselected keyboard layout is always the most popular layout matching
// the preselected locale. Users can always choose any locale supported by
// Google ChromeOS for their session.
//
// Supported on: chrome_os
message SessionLocalesProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SessionLocales = 2;
}

// Control Javascript setTimeout() function minimum timeout.
//
// When the policy is set to Enabled, the Javascript setTimeout() with a timeout
// of 0ms will not clamp to 1ms.
// When the policy is set to Disabled,  the Javascript setTimeout() with a
// timeout of 0ms will clamp to 1ms.
// When the policy is unset, use the browser's default behavior for setTimeout()
// function clamp.
//
// This is a web standards compliant feature, but it may change task ordering
// on a web page, leading to unexpected behavior on sites that are dependent on
// a certain ordering in some way. It also may affect sites with a lot of
// setTimeout()
// with a timeout of 0ms usage, e.g. increasing CPU load.
//
// For users where this policy is unset, Chrome will roll out the change
// gradually on the stable channel.
//
// This policy was removed in Chrome 110.
//
// Valid values:
//   True: Javascript setTimeout() with a timeout of 0ms will not clamp to 1ms.
//   False: Javascript setTimeout() with a timeout of 0ms will clamp to 1ms.
//   None: 'Default behavior for setTimeout() function clamp.
//
// Supported on:
message SetTimeoutWithout1MsClampEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SetTimeoutWithout1MsClampEnabled = 2;
}

// Specifies whether SharedArrayBuffers can be used in a non cross-origin-
// isolated context
//
//
// Specifies whether SharedArrayBuffers can be used in a non cross-origin-
// isolated context. Google Chrome will require cross-origin isolation when
// using SharedArrayBuffers from Google Chrome 91 onward (2021-05-25) for Web
// Compatibility reasons. Additional details can be found on:
// https://developer.chrome.com/blog/enabling-shared-array-buffer/.
//
// When set to Enabled, sites can use SharedArrayBuffer with no restrictions.
//
// When set to Disabled or not set, sites can only use SharedArrayBuffers when
// cross-origin isolated.
//
// Valid values:
//   True: Allow sites to use SharedArrayBuffers
//   False: Prevent sites from using SharedArrayBuffers
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SharedArrayBufferUnrestrictedAccessAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SharedArrayBufferUnrestrictedAccessAllowed = 2;
}

// Enable the Shared Clipboard Feature
//
// This policy is deprecated and has no effect because the Shared Clipboard
// feature has been removed from Chrome.
//
// Original description:
// Enable the Shared Clipboard feature which allows users to send text between
// Chrome Desktops and an Android device when Sync is enabled and the user is
// Signed-in.
//
// If this policy is set to true, the capability of sending text, cross device,
// for chrome user is enabled.
//
// If this policy is set to false, the capability of sending text, cross device,
// for chrome user is disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the shared clipboard feature is enabled by
// default.
//
// It is up to the admins to set policies in all platforms they care about. It's
// recommended to set this policy to one value in all platforms.
//
// Valid values:
//   True: Enable the shared clipboard feature
//   False: Disable the shared clipboard feature
//   None: Allow the user to decide
//
// Supported on:
message SharedClipboardEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SharedClipboardEnabled = 2;
}

// Make SharedWorker blob URL behavior aligned with the specification
//
// Upon https://w3c.github.io/ServiceWorker/#control-and-use-worker-client,
// workers should inherit controllers for the blob URL.  However, existing code
// allows only DedicatedWorkers to inherit the controller, and SharedWorkers do
// not inherit the controller.
//
// Setting the policy to Enabled or leaving it unset means
// Google Chrome inherit the controller
// if a blob URL is used as a SharedWorker URL.
//
// Setting the policy to Disabled leaves the behavior not aligned with the
// specification as-is.
//
// This policy is intended to be temporary and will be removed in the future.
//
// Valid values:
//   True: A blob URL SharedWorker inherits a controller.
//   False: A blob URL SharedWorker does not inherit a controller. (legacy
// behavior)
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SharedWorkerBlobURLFixEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SharedWorkerBlobURLFixEnabled = 2;
}

// Enable extended lifetime for SharedWorkers
//
// SharedWorkers can have an extended lifetime if the "extendedLifetime" option
// is set to true in the SharedWorker constructor.
//
// If this policy is set to Enabled or left unset, SharedWorkers can have an
// extended lifetime.
//
// If this policy is set to Disabled, SharedWorkers cannot have an extended
// lifetime, even if the option is set to true.
//
// This policy is intended to be temporary and will be removed in the future.
//
// Valid values:
//   True: SharedWorkers can have an extended lifetime.
//   False: SharedWorkers cannot have an extended lifetime.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SharedWorkerExtendedLifetimeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SharedWorkerExtendedLifetimeEnabled = 2;
}

// Control the shelf position
//
// Control the position of the Google ChromeOS shelf.
//
// If this policy is set to 'Bottom', the shelf will be placed at the bottom of
// the screen.
//
// If this policy is set to 'Left', the shelf will be placed on the left side of
// the screen.
//
// If this policy is set to 'Right', the shelf will be placed on the right side
// of the screen.
//
// If you set this policy as mandatory, users cannot change or override it.
//
// If the policy is left not set, the shelf will be be positioned at the bottom
// of the screen by default and the user can change the shelf's position.
//
// Valid values:
//   Left: Position the shelf on the left side of the screen
//   Bottom: Position the shelf at the bottom of the screen
//   Right: Position the shelf on the right side of the screen
//
// Supported on: chrome_os
message ShelfAlignmentProto {
  optional PolicyOptions policy_options = 1;
  optional string ShelfAlignment = 2;
}

// Control shelf auto-hiding
//
// Setting the policy to Always will autohide the Google ChromeOS shelf. Setting
// the policy to Never ensures the shelf never autohides.
//
// If you set the policy, users can't change it. If not set, users decide
// whether the shelf autohides.
//
// Valid values:
//   Always: Always auto-hide the shelf
//   Never: Never auto-hide the shelf
//
// Supported on: chrome_os
message ShelfAutoHideBehaviorProto {
  optional PolicyOptions policy_options = 1;
  optional string ShelfAutoHideBehavior = 2;
}

// Allow the shopping list feature to be enabled
//
// This policy controls the availability of the shopping list feature.
// If enabled, users will be presented with UI to track the price of the product
// displayed on the current page. The tracked product will be shown in the
// bookmarks side panel.
// If this policy is set to Enabled or not set, the shopping list feature will
// be available to users.
// If this policy is set to Disabled, the shopping list feature will be
// unavailable.
//
// Valid values:
//   True: The shopping list feature will be available to users.
//   False: The shopping list feature will not be available to users.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message ShoppingListEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShoppingListEnabled = 2;
}

// Allow customization of system shortcuts
//
// This policy controls whether customization of system shortcuts is allowed.
//
// When this policy is enabled or unset, users will be able to customize system
// shortcuts through the Key Shortcuts App.
//
// When this policy is disabled, the Key Shortcuts app will be in read-only
// mode, disallowing any customization.
//
// Valid values:
//   True: Allow the user to customize system shortcuts
//   False: Disallow the user to customize system shortcuts
//
// Supported on: chrome_os
message ShortcutCustomizationAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShortcutCustomizationAllowed = 2;
}

// Show accessibility options in system tray menu
//
// Setting the policy to True displays the accessibility options in the system
// tray menu. If you set the policy to False, the options don't appear in the
// menu.
//
// If you set the policy, users can't change it. If not set, accessibility
// options don't appear in the menu, but users can make them appear through the
// Settings page.
//
// If you turn on accessibility features by other means (for example, by key
// combination), accessibility options always appear in the system tray menu.
//
// Valid values:
//   True: Show accessibility options in the system tray menu
//   False: Hide accessibility options in the system tray menu
//   None: Allow the user to decide
//
// Supported on: chrome_os
message ShowAccessibilityOptionsInSystemTrayMenuProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowAccessibilityOptionsInSystemTrayMenu = 2;
}

// Enable displaying the introduction screen for in-session AI features during
// sign-in flow
//
// This policy controls if the introduction screen for in-session AI features is
// shown to the user during the first sign-in flow.
//
// If set to disabled, the AI introduction screen will not be displayed.
//
// If set to enabled, the AI introduction screen will be displayed.
//
// If unset, the AI introduction screen will be skipped for enterprise-managed
// users and displayed for unmanaged users.
//
// Valid values:
//   True: Display the AI introduction screen during sign-in
//   False: Do not display the AI introduction screen during sign-in
//
// Supported on: chrome_os
message ShowAiIntroScreenEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowAiIntroScreenEnabled = 2;
}

// Show the apps shortcut in the bookmark bar
//
// Setting the policy to True displays the apps shortcut. Setting the policy to
// False means this shortcut never appears.
//
// If you set the policy, users can't change it. If not set, users decide to
// show or hide the apps shortcut from the bookmark bar context menu.
//
// Valid values:
//   True: Show the apps shortcut in the bookmark bar
//   False: Do not show the apps shortcut in the bookmark bar
//   None: Allow the user to decide
//
// Supported on: fuchsia, linux, mac, win
message ShowAppsShortcutInBookmarkBarProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowAppsShortcutInBookmarkBar = 2;
}

// Show the Google Cast toolbar icon
//
// Setting the policy to Enabled displays the Cast toolbar icon on the toolbar
// or the overflow menu, and users can't remove it.
//
// Setting the policy to Disabled or leaving it unset lets users pin or remove
// the icon through its contextual menu.
//
// If the policy EnableMediaRouter is set to Disabled, then this policy's value
// has no effect, and the toolbar icon doesn't appear.
//
// Valid values:
//   True: Always show the Google Cast icon in the toolbar
//   False: Do not show the Google Cast icon in the toolbar by default, but let
// users choose
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message ShowCastIconInToolbarProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowCastIconInToolbar = 2;
}

// Show media controls for Google Cast sessions started by other devices on the
// local network
//
// When this policy is enabled, media playback controls UI is available for
// Google Cast sessions started by other devices on the local network.
//
// When this policy is unset for enterprise users or is disabled, media playback
// controls UI is unavailable for Google Cast sessions started by other devices
// on the local network.
//
// If the policy EnableMediaRouter is disabled, then this policy's value has no
// effect, as the entire Google Cast functionality is disabled.
//
// Valid values:
//   True: Show media controls for Google Cast sessions started by other devices
//   False: Do not show media controls for Google Cast sessions started by other
// devices
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message ShowCastSessionsStartedByOtherDevicesProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowCastSessionsStartedByOtherDevices = 2;
}

// Enable displaying display size setting screen during sign-in
//
// This policy controls if the display size setting screen is shown to the user
// during the first sign-in.
// If set to false, the display size setting screen will not be displayed.
// If set to true, the display size setting screen will be displayed.
//
// Valid values:
//   True: Display the display size setting screen during sign-in
//   False: Do not display the display size setting screen during sign-in
//
// Supported on: chrome_os
message ShowDisplaySizeScreenEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowDisplaySizeScreenEnabled = 2;
}

// Show Full URLs
//
// This feature enables display of the full URL in the address bar.
// If this policy is set to True, then the full URL will be shown in the address
// bar, including schemes and subdomains.
// If this policy is set to False, then the default URL display will apply.
// If this policy is left unset, then the default URL display will apply and the
// user will be able to toggle between default and full URL display with a
// context menu option.
//
// Valid values:
//   True: Display the full URL
//   False: Display the default URL
//   None: Display the default URL, allow users to switch to the full URL
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ShowFullUrlsInAddressBarProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowFullUrlsInAddressBar = 2;
}

// Enable displaying the introduction screen for Gemini during sign-in flow
//
// This policy controls if the introduction screen for Gemini is shown to the
// user during the first sign-in flow.
//
// If set to disabled, the Gemini introduction screen will not be displayed.
//
// If set to enabled, the Gemini introduction screen will be displayed.
//
// If unset, the Gemini introduction screen will be skipped for enterprise-
// managed users and displayed for unmanaged users.
//
// Valid values:
//   True: Display the Gemini introduction screen during sign-in
//   False: Do not display the Gemini introduction screen during sign-in
//
// Supported on: chrome_os
message ShowGeminiIntroScreenEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowGeminiIntroScreenEnabled = 2;
}

// Show Home button on toolbar
//
// Setting the policy to Enabled shows the Home button on Google Chrome's
// toolbar. Setting the policy to Disabled keeps the Home button from appearing.
//
// If you set the policy, users can't change it in Google Chrome. If not set,
// users chooses whether to show the Home button.
//
// Valid values:
//   True: Show the Home button on the toolbar
//   False: Hide the Home button from the toolbar
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message ShowHomeButtonProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowHomeButton = 2;
}

// Enable displaying human presence sensor screen during sign-in
//
// This policy controls if the human presence sensor screen is shown to the user
// during the first sign-in.
// If set to false, the human presence sensor screen will not be displayed.
// If set to true, the human presence sensor screen will be displayed.
// If the policy is left not set, the default value false applies for
// enterprise-managed users and true will be used for non-managed users.
//
// Valid values:
//   True: Display the human presence sensor screen during sign-in
//   False: Do not display the human presence sensor screen during sign-in
//
// Supported on: chrome_os
message ShowHumanPresenceSensorScreenEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowHumanPresenceSensorScreenEnabled = 2;
}

// Add a logout button to the system tray
//
// Setting the policy to True displays a big, red sign-out button in the system
// tray during active sessions while the screen isn't locked.
//
// Setting the policy to False or leaving it unset means no button appears.
//
// Valid values:
//   True: Show logout button in tray
//   False: Do not show logout button in tray
//
// Supported on: chrome_os
message ShowLogoutButtonInTrayProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowLogoutButtonInTray = 2;
}

// Enable displaying touchpad scrolling direction screen during sign-in
//
// This policy controls if the touchpad scrolling direction screen is shown to
// the user during the first sign-in.
// If set to false, the touchpad scrolling direction screen will not be
// displayed.
// If set to true, the touchpad scrolling direction screen will be displayed.
//
// Valid values:
//   True: Display the touchpad scrolling direction screen during sign-in
//   False: Do not display the touchpad scrolling direction screen during sign-
// in
//
// Supported on: chrome_os
message ShowTouchpadScrollScreenEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ShowTouchpadScrollScreenEnabled = 2;
}

// Allow showing the most recent default search engine results page in a Browser
// side panel
//
// Setting the policy to Enabled or leaving the policy unset means that users
// can bring up their most recent default search engine results page in a side
// panel via toggling an icon in the toolbar.
//
// Setting the policy to Disabled removes the icon from the toolbar that opens
// the side panel with the default search engine results page.
//
// Valid values:
//   True: Enable showing default search engine results pages in a Browser side
// panel.
//   False: Disable showing default search engine results pages in a Browser
// side panel.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SideSearchEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SideSearchEnabled = 2;
}

// Enable Signed HTTP Exchange (SXG) support
//
// Setting the policy to True or leaving it unset means Google Chrome will
// accept web contents served as Signed HTTP Exchanges.
//
// Setting the policy to False prevents Signed HTTP Exchanges from loading.
//
// Valid values:
//   True: Accept web contents served as Signed HTTP Exchanges
//   False: Prevent Signed HTTP Exchanges from loading
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SignedHTTPExchangeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SignedHTTPExchangeEnabled = 2;
}

// Allow sign in to Google Chrome
//
// This policy is deprecated, consider using BrowserSignin instead.
//
// Allows the user to sign in to Google Chrome.
//
// Setting this policy to Enabled will allow the user to sign in to Google
// Chrome.
// Setting this policy to Disabled will prevent sign in. It also blocks apps and
// extensions that use the chrome.identity API from functioning. To avoid that,
// use SyncDisabled instead.
//
// Valid values:
//   True: Allow users to sign in to Google Chrome
//   False: Prevent users from signing in to Google Chrome
//
// Supported on: android, linux, mac, win
message SigninAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SigninAllowed = 2;
}

// Enable signin interception
//
// This settings enables or disables signin interception.
//
// When this policy not set or is enabled, the signin interception dialog
// triggers when a Google account is added on the web, and the user may benefit
// from moving this account to another (new or existing) profile.
//
// When this is disabled, the signin interception dialog does not trigger.
// When this is disabled, a dialog will still be shown if managed account
// profile separation is enforced by ManagedAccountsSigninRestriction.
//
// Valid values:
//   True: Enable signin interception
//   False: Disable signin interception
//   None: Enable signin interception
//
// Supported on: fuchsia, linux, mac, win
message SigninInterceptionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SigninInterceptionEnabled = 2;
}

// Enable Silent Printing
//
// Setting this policy to true enables silent printing, which immediately closes
// print preview window when opened and prints to the default printer with
// default options. If the default printer is 'Save as PDF', the file will be
// saved to the Downloads folder.
//
// Not setting this policy or setting this policy to false disables silent
// printing, which doesn't automatically close print preview window and requires
// the user to make a selection as usual.
//
// Valid values:
//   True: Enable Silent Printing
//   False: Disable Silent Printing
//
// Supported on: chrome_os, linux, mac, win
message SilentPrintingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SilentPrintingEnabled = 2;
}

// Require Site Isolation for every site
//
// Since Google Chrome 67, site isolation has been enabled by default on all
// Desktop platforms, causing every site to run in its own process. A site is a
// scheme plus eTLD+1 (e.g., https://example.com). Setting this policy to
// Enabled does not change that behavior; it only prevents users from opting out
// (for example, using Disable site isolation in chrome://flags). Since Google
// Chrome 76, setting the policy to Disabled or leaving it unset doesn't turn
// off site isolation, but instead allows users to opt out.
//
// IsolateOrigins might also be useful for isolating specific origins at a finer
// granularity than site (e.g., https://a.example.com).
//
// On Google ChromeOS version 76 and earlier, set the
// DeviceLoginScreenSitePerProcess device policy to the same value. (If the
// values don't match, a delay can occur when entering a user session.)
//
// Note: For Android, use the SitePerProcessAndroid policy instead.
//
// Valid values:
//   True: Require site isolation for all websites
//   False: Enable site isolation for all websites, but allow the user to opt
// out
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SitePerProcessProto {
  optional PolicyOptions policy_options = 1;
  optional bool SitePerProcess = 2;
}

// Enable Site Isolation for every site
//
// Setting the policy to Enabled isolates all sites on Android, such that each
// site runs in its own process, and it prevents users from opting out. A site
// is a scheme plus eTLD+1 (e.g., https://example.com). Note that Android
// isolates certain sensitive sites by default starting in Google Chrome version
// 77, and this policy extends that default site isolation mode to apply to all
// sites.
//
// Setting the policy to Disabled turns off any form of site isolation,
// including isolation of sensitive sites and field trials of
// IsolateOriginsAndroid, SitePerProcessAndroid, and other site isolation modes.
// Users can still turn the policy on manually.
//
// Leaving the policy unset means users can change this setting.
//
// IsolateOriginsAndroid might also be useful for isolating specific origins at
// a finer granularity than site (e.g., https://a.example.com).
//
// Note: Support for isolating every site on Android will improve, but currently
// it may cause performance problems, especially on low-end devices. This policy
// applies only to Chrome on Android running on devices with strictly more than
// 1 GB of RAM. To isolate specific sites while limiting performance impact for
// users, use IsolateOriginsAndroid with a list of the sites you want to
// isolate.  To apply the policy on non-Android platforms, use SitePerProcess.
//
// Valid values:
//   True: Require site isolation for all websites
//   False: Disable site isolation for all websites, but allow the user to
// enable it
//   None: Allow the user to decide
//
// Supported on: android
message SitePerProcessAndroidProto {
  optional PolicyOptions policy_options = 1;
  optional bool SitePerProcessAndroid = 2;
}

// Site search settings
//
// This policy provides a list of sites that users can quickly search using
// shortcuts in the address bar. Users can initiate a search by typing the
// shortcut or @shortcut (e.g. @work), followed by Space or Tab, in the address
// bar.
//
// The following fields are required for each site: name, shortcut, url.
//
// The name field corresponds to the site or search engine name to be shown to
// the user in the address bar.
//
// The shortcut can include plain words and characters, but cannot include
// spaces or start with the @ symbol. Shortcuts must also be unique.
//
// For each entry, the url field specifies the URL of the search engine used
// during a search with the corresponding keyword. The URL must include the
// string '{searchTerms}', replaced in the query by the user's search terms.
// Invalid entries and entries with duplicate shortcuts are ignored.
//
// Site search entries configured as featured are displayed in the address bar
// when the user types "@". Up to three entries can be selected as featured.
//
// For a site search entry where allow_user_override is true, users have the
// ability to edit or disable that entry. However, featured engines (beginning
// with "@") can only be disabled. If a user modifies an entry that was
// initially created by this policy, it will no longer be managed by policy and
// will be treated like a user-created shortcut. When allow_user_override is
// false or unspecified for a site search entry, users cannot edit or disable
// that entry. The setting to allow user override is only supported on M139 and
// later; earlier versions will default to disabling user override.
//
// Users cannot create new site search entries with a shortcut previously
// created via this policy unless allow_user_override is set to true for the
// site search entry.
//
// In case of a conflict with a shortcut previously created by the user, the
// user setting takes precedence. However, users can still trigger the option
// created by the policy by typing "@" in the search bar. For example, if the
// user already defined "work" as a shortcut to URL1 and the policy defines
// "work" as a shortcut to URL2, then typing "work" in the search bar will
// trigger a search to URL1, but typing "@work" in the search bar will trigger a
// search to URL2.
//
// On Microsoft® Windows®, this policy is only available on instances that are
// joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure®
// Active Directory® or enrolled in Chrome Enterprise Core.
//
// On macOS, this policy is only available on instances that are managed via
// MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "allow_user_override": {
//                 "type": "boolean"
//             },
//             "featured": {
//                 "type": "boolean"
//             },
//             "name": {
//                 "type": "string"
//             },
//             "shortcut": {
//                 "type": "string"
//             },
//             "url": {
//                 "type": "string"
//             }
//         },
//         "required": [
//             "shortcut",
//             "name",
//             "url"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, linux, mac, win
message SiteSearchSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional string SiteSearchSettings = 2;
}

// Allow Smart Card connection by Isolated Apps
//
// Setting the policy specifies which Isolated Web Apps (IWAs) can connect to
// smart cards using Web Smart Card API without having the user prompted for
// permission.
//
// This policy overrides the behavior of DefaultSmartCardConnectSetting and is
// overridden by SmartCardConnectBlockedForUrls.
//
// By default, IWAs that specify Smart Card permissions within their manifest
// can connect to smart cards provided that user grants the permission
// interactively per-reader.
//
// Supported on: chrome_os
message SmartCardConnectAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SmartCardConnectAllowedForUrls = 2;
}

// Block Smart Card connection by Isolated Apps
//
// Setting the policy specifies which Isolated Web Apps (IWAs) won't be able to
// connect to smart card readers (users won't even be prompted for permission).
//
// This policy overrides the behavior of DefaultSmartCardConnectSetting and
// SmartCardConnectAllowedForUrls.
//
// By default, IWAs that specify Smart Card permissions within their manifest
// can connect to smart cards provided that user grants the permission
// interactively per-reader.
//
// Supported on: chrome_os
message SmartCardConnectBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SmartCardConnectBlockedForUrls = 2;
}

// Allow Smart Lock Signin to be used.
//
// If this setting is enabled, users will be allowed to sign into their account
// with Smart Lock. This is more permissive than usual Smart Lock behavior which
// only allows users to unlock their screen.
//
// If this setting is disabled, users will not be allowed to use Smart Lock
// Signin.
//
// If this policy is left not set, the default is not allowed for enterprise-
// managed users and allowed for non-managed users.
//
// Valid values:
//   True: Allow users to sign into their device with Smart Lock
//   False: Do not allow users to sign into their device with Smart Lock
//
// Supported on:
message SmartLockSigninAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SmartLockSigninAllowed = 2;
}

// Smart tab sharing settings
//
// This policy controls the smart tab sharing feature of Google AI Mode through
// Google Chrome side panel or tabs.
//
// Note that this policy doesn't affect Google AI Mode on the web. It only
// controls how users can share information with it when using Google Chrome.
//
// 0 = users can share page or file content with Google AI Mode.
//
// 1 = users cannot share page or file content with Google AI Mode. The entry
// points for sharing context and the side panel will be disabled or hidden.
//
// This policy will be ignored when Google Search is not users' default search
// engine as the feature is disabled.
//
// This policy is independent of the AIModeSettings policy. The AIModeSettings
// policy only controls entry points on omnibox or NTP search box, while this
// policy controls context sharing through side panel or tabs.
//
// This policy also doesn't control Google Gemini integration which can be
// disabled by GeminiSettings.
//
// Note that if SearchContentSharingSettings is disabled, this policy will be
// ignored.
//
// If this policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow smart tab sharing with Google AI Mode integrations.
//   1: Do not allow smart tab sharing with Google AI Mode integrations.
//
// Supported on: chrome_os, linux, mac, win
message SmartTabSharingSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SmartTabSharingSettings = 2;
}

// Allow SMS Messages to be synced from phone to Chromebook.
//
// Setting the policy to Enabled lets users set up their devices to sync their
// text messages to Chromebooks. Users must explicitly opt in to this feature by
// completing a setup flow. On completion, users can send and receive texts on
// their Chromebooks.
//
// Setting the policy to Disabled means users can't set up text syncing.
//
// Leaving the policy unset means that by default, the feature isn't allowed for
// managed users but is allowed for other users.
//
// Valid values:
//   True: Allow users to sync SMS messages between their phone and Chromebook
//   False: Do not allow users to sync SMS messages between their phone and
// Chromebook
//
// Supported on: chrome_os
message SmsMessagesAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SmsMessagesAllowed = 2;
}

// Enable or disable spell checking web service
//
// Setting the policy to Enabled puts a Google web service in use to help
// resolve spelling errors. This policy only controls the use of the online
// service. Setting the policy to Disabled means this service is never used.
//
// Leaving the policy unset lets users choose whether to use the spellcheck
// service.
//
// The spell check can always use a downloaded dictionary locally unless the
// feature is disabled by SpellcheckEnabled in which case this policy will have
// no effect.
//
// Valid values:
//   True: Use a Google web service to help resolve spelling errors
//   False: Do not use any Google web services to help resolve spelling errors
//   None: Allow the user to choose if Google web services are used to resolve
// spelling errors
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SpellCheckServiceEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SpellCheckServiceEnabled = 2;
}

// Enable spellcheck
//
// Setting the policy to Enabled turns spellcheck on, and users can't turn it
// off. On Microsoft® Windows®, Google ChromeOS and Linux®, spellcheck languages
// can be switched on or off individually, so users can still turn spellcheck
// off by switching off every spellcheck language. To avoid that, use the
// SpellcheckLanguage to force-enable specific spellcheck languages.
//
// Setting the policy to Disabled turns off spellcheck from all sources, and
// users can't turn it on. The SpellCheckServiceEnabled, SpellcheckLanguage and
// SpellcheckLanguageBlocklist policies have no effect when this policy is set
// to False.
//
// Leaving the policy unset lets users turn spellcheck on or off in the language
// settings.
//
// Valid values:
//   True: Enable spellcheck
//   False: Disable spellcheck
//   None: Allow the user to enable or disable spellcheck
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SpellcheckEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SpellcheckEnabled = 2;
}

// Force enable spellcheck languages
//
// Force-enables spellcheck languages. Unrecognized languages in the list will
// be ignored.
//
// If you enable this policy, spellcheck will be enabled for the languages
// specified, in addition to the languages for which the user has enabled
// spellcheck.
//
// If you do not set this policy, or disable it, there will be no change to the
// user's spellcheck preferences.
//
// If the SpellcheckEnabled policy is set to false, this policy will have no
// effect.
//
// If a language is included in both this policy and the
// SpellcheckLanguageBlocklist policy, this policy is prioritized and the
// spellcheck language is enabled.
//
// The currently supported languages are: af, bg, ca, cs, da, de, el, en-AU, en-
// CA, en-GB, en-US, es, es-419, es-AR, es-ES, es-MX, es-US, et, fa, fo, fr, he,
// hi, hr, hu, id, it, ko, lt, lv, nb, nl, pl, pt-BR, pt-PT, ro, ru, sh, sk, sl,
// sq, sr, sv, ta, tg, tr, uk, vi.
//
// Supported on: chrome_os, linux, win
message SpellcheckLanguageProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SpellcheckLanguage = 2;
}

// Force disable spellcheck languages
//
// This policy is deprecated, please use SpellcheckLanguageBlocklist instead.
//
// Force-disables spellcheck languages. Unrecognized languages in that list will
// be ignored.
//
// If you enable this policy, spellcheck will be disabled for the languages
// specified. The user can still enable or disable spellcheck for languages not
// in the list.
//
// If you do not set this policy, or disable it, there will be no change to the
// user's spellcheck preferences.
//
// If the SpellcheckEnabled policy is set to false, this policy will have no
// effect.
//
// If a language is included in both this policy and the SpellcheckLanguage
// policy, the latter is prioritized and the spellcheck language will be
// enabled.
//
// The currently supported languages are: af, bg, ca, cs, da, de, el, en-AU, en-
// CA, en-GB, en-US, es, es-419, es-AR, es-ES, es-MX, es-US, et, fa, fo, fr, he,
// hi, hr, hu, id, it, ko, lt, lv, nb, nl, pl, pt-BR, pt-PT, ro, ru, sh, sk, sl,
// sq, sr, sv, ta, tg, tr, uk, vi.
//
// Supported on:
message SpellcheckLanguageBlacklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SpellcheckLanguageBlacklist = 2;
}

// Force disable spellcheck languages
//
// Force-disables spellcheck languages. Unrecognized languages in that list will
// be ignored.
//
// If you enable this policy, spellcheck will be disabled for the languages
// specified. The user can still enable or disable spellcheck for languages not
// in the list.
//
// If you do not set this policy, or disable it, there will be no change to the
// user's spellcheck preferences.
//
// If the SpellcheckEnabled policy is set to false, this policy will have no
// effect.
//
// If a language is included in both this policy and the SpellcheckLanguage
// policy, the latter is prioritized and the spellcheck language will be
// enabled.
//
// The currently supported languages are: af, bg, ca, cs, da, de, el, en-AU, en-
// CA, en-GB, en-US, es, es-419, es-AR, es-ES, es-MX, es-US, et, fa, fo, fr, he,
// hi, hr, hu, id, it, ko, lt, lv, nb, nl, pl, pt-BR, pt-PT, ro, ru, sh, sk, sl,
// sq, sr, sv, ta, tg, tr, uk, vi.
//
// Supported on: chrome_os, linux, win
message SpellcheckLanguageBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SpellcheckLanguageBlocklist = 2;
}

// Enable spoken feedback
//
// Setting the policy to True keeps spoken feedback on. Setting the policy to
// False keeps spoken feedback off.
//
// If you set the policy, users can't change it. If not set, spoken feedback is
// off at first, but users can turn it on any time.
//
// Valid values:
//   True: Enable spoken feedback
//   False: Disable spoken feedback
//   None: Allow the user to decide
//
// Supported on: chrome_os
message SpokenFeedbackEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SpokenFeedbackEnabled = 2;
}

// Enable Standardized Browser Zoom Behavior
//
// This policy enables conformance to the newly-adopted specification of CSS
// zoom.
//
// When this policy is Enabled or unset, the CSS "zoom" property will adhere to
// the specification:
//
// https://drafts.csswg.org/css-viewport/#zoom-property
//
// When Disabled, the CSS "zoom" property will fall back to its legacy pre-
// standardized behavior.
//
// This policy is a temporary reprieve to allow time to migrate web content to
// the new behavior. There is also an origin trial
// ("DisableStandardizedBrowserZoom") that corresponds to the behavior when this
// policy is Disabled. This policy will be removed and the "Enabled" behavior
// made permanent in milestone 134.
//
// Valid values:
//   True: Enabled: CSS zoom conforms to the standard specification.
//   False: Disabled: CSS zoom preserves its legacy pre-standard behavior.
//
// Supported on: android, chrome_os, linux, mac, win
message StandardizedBrowserZoomEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool StandardizedBrowserZoomEnabled = 2;
}

// Suppress launching of browser window
//
// Setting the policy to True prevents the browser window from launching at the
// start of the session.
//
// Setting the policy to False or leaving it unset allows the window to launch.
//
// Note: The browser window might not launch due to other policies or command-
// line flags.
//
// Valid values:
//   True: Do not launch the browser on startup
//   False: Automatically launch the browser on startup
//
// Supported on: chrome_os
message StartupBrowserWindowLaunchSuppressedProto {
  optional PolicyOptions policy_options = 1;
  optional bool StartupBrowserWindowLaunchSuppressed = 2;
}

// Control whether storage quota APIs will return static values
//
// When enabled, the storage quota APIs will return a static value equal to
// usage + min(10 GiB, disk rounded up to the nearest 1 GiB).
// When disabled, the storage quota APIs will generally return a dynamic value
// proportional to the total space available on the device, regardless of usage.
// If unset, the storage quota APIs will use the default Chrome behavior.
// Sites with unlimited storage permissions are unaffected by this setting.
// Enforced quota is also unaffected.
//
// Valid values:
//   True: Storage quota APIs return static values.
//   False: Storage quota APIs return dynamic values.
//   None: Storage quota APIs return values based on feature launch process.
//
// Supported on: android, chrome_os, linux, mac, win
message StaticStorageQuotaEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool StaticStorageQuotaEnabled = 2;
}

// Enable sticky keys
//
// Setting the policy to True keeps sticky keys on. Setting the policy to False
// keeps sticky keys off.
//
// If you set the policy, users can't change it. If not set, sticky keys is off
// at first, but users can turn it on any time.
//
// Valid values:
//   True: Enable sticky keys
//   False: Disable sticky keys
//   None: Allow the user to decide
//
// Supported on: chrome_os
message StickyKeysEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool StickyKeysEnabled = 2;
}

// Enable strict MIME type checking for worker scripts
//
// This policy enables strict MIME type checking for worker scripts.
//
// When enabled or unset, then worker scripts will use strict MIME type checking
// for JavaScript, which is the new default behaviour. Worker scripts with
// legacy MIME types will be rejected.
//
// When disabled, then worker scripts will use lax MIME type checking, so that
// worker scripts with legacy MIME types, e.g. text/ascii, will continue to be
// loaded and executed.
//
// Browsers traditionally used lax MIME type checking, so that resources with a
// number of legacy MIME types were supported. E.g. for JavaScript resources,
// text/ascii is a legacy supported MIME type. This may cause security issues,
// by allowing to load resources as scripts that were never intended to be used
// as such. Chrome will transition to use strict MIME type checking in the near
// future. The enabled policy will track the default behaviour. Disabling this
// policy allows administrators to retain the legacy behaviour, if desired.
//
// See https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguage
// for details about JavaScript / ECMAScript media types.
//
// Valid values:
//   True: Scripts for workers (Web Workers, Service Workers, etc.) require a
// JavaScript MIME type, like text/javascript. Worker scripts with legacy MIME
// types, like text/ascii, will be rejected.
//   False: Scripts for workers (Web Workers, Service Workers, etc.) use lax
// MIME type checking. Worker scripts with legacy MIME types, like text/ascii,
// will work.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message StrictMimetypeCheckForWorkerScriptsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool StrictMimetypeCheckForWorkerScriptsEnabled = 2;
}

// Enable stricter treatment for mixed content
//
// This policy has been removed as of M85, please use
// InsecureContentAllowedForUrls to allow insecure content on a per-site basis
// instead.
// This policy controls the treatment for mixed content (HTTP content in HTTPS
// sites) in the browser.
// If the policy is set to true or unset, audio and video mixed content will be
// autoupgraded to HTTPS (i.e. the URL will be rewritten as HTTPS, without a
// fallback if the resource is not available over HTTPS) and a 'Not Secure'
// warning will be shown in the URL bar for image mixed content.
// If the policy is set to false, autoupgrades will be disabled for audio and
// video, and no warning will be shown for images.
// This policy does not affect other types of mixed content other than audio,
// video, and images.
// This policy will no longer take effect starting in Google Chrome 84.
//
// Valid values:
//   True: Enable autoupgrades to HTTPS for audio and video, and show 'Not
// Secure' warning for images.
//   False: Disable autoupgrades to HTTPS for audio and video, and show no
// warning for images.
//
// Supported on:
message StricterMixedContentTreatmentEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool StricterMixedContentTreatmentEnabled = 2;
}

// Allow subApps APIs to be called without prior user gesture or requiring user
// confirmation.
//
// For security reasons, the
// subApps.add(),
// subApps.remove() and
// subApps.list() web APIs
// require a prior user gesture ("transient activation") to be called or will
// otherwise fail. In addition, the user will be requested to confirm the
// operation via a confirmation dialog.
//
// With this policy set, admins can specify origins on which these APIs can be
// called without prior user gesture, nor asking the user for confirmation.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/. * is
// not an accepted value for this policy.
//
// If this policy is unset, all origins will require a prior user gesture to
// call
// these APIs, and will present a confirmation dialog to the user.
//
// Supported on: chrome_os, fuchsia
message SubAppsAPIsAllowedWithoutGestureAndAuthorizationForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SubAppsAPIsAllowedWithoutGestureAndAuthorizationForOrigins = 2;
}

// Allow Isolated Web Apps to use Sub Apps Add API without user prompt
//
// By default, Isolated Web Apps (IWAs) can add Sub Apps provided the user
// confirms the prompt interactively.
//
// This policy controls which IWA origins will be able to add Sub Apps without
// having the user prompted.
//
// This policy overrides the behavior of DefaultSubAppsWithoutPromptsSetting and
// is overridden by SubAppsWithoutPromptsBlockedForOrigins.
//
// Supported on: chrome_os, linux, mac, win
message SubAppsWithoutPromptsAllowedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SubAppsWithoutPromptsAllowedForOrigins = 2;
}

// Block Isolated Web Apps from using Sub Apps Add API without user prompt
//
// By default, Isolated Web Apps (IWAs) can add Sub Apps provided that user
// confirms the prompt interactively.
//
// This policy controls which IWA origins will be blocked from adding Sub Apps
// without having the user prompted interactively.
//
// This policy overrides the behavior of DefaultSubAppsWithoutPromptsSetting and
// SubAppsWithoutPromptsAllowedForOrigins.
//
// Supported on: chrome_os, linux, mac, win
message SubAppsWithoutPromptsBlockedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SubAppsWithoutPromptsBlockedForOrigins = 2;
}

// Display the logout confirmation dialog
//
// The policy only applies to managed guest sessions.
// Setting the policy to True or leaving it unset will show a dialog asking the
// user to confirm or deny logout when the last window is closed.
// Setting the policy to False will prevent the dialog from being displayed and
// therefore also disables auto-logout after closing the last window.
//
// Valid values:
//   True: Show logout dialog on last window closed.
//   False: Suppress showing logout dialog on last window closed.
//
// Supported on: chrome_os
message SuggestLogoutAfterClosingLastWindowProto {
  optional PolicyOptions policy_options = 1;
  optional bool SuggestLogoutAfterClosingLastWindow = 2;
}

// Enable Suggested Content
//
// This feature enables suggestions for new content to explore. Includes apps,
// webpages, and more.
// If this policy is set to True, then suggestions for new content to explore
// will be enabled.
// If this policy is set to False, then suggestions for new content to explore
// will be disabled.
// If this policy is left unset, then suggestions for new content to explore
// will be disabled for managed users and enabled for other users.
//
// Valid values:
//   True: Enable suggested content
//   False: Disable suggested content
//
// Supported on: chrome_os
message SuggestedContentEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SuggestedContentEnabled = 2;
}

// Enable the supervised user content provider
//
// If true and the user is a supervised user then other Android apps can query
// the user's web restrictions through a content provider.
//
// If false or unset then the content provider returns no information.
//
// Supported on:
message SupervisedUserContentProviderEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SupervisedUserContentProviderEnabled = 2;
}

// Enable creation of supervised users
//
// If set to false, supervised-user creation by this user will be disabled. Any
// existing supervised users will still be available.
//
// If set to true or not configured, supervised users can be created and managed
// by this user.
//
// Valid values:
//   True: Enable creation of supervised users
//   False: Disable creation of supervised users
//
// Supported on:
message SupervisedUserCreationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SupervisedUserCreationEnabled = 2;
}

// Suppress JavaScript Dialogs triggered from different origin subframes
//
// As described in https://www.chromestatus.com/feature/5148698084376576 ,
// JavaScript modal dialogs, triggered by window.alert, window.confirm, and
// window.prompt, will be blocked in Google Chrome if triggered from a subframe
// whose origin is different from the main frame origin.
//
// This policy allows overriding that change.
// If the policy is set to enabled or unset, JavaScript dialogs triggered from a
// different origin subframe will be blocked.
// If the policy is set to disabled, JavaScript dialogs triggered from a
// different origin subframe will not be blocked.
//
// This policy will be removed from Google Chrome in the future.
//
// Valid values:
//   True: Block JavaScript dialogs triggered from a different origin subframe.
//   False: Allow JavaScript dialogs triggered from a different origin subframe.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message SuppressDifferentOriginSubframeDialogsProto {
  optional PolicyOptions policy_options = 1;
  optional bool SuppressDifferentOriginSubframeDialogs = 2;
}

// Suppress the unsupported OS warning
//
// Setting the policy to Enabled suppresses the warning that appears when Google
// Chrome is running on an unsupported computer or operating system.
//
// Setting the policy to Disabled or leaving it unset means the warnings appear
// on unsupported systems.
//
// Valid values:
//   True: Suppress warnings when Chrome is running on an unsupported system
//   False: Allow Chrome to display warnings when running on an unsupported
// system
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message SuppressUnsupportedOSWarningProto {
  optional PolicyOptions policy_options = 1;
  optional bool SuppressUnsupportedOSWarning = 2;
}

// Disable synchronization of data with Google
//
// Setting the policy to Enabled turns off data synchronization in Google Chrome
// using Google-hosted synchronization services.
// To fully turn off Chrome Sync services, we recommend that you turn off the
// service in the Google Admin console.
//
// If the policy is set to Disabled or not set, users are allowed to choose
// whether to use Chrome Sync.
//
// Note: Do not turn on this policy when RoamingProfileSupportEnabled is
// Enabled, because that feature shares the same client-side functionality. The
// Google-hosted synchronization is off completely in this case.
//
// Valid values:
//   True: Disable Chrome Sync
//   False: Allow users to choose whether to enable Chrome Sync
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message SyncDisabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool SyncDisabled = 2;
}

// List of types that should be excluded from synchronization
//
// If this policy is set all specified data types will be excluded from
// synchronization both for Chrome Sync as well as for roaming profile
// synchronization. This can be beneficial to reduce the size of the roaming
// profile or limit the type of data uploaded to the Chrome Sync Servers.
//
// The current data types for this policy are: "apps", "autofill", "bookmarks",
// "extensions", "preferences", "passwords", "payments", "productComparison",
// "readingList", "tabs", "themes", "typedUrls", "wifiConfigurations". Those
// names are case sensitive!
//
// Notes: Dynamic Policy Refresh is supported only in Google Chrome version 123
// and later. Disabling "autofill" also disables "payments". "typedUrls" refers
// to all browsing history.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message SyncTypesListDisabledProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SyncTypesListDisabled = 2;
}

// Configure the camera, browser settings, os settings, scanning, web store,
// canvas, explore, crosh, gallery, terminal, recorder, print jobs,
// key_shortcuts, gmail, google_docs, google_slides, google_sheets,
// google_drive, google_keep, google_calendar, google_chat, youtube,
// google_maps, calculator and text_editor features to be disabled
//
// Allows you to set a list of Google ChromeOS features to be disabled.
//
// Disabling any of these features means that the user can't access it from the
// UI. In user sessions, the disabled features are hidden in the UI. The user
// experience of disabled features in Managed Guest Sessions (MGS) is decided by
// SystemFeaturesDisableMode; by default the users will see them as "disabled by
// admin".
//
// If the policy is left not set, all Google ChromeOS features will be enabled
// by default and the user can use any of them.
//
// Note: The scanning feature is currently disabled by default via a feature
// flag. If the user enables the feature via the feature flag, the feature can
// still be disabled by this policy.
//
// Valid values:
//   browser_settings: Browser Settings
//   os_settings: OS Settings
//   camera: Camera
//   scanning: Scanning (supported since version 87)
//   web_store: Web Store (supported since version 89)
//   canvas: Canvas (supported since version 90)
//   google_news: Unsupported
//   explore: Explore (supported since version 91)
//   crosh: Crosh (supported since version 99)
//   gallery: Gallery (supported since version 117)
//   terminal: Terminal (supported since version 117)
//   print_jobs: Print Jobs (supported since version 129)
//   key_shortcuts: Key Shortcuts (supported since version 129)
//   recorder: Recorder (supported since version 130)
//   gmail: Gmail (supported since version 135)
//   google_docs: Google Docs (supported since version 135)
//   google_slides: Google Slides (supported since version 135)
//   google_sheets: Google Sheets (supported since version 135)
//   google_drive: Google Drive (supported since version 135)
//   google_keep: Google Keep (supported since version 135)
//   google_calendar: Google Calendar (supported since version 135)
//   google_chat: Google Chat (supported since version 135)
//   youtube: YouTube (supported since version 135)
//   google_maps: Google Maps (supported since version 135)
//   calculator: Calculator (supported since version 136)
//   text_editor: Text Editor (supported since version 136)
//   vids: Vids (supported since version 143)
//
// Supported on: chrome_os
message SystemFeaturesDisableListProto {
  optional PolicyOptions policy_options = 1;
  optional StringList SystemFeaturesDisableList = 2;
}

// Set the user experience of disabled features
//
// Controls the user experience of disabled features listed in
// SystemFeaturesDisableList for Managed Guest Sessions (MGS).
//
// If this policy is set to "blocked", the disabled features will become
// unusable but still visible to users.
//
// If this policy is set to "hidden", the disabled features will become unusable
// and invisible to users.
//
// If this policy is left unset or has an invalid value, the disable mode of
// system features will be "blocked" in MGS, and "hidden" in user sessions.
//
// Valid values:
//   blocked: Block the disabled features
//   hidden: Hide and block the disabled features
//
// Supported on: chrome_os
message SystemFeaturesDisableModeProto {
  optional PolicyOptions policy_options = 1;
  optional string SystemFeaturesDisableMode = 2;
}

// Allows applications to capture and override default system shortcuts.
//
// This policy controls shortcut behavior on Google ChromeOS.
//
// If this policy is unset or set to NormalSystemPriority, all Google ChromeOS
// system shortcuts will always activate as expected.
//
// If this policy is set to ShouldIgnoreCommonVdiShortcuts, a predetermined list
// of Launcher key shortcuts will never activate a shortcut.
//
// If this policy is set to ShouldIgnoreCommonVdiShortcutsFullscreenOnly, a
// predetermined list of Launcher key shortcuts will never activate a shortcut
// while an app is fullscreen.
//
// If this policy is set to AllowPassthroughOfSearchBasedShortcuts, shortcuts
// with the Search key flow through to apps and are not consumed by the OS.
//
// If this policy is set to
// AllowPassthroughOfSearchBasedShortcutsFullscreenOnly, shortcuts with the
// Search key flow through to apps and are not consumed by the OS, but only when
// the focused app is fullscreen.
//
// Valid values:
//   0: All system shortcuts will always activate as expected.
//   1: A predetermined list of shortcuts with the launcher key will never
// perform an action.
//   2: A predetermined list of shortcuts with the launcher key will never
// perform an action while fullscreen only.
//   3: Shortcuts with the search key are sent to the app first before being
// handled by the OS.
//   4: Shortcuts with the search key are sent to the app first before being
// handled by the OS only when the focused app is fullscreen.
//
// Supported on: chrome_os
message SystemShortcutBehaviorProto {
  optional PolicyOptions policy_options = 1;
  optional int64 SystemShortcutBehavior = 2;
}

// Allow SSH outgoing client connections in Terminal System App
//
// If this policy doesn't exist (e.g. for unmanaged users), the SSH (Secure
// SHell) outgoing client connections feature in Terminal System App is enabled
// (default True).
// If the user is managed, and the policy is unset or Disabled, the feature is
// disabled in Terminal.
// Setting the policy to Enabled allows managed users to create outgoing client
// SSH connections in Terminal.
//
// Valid values:
//   True: Enable SSH in Terminal System App
//   False: Disable SSH in Terminal System App
//
// Supported on: chrome_os
message SystemTerminalSshAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool SystemTerminalSshAllowed = 2;
}

// Enable TLS 1.3 Early Data
//
// TLS 1.3 Early Data is an extension to TLS 1.3 to send an HTTP request
// simultaneously with the TLS handshake.
//
// If this policy is not configured, Google Chrome will follow the default
// rollout process for TLS 1.3 Early Data.
//
// If it is enabled, Google Chrome will enable TLS 1.3 Early Data.
//
// If it is disabled, Google Chrome will not enable TLS 1.3 Early Data.
//
// When the feature is enabled, Google Chrome may or may not use TLS 1.3 Early
// Data depending on server support.
//
// TLS 1.3 Early Data is an established protocol. Existing TLS servers,
// middleboxes, and security software are expected to either handle or reject
// TLS 1.3 Early Data without dropping the connection.
//
// However, devices that do not correctly implement TLS may malfunction and
// disconnect when TLS 1.3 Early Data is in use. If this occurs, administrators
// should contact the vendor for a fix.
//
// This policy is a temporary measure to control the feature and will be removed
// afterwards. The policy may be enabled to allow you to test for issues and
// disabled while issues are being resolved.
//
// Valid values:
//   True: Enable the TLS 1.3 Early Data
//   False: Disable the TLS 1.3 Early Data
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message TLS13EarlyDataEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool TLS13EarlyDataEnabled = 2;
}

// Enable a TLS 1.3 security feature for local trust anchors.
//
// This policy controls a security feature in TLS 1.3 which protects connections
// against downgrade attacks. It is backwards-compatible and will not affect
// connections to compliant TLS 1.2 servers or proxies. However, older versions
// of some TLS-intercepting proxies have an implementation flaw which causes
// them to be incompatible.
//
// If this policy is set to True or not set, Google Chrome will enable these
// security protections for all connections.
//
// If this policy is set to False, Google Chrome will disable these security
// protections for connections authenticated with locally-installed CA
// certificates. These protections are always enabled for connections
// authenticated with publicly-trusted CA certificates.
//
// The default value for this policy was changed in Google Chrome 81 from false
// to true. Affected proxies are expected to fail connections with an error code
// of ERR_TLS13_DOWNGRADE_DETECTED. Administrators who need more time to upgrade
// affected proxies may use this policy to temporarily disable this security
// feature. This policy was removed in version 86.
//
// Supported on:
message TLS13HardeningForLocalAnchorsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool TLS13HardeningForLocalAnchorsEnabled = 2;
}

// Allow Tab capture by these origins
//
// Setting the policy lets you set a list of URL patterns that can use Tab
// Capture.
//
// Leaving the policy unset means that sites will not be considered for an
// override at this level of capture.
//
// Note that windowed Chrome Apps will still be allowed to be captured.
//
// This policy is not considered if a site matches a URL pattern in the
// SameOriginTabCaptureAllowedByOrigins policy.
//
// If a site matches a URL pattern in this policy, the following policies will
// not be considered: WindowCaptureAllowedByOrigins,
// ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.  This policy only
// matches based on origin, so any path in the URL pattern is ignored.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message TabCaptureAllowedByOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList TabCaptureAllowedByOrigins = 2;
}

// Tab Compare settings
//
// Tab Compare is an AI-powered tool for comparing information across a user's
// tabs. As an example, the feature can be offered to the user when multiple
// tabs with products in a similar category are open.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Tab Compare and improve AI models.
//   1: Allow Tab Compare without improving AI models.
//   2: Do not allow Tab Compare.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message TabCompareSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 TabCompareSettings = 2;
}

// URL pattern Exceptions to tab discarding
//
// This policy makes it so that any URL matching one or more of the patterns it
// specifies (using the URLBlocklist filter format) will never be discarded by
// the browser.
// This applies to memory pressure and high efficiency mode discarding.
// A discarded page is unloaded and its resources fully reclaimed. The tab its
// associated with remains in the tabstrip, but making it visible will trigger a
// full reload.
//
// Supported on: chrome_os, linux, mac, win
message TabDiscardingExceptionsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList TabDiscardingExceptions = 2;
}

// Allow background tabs freeze
//
// Controls whether Google Chrome can freeze tabs that have been in the
// background for at least 5 minutes.
//
// If the policy is set to true, tabs that have been in the background for at
// least 5 minutes may be frozen. Tab freezing reduces CPU, battery and memory
// usage. Google Chrome uses heuristics to avoid freezing tabs that do useful
// work in the background (e.g. display notifications, play sound, stream
// video). Web developers can also opt-out their site from freezing (https://chr
// omium.googlesource.com/chromium/src/+/HEAD/chrome/browser/performance_manager
// /docs/freezing_opt_out_opt_in.md).
//
// If the policy is set to false, no tabs will be frozen.
//
// Supported on:
message TabFreezingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool TabFreezingEnabled = 2;
}

// Tab group sharing settings
//
// Control whether an entreprise user can access tab group sharing feature in
// Chrome.
//
// Tab group sharing feature allows user to share and collaborate in tab groups.
//
// Setting the policy to 0 or not set, indicates that tab groups can be shared.
// Setting the policy to 1, indicates that tab groups can not be shared.
//
// Valid values:
//   0: Use the tab group sharing feature.
//   1: Do not use the tab group sharing feature.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message TabGroupSharingSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 TabGroupSharingSettings = 2;
}

// Settings for Tab Organizer
//
// This policy is deprecated since tab organizer has been sunset as a feature.
//
// Tab Organizer is an AI-based tool that automatically creates tab groups based
// on a user's open tabs. Suggestions are based on open tabs (but not page
// content).
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Tab Organizer and improve AI models.
//   1: Allow Tab Organizer without improving AI models.
//   2: Do not allow Tab Organizer.
//
// Supported on:
message TabOrganizerSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 TabOrganizerSettings = 2;
}

// Allow sites to simultaneously navigate and open pop-ups
//
// Deprecated in M68. Use DefaultPopupsSetting instead.
//
// For a full explanation, see
// https://www.chromestatus.com/feature/5675755719622656.
// If this policy is enabled, sites will be allowed to simultaneously navigate
// and open new windows/tabs.
// If this policy is disabled or not set, sites will be disallowed from
// simultaneously navigating and opening a new window/tab.
//
// Supported on:
message TabUnderAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool TabUnderAllowed = 2;
}

// Do not set window.opener for links targeting _blank
//
// Setting the policy to Disabled allows pop-ups targeting _blank to access (via
// JavaScript) the page that requested to open the pop-up.
//
// Setting the policy to Enabled or leaving it unset causes the window.opener
// property to be set to null unless the anchor specifies rel="opener".
//
// This policy was removed in Google Chrome version 102.
//
// See https://chromestatus.com/feature/6140064063029248.
//
// Valid values:
//   True: Only allow pop-ups opened with a target of _blank to interact with
// the page that opened the pop-up if the opener page explicitly opts-in to such
// interaction
//   False: Allow all pop-ups opened with a target of _blank to interact the
// page that requested to open the pop-up unless the opener page explicitly
// opts-out of such interaction
//
// Supported on:
message TargetBlankImpliesNoOpenerProto {
  optional PolicyOptions policy_options = 1;
  optional bool TargetBlankImpliesNoOpener = 2;
}

// Enable ending processes in Task Manager
//
// Setting the policy to Disabled prevents users from ending processes in the
// Task Manager.
//
// Setting the policy to Enabled or leaving it unset lets users end processes in
// the Task Manager.
//
// Valid values:
//   True: Allow users to end processes with the Chrome task manager
//   False: Block users from ending processes with the Chrome task manager
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message TaskManagerEndProcessEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool TaskManagerEndProcessEnabled = 2;
}

// Set the Terms of Service for a device-local account
//
// Setting the policy means Google ChromeOS downloads the Terms of Service and
// presents them to users whenever a device-local account session starts. Users
// can only sign in to the session after accepting the Terms of Service.
//
// Leaving the policy unset means no Terms of Service appear.
//
// The policy should be set to a URL from which Google ChromeOS can download the
// Terms of Service. The Terms of Service must be plain text, served as MIME
// type text/plain. No markup is allowed.
//
// Supported on: chrome_os
message TermsOfServiceURLProto {
  optional PolicyOptions policy_options = 1;
  optional string TermsOfServiceURL = 2;
}

// Settings for 3rd party AI Mode integrations in the address bar and New Tab
// page search box.
//
// This policy controls 3rd party AI Mode integrations in the address bar and
// the New Tab page search box.
//
// To access this feature, a 3rd party search engine that supports AI Mode must
// be set as the user's default search engine.
//
// 0 = The feature will be available to users.
//
// 1 = The feature will not be available to users.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// Valid values:
//   0: Allow 3rd party AI Mode integrations.
//   1: Do not allow 3rd party AI Mode integrations.
//
// Supported on: android, chrome_os, ios, linux, mac, win
message ThirdPartyAiChatSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ThirdPartyAiChatSettings = 2;
}

// Enable third party software injection blocking
//
// This policy is deprecated.
//
// Setting the policy to Enabled or leaving it unset prevents third-party
// software from injecting executable code into Google Chrome's processes.
//
// Setting the policy to Disabled allows this software to inject such code into
// Google Chrome's processes.
//
// Valid values:
//   True: Prevent third party code from being injected into Chrome
//   False: Allow third party code to be injected into Chrome
//
// Supported on:
message ThirdPartyBlockingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ThirdPartyBlockingEnabled = 2;
}

// Allow using Third-Party Password Managers in Google Chrome on Android
//
// Setting the policy to true lets users use a third-party password manager.
// That password manager will handle saving and filling for all password,
// payment
// and autofill data.
// When the policy is true or not set, a setting will allow to switch between
// Google Chrome's buit-in password
// manager and the password manager configured in Android settings.
// Since Google Chrome uses the same data
// as Autofill with Google, the setting can only be changed to use third-party
// password managers if a manager other than Autofill with Google is configured
// in Android's system settings.
//
// Setting the policy to false means
// Google Chrome will always use the
// built-in password manager.
//
// This policy doesn't affect third-party password managers that use
// accessibility APIs.
//
// Valid values:
//   True: Allow using third-party password manager in Chrome
//   False: Block switching to a third-party password manager
//
// Supported on: android
message ThirdPartyPasswordManagersAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool ThirdPartyPasswordManagersAllowed = 2;
}

// Disable third-party storage partitioning for specific top-level origins
//
// This policy allows you to set a list of URL patterns that specify top-level
// origins for which third-party storage partitioning (partitioning of cross-
// origin iframe storage) should be disabled.
//
// If this policy is left unset or if a top-level origin doesn't match one of
// the URL patterns, DefaultThirdPartyStoragePartitioningSetting will apply.
//
// For detailed information on valid patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Note that patterns you
// list here are treated as origins, not URLs, so you should not specify a path.
//
// For detailed information on third-party storage partitioning, please see
// https://developers.google.com/privacy-sandbox/cookies/storage-partitioning.
//
// This was removed in Chrome 145, and the requestStorageAccess method is
// recommended for use instead: https://developer.mozilla.org/en-
// US/docs/Web/API/Document/requestStorageAccess. Feedback can be left at
// https://crbug.com/425248669.
//
// Supported on: fuchsia
message ThirdPartyStoragePartitioningBlockedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList ThirdPartyStoragePartitioningBlockedForOrigins = 2;
}

// Allows enabling throttling of non-visible, cross-origin iframes
//
// ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes is a Chrome feature
// designed to make cross-process and same-process cross-origin iframes
// consistent in their rendering behavior. For further details on cross-process
// vs. same-process throttling, refer to
// https://chromestatus.com/feature/5175574929080320.
//
// This enterprise policy exists to allow administrators to control whether
// their users are able to turn the additional throttling on or not. When the
// policy is set to disabled it prevents enabling the throttling. When the
// policy is set to enabled or not set, the user can opt-in to throttling, or it
// may be enabled via Chrome variations.
//
// Valid values:
//   True: ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes feature
// available
//   False: ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes feature
// disabled
//
// Supported on: fuchsia
message ThrottleNonVisibleCrossOriginIframesAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool ThrottleNonVisibleCrossOriginIframesAllowed = 2;
}

// Managed toolbar avatar label setting
//
// This policy is deprecated as the feature it controls was never launched.
// Please use the EnterpriseProfileBadgeToolbarSettings policy instead.
//
// Leaving this policy unset or setting it to display_management_label_permanent
// (value 0) will show a Work or School label next to the toolbar avatar.
// These labels will only be shown if the signed in account is managed.
//
// Setting it to display_management_label_transient (value 1) will show a Work
// or School label next to the toolbar avatar for 30 seconds after opening the
// profile.
//
// Valid values:
//   0: Always display management label
//   1: Display management labels for 30s
//
// Supported on:
message ToolbarAvatarLabelSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 ToolbarAvatarLabelSettings = 2;
}

// Configuring the ToS behavior during first-run for CCT
//
// By default the Terms of Service are shown when CCT is first-run. Setting this
// policy to SkipTosDialog will cause the Terms of Service dialog to not appear
// during the first-run-experience or subsequent runs. Setting this policy to
// StandardTosDialog or leaving it unset will cause the Terms of Service dialog
// to appear during the first-run-experience. The other caveats are:
//
// - This policy only works on fully managed Android devices that can be
// configured by Unified Endpoint Management vendors.
//
// - If this policy is SkipTosDialog the BrowserSignin policy will have no
// effect.
//
// - If this policy is SkipTosDialog metrics​ will not be sent to the server.
//
// - If this policy is SkipTosDialog the browser will have limited
// functionality.
//
// - If this policy is SkipTosDialog admins must communicate this to end users
// of the device.
//
// Valid values:
//   1: Use default browser behavior, shows the ToS and waits for the user to
// accept.
//   2: Automatically skips ToS and loads the browser.
//
// Supported on: android
message TosDialogBehaviorProto {
  optional PolicyOptions policy_options = 1;
  optional int64 TosDialogBehavior = 2;
}

// Set limit on megabytes of memory a single Chrome instance can use.
//
// Configures the amount of memory that a single Google Chrome instance can use
// before tabs start being discarded (I.E. the memory used by the tab will be
// freed and the tab will have to be reloaded when switched to) to save memory.
//
// If the policy is set, browser will begin to discard tabs to save memory once
// the limitation is exceeded. However, there is no guarantee that the browser
// is always running under the limit. Any value under 1024 will be rounded up to
// 1024.
//
// If this policy is not set, the browser will only begin attempts to save
// memory once it has detected that the amount of physical memory on its machine
// is low.
//
// Supported on: mac, win
message TotalMemoryLimitMbProto {
  optional PolicyOptions policy_options = 1;
  optional int64 TotalMemoryLimitMb = 2;
}

// Enable the touch virtual keyboard
//
// Controls the touch virtual keyboard, acting as a supplementary policy to the
// VirtualKeyboardEnabled policy.
//
// If accessibility virtual keyboard is turned on, this policy has no effect.
//
// Otherwise, this policy has the following effect:
// If this policy is not set, the virtual keyboard is displayed based on the
// default system heuristics, such as whether there are keyboards attached.
// If this policy is set to True, the virtual keyboard is always displayed.
// If this policy is set to False, the virtual keyboard is never displayed.
//
// The virtual keyboard may change to a compact layout depending on the input
// method.
//
// Valid values:
//   True: Enable touch virtual keyboard
//   False: Disable touch virtual keyboard
//   None: Enable touch virtual keyboard based on the default system heuristics
//
// Supported on: chrome_os
message TouchVirtualKeyboardEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool TouchVirtualKeyboardEnabled = 2;
}

// Enable Translate
//
// Setting the policy to True provides translation functionality when it's
// appropriate for users by showing an integrated translate toolbar in Google
// Chrome and a translate option on the right-click context menu. Setting the
// policy to False shuts off all built-in translate features.
//
// If you set the policy, users can't change this function. Leaving it unset
// lets them change the setting.
//
// Valid values:
//   True: Always offer translation
//   False: Never offer translation
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message TranslateEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool TranslateEnabled = 2;
}

// Allow Translator API
//
// Setting the policy to Enabled or leaving it unset allows the use of
// Translator API in Google Chrome.
//
// Setting the policy to Disabled disallows the use of Translator API.
//
// Valid values:
//   True: Allows the use of Translator API
//   False: Disallows the use of Translator API
//
// Supported on: chrome_os, linux, mac, win
message TranslatorAPIAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool TranslatorAPIAllowed = 2;
}

// Enable capability to send files to the Trash (on supported filesystems) in
// the Google ChromeOS Files app
//
// Setting the policy to True allows users of Google ChromeOS Files app to see a
// Trash bin and files under My files and Downloads (including their user
// created descendants) will be sent there on deletion.
//
// If the policy is set to False the files that previously resided in trash will
// still be available by showing hidden files and finding the .Trash directory
// under My files or Downloads.
//
// Valid values:
//   True: Trash is enabled for the user.
//   False: Trash is disabled for the user.
//
// Supported on: chrome_os
message TrashEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool TrashEnabled = 2;
}

// Enable 3DES cipher suites in TLS
//
// This policy was removed in M97 after 3DES was removed from Google Chrome.
//
// If the policy is set to true, then 3DES cipher suites in TLS will be enabled.
// If it is set to false, they will be disabled. If the policy is unset, 3DES
// cipher suites are disabled by default. This policy may be used to temporarily
// retain compatibility with an outdated server. This is a stopgap measure and
// the server should be reconfigured.
//
// Valid values:
//   True: 3DES cipher suites will be enabled in TLS
//   False: 3DES cipher suites will be disabled in TLS
//   None: Use the default setting for 3DES cipher suites in TLS
//
// Supported on:
message TripleDESEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool TripleDESEnabled = 2;
}

// Allow using the deprecated U2F Security Key API
//
// If set to Enabled, the deprecated U2F Security Key API can be used and the
// deprecation reminder prompt shown for U2F API requests is suppressed.
//
// If the policy is set to Disabled or left unset, the default behavior will
// apply.
//
// The U2F Security Key API is deprecated and it will be disabled by default in
// Chrome 98.
//
// This is a temporary opt-out mechanism. The U2F API will be removed from
// Chrome in Chrome 104, at which point this policy will cease to be supported.
//
// For more information about the deprecation of the U2F Security Key API,
// please refer to https://groups.google.com/a/chromium.org/g/blink-
// dev/c/xHC3AtU_65A.
//
// Valid values:
//   True: Allow using the U2F Security Key API.
//   False: Apply default settings for U2F API deprecation.
//
// Supported on:
message U2fSecurityKeyApiEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool U2fSecurityKeyApiEnabled = 2;
}

// Allow access to a list of URLs
//
// Setting the policy provides access to the listed URLs, as exceptions to
// URLBlocklist. See that policy's description for the format of entries of this
// list. For example, setting URLBlocklist to * will block all requests, and you
// can use this policy to allow access to a limited list of URLs. Use it to open
// exceptions to certain schemes, subdomains of other domains, ports, or
// specific paths, using the format specified at (
// https://support.google.com/chrome/a?p=url_blocklist_filter_format ). The most
// specific filter determines if a URL is blocked or allowed. The URLAllowlist
// policy takes precedence over URLBlocklist. This policy is limited to 1,000
// entries.
//
// This policy also allows enabling the automatic invocation by the browser of
// external application registered as protocol handlers for the listed protocols
// like "tel:" or "ssh:".
//
// Leaving the policy unset allows no exceptions to URLBlocklist.
//
// From Google Chrome version 92, this policy is also supported in the headless
// mode.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message URLAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList URLAllowlist = 2;
}

// Block access to a list of URLs
//
// This policy is deprecated and unsupported, please use the 'URLBlocklist'
// policy instead.
//
// Supported on:
message URLBlacklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList URLBlacklist = 2;
}

// Block access to a list of URLs
//
// Setting the URLBlocklist policy stops web pages with prohibited URLs from
// loading. Administrators can specify the list of URL patterns to be blocked.
// If left unset, no URLs are blocked in the browser. Up to 1,000 exceptions can
// be defined in URLAllowlist. See how to format a URL pattern (
// https://support.google.com/chrome/a?p=url_blocklist_filter_format ).
//
// Note: This policy does not apply to in-page JavaScript URLs with dynamically
// loaded data. If you blocked example.com/abc, then example.com could still
// load it using XMLHTTPRequest. Additionally, this policy does not prevent web
// pages from updating the URL shown in the omnibox to a blocked one using the
// JavaScript History API.
//
// From Google Chrome version 73, you can block javascript://* URLs. But, this
// only affects JavaScript entered in the address bar or, for example,
// bookmarklets.
//
// From Google Chrome version 92, this policy is also supported in the headless
// mode.
//
// From Google Chrome version 147, the wildcard * on its own does not apply to
// internal chrome:// URLs. To block these, you must explicitly use the
// chrome://* pattern.
//
// Note: Blocking internal chrome://* and chrome-untrusted://* URLs can lead to
// unexpected errors or can be circumvented in some cases. Instead of blocking
// certain internal URLs, see if there are more specific policies available. For
// example:
//
// - Instead of blocking chrome://settings/certificates, use
// CACertificateManagementAllowed.
//
// - Instead of blocking chrome-untrusted://crosh, use
// SystemFeaturesDisableList.
//
// - Instead of blocking devtools://*, use one of the
// DeveloperToolsAvailability, DeveloperToolsAvailabilityAllowlist or
// DeveloperToolsAvailabilityBlocklist policies.
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message URLBlocklistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList URLBlocklist = 2;
}

// Allow access to a list of URLs
//
// This policy is deprecated and unsupported, please use the 'URLAllowlist'
// policy instead.
//
// Supported on:
message URLWhitelistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList URLWhitelist = 2;
}

// Enable the browser's UI Automation accessibility framework provider on
// Windows
//
// Enables the UI Automation accessibility framework
// provider in Google Chrome for use by
// accessibility tools.
//
// This policy is supported in
// Google Chrome for a one-year
// transition period to allow enterprise administrators to control the
// deployment
// of the browser's UI Automation accessibility
// framework provider. Accessibility and other tools that use the
// UI Automation accessibility framework to interoperate
// with the browser may require updates to function properly with the browser's
// UI Automation provider. Administrators can use this
// policy to temporarily disable the browser's
// UI Automation provider (thereby reverting to the old
// behavior) while they work with vendors to provide updates to impacted tools.
//
// When set to false, Google Chrome only
// enables its Microsoft Active Accessibility
// provider. Accessibility and other tools that use the newer
// UI Automation accessibility framework to interoperate
// with the browser will communicate with it by way of a compatibility shim in
// Microsoft® Windows®.
//
// When set to true, Google Chrome
// enables its UI Automation provider in addition to its
// Microsoft Active Accessibility provider.
// Accessibility and other tools that use the newer
// UI Automation accessibility framework to interoperate
// with the browser will communicate directly with it.
//
// When left unset, the variations framework in Google Chrome is used to enable
// or disable
// the provider.
//
// Support for this policy setting will end in Google Chrome 146.
//
// Valid values:
//   True: Enable the UI Automation provider.
//   False: Disable the UI Automation provider.
//   None: The UI Automation provider will be enabled or disabled via the
// variations framework.
//
// Supported on:
message UiAutomationProviderEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UiAutomationProviderEnabled = 2;
}

// Allow enterprise users to use ARC on unaffiliated devices.
//
// Unless ARC is turned off by other means, then setting the policy to True or
// leaving it unset lets managed users use ARC on unaffiliated devices. Setting
// the policy to False means managed users may not use ARC on unaffiliated
// devices.
//
// Note that other restrictions, like those imposed by ArcEnabled and
// UnaffiliatedArcAllowed policies, continue to be respected, and ARC gets
// disabled if any of them specifies so.
//
// Valid values:
//   True: Allow users to use Android apps on unaffiliated devices
//   False: Do not allow users to use Android apps on unaffiliated devices
//
// Supported on: chrome_os
message UnaffiliatedDeviceArcAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool UnaffiliatedDeviceArcAllowed = 2;
}

// Make Unified Desktop available and turn on by default
//
// Setting the policy to True turns on Unified Desktop, which allows
// applications to span multiple displays. Users can turn off Unified Desktop
// for individual displays.
//
// Setting the policy to False or leaving it unset turns off Unified Desktop,
// and users can't turn it on.
//
// Valid values:
//   True: Make Unified Desktop mode available to the user
//   False: Do not make Unified Desktop mode available to the user
//
// Supported on: chrome_os
message UnifiedDesktopEnabledByDefaultProto {
  optional PolicyOptions policy_options = 1;
  optional bool UnifiedDesktopEnabledByDefault = 2;
}

// Ask for consent from managed users to share device signals on unmanaged
// devices to gain access
//
//
// Setting the policy to Enabled (True) lets Google Chrome asks for managed
// users' consent prior to sharing device signals on unmanaged devices in order
// to gain access.
//
// Setting the policy to Disabled (False) or leaving it unset disallows Google
// Chrome from collecting device signals.
//
// Examples of device signals include (but are not limited to) OS information,
// registry, file presesnce.
//
// Valid values:
//   True: Enable device signal consenting for managed users on unmanaged
// devices
//   False: Disable device signal consenting for managed users on unmanaged
// devices
//
// Supported on: chrome_os, linux, mac, win
message UnmanagedDeviceSignalsConsentFlowEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UnmanagedDeviceSignalsConsentFlowEnabled = 2;
}

// Origins or hostname patterns for which restrictions on insecure origins
// should not apply
//
// Deprecated in M69. Use OverrideSecurityRestrictionsOnInsecureOrigin instead.
//
// The policy specifies a list of origins (URLs) or hostname patterns (such as
// "*.example.com") for which security restrictions on insecure origins will not
// apply.
//
// The intent is to allow organizations to allow origins for legacy applications
// that cannot deploy TLS, or to set up a staging server for internal web
// development so that their developers can test out features requiring secure
// contexts without having to deploy TLS on the staging server. This policy will
// also prevent the origin from being labeled "Not Secure" in the omnibox.
//
// Setting a list of URLs in this policy has the same effect as setting the
// command-line flag '--unsafely-treat-insecure-origin-as-secure' to a comma-
// separated list of the same URLs. If the policy is set, it will override the
// command-line flag.
//
// This policy is deprecated in M69 in favor of
// OverrideSecurityRestrictionsOnInsecureOrigin. If both policies are present,
// OverrideSecurityRestrictionsOnInsecureOrigin will override this policy.
//
// For more information on secure contexts, see https://www.w3.org/TR/secure-
// contexts/
//
// Supported on: fuchsia, linux, mac, win
message UnsafelyTreatInsecureOriginAsSecureProto {
  optional PolicyOptions policy_options = 1;
  optional StringList UnsafelyTreatInsecureOriginAsSecure = 2;
}

// Control the nesting threshold before which Javascript setTimeout() function
// start being clamped
//
// setTimeout(…, 0) is commonly used to break down long Javascript tasks.
// When the policy is set to Enabled, setTimeouts and setIntervals with an
// interval smaller than 4ms are not clamped as aggressively.
// This improves short horizon performance, but websites abusing the API will
// still eventually have their setTimeouts clamped.
//
// When the policy is set to Disabled, setTimeouts and setIntervals with an
// interval smaller than 4ms will be clamped.
//
// This may change task ordering on a web page, leading to unexpected behavior
// on sites that are dependent on a certain ordering in some way.
// It also may affect sites with a lot of setTimeout() with a timeout of 0ms
// usage, e.g. increasing CPU load.
//
// For users where this policy is unset, Google Chrome will roll out the change
// gradually on the stable channel.
//
// This is a temporary policy that is planned be removed in Google Chrome 107.
// This deadline may be extended if there is a need for it among enterprises.
//
// Valid values:
//   True: Javascript setTimeout() will not be clamped until a higher nesting
// threshold.
//   False: Javascript setTimeout() will be clamped after a normal nesting
// threshold.
//   None: Default behavior for setTimeout() function nested clamp.
//
// Supported on:
message UnthrottledNestedTimeoutEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UnthrottledNestedTimeoutEnabled = 2;
}

// Controls background automatic relaunch when all browser windows are closed
//
// Controls the background automatic restart behavior on macOS when a security
// update is pending and all browser windows are closed.
//
// If this policy is set to True or left unset, Google Chrome is allowed to
// automatically relaunch to apply pending updates when all browser windows are
// closed.
//
// If this policy is set to False, automatic relaunches are disabled when all
// browser windows are closed.
//
// Valid values:
//   True: Enable automatic relaunches when all windows are closed
//   False: Disable automatic relaunches when all windows are closed
//
// Supported on: mac
message UpdateOnZeroWindowEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UpdateOnZeroWindowEnabled = 2;
}

// Enable URL-keyed anonymized data collection
//
// Setting the policy to Enabled means URL-keyed anonymized data collection,
// which sends URLs of pages the user visits to Google to make searches and
// browsing better, is always active.
//
// Setting the policy to Disabled results in no URL-keyed anonymized data
// collection.
//
// If this policy is left unset, the user will be able to change this setting
// manually.
//
// In Google ChromeOS Kiosk, this policy doesn't offer the option to "Allow the
// user to decide". If this policy is unset for Google ChromeOS Kiosk, URL-keyed
// anonymized data collection is always active.
// When set for Google ChromeOS Kiosk, this policy enables URL-keyed metrics
// collection for kiosk apps.
//
// Valid values:
//   True: URL-keyed anonymized data collection is always active
//   False: URL-keyed anonymized data collection is never active
//   None: Allow the user to decide
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message UrlKeyedAnonymizedDataCollectionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UrlKeyedAnonymizedDataCollectionEnabled = 2;
}

// Allow URL-keyed metrics collection
//
// If this policy is set to allowed or unset, URL-keyed metrics collection is
// allowed.
// If allowed and URL-keyed metrics collection is enabled by the user, URL-keyed
// metrics collection sends URLs of pages the user visits to Google to make
// searches and browsing better along with per-page usage statistics.
// URL-keyed metrics also includes the identifiers and usage statistics of other
// browser components that can modify or provide content, such as extensions.
//
// If this policy is set to disallowed, users cannot enable URL-keyed metrics
// collection.
//
// Valid values:
//   True: URL-keyed metrics collection is allowed
//   False: URL-keyed metrics collection is not allowed
//   None: URL-keyed metrics collection is allowed
//
// Supported on: android, chrome_os, fuchsia, ios, linux, mac, win
message UrlKeyedMetricsAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool UrlKeyedMetricsAllowed = 2;
}

// Control the URL parameter filter feature
//
// When enabled or not set, the URL parameter filter may remove some parameters
// when a user selects "Open Link in Incognito Window" from the context menu.
// When disabled, no filtering is performed.
// This policy is temporary and may be removed in a future release.
//
// Valid values:
//   True: Allow the browser to filter URL parameters.
//   False: Disallow any filtering of URL parameters.
//
// Supported on:
message UrlParamFilterEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UrlParamFilterEnabled = 2;
}

// Time Limit
//
// Allows you to lock the user's session based on the client time or the usage
// quota of the day.
//
// The |time_window_limit| specifies a daily window in which the user's session
// should be locked. We only support one rule for each day of the week,
// therefore the |entries| array may vary from 0-7 in size. |starts_at| and
// |ends_at| are the beginning and the end of the window limit, when |ends_at|
// is smaller than |starts_at| it means that the |time_limit_window| ends on the
// following day. |last_updated_millis| is the UTC timestamp for the last time
// this entry was updated, it is sent as a string because the timestamp wouldn't
// fit in an integer.
//
// The |time_usage_limit| specifies a daily screen quota, so when the user
// reaches it, the user's session is locked. There is a property for each day of
// the week, and it should be set only if there is an active quota for that day.
// |usage_quota_mins| is the amount of time that the managed device can be use
// in a day and |reset_at| is the time when the usage quota is renewed. The
// default value for |reset_at| is midnight ({'hour': 0, 'minute': 0}).
// |last_updated_millis| is the UTC timestamp for the last time this entry was
// updated, it is sent as a string because the timestamp wouldn't fit in an
// integer.
//
// |overrides| is provided to invalidate temporarily one or more of the previous
// rules.
// * If neither time_window_limit nor time_usage_limit is active |LOCK| can be
// used to lock the device.
// * |LOCK| temporarily locks a user session until the next time_window_limit or
// time_usage_limit starts.
// * |UNLOCK| unlocks a user's session locked by time_window_limit or
// time_usage_limit.
// |created_time_millis| is the UTC timestamp for the override creation, it is
// sent as a String because the timestamp wouldn't fit in an integer It is used
// to determine whether this override should still be applied. If the current
// active time limit feature (time usage limit or time window limit) started
// after the override was created, it should not take action. Also if the
// override was created before the last change of the active time_window_limit
// or time_usage_window it should not be applied.
//
// Multiple overrides may be sent, the newest valid entry is the one that is
// going to be applied.
//
// Value schema:
// {
//     "properties": {
//         "overrides": {
//             "items": {
//                 "properties": {
//                     "action": {
//                         "enum": [
//                             "LOCK",
//                             "UNLOCK"
//                         ],
//                         "type": "string"
//                     },
//                     "action_specific_data": {
//                         "properties": {
//                             "duration_mins": {
//                                 "minimum": 0,
//                                 "type": "integer"
//                             }
//                         },
//                         "type": "object"
//                     },
//                     "created_at_millis": {
//                         "type": "string"
//                     }
//                 },
//                 "type": "object"
//             },
//             "type": "array"
//         },
//         "time_usage_limit": {
//             "properties": {
//                 "friday": {
//                     "id": "TimeUsageLimitEntry",
//                     "properties": {
//                         "last_updated_millis": {
//                             "type": "string"
//                         },
//                         "usage_quota_mins": {
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "monday": {
//                     "properties": {
//                         "last_updated_millis": {
//                             "type": "string"
//                         },
//                         "usage_quota_mins": {
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "reset_at": {
//                     "description": "Time interpreted in local wall-clock 24h
// format.",
//                     "id": "Time",
//                     "properties": {
//                         "hour": {
//                             "maximum": 23,
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "minute": {
//                             "maximum": 59,
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "required": [
//                         "hour",
//                         "minute"
//                     ],
//                     "type": "object"
//                 },
//                 "saturday": {
//                     "properties": {
//                         "last_updated_millis": {
//                             "type": "string"
//                         },
//                         "usage_quota_mins": {
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "sunday": {
//                     "properties": {
//                         "last_updated_millis": {
//                             "type": "string"
//                         },
//                         "usage_quota_mins": {
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "thursday": {
//                     "properties": {
//                         "last_updated_millis": {
//                             "type": "string"
//                         },
//                         "usage_quota_mins": {
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "tuesday": {
//                     "properties": {
//                         "last_updated_millis": {
//                             "type": "string"
//                         },
//                         "usage_quota_mins": {
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "wednesday": {
//                     "properties": {
//                         "last_updated_millis": {
//                             "type": "string"
//                         },
//                         "usage_quota_mins": {
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 }
//             },
//             "type": "object"
//         },
//         "time_window_limit": {
//             "properties": {
//                 "entries": {
//                     "items": {
//                         "properties": {
//                             "effective_day": {
//                                 "enum": [
//                                     "MONDAY",
//                                     "TUESDAY",
//                                     "WEDNESDAY",
//                                     "THURSDAY",
//                                     "FRIDAY",
//                                     "SATURDAY",
//                                     "SUNDAY"
//                                 ],
//                                 "type": "string"
//                             },
//                             "ends_at": {
//                                 "description": "Time interpreted in local
// wall-clock 24h format.",
//                                 "properties": {
//                                     "hour": {
//                                         "maximum": 23,
//                                         "minimum": 0,
//                                         "type": "integer"
//                                     },
//                                     "minute": {
//                                         "maximum": 59,
//                                         "minimum": 0,
//                                         "type": "integer"
//                                     }
//                                 },
//                                 "required": [
//                                     "hour",
//                                     "minute"
//                                 ],
//                                 "type": "object"
//                             },
//                             "last_updated_millis": {
//                                 "type": "string"
//                             },
//                             "starts_at": {
//                                 "description": "Time interpreted in local
// wall-clock 24h format.",
//                                 "properties": {
//                                     "hour": {
//                                         "maximum": 23,
//                                         "minimum": 0,
//                                         "type": "integer"
//                                     },
//                                     "minute": {
//                                         "maximum": 59,
//                                         "minimum": 0,
//                                         "type": "integer"
//                                     }
//                                 },
//                                 "required": [
//                                     "hour",
//                                     "minute"
//                                 ],
//                                 "type": "object"
//                             }
//                         },
//                         "type": "object"
//                     },
//                     "type": "array"
//                 }
//             },
//             "type": "object"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message UsageTimeLimitProto {
  optional PolicyOptions policy_options = 1;
  optional string UsageTimeLimit = 2;
}

// Show a notification when a USB device is detected
//
// If this setting is enabled, a notification is shown to the user when a USB
// device gets plugged in on Google ChromeOS.
//
// If this setting is disabled, no notifications about plugged-in USB devices
// will be shown to the user.
//
// If this policy is left unset, users will receive the notifications about
// plugged-in USB devices.
//
// Valid values:
//   True: Show notifications when USB devices are detected
//   False: Do not show notifications when USB devices are detected
//
// Supported on: chrome_os
message UsbDetectorNotificationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UsbDetectorNotificationEnabled = 2;
}

// Use Legacy Form Controls until M84.
//
// Starting in M81, the standard form control elements (e.g. &lt;select&gt;,
// &lt;button&gt;, &lt;input type=date&gt;) were given a refreshed look and
// feel, with improved accessibility and better platform uniformity. This policy
// restores the old "legacy" form control elements until M84.
//
// If this policy is set to True, the "legacy" form control elements will be
// used for all sites.
//
// If this policy is set to False or not set, the form control elements will be
// enabled as they are launched in M81, M82, and M83.
//
// This policy will be removed after Chrome 84.
//
// Supported on:
message UseLegacyFormControlsProto {
  optional PolicyOptions policy_options = 1;
  optional bool UseLegacyFormControls = 2;
}

// Allow Pepper to use a new decoder for hardware accelerated video decoding.
//
// This policy controls whether Pepper plugins can
// use the new decoder to talk to hardware decoders instead of the legacy video
// decoder.
//
// The migration only affects internal implementation details and should not
// change any behavior. However, this policy can be used in case any PPAPI
// applications do not work as expected.
//
// When the policy is left unset or set to Enabled the browser will decide which
// implementation is used.
// When the policy is set to Disabled, the browser will use the old
// implementation
// until this policy expires.
//
// If you must use the policy, please file a bug on crbug.com explaining your
// use case and CC {andrescj, blundell, pmolinalopez, vasilyt}@chromium.org. The
// policy is scheduled to be offered through Google Chrome version 114, after
// which
// the old implementation will be removed.
//
// NOTE: Only newly-started renderer processes will reflect changes to this
// policy while the browser is running.
//
// Valid values:
//   True: Allow Pepper to use the new video decoder.
//   False: Force Pepper to use the legacy video decoder.
//
// Supported on:
message UseMojoVideoDecoderForPepperAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool UseMojoVideoDecoderForPepperAllowed = 2;
}

// Percentage by which to scale the screen dim delay if the user becomes active
// after dimming
//
// If PowerSmartDimEnabled is Disabled, then setting
// UserActivityScreenDimDelayScale specifies the percent that the screen dim
// delay scales when there's user activity while the screen dims or soon after
// the screen turns off. When the dim delay scales, the screen off, screen lock
// and idle delays adjust to maintain the same distances from the screen dim
// delay as originally set.
//
// Leaving the policy unset puts a default scale factor in use.
//
// Note: The scale factor must be 100% or more.
//
// Supported on: chrome_os
message UserActivityScreenDimDelayScaleProto {
  optional PolicyOptions policy_options = 1;
  optional int64 UserActivityScreenDimDelayScale = 2;
}

// Control the User-Agent Client Hints feature.
//
// Note that this policy was removed in M94.  This policy was intended for
// short-term adaptation purposes only.
//
// When enabled the User-Agent Client Hints feature sends granular request
// headers providing information about the user browser and environment.
// This is an additive feature, but the new headers may break some websites that
// restrict the characters that requests may contain.
// If this policy is enabled or not set the User-Agent Client Hints feature is
// enabled. If the policy is disabled the feature is unavailable.
//
// Supported on:
message UserAgentClientHintsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserAgentClientHintsEnabled = 2;
}

// Control the User-Agent Client Hints GREASE Update feature.
//
// This policy is deprecated as the updated GREASE algorithm has been on by
// default since M103.
// When enabled the User-Agent Client Hints GREASE Update feature aligns the
// User-Agent GREASE algorithm with the latest spec.
// The updated spec may break some websites that restrict the characters that
// requests may contain. See the spec for more information:
// https://wicg.github.io/ua-client-hints/#grease
// This policy will be removed in a future release.
//
// Valid values:
//   True: Allow the updated User-Agent GREASE algorithm to be run.
//   False: Force the prior User-Agent GREASE algorithm to be used.
//
// Supported on:
message UserAgentClientHintsGREASEUpdateEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserAgentClientHintsGREASEUpdateEnabled = 2;
}

// Enable or disable the User-Agent Reduction.
//
// The User-Agent HTTP request header had been reduced by default since Chrome
// 110 and deprecaton trial ended after Chrome 113. In order to continue
// receiving detailed plaform information, please migrate to User-Agent Client
// Hints which serve as a replacement for deprecated detailed User-Agent header:
// https://web.dev/articles/migrate-to-ua-ch
//
// Valid values:
//   0: Reduced User Agent.
//   1: Full (legacy) User Agent.
//   2: Reduced User Agent.
//
// Supported on: fuchsia
message UserAgentReductionProto {
  optional PolicyOptions policy_options = 1;
  optional int64 UserAgentReduction = 2;
}

// Allow customization of user avatar image using Google profile image or local
// images.
//
// If this policy is disabled, the user's Google ChromeOS avatar image cannot be
// set using local files, the device camera, or the user's Google profile image.
//
// The user may set the avatar image from any of these options if this policy is
// enabled or not set.
//
// Valid values:
//   True: Allow user avatar selection from local filesystem, camera and Google
// profile
//   False: Prevent user avatar selection from local filesystem, camera and
// Google profile
//
// Supported on: chrome_os
message UserAvatarCustomizationSelectorsEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserAvatarCustomizationSelectorsEnabled = 2;
}

// User avatar image
//
// This policy allows you to configure the avatar image representing the user on
// the login screen. The policy is set by specifying the URL from which Google
// ChromeOS can download the avatar image and a cryptographic hash used to
// verify the integrity of the download. The image must be in JPEG format, its
// size must not exceed 512kB. The URL must be accessible without any
// authentication.
//
// The avatar image is downloaded and cached. It will be re-downloaded whenever
// the URL or the hash changes.
//
// If this policy is set, Google ChromeOS will download and use the avatar
// image.
//
// If you set this policy, users cannot change or override it.
//
// If the policy is left not set, the user can choose the avatar image
// representing them on the login screen.
//
// Supported on: chrome_os
message UserAvatarImageProto {
  optional PolicyOptions policy_options = 1;
  optional string UserAvatarImage = 2;
}

// Allow users to use Borealis on Google ChromeOS
//
// Controls the availability of Borealis for this user.
//
// If the policy is unset, or is set to false, Borealis will be unavailable.
// When the policy is set to true Borealis will be available if and only if no
// other policy or setting disables it.
//
// Valid values:
//   True: Allow Borealis to run for a user
//   False: Prevent Borealis from running for a user
//
// Supported on: chrome_os
message UserBorealisAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserBorealisAllowed = 2;
}

// Enable the Chrome Enterprise Device Trust Connector attestation flow for a
// list of URLs on Managed Profiles
//
// Enable Chrome Enterprise Device Trust Connector for a list of URLs.
//
// Setting this policy specifies for which URLs Google Chrome will offer to
// start the attestation flow for managed profiles. The latter allows those
// websites to get an attested set of context-aware signals from the device.
// This policy can only be configured via the Chrome Enterprise Connectors page
// on the Google Admin console.
//
// Leaving this policy unset or empty means that no website will be able to
// start a user-level attestation flow and get signals from the device. However
// if the corresponding
// BrowserContextAwareAccessSignalsAllowlist policy is enabled then the
// attestation flow can be started for the managed browser and device signals
// can be collected.
//
// For Google ChromeOS, this policy is related to remote attestation where a
// certificate is automatically generated and uploaded to the server. For usage
// of the attestation flow on the device's login screen, please use the
// DeviceLoginScreenContextAwareAccessSignalsAllowlist policy.
//
// For detailed information on valid URL patterns, please see
// https://support.google.com/chrome/a?p=url_blocklist_filter_format.
//
// Supported on: chrome_os, ios, linux, mac, win
message UserContextAwareAccessSignalsAllowlistProto {
  optional PolicyOptions policy_options = 1;
  optional StringList UserContextAwareAccessSignalsAllowlist = 2;
}

// Set user data directory
//
// Configures the directory that Google Chrome will use for storing user data.
//
// If you set this policy, Google Chrome will use the provided directory
// regardless whether the user has specified the '--user-data-dir' flag or not.
// To avoid data loss or other unexpected errors this policy should not be set
// to a directory used for other purposes, because Google Chrome manages its
// contents.
//
// See https://support.google.com/chrome/a?p=Supported_directory_variables for a
// list of variables that can be used.
//
// If this policy is left not set the default profile path will be used and the
// user will be able to override it with the '--user-data-dir' command line
// flag.
//
// Supported on: mac, win
message UserDataDirProto {
  optional PolicyOptions policy_options = 1;
  optional string UserDataDir = 2;
}

// Limits the number of user data snapshots retained for use in case of
// emergency rollback.
//
// Following each major version update, Chrome will create a snapshot of certain
// portions of the user's browsing data for use in case of a later emergency
// version rollback. If an emergency rollback is performed to a version for
// which a user has a corresponding snapshot, the data in the snapshot is
// restored. This allows users to retain such settings as bookmarks and autofill
// data.
//
// If this policy is not set, the default value of 3 is used
//
// If the policy is set, old snapshots are deleted as needed to respect the
// limit. If the policy is set to 0, no snapshots will be taken
//
// Supported on: fuchsia, linux, mac, win
message UserDataSnapshotRetentionLimitProto {
  optional PolicyOptions policy_options = 1;
  optional int64 UserDataSnapshotRetentionLimit = 2;
}

// Set the display name for device-local accounts
//
// Controls the account name Google ChromeOS shows on the login screen for the
// corresponding device-local account.
//
// If this policy is set, the login screen will use the specified string in the
// picture-based login chooser for the corresponding device-local account.
//
// If the policy is left not set, Google ChromeOS will use the device-local
// account's email account ID as the display name on the login screen.
//
// This policy is ignored for regular user accounts.
//
// Supported on: chrome_os
message UserDisplayNameProto {
  optional PolicyOptions policy_options = 1;
  optional string UserDisplayName = 2;
}

// Allow user feedback
//
// Setting the policy to Enabled or leaving it unset lets users send feedback to
// Google through Menu > Help > Report an Issue or key combination.
//
// Setting the policy to Disabled means users can't send feedback to Google.
//
// Valid values:
//   True: Allow users to file feedback
//   False: Prevent users from filing feedback
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message UserFeedbackAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserFeedbackAllowed = 2;
}

// Allow low level debug data in user feedback
//
// Setting this policy to a list of device types allows low level debug data
// from the mentioned device types to be included in user feedback.
//
// The special entry "all" includes all device types, including device types to
// be added in the future.
//
// If the policy is unset or set to an empty list, no low level debug data is
// attached to the user feedback.
// See the description of each device type for the specific type of low level
// debug data.
//
// Valid values:
//   all: Allow users to include low level debug data from all device types
// available below in user feedback
//   wifi: Allow users to include WiFi low level debug data in user feedback
//
// Supported on: chrome_os
message UserFeedbackWithLowLevelDebugDataAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional StringList UserFeedbackWithLowLevelDebugDataAllowed = 2;
}

// Allow access to native CUPS printers
//
// Allows you to control if users can access non-enterprise printers
//
// If the policy is set to True, or not set at all, users will be able to add,
// configure, and print using their own native printers.
//
// If the policy is set to False, users will not be able to add and configure
// their own native printers. They will also not be able to print using any
// previously configured native printers.
//
// This policy is deprecated, please use UserPrintersAllowed instead.
//
// Supported on:
message UserNativePrintersAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserNativePrintersAllowed = 2;
}

// Allow users to use a PluginVm on Google ChromeOS
//
// Allow this user to run PluginVm.
//
// If the policy is set to false or left unset, PluginVm is not enabled for the
// user.
// If set to true, PluginVm is enabled for the user as long as other settings
// also allow it. PluginVmAllowed and UserPluginVmAllowed need to be true, and
// either PluginVmLicenseKey or PluginVmUserId need to be set for PluginVm to be
// allowed to run.
//
// Valid values:
//   True: Allow users to use a PluginVm
//   False: Do not allow users to use a PluginVm
//
// Supported on:
message UserPluginVmAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserPluginVmAllowed = 2;
}

// Allow access to CUPS printers
//
// Allows you to control if users can access non-enterprise printers
//
// If the policy is set to True, or not set at all, users will be able to add,
// configure, and print using their own printers.
//
// If the policy is set to False, users will not be able to add and configure
// their own printers. They will also not be able to print using any previously
// configured printers.
//
// Valid values:
//   True: Allow users to add, configure, and print from non-enterprise printers
//   False: Do not allow users to add, configure, and print from non-enterprise
// printers
//
// Supported on: chrome_os
message UserPrintersAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserPrintersAllowed = 2;
}

// Enable cloud reporting of security signals in managed profiles
//
// This policy controls Google Chrome usage of first party user authentication
// when reporting user security signals for a particular managed profile.
//
// This policy is set to Enabled, first party authentication will be used when
// uploading security signals.
//
// This policy is set to Disabled, or is left unset, first party authentication
// will not be used when uploading security signals.
//
// User security signals reports are only uploaded when
// UserSecuritySignalsReporting is enabled.
//
// This policy can only be set as cloud user policy.
//
// Valid values:
//   True: Enable first-party authentication when reporting user security
// signals
//   False: Disable first-party authentication when reporting user security
// signals
//
// Supported on: android, chrome_os, ios, linux, mac, win
message UserSecurityAuthenticatedReportingProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserSecurityAuthenticatedReporting = 2;
}

// Enable cloud reporting of security signals in managed profiles
//
// This policy controls Google Chrome cloud reporting of security signals for a
// particular managed profile.
//
// When this policy is set to Enabled, it will report security signals about the
// device, browser and profile to the device management server.
//
// When this policy is set to Disabled, or is left unset, it will not trigger
// the collecton and upload of security signals.
//
// The report contains profile state and usage information, including but not
// limited to OS version, browser version, installed extensions and applied
// policies.
//
// This policy can only be set as cloud user policy.
//
// Valid values:
//   True: Enable user security signals cloud reporting
//   False: Disable user security signals cloud reporting
//
// Supported on: android, chrome_os, ios, linux, mac, win
message UserSecuritySignalsReportingProto {
  optional PolicyOptions policy_options = 1;
  optional bool UserSecuritySignalsReporting = 2;
}

// Set the restriction on the fetching of the Variations seed
//
// Add a parameter to the fetching of the Variations seed in Google Chrome.
//
// If specified, will add a query parameter called 'restrict' to the URL used to
// fetch the Variations seed. The value of the parameter will be the value
// specified in this policy.
//
// If not specified, will not modify the Variations seed URL.
//
// Supported on: android, fuchsia, linux, mac, win
message VariationsRestrictParameterProto {
  optional PolicyOptions policy_options = 1;
  optional string VariationsRestrictParameter = 2;
}

// Allow or deny video capture
//
// Setting the policy to Enabled or leaving it unset means that, with the
// exception of URLs set in the VideoCaptureAllowedUrls list, users get prompted
// for video capture access.
//
// Setting the policy to Disabled turns off prompts, and video capture is only
// available to URLs set in the VideoCaptureAllowedUrls list.
//
// Note: The policy affects all video input (not just the built-in camera).
//
// Valid values:
//   True: Enable video input
//   False: Disable video input
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message VideoCaptureAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool VideoCaptureAllowed = 2;
}

// URLs that will be granted access to video capture devices without prompt
//
// Setting the policy means you specify the URL list whose patterns get matched
// to the security origin of the requesting URL. A match grants access to video
// capture devices without prompt
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/. Note, however, that
// the pattern "*", which matches any URL, is not supported by this policy.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message VideoCaptureAllowedUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList VideoCaptureAllowedUrls = 2;
}

// Enable the accessibility virtual keyboard
//
// Enable the virtual keyboard accessibility feature.
//
// If this policy is set to true, the accessibility virtual keyboard will always
// be enabled.
//
// If this policy is set to false, the accessibility virtual keyboard will
// always be disabled.
//
// If you set this policy, users cannot change or override it.
//
// If this policy is left unset, the accessibility virtual keyboard is disabled
// initially but can be enabled by the user at any time by using the
// accessibility settings.
//
// This policy does not affect whether the touch virtual keyboard is enabled.
// For example, the touch virtual keyboard will still show up on a tablet device
// even if this policy is set to false. Use the TouchVirtualKeyboardEnabled
// policy to control the behavior of the touch virtual keyboard.
//
// Valid values:
//   True: Enable accessibility virtual keyboard
//   False: Disable accessibility virtual keyboard
//   None: Allow the user to decide
//
// Supported on: chrome_os
message VirtualKeyboardEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool VirtualKeyboardEnabled = 2;
}

// Enable or disable various features on the on-screen keyboard
//
// Enable or disable various features on the on-screen keyboard. This policy
// takes effect only when "VirtualKeyboardEnabled" policy is enabled.
//
// If one feature in this policy is set to True, it will be enabled on the on-
// screen keyboard.
//
// If one feature in this policy is set to False or left unset, it will be
// disabled on the on-screen keyboard.
//
// NOTE: this policy is only supported in PWA Kiosk mode.
//
// Value schema:
// {
//     "properties": {
//         "auto_complete_enabled": {
//             "description": "A boolean flag indicating if the on-screen
// keyboard can provide auto-complete.",
//             "type": "boolean"
//         },
//         "auto_correct_enabled": {
//             "description": "A boolean flag indicating if the on-screen
// keyboard can provide auto-correct.",
//             "type": "boolean"
//         },
//         "handwriting_enabled": {
//             "description": "A boolean flag indicating if the on-screen
// keyboard can provide input via handwriting recognition.",
//             "type": "boolean"
//         },
//         "spell_check_enabled": {
//             "description": "A boolean flag indicating if the on-screen
// keyboard can provide spell-check.",
//             "type": "boolean"
//         },
//         "voice_input_enabled": {
//             "description": "A boolean flag indicating if the on-screen
// keyboard can provide voice input.",
//             "type": "boolean"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os
message VirtualKeyboardFeaturesProto {
  optional PolicyOptions policy_options = 1;
  optional string VirtualKeyboardFeatures = 2;
}

// The virtual keyboard resizes the layout viewport by default
//
// Setting the policy to True causes the virtual keyboard to resize the layout
// viewport by default.
// Other states (False/unset) have no effect.
//
// Note that this only affects the default resizing behavior: if a page requests
// a specific behavior using a &lt;meta&gt; tag or the Virtual Keyboard API,
// then that requested behavior will still apply.
//
// Note also that this is an "escape hatch" policy that's intended to be short-
// lived.
//
// Valid values:
//   True: The default virtual keyboard resize behavior is changed to resize the
// layout viewport
//   False: The default virtual keyboard resize behavior is not modified
//
// Supported on: android
message VirtualKeyboardResizesLayoutByDefaultProto {
  optional PolicyOptions policy_options = 1;
  optional bool VirtualKeyboardResizesLayoutByDefault = 2;
}

// Let the on-screen keyboard appear when appropriate.
//
// When the policy is set to True or unset, the on-screen keyboard can appear
// when it predicts that the user is about to use it.
//
// When the policy to set to False, the on-screen keyboard only appears if the
// user explicitly taps on an input field or if an application requests it.
//
// For example, suppose the user uses the virtual keyboard to type their
// username in a two-stage login screen. When the login screen transitions to
// the password stage, if the policy is True, the virtual keyboard may remain
// visible, even though the user did not tap on the password input field. If the
// policy is False, then the virtual keyboard will disappear.
//
// This policy does not apply if the virtual keyboard is disabled (e.g. using
// the TouchVirtualKeyboardEnabled policy, or if the device is connected to a
// physical keyboard).
//
// Valid values:
//   True: Show the on-screen keyboard when appropriate.
//   False: Only show the on-screen keyboard if the user or application requests
// it.
//
// Supported on: chrome_os
message VirtualKeyboardSmartVisibilityEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool VirtualKeyboardSmartVisibilityEnabled = 2;
}

// Specify VM CLI permission
//
// Instructs Google ChromeOS to enable or disable virtual machine management
// console tools.
//
// If the policy is set to true or left unset, the user will be able to use VM
// management CLI.
// Otherwise, all of VM management CLI is disabled and hidden.
//
// Valid values:
//   True: Enable virtual machine command line access
//   False: Disable virtual machine command line access
//
// Supported on: chrome_os
message VmManagementCliAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool VmManagementCliAllowed = 2;
}

// Allow Google Assistant to access screen context
//
// Setting the policy to Enabled lets Google Assistant access screen context and
// send that data to a server. Setting the policy to Disabled keeps Google
// Assistant from screen context.
//
// Leaving the policy unset lets users decide to turn this feature on or off.
//
// Valid values:
//   True: Allow Google Assistant to access screen context
//   False: Block Google Assistant from accessing screen context during
// interactions
//   None: Allow the user to decide
//
// Supported on:
message VoiceInteractionContextEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool VoiceInteractionContextEnabled = 2;
}

// Allow Google Assistant to listen for the voice activation phrase
//
// Setting the policy to Enabled lets Google Assistant listen for the voice
// activation phrase. Setting the policy to Disabled keeps Google Assistant from
// listening for the phrase.
//
// Leaving the policy unset lets users decide to turn this feature on or off.
//
// Valid values:
//   True: Enable the Google Assistant hotword
//   False: Disable the Google Assistant hotword
//   None: Allow the user to decide
//
// Supported on:
message VoiceInteractionHotwordEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool VoiceInteractionHotwordEnabled = 2;
}

// Allow Quick Answers to access selected content
//
// This policy is deprecated and will be removed in Google ChromeOS version 89.
//
// This policy gives Quick Answers permission to access selected content and
// send the info to server.
//
// If the policy is enabled, Quick Answers will be allowed to access selected
// content.
// If the policy is disabled, Quick Answers will not be allowed to access
// selected content.
// If the policy is not set, users can decide whether to allow Quick Answers to
// access selected content.
//
// Supported on:
message VoiceInteractionQuickAnswersEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool VoiceInteractionQuickAnswersEnabled = 2;
}

// Settings for Talk to type
//
// Talk to type is an AI-based feature that allows users to input and edit text
// using their voice, powered by generative AI models to provide high-quality
// transcription and formatting.
//
// 0 = Allow the feature to be used, while allowing Google to use relevant data
// to improve its AI models. Relevant data may include prompts, inputs, outputs,
// source materials, and written feedback, depending on the feature. It may also
// be reviewed by humans to improve AI models. 0 is the default value, except
// when noted below.
//
// 1 = Allow the feature to be used, but does not allow Google to improve models
// using users' content (including prompts, inputs, outputs, source materials,
// and written feedback). 1 is the default value for Enterprise users managed by
// Google Admin console and for Education accounts managed by Google Workspace.
//
// 2 = Do not allow the feature.
//
// If the policy is unset, its behavior is determined by the
// GenAiDefaultSettings policy.
//
// For more information on data handling for generative AI features, please see
// https://support.google.com/chrome/a?p=generative_ai_settings.
//
// Valid values:
//   0: Allow Talk to type.
//   1: Allow Talk to type without data collection.
//   2: Do not allow Talk to type.
//
// Supported on: chrome_os, linux, mac, win
message VoiceTypingSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional int64 VoiceTypingSettings = 2;
}

// Allow the user to manage VPN connections
//
// Setting the policy to Enabled or leaving it unset lets users manage
// (disconnect or modify) VPN connections. If the VPN connection is created
// using a VPN app, the UI inside the app isn't affected. So, users might still
// be able to use the app to modify the VPN connection. Use this policy with the
// Always on VPN feature, which lets the admin decide to establish a VPN
// connection when starting a device.
//
// Setting the policy to Disabled turns off the Google ChromeOS user interfaces
// that would let the user disconnect or modify VPN connections.
//
// Valid values:
//   True: Allow the user to manually disconnect or modify a VPN
//   False: Do not allow the user to manually disconnect or modify a VPN
//
// Supported on: chrome_os
message VpnConfigAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool VpnConfigAllowed = 2;
}

// Enable WPAD optimization
//
// Setting the policy to Enabled or leaving it unset turns on WPAD (Web Proxy
// Auto-Discovery) optimization in Google Chrome.
//
// Setting the policy to Disabled turns off WPAD optimization, causing Google
// Chrome to wait longer for DNS-based WPAD servers.
//
// Whether or not this policy is set, users can't change the WPAD optimization
// setting.
//
// Valid values:
//   True: Enable Web Proxy Auto-Discovery (WPAD) optimizations
//   False: Disable Web Proxy Auto-Discovery (WPAD) optimization
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WPADQuickCheckEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WPADQuickCheckEnabled = 2;
}

// Wait for initial user activity
//
// Setting the policy to Enabled means that power management delays and session
// length limits don't start until after the first user activity occurs in a
// session.
//
// Setting the policy to Disabled or leaving it unset means power management
// delays and the time limit begin immediately at session start.
//
// Valid values:
//   True: Start power management delays and session length limits after initial
// user activity
//   False: Start power management delays and session length limits at session
// start
//
// Supported on: chrome_os
message WaitForInitialUserActivityProto {
  optional PolicyOptions policy_options = 1;
  optional bool WaitForInitialUserActivity = 2;
}

// Wallpaper selection from Google Photos
//
// If this policy is disabled, the user's Google ChromeOS wallpaper image cannot
// be selected from a Google Photos album.
//
// The user can choose a Google Photos image as wallpaper if this policy is
// enabled or not set.
//
// Valid values:
//   True: Allow Google Photos access from personalization app
//   False: Prevent Google Photos access from personalization app
//
// Supported on: chrome_os
message WallpaperGooglePhotosIntegrationEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WallpaperGooglePhotosIntegrationEnabled = 2;
}

// Wallpaper image
//
// If you set the policy, Google ChromeOS
//
// downloads and uses the wallpaper image you set for the user's desktop and
// sign-in screen background, and users can't change it. Specify the URL (that's
// accessible without authentication) which Google ChromeOS
//
// can download the wallpaper image from, as well as a cryptographic hash (in
// JPEG format with a file size up to 16 MB) to verify its integrity.
//
// If not set, users choose the image for the desktop and sign-in screen
// background.
//
// Supported on: chrome_os
message WallpaperImageProto {
  optional PolicyOptions policy_options = 1;
  optional string WallpaperImage = 2;
}

// Show a warning dialog when the user is attempting to quit
//
// Controls "Warn Before Quitting (⌘Q)" dialog when the user is attempting to
// quit browser.
//
// If this policy is set to Enabled or not set, a warning dialog is shown when
// the user is attempting to quit.
//
// If this policy is set to Disabled, a warning dialog is not shown when the
// user is attempting to quit.
//
// Valid values:
//   True: Show a warning dialog when the user is attempting to quit
//   False: Do not show a warning dialog when the user is attempting to quit
//
// Supported on: mac
message WarnBeforeQuittingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WarnBeforeQuittingEnabled = 2;
}

// Configure Custom Watermark Settings
//
// Allows administrators to customize the appearance of watermarks applied by
// Data Loss Prevention (DLP) rules. This includes setting its fill/outline
// opacity, defining its font size, and setting its timestamp time zone.
// If this policy or some values is not set, Chrome will use its default
// watermark behavior.
// The default values on desktop are: fill opacity at 4, outline opacity at 6,
// font size at 24. On iOS, the default values are: fill opacity at 10, outline
// opacity at 15, font size at 16. On all platforms, the timestamp time zone
// defaults to 'user_device' (user's local device time zone).
//
// The 'Fill Opacity' is a percentage from 0 (fully transparent) to 100 (fully
// opaque).
// The 'Outline Opacity' is a percentage from 0 (fully transparent) to 100
// (fully opaque).
// The 'Font Size' is specified in points.
// The 'Timestamp Timezone' specifies the IANA time zone identifier (e.g.
// 'America/Toronto') used for formatting watermark timestamps (supported
// starting in Chrome 152+), which follows the names in the IANA Time Zone
// Database ( https://www.iana.org/time-zones ).
//
// Value schema:
// {
//     "properties": {
//         "fill_opacity": {
//             "description": "Fill opacity of the watermark text, from 0
// (transparent) to 100 (opaque).",
//             "maximum": 100,
//             "minimum": 0,
//             "type": "integer"
//         },
//         "font_size": {
//             "description": "Font size of the watermark text in points.",
//             "minimum": 1,
//             "type": "integer"
//         },
//         "outline_opacity": {
//             "description": "Outline opacity of the watermark text, from 0
// (transparent) to 100 (opaque).",
//             "maximum": 100,
//             "minimum": 0,
//             "type": "integer"
//         },
//         "timestamp_timezone": {
//             "description": "IANA time zone identifier (e.g.
// 'America/Toronto') used for formatting watermark timestamps (supported
// starting in Chrome 152+). Defaults to 'user_device'.",
//             "type": "string"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: chrome_os, ios, linux, mac, win
message WatermarkStyleProto {
  optional PolicyOptions policy_options = 1;
  optional string WatermarkStyle = 2;
}

// Allow detecting plain text entities in web pages.
//
// This policy decides if plain text entities are detected on webpages, letting
// users trigger contextual actions by interacting with them.
// The policy has multiple properties, one for each entity type.
// The entity types are default, addresses ... .
//
// If the value for an entity is unset, the behavior of the default entity is
// applied.
// The default behavior for default is enabled.
//
// The values for each entity types are default, enabled,
// disabled or longpressonly.
// If the value is set to default, the behavior of the default entity is
// applied.
// If the value is set to enabled, entities are detected, underlines and
// triggered either by one tap or long press.
// If the value is set to disabled, entities are not detected and not
// actionable.
// If the value is set to longpressonly, entities are detected and only
// actionable using long press.
//
// Value schema:
// {
//     "properties": {
//         "addresses": {
//             "enum": [
//                 "default",
//                 "enabled",
//                 "disabled",
//                 "longpressonly"
//             ],
//             "type": "string"
//         },
//         "calendar": {
//             "enum": [
//                 "default",
//                 "enabled",
//                 "disabled",
//                 "longpressonly"
//             ],
//             "type": "string"
//         },
//         "default": {
//             "enum": [
//                 "enabled",
//                 "disabled",
//                 "longpressonly"
//             ],
//             "type": "string"
//         },
//         "email": {
//             "enum": [
//                 "default",
//                 "enabled",
//                 "disabled",
//                 "longpressonly"
//             ],
//             "type": "string"
//         },
//         "package": {
//             "enum": [
//                 "default",
//                 "enabled",
//                 "disabled",
//                 "longpressonly"
//             ],
//             "type": "string"
//         },
//         "phonenumbers": {
//             "enum": [
//                 "default",
//                 "enabled",
//                 "disabled",
//                 "longpressonly"
//             ],
//             "type": "string"
//         },
//         "units": {
//             "enum": [
//                 "default",
//                 "enabled",
//                 "disabled",
//                 "longpressonly"
//             ],
//             "type": "string"
//         }
//     },
//     "type": "object"
// }
//
// Supported on: ios
message WebAnnotationsProto {
  optional PolicyOptions policy_options = 1;
  optional string WebAnnotations = 2;
}

// Enable User Web App Install From Browser
//
// This policy controls whether users can install web apps through the browser.
// If you enable or don’t configure this policy, users can install web apps
// through the browser.
// If you disable this policy, users can’t install web apps through the browser
// and the "apps" data type will be excluded from synchronization for Chrome
// Sync.
// This policy doesn't support dynamic refresh. Any changes, whether enabling,
// disabling or unsetting, become effective only after the browser is restarted.
// This policy doesn't affect the 'WebAppInstallForceList' policy.
//
// Valid values:
//   True: Users can install web apps through the browser.
//   False: Users can’t install web apps through the browser.
//
// Supported on: chrome_os, linux, mac, win
message WebAppInstallByUserEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebAppInstallByUserEnabled = 2;
}

// Configure list of force-installed Web Apps
//
// Setting the policy specifies a list of web apps that install silently,
// without user interaction, and which users can't uninstall or turn off.
//
// Each list item of the policy is an object with a mandatory member:
// url (the URL of the web app to install)
//
// and 6 optional members:
// - default_launch_container
// (for how the web app opens—a new tab is the default)
//
// - create_desktop_shortcut
// (True if you want to create Linux and
// Microsoft® Windows® desktop shortcuts).
//
// - fallback_app_name
// (Starting with Google Chrome version 90,
// allows you to override the app name if it is not a
// Progressive Web App (PWA), or the app name that is temporarily
// installed if it is a PWA but authentication is required before the
// installation can be completed. If both
// custom_name and
// fallback_app_name are provided,
// the latter will be ignored.)
//
// - custom_name
// (Starting with Google ChromeOS
// version 99, and version 112 on all other desktop operating systems, allows
// you to
// permanently override the app name for all web apps and PWAs.)
//
// - custom_icon
// (Starting with Google ChromeOS
// version 99, and version 112 on all other desktop operating systems, allows
// you to
// override the app icon of installed apps. The icons have to be square,
// maximal 1 MB in size, and in one of the following formats: jpeg, png, gif,
// webp, ico.
// The hash value has to be the SHA256 hash of the icon file. The url
// should be accessible without authentication to ensure the icon can be used
// upon app installation.)
//
// - install_as_shortcut
// (Starting with Google Chrome
// version 107). If enabled the given url
// will be installed as a shortcut, as if done via the "Create Shortcut..."
// option in the desktop browser GUI.
// Note that when installed as a shortcut it won't be updated if the
// manifest in url changes.
// If disabled or unset, the web app at the given
// url will be installed normally.
//
// See PinnedLauncherApps for pinning apps to the Google ChromeOS shelf.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "create_desktop_shortcut": {
//                 "type": "boolean"
//             },
//             "custom_icon": {
//                 "properties": {
//                     "hash": {
//                         "type": "string"
//                     },
//                     "url": {
//                         "type": "string"
//                     }
//                 },
//                 "required": [
//                     "url",
//                     "hash"
//                 ],
//                 "type": "object"
//             },
//             "custom_name": {
//                 "type": "string"
//             },
//             "default_launch_container": {
//                 "enum": [
//                     "tab",
//                     "window"
//                 ],
//                 "type": "string"
//             },
//             "fallback_app_name": {
//                 "type": "string"
//             },
//             "install_as_shortcut": {
//                 "type": "boolean"
//             },
//             "url": {
//                 "type": "string"
//             }
//         },
//         "required": [
//             "url"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WebAppInstallForceListProto {
  optional PolicyOptions policy_options = 1;
  optional string WebAppInstallForceList = 2;
}

// Web App management settings
//
// This policy allows an admin to specify settings for installed web apps. This
// policy maps a Web App ID to its specific setting. A default configuration can
// be set using the special ID *, which applies to all web apps without a custom
// configuration in this policy.
//
// The manifest_id field is the Manifest ID for the Web App. See
// https://developer.chrome.com/blog/pwa-manifest-id/ for instructions on how to
// determine the Manifest ID for an installed web app.
// The run_on_os_login field specifies if a web app can be run during OS login.
// If this field is set to blocked, the web app will not run during OS login and
// the user will not be able to enable this later. If this field is set to
// run_windowed, the web app will run during OS login and the user will not be
// able to disable this later. If this field is set to allowed, the user will be
// able to configure the web app to run at OS login. The default configuration
// only allows the allowed and blocked values.
// (Since version 117) The prevent_close_after_run_on_os_login field specifies
// if a web app shall be prevented from closing in any way (e.g. by the user,
// task manager, web APIs). This behavior can only be enabled if run_on_os_login
// is set to run_windowed. If the app were already running, this property will
// only come into effect after the app is restarted. If this field is not
// defined, apps will be closable by users.
// (Since version 118) The force_unregister_os_integration field specifies if
// all OS integration for a web app, i.e. shortcuts, file handlers, protocol
// handlers etc will be removed or not. If an app is already running, this
// property will come into effect after the app has restarted. This should be
// used with caution, since this can override any OS integration that is set
// automatically during the startup of the web applications system. Currently
// only works on Windows, Mac and Linux platforms.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "force_unregister_os_integration": {
//                 "type": "boolean"
//             },
//             "manifest_id": {
//                 "type": "string"
//             },
//             "prevent_close_after_run_on_os_login": {
//                 "type": "boolean"
//             },
//             "run_on_os_login": {
//                 "enum": [
//                     "allowed",
//                     "blocked",
//                     "run_windowed"
//                 ],
//                 "type": "string"
//             }
//         },
//         "required": [
//             "manifest_id"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WebAppSettingsProto {
  optional PolicyOptions policy_options = 1;
  optional string WebAppSettings = 2;
}

// Enable adaptive buffering for Web Audio
//
// This policy controls whether the browser uses adaptive buffering for
// Web Audio, which may decrease audio glitches but may increase
// latency by a variable amount.
//
// Setting the policy to Enabled will always use adaptive buffering.
//
// Setting the policy to Disabled or not set will allow the browser
// feature launch process to decide if adaptive buffering is used.
//
// Valid values:
//   True: Enable Web Audio adaptive buffering.
//   False: Web Audio adaptive buffering may be enabled depending on feature
// launch process.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebAudioOutputBufferingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebAudioOutputBufferingEnabled = 2;
}

// Allowed Origins for Proxied WebAuthn Requests from Remote Desktop
// Applications.
//
// A list of origins of remote desktop client apps that may execute WebAuthn API
// requests that originate from a browsing session on a remote host.
//
// Any origin configured in this policy can make WebAuthn requests for Relying
// Party IDs (RP IDs) that it would normally not allowed to be able to claim.
//
// Only valid HTTPS origins are allowed. Wildcards are not supported.
// Any invalid entries are ignored.
//
// This policy only applies to affiliated users.
//
// Supported on: android, chrome_os, linux, mac, win
message WebAuthenticationRemoteDesktopAllowedOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebAuthenticationRemoteDesktopAllowedOrigins = 2;
}

// Allow Chrome Remote Desktop to execute WebAuthn API requests proxied from a
// remote host.
//
// If set to Enabled, Chrome Remote Desktop may execute WebAuthn API requests
// that originate from a browsing session on a remote host.
//
// If the policy is set to Disabled or left unset, the default behavior will
// apply.
//
// Note that this feature is only supported inside Google's internal network
// environment.
//
// Valid values:
//   True: Allow CRD to execute WebAuthn API requests proxied from a remote
// host.
//   False: Do not allow CRD to execute WebAuthn API requests proxied from a
// remote host.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WebAuthenticationRemoteProxiedRequestsAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebAuthenticationRemoteProxiedRequestsAllowed = 2;
}

// Configure allowed WebAuthn factors
//
// Setting the policy controls which WebAuthn factors can be used.
//
// To allow:
//
// * Every WebAuthn factor, use ["all"] (includes factors added in the future).
//
// * Only PIN, use ["PIN"].
//
// * PIN and fingerprint, use ["PIN", "FINGERPRINT"].
//
// If the policy is unset or set to an empty list, no WebAuthn factors are
// available for managed devices.
//
// Valid values:
//   all: All
//   PIN: PIN
//   FINGERPRINT: Fingerprint
//
// Supported on: chrome_os
message WebAuthnFactorsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebAuthnFactors = 2;
}

// Re-enable Web Components v0 API until M84.
//
// The Web Components v0 APIs (Shadow DOM v0, Custom Elements v0, and HTML
// Imports) were deprecated in 2018, and have been disabled by default starting
// in M80. This policy allows these features to be selectively re-enabled until
// M84.
//
// If this policy is set to True, the Web Components v0 features will be enabled
// for all sites.
//
// If this policy is set to False or not set, the Web Components v0 features
// will be disabled by default, starting in M80.
//
// This policy will be removed after Chrome 84.
//
// Supported on:
message WebComponentsV0EnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebComponentsV0Enabled = 2;
}

// Allow WebDriver to Override Incompatible Policies
//
//
// This policy was removed in M80, because it is not necessary anymore as
// WebDriver is now compatible with all existing policies.
//
// This policy allows users of the WebDriver feature to override policies which
// can interfere with its operation.
//
// Currently this policy disables SitePerProcess and IsolateOrigins policies.
//
// If the policy is enabled, WebDriver will be able to override incompatible
// policies.
//
// If the policy is disabled or not configured, WebDriver will not be allowed to
// override incompatible policies.
//
// Supported on:
message WebDriverOverridesIncompatiblePoliciesProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebDriverOverridesIncompatiblePolicies = 2;
}

// Automatically grant permission to sites to connect to any HID device.
//
// Setting the policy allows you to list sites which are automatically granted
// permission to access all available devices.
//
// The URLs must be valid, otherwise the policy is ignored. Only the origin
// (scheme, host and port) of the URL is considered.
//
// On ChromeOS, this policy only applies to affiliated users.
//
// This policy overrides DefaultWebHidGuardSetting, WebHidAskForUrls,
// WebHidBlockedForUrls and the user's preferences.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebHidAllowAllDevicesForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebHidAllowAllDevicesForUrls = 2;
}

// Automatically grant permission to these sites to connect to HID devices with
// the given vendor and product IDs.
//
// Setting the policy lets you list the URLs that specify which sites are
// automatically granted permission to access a HID device with the given vendor
// and product IDs. Each item in the list requires both devices and urls fields
// for the item to be valid, otherwise the item is ignored. Each item in the
// devices field must have a vendor_id and may have a product_id field. Omitting
// the product_id field will create a policy matching any device with the
// specified vendor ID. An item which has a product_id field without a vendor_id
// field is invalid and is ignored.
//
// Leaving the policy unset means DefaultWebHidGuardSetting applies, if it's
// set. If not, the user's personal setting applies.
//
// URLs in this policy shouldn't conflict with those configured through
// WebHidBlockedForUrls. If they do, this policy takes precedence over
// WebHidBlockedForUrls.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "devices": {
//                 "items": {
//                     "properties": {
//                         "product_id": {
//                             "maximum": 65535,
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "vendor_id": {
//                             "maximum": 65535,
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "required": [
//                         "vendor_id"
//                     ],
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "urls": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             }
//         },
//         "required": [
//             "devices",
//             "urls"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebHidAllowDevicesForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional string WebHidAllowDevicesForUrls = 2;
}

// Automatically grant permission to these sites to connect to HID devices
// containing top-level collections with the given HID usage.
//
// Setting the policy lets you list the URLs that specify which sites are
// automatically granted permission to access a HID device containing a top-
// level collection with the given HID usage. Each item in the list requires
// both usages and urls fields for the policy to be valid. Each item in the
// usages field must have a usage_page and may have a usage field. Omitting the
// usage field will create a policy matching any device containing a top-level
// collection with a usage from the specified usage page. An item which has a
// usage field without a usage_page field is invalid and is ignored.
//
// Leaving the policy unset means DefaultWebHidGuardSetting applies, if it's
// set. If not, the user's personal setting applies.
//
// URLs in this policy shouldn't conflict with those configured through
// WebHidBlockedForUrls. If they do, this policy takes precedence over
// WebHidBlockedForUrls.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "urls": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             },
//             "usages": {
//                 "items": {
//                     "properties": {
//                         "usage": {
//                             "maximum": 65535,
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "usage_page": {
//                             "maximum": 65535,
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "required": [
//                         "usage_page"
//                     ],
//                     "type": "object"
//                 },
//                 "type": "array"
//             }
//         },
//         "required": [
//             "usages",
//             "urls"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebHidAllowDevicesWithHidUsagesForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional string WebHidAllowDevicesWithHidUsagesForUrls = 2;
}

// Allow the WebHID API on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can ask users to grant them access to a HID device.
//
// Leaving the policy unset means DefaultWebHidGuardSetting applies for all
// sites, if it's set. If not, users' personal settings apply.
//
// For URL patterns which do not match the policy, the following take
// precedence, in this order:
//
// * WebHidBlockedForUrls (if there is a match),
//
// * DefaultWebHidGuardSetting (if set), or
//
// * Users' personal settings.
//
// URL patterns must not conflict with WebHidBlockedForUrls. Neither policy
// takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebHidAskForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebHidAskForUrls = 2;
}

// Block the WebHID API on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can't ask users to grant them access to a HID device.
//
// Leaving the policy unset means DefaultWebHidGuardSetting applies for all
// sites, if it's set. If not, users' personal settings apply.
//
// For URL patterns which do not match the policy, the following take
// precedence, in this order:
//
// * WebHidAskForUrls (if there is a match),
//
// * DefaultWebHidGuardSetting (if set), or
//
// * Users' personal settings.
//
// URL patterns can't conflict with WebHidAskForUrls. Neither policy takes
// precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebHidBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebHidBlockedForUrls = 2;
}

// Allow WebPrinting API on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// are automatically granted access to local printers via the WebPrinting API.
// Valid patterns are limited to Isolated Web Apps.
//
// Leaving the policy unset means DefaultWebPrintingSetting applies for all
// sites, if it's set. If not, users' personal settings apply.
//
// URL patterns must not conflict with WebPrintingBlockedForUrls. Neither policy
// takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os
message WebPrintingAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebPrintingAllowedForUrls = 2;
}

// Block WebPrinting API on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// are automatically denied access to local printers via the WebPrinting API.
// Valid patterns are limited to Isolated Web Apps.
//
// Leaving the policy unset means DefaultWebPrintingSetting applies for all
// sites, if it's set. If not, users' personal settings apply.
//
// URL patterns must not conflict with WebPrintingAllowedForUrls. Neither policy
// takes precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: chrome_os
message WebPrintingBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebPrintingBlockedForUrls = 2;
}

// Allow legacy TLS/DTLS downgrade in WebRTC
//
// If enabled, WebRTC peer connections can downgrade to obsolete
// versions of the TLS/DTLS (DTLS 1.0, TLS 1.0 and TLS 1.1) protocols.
// When this policy is disabled or not set, these TLS/DTLS versions are
// disabled.
//
// This policy was removed in version M121 of
// Google Chrome.
//
// Valid values:
//   True: Allow WebRTC to use obsolete versions of the TLD/DTLS protocol
//   False: Prevent WebRTC from using obsolete versions of TLS/DTLS
//
// Supported on:
message WebRtcAllowLegacyTLSProtocolsProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebRtcAllowLegacyTLSProtocols = 2;
}

// Enable WebRTC diagnostic log collection for specific origins
//
// This policy allows enabling diagnostic log collection for WebRTC for specific
// origins.
//
// For detailed information on valid input patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy. This policy only matches based on origin, so any path
// in the URL pattern is ignored. Scheme and subdomains are supported.
//
// If the policy is set, diagnostic log collection will be enabled for the
// origins matched by the patterns in the list.
//
// If the policy is not set, diagnostic log collection will be disabled by
// default.
//
// Supported on: chrome_os, linux, mac, win
message WebRtcDiagnosticLogCollectionAllowedForOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebRtcDiagnosticLogCollectionAllowedForOrigins = 2;
}

// Allow collection of WebRTC event logs from Google services
//
// Setting the policy to Enabled means Google Chrome can collect WebRTC event
// logs from Google services such as Hangouts Meet and upload them to Google.
// These logs have diagnostic information for debugging issues with audio or
// video meetings in Google Chrome, such as the time and size of RTP packets,
// feedback about congestion on the network, and metadata about time and quality
// of audio and video frames. These logs have no audio or video content from the
// meeting. To make debugging easier, Google might associate these logs, by
// means of a session ID, with other logs collected by the Google service
// itself.
//
// Setting the policy to Disabled results in no collection or uploading of such
// logs.
//
// Leaving the policy unset on versions up to and including M76 means Google
// Chrome defaults to not being able to collect and upload these logs. Starting
// at M77, Google Chrome defaults to being able to collect and upload these logs
// from most profiles affected by cloud-based, user-level enterprise policies.
// From M77 up to and including M80, Google Chrome can also collect and upload
// these logs by default from profiles affected by Google Chrome on-premise
// management.
//
// Valid values:
//   True: Allow WebRTC event log collection from Google services
//   False: Do not allow WebRTC event log collection from Google services
//
// Supported on: android, chrome_os, linux, mac, win
message WebRtcEventLogCollectionAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebRtcEventLogCollectionAllowed = 2;
}

// WebRTC IP handling
//
// This policy allows restricting which IP addresses and interfaces WebRTC uses
// when attempting to find the best available connection.
//
// Valid values:
//
// * default - WebRTC uses all available network interfaces.
//
// * default_public_and_private_interfaces - WebRTC uses all public and private
// interfaces.
//
// * default_public_interface_only - WebRTC uses all public interfaces, but not
// private ones.
//
// * disable_non_proxied_udp - WebRTC uses either UDP SOCKS proxying or will
// fallback to TCP proxying.
//
// When unset, defaults to using all available network interfaces.
//
// See RFC 8828 section 5.2
// (https://tools.ietf.org/html/rfc8828.html#section-5.2) for a detailed
// description of all the handling values.
//
// Valid values:
//   default: WebRTC will use all available interfaces when searching for the
// best path.
//   default_public_and_private_interfaces: WebRTC will only use the interface
// connecting to the public Internet, but may connect using private IP
// addresses.
//   default_public_interface_only: WebRTC will only use the interface
// connecting to the public Internet, and will not connect using private IP
// addresses.
//   disable_non_proxied_udp: WebRTC will use TCP on the public-facing
// interface, and will only use UDP if supported by a configured proxy.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WebRtcIPHandlingProto {
  optional PolicyOptions policy_options = 1;
  optional string WebRtcIPHandling = 2;
}

// WebRTC per URL IP Handling
//
// This policy allows restricting which IP addresses and interfaces WebRTC uses
// when attempting to find the best available connection for each specific URL
// pattern.
//
// It accepts a list of URL patterns and handling type pairs. The URL patterns
// are checked in order and the first match will configure which handling is
// used by WebRTC for the domain. When the URL of the current document is not
// matched against any entry, it uses the configuration set by the policy
// WebRtcIPHandling.
//
// For detailed information on valid input patterns, please see
// https://chromeenterprise.google/policies/url-patterns/. Wildcards, *, are
// allowed. This policy only matches based on origin, so any path in the URL
// pattern is ignored.
//
// Valid handling values:
//
// * default - WebRTC uses all network interfaces.
//
// * default_public_and_private_interfaces - WebRTC uses all public and private
// interfaces.
//
// * default_public_interface_only - WebRTC uses all public interfaces, but not
// private ones.
//
// * disable_non_proxied_udp - WebRTC uses either UDP SOCKS proxying or will
// fallback to TCP proxying.
//
// See RFC 8828 section 5.2
// (https://tools.ietf.org/html/rfc8828.html#section-5.2) for a detailed
// description of all the handling values.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "handling": {
//                 "enum": [
//                     "default",
//                     "default_public_and_private_interfaces",
//                     "default_public_interface_only",
//                     "disable_non_proxied_udp"
//                 ],
//                 "type": "string"
//             },
//             "url": {
//                 "type": "string"
//             }
//         },
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: chrome_os, linux, mac, win
message WebRtcIPHandlingUrlProto {
  optional PolicyOptions policy_options = 1;
  optional string WebRtcIPHandlingUrl = 2;
}

// URLs for which local IPs are exposed in WebRTC ICE candidates
//
// Patterns in this list will be matched against the security origin of the
// requesting URL.
// If a match is found or chrome://flags/#enable-webrtc-hide-local-ips-with-mdns
// is Disabled, the local IP addresses are shown in WebRTC ICE candidates.
// Otherwise, local IP addresses are concealed with mDNS hostnames.
// Please note that this policy weakens the protection of local IPs if needed by
// administrators.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WebRtcLocalIpsAllowedUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebRtcLocalIpsAllowedUrls = 2;
}

// Enable post-quantum key agreement for WebRTC
//
// This policy allows controlling post-quantum key agreement for WebRTC.
//
// If this policy is set to Enabled, post-quantum key agreement would be offered
// for
// WebRTC.
//
// If this policy is set to Disabled, post-quantum key agreement would not be
// offered
// for WebRTC.
//
// If this policy is not set, the value would be set by the default rollout
// process
// for post-quantum key agreement offered for WebRTC.
//
// Offering a post-quantum key agreement is backwards-compatible. Existing DTLS
// peers and networking middleware are expected to ignore the new option and
// continue selecting previous options.
//
// However, devices that do not correctly implement DTLS may malfunction when
// offered the new option. For example, they may disconnect in response to
// unrecognized options or the resulting larger messages. Such devices are not
// post-quantum-ready and will interfere with an enterprise's post-quantum
// transition. If encountered, administrators should contact the vendor for a
// fix.
//
// This policy is a temporary measure and will be removed after some milestones.
//
// Valid values:
//   None: Use default value for post-quantum key agreement for WebRTC
//   True: Enable post-quantum key agreement for WebRTC
//   False: Disable post-quantum key agreement for WebRTC
//
// Supported on: chrome_os, linux, mac, win
message WebRtcPostQuantumKeyAgreementProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebRtcPostQuantumKeyAgreement = 2;
}

// Allow WebRTC text logs collection from Google Services
//
// Setting the policy to enabled means Google Chrome can collect WebRTC text
// logs from Google services such as Google Meet and upload them to Google.
// These logs have diagnostic information for debugging issues with audio or
// video meetings in Google Chrome, such as textual metadata describing incoming
// and outgoing WebRTC streams, WebRTC specific log entries and additional
// system information. These logs have no audio or video content from the
// meeting.
// Setting the policy to disabled results in no uploading of such logs to
// Google. Logs would still accumulate locally on the user's device.
// Leaving the policy unset means Google Chrome defaults to being able to
// collect and upload these logs.
//
// Valid values:
//   True: Allow WebRTC text log collection from Google Services
//   False: Do not allow WebRTC text log collection from Google Services
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WebRtcTextLogCollectionAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebRtcTextLogCollectionAllowed = 2;
}

// Restrict the range of local UDP ports used by WebRTC
//
// If the policy is set, the UDP port range used by WebRTC is restricted to the
// specified port interval (endpoints included).
//
// If the policy is not set, or if it is set to the empty string or an invalid
// port range, WebRTC is allowed to use any available local UDP port.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebRtcUdpPortRangeProto {
  optional PolicyOptions policy_options = 1;
  optional string WebRtcUdpPortRange = 2;
}

// Force WebSQL to be enabled.
//
// As of M119, if this policy is set to false or unset, WebSQL is disabled, but
// can be enabled via Chrome flag "web-sql-access". If the policy is set to
// true, WebSQL access is enabled.
// This policy is deprecated as of M124.
//
// Valid values:
//   True: Force WebSQL to be enabled.
//   False: Allow WebSQL to be enabled by Chrome flag.
//
// Supported on:
message WebSQLAccessProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebSQLAccess = 2;
}

// Force WebSQL in third-party contexts to be re-enabled.
//
// WebSQL in third-party contexts (e.g., cross-site iframes) is off by default
// as of M97 and will be fully removed in M101.
// If this policy is set to false or unset, WebSQL in third party contexts will
// remain off.
// If this policy is set to true, WebSQL in third-party contexts will be re-
// enabled.
//
// Valid values:
//   True: Force WebSQL in third-party contexts to be re-enabled.
//   False: Allow WebSQL in third-party contexts to be disabled by default.
//
// Supported on:
message WebSQLInThirdPartyContextEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebSQLInThirdPartyContextEnabled = 2;
}

// Force WebSQL in non-secure contexts to be enabled.
//
// WebSQL in non-secure contexts will be removed starting M110. This policy re-
// enables the API.
// If this policy is set to true, WebSQL in non-secure contexts will be
// available.
// If this policy is set to false or unset, WebSQL in non-secure contexts will
// remain available until M109, then unavailable starting M110.
// This was removed in M112.
//
// Valid values:
//   True: WebSQL in non-secure contexts will be available.
//   False: WebSQL in non-secure contexts will remain available until M109, then
// unavailable starting M110.
//
// Supported on:
message WebSQLNonSecureContextEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebSQLNonSecureContextEnabled = 2;
}

// Automatically grant permission to these sites to connect to USB devices with
// the given vendor and product IDs.
//
// Setting the policy lets you list the URL patterns that specify which sites
// are automatically granted permission to access a USB device with the given
// vendor and product IDs. Each item in the list requires both devices and urls
// fields for the policy to be valid. Each item in the devices field can have a
// vendor_id and product_id field. Omitting the vendor_id field will create a
// policy matching any device. Omitting the product_id field will create a
// policy matching any device with the given vendor ID. A policy which has a
// product_id field without a vendor_id field is invalid.
//
// The USB permission model will grant the specified URL permission to access
// the USB device as a top-level origin. If embedded frames need to access USB
// devices, the 'usb' feature-policy header should be used to grant access. The
// URL must be valid, otherwise the policy is ignored.
//
// Deprecated: The USB permission model used to support specifying both the
// requesting and embedding URLs. This is deprecated and only supported for
// backwards compatibility in this manner: if both a requesting and embedding
// URL is specified, then the embedding URL will be granted the permission as
// top-level origin and the requesting URL will be ignored entirely.
//
// This policy overrides DefaultWebUsbGuardSetting, WebUsbAskForUrls,
// WebUsbBlockedForUrls and the user's preferences.
//
// This policy only affects access to USB devices through the WebUSB API. To
// grant access to USB devices through the Web Serial API see the
// SerialAllowUsbDevicesForUrls policy.
//
// Value schema:
// {
//     "items": {
//         "properties": {
//             "devices": {
//                 "items": {
//                     "properties": {
//                         "product_id": {
//                             "maximum": 65535,
//                             "minimum": 0,
//                             "type": "integer"
//                         },
//                         "vendor_id": {
//                             "maximum": 65535,
//                             "minimum": 0,
//                             "type": "integer"
//                         }
//                     },
//                     "type": "object"
//                 },
//                 "type": "array"
//             },
//             "urls": {
//                 "items": {
//                     "type": "string"
//                 },
//                 "type": "array"
//             }
//         },
//         "required": [
//             "devices",
//             "urls"
//         ],
//         "type": "object"
//     },
//     "type": "array"
// }
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebUsbAllowDevicesForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional string WebUsbAllowDevicesForUrls = 2;
}

// Allow WebUSB on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can ask users to grant them access to a USB device.
//
// Leaving the policy unset means DefaultWebUsbGuardSetting applies for all
// sites, if it's set. If not, users' personal settings apply.
//
// URL patterns must not conflict with WebUsbAskForUrls. Neither policy takes
// precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebUsbAskForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebUsbAskForUrls = 2;
}

// Block WebUSB on these sites
//
// Setting the policy lets you list the URL patterns that specify which sites
// can't ask users to grant them access to a USB device.
//
// Leaving the policy unset means DefaultWebUsbGuardSetting applies for all
// sites, if it's set. If not, the user's personal setting applies.
//
// URL patterns can't conflict with WebUsbAskForUrls. Neither policy takes
// precedence if a URL matches with both.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. * is not an accepted
// value for this policy.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WebUsbBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WebUsbBlockedForUrls = 2;
}

// Allow creating WebXR's "immersive-ar" sessions
//
// Configures whether the sites that the user navigates to are allowed to create
// immersive Augmented Reality sessions using WebXR Device API.
//
// When this policy is unset or enabled, the WebXR Device API will accept
// "immersive-ar" during session creation, thus allowing the users to enter
// Augmented Reality experiences.
//
// When this policy is disabled, the WebXR Device API will reject requests to
// create sessions with mode set to "immersive-ar". The existing "immersive-ar"
// sessions (if any) will not be terminated.
//
// For more details about "immersive-ar" sessions, please see WebXR Augmented
// Reality Module specification.
//
// Valid values:
//   True: Allow creating WebXR's "immersive-ar" sessions
//   False: Prevent creating WebXR's "immersive-ar" sessions
//
// Supported on: android
message WebXRImmersiveArEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WebXRImmersiveArEnabled = 2;
}

// Enable showing the welcome page on the first browser launch following OS
// upgrade
//
// If this policy is set to true or not configured, the browser will re-show the
// welcome page on the first launch following an OS upgrade.
//
// If this policy is set to false, the browser will not re-show the welcome page
// on the first launch following an OS upgrade.
//
// Supported on:
message WelcomePageOnOSUpgradeEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WelcomePageOnOSUpgradeEnabled = 2;
}

// Allow Wi-Fi network configurations to be synced across Google ChromeOS
// devices and a connected Android phone.
//
// If this setting is enabled, users will be allowed to sync Wi-Fi network
// configurations between their Google ChromeOS device(s) and a connected
// Android phone. Before Wi-Fi network configurations can sync, users must
// explicitly opt in to this feature by completing a setup flow.
//
// If this setting is disabled, users will not be allowed to sync Wi-Fi network
// configurations.
//
// This feature depends on the wifiConfigurations datatype in Chrome Sync being
// enabled. If wifiConfigurations is disabled in the SyncTypesListDisabled
// policy, or Chrome Sync is disabled in the SyncDisabled policy this feature
// will not be enabled.
//
// If this policy is left not set, the default is not allowed for managed users.
//
// Valid values:
//   True: Allow Wi-Fi network configurations to be synced across Google
// ChromeOS devices and a connected Android phone
//   False: Do not allow Wi-Fi network configurations to be synced across Google
// ChromeOS devices and a connected Android phone
//
// Supported on: chrome_os
message WifiSyncAndroidAllowedProto {
  optional PolicyOptions policy_options = 1;
  optional bool WifiSyncAndroidAllowed = 2;
}

// Allow Window and Tab capture by these origins
//
// Setting the policy lets you set a list of URL patterns that can use Window
// and Tab Capture.
//
// Leaving the policy unset means that sites will not be considered for an
// override at this level of Capture.
//
// This policy is not considered if a site matches a URL pattern in any of the
// following policies: TabCaptureAllowedByOrigins,
// SameOriginTabCaptureAllowedByOrigins.
//
// If a site matches a URL pattern in this policy, the following policies will
// not be considered: ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.
//
// For detailed information on valid url patterns, please see
// https://chromeenterprise.google/policies/url-patterns/.  This policy only
// matches based on origin, so any path in the URL pattern is ignored.
//
// Supported on: android, chrome_os, fuchsia, linux, mac, win
message WindowCaptureAllowedByOriginsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WindowCaptureAllowedByOrigins = 2;
}

// Allow Window Management permission on these sites
//
// Allows you to set a list of site url patterns that specify sites which will
// automatically grant the window management permission. This will extend the
// ability of sites to see information about the device's screens and use that
// information to open and place windows or request fullscreen on specific
// screens.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed. This policy only matches based on origin, so any path in the URL
// pattern is ignored.
//
// If this policy is not set for a site then the policy from
// DefaultWindowManagementSetting applies to the site, if set, otherwise the
// permission will follow the browser's defaults and allow users to choose this
// permission per site.
//
// This replaces the deprecated WindowPlacementAllowedForUrls policy.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WindowManagementAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WindowManagementAllowedForUrls = 2;
}

// Block Window Management permission on these sites
//
// Allows you to set a list of site url patterns that specify sites which will
// automatically deny the window management permission. This will limit the
// ability of sites to see information about the device's screens and use that
// information to open and place windows or request fullscreen on specific
// screens.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed. This policy only matches based on origin, so any path in the URL
// pattern is ignored.
//
// If this policy is not set for a site then the policy from
// DefaultWindowManagementSetting applies to the site, if set, otherwise the
// permission will follow the browser's defaults and allow users to choose this
// permission per site.
//
// This replaces the deprecated WindowPlacementBlockedForUrls policy.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WindowManagementBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WindowManagementBlockedForUrls = 2;
}

// Enable Window Occlusion
//
// Enables window occlusion in Google Chrome.
//
// If you enable this setting, to reduce CPU and power consumption Google Chrome
// will detect when a window is covered by other windows, and will suspend work
// painting pixels.
//
// If you disable this setting Google Chrome will not detect when a window is
// covered by other windows.
//
// If this policy is left not set, occlusion detection will be enabled.
//
// Valid values:
//   True: Detect covered window and suspend its painting
//   False: Do not detect covered window
//
// Supported on: win
message WindowOcclusionEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool WindowOcclusionEnabled = 2;
}

// Allow Window Placement permission on these sites
//
// Allows you to set a list of site url patterns that specify sites which will
// automatically grant the window placement permission. This will extend the
// ability of sites to see information about the device's screens and use that
// information to open and place windows or request fullscreen on specific
// screens.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed. This policy only matches based on origin, so any path in the URL
// pattern is ignored.
//
// If this policy is not set for a site then the policy from
// DefaultWindowPlacementSetting applies to the site, if set, otherwise the
// permission will follow the browser's defaults and allow users to choose this
// permission per site.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WindowPlacementAllowedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WindowPlacementAllowedForUrls = 2;
}

// Block Window Placement permission on these sites
//
// Allows you to set a list of site url patterns that specify sites which will
// automatically deny the window placement permission. This will limit the
// ability of sites to see information about the device's screens and use that
// information to open and place windows or request fullscreen on specific
// screens.
//
// For detailed information on valid site url patterns, please see
// https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are
// allowed. This policy only matches based on origin, so any path in the URL
// pattern is ignored.
//
// If this policy is not set for a site then the policy from
// DefaultWindowPlacementSetting applies to the site, if set, otherwise the
// permission will follow the browser's defaults and allow users to choose this
// permission per site.
//
// Supported on: chrome_os, fuchsia, linux, mac, win
message WindowPlacementBlockedForUrlsProto {
  optional PolicyOptions policy_options = 1;
  optional StringList WindowPlacementBlockedForUrls = 2;
}

// Control the availability of the XSLT feature
//
// This policy controls the availability of the XSLT feature (the XSLTProcessor
// Javascript API and the XSL processing instruction).
// If this policy is set to Enabled, XSLT will be available, regardless of the
// default state of the feature in the browser.
// If this policy is set to Disabled, XSLT will be unavailable, regardless of
// the default state of the feature in the browser.
// If this policy is left unset, XSLT availability will be determined by the
// browser's default settings and field trials.
// This policy is a temporary measure, and will be removed in M164.
//
// Valid values:
//   True: Enabled: XSLT is explicitly enabled.
//   False: Disabled: XSLT is explicitly disabled.
//   None: Default: XSLT availability will be determined by browser defaults and
// field trials.
//
// Supported on: android, chrome_os, linux, mac, win
message XSLTEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool XSLTEnabled = 2;
}

// Enable zstd content-encoding support
//
// This policy is temporary and will no longer work starting in M137.
//
// This feature enables the use of "zstd" in the Accept-Encoding request header,
// and support for decompressing
// zstd-compressed web content.
//
// Setting the policy to Enabled or leaving it unset means
// Google Chrome will accept web contents
// compressed with zstd.
// Setting the policy to Disabled turns off the
// zstd content-encoding feature.
//
// Valid values:
//   True: Enable advertising zstd content-encoding in the Accept-Encoding
// header
//   False: Do not allow using the zstd content-encoding feature
//
// Supported on: fuchsia
message ZstdContentEncodingEnabledProto {
  optional PolicyOptions policy_options = 1;
  optional bool ZstdContentEncodingEnabled = 2;
}

// --------------------------------------------------
// PBs for policies with ID > 1040.

message ChromeSettingsSubProto1 {
  optional AIModeSettingsProto AIModeSettings = 327;
  optional AccessibilityPerformanceFilteringAllowedProto AccessibilityPerformanceFilteringAllowed = 86;
  optional AdHocCodeSigningForPWAsEnabledProto AdHocCodeSigningForPWAsEnabled = 252;
  optional AllowBackForwardCacheForCacheControlNoStorePageEnabledProto AllowBackForwardCacheForCacheControlNoStorePageEnabled = 74;
  optional AllowExcludeDisplayInMirrorModeProto AllowExcludeDisplayInMirrorMode = 259;
  optional AllowSocketPoolSizeRandomizationForProxiesProto AllowSocketPoolSizeRandomizationForProxies = 407;
  optional AllowedDomainsForAppsListProto AllowedDomainsForAppsList = 172;
  optional AllowedInputMethodsForceEnabledProto AllowedInputMethodsForceEnabled = 283;
  optional AllowedLocalAuthFactorsProto AllowedLocalAuthFactors = 365;
  optional AlwaysOnVpnPreConnectUrlAllowlistProto AlwaysOnVpnPreConnectUrlAllowlist = 150;
  optional AndroidEntraSsoEnabledProto AndroidEntraSsoEnabled = 398;
  optional AppLaunchAutomationProto AppLaunchAutomation = 54;
  optional AppStoreRatingEnabledProto AppStoreRatingEnabled = 12;
  optional ApplicationBoundEncryptionEnabledProto ApplicationBoundEncryptionEnabled = 206;
  optional ArcOpenLinksInBrowserByDefaultProto ArcOpenLinksInBrowserByDefault = 261;
  optional ArcVmDataMigrationStrategyProto ArcVmDataMigrationStrategy = 85;
  optional AutoSignOutEnabledProto AutoSignOutEnabled = 349;
  optional AutofillPredictionSettingsProto AutofillPredictionSettings = 260;
  optional AutofillSettingsProto AutofillSettings = 419;
  optional AutomatedPasswordChangeSettingsProto AutomatedPasswordChangeSettings = 336;
  optional AutomaticDownloadsAllowedForUrlsProto AutomaticDownloadsAllowedForUrls = 423;
  optional AutomaticDownloadsBlockedForUrlsProto AutomaticDownloadsBlockedForUrls = 424;
  optional AutomaticFullscreenAllowedForUrlsProto AutomaticFullscreenAllowedForUrls = 185;
  optional AutomaticFullscreenBlockedForUrlsProto AutomaticFullscreenBlockedForUrls = 186;
  optional BackForwardCacheForWebSocketsAllowedProto BackForwardCacheForWebSocketsAllowed = 432;
  optional BeforeunloadEventCancelByPreventDefaultEnabledProto BeforeunloadEventCancelByPreventDefaultEnabled = 71;
  optional BlockTruncatedCookiesProto BlockTruncatedCookies = 102;
  optional BoundSessionCredentialsEnabledProto BoundSessionCredentialsEnabled = 204;
  optional BrowserContextAwareAccessSignalsAllowlistProto BrowserContextAwareAccessSignalsAllowlist = 65;
  optional BruschettaInstallerConfigurationProto BruschettaInstallerConfiguration = 96;
  optional BuiltInAIAPIsEnabledProto BuiltInAIAPIsEnabled = 317;
  optional CACertificatesProto CACertificates = 151;
  optional CACertificatesWithConstraintsProto CACertificatesWithConstraints = 189;
  optional CADistrustedCertificatesProto CADistrustedCertificates = 152;
  optional CAHintCertificatesProto CAHintCertificates = 153;
  optional CAPlatformIntegrationEnabledProto CAPlatformIntegrationEnabled = 156;
  optional CSSCustomStateDeprecatedSyntaxEnabledProto CSSCustomStateDeprecatedSyntaxEnabled = 220;
  optional CacheEncryptionEnabledProto CacheEncryptionEnabled = 356;
  optional CameraSaveLocationProto CameraSaveLocation = 373;
  optional ChromeAppsWebViewPermissiveBehaviorAllowedProto ChromeAppsWebViewPermissiveBehaviorAllowed = 33;
  optional ChromeDataRegionSettingProto ChromeDataRegionSetting = 213;
  optional ChromeForTestingAllowedProto ChromeForTestingAllowed = 173;
  optional ChromeSuggestionsSettingsProto ChromeSuggestionsSettings = 415;
  optional ClassManagementCaptionsEnabledProto ClassManagementCaptionsEnabled = 299;
  optional ClassManagementClassroomIntegrationEnabledProto ClassManagementClassroomIntegrationEnabled = 300;
  optional ClassManagementEnabledProto ClassManagementEnabled = 267;
  optional ClassManagementNetworkRestrictionEnabledProto ClassManagementNetworkRestrictionEnabled = 301;
  optional ClassManagementViewScreenEnabledProto ClassManagementViewScreenEnabled = 303;
  optional ClearWindowNameForNewBrowsingContextGroupProto ClearWindowNameForNewBrowsingContextGroup = 321;
  optional CloudAPAuthEnabledProto CloudAPAuthEnabled = 3;
  optional ColorCorrectionEnabledProto ColorCorrectionEnabled = 80;
  optional CompressionDictionaryTransportEnabledProto CompressionDictionaryTransportEnabled = 104;
  optional ContentTransferEnablementStatusProto ContentTransferEnablementStatus = 254;
  optional ContextMenuPhotoSharingSettingsProto ContextMenuPhotoSharingSettings = 138;
  optional ContextualGoogleIntegrationsConfigurationProto ContextualGoogleIntegrationsConfiguration = 215;
  optional ContextualGoogleIntegrationsEnabledProto ContextualGoogleIntegrationsEnabled = 214;
  optional ControlledFrameAllowedForUrlsProto ControlledFrameAllowedForUrls = 289;
  optional ControlledFrameBlockedForUrlsProto ControlledFrameBlockedForUrls = 290;
  optional CpuPerformanceTierOverrideProto CpuPerformanceTierOverride = 402;
  optional CreatePasskeysInICloudKeychainProto CreatePasskeysInICloudKeychain = 110;
  optional CreateThemesSettingsProto CreateThemesSettings = 148;
  optional CredentialProviderPromoEnabledProto CredentialProviderPromoEnabled = 46;
  optional DataControlsRulesProto DataControlsRules = 121;
  optional DataURLWhitespacePreservationEnabledProto DataURLWhitespacePreservationEnabled = 258;
  optional DataUrlInSvgUseEnabledProto DataUrlInSvgUseEnabled = 69;
  optional DataUrlInWebWorkerOpaqueOriginEnabledProto DataUrlInWebWorkerOpaqueOriginEnabled = 404;
  optional DefaultAutomaticDownloadsSettingProto DefaultAutomaticDownloadsSetting = 422;
  optional DefaultControlledFrameSettingProto DefaultControlledFrameSetting = 288;
  optional DefaultDeviceAttributesSettingProto DefaultDeviceAttributesSetting = 337;
  optional DefaultDirectSocketsPrivateNetworkAccessSettingProto DefaultDirectSocketsPrivateNetworkAccessSetting = 263;
  optional DefaultDirectSocketsSettingProto DefaultDirectSocketsSetting = 190;
  optional DefaultIdleDetectionSettingProto DefaultIdleDetectionSetting = 367;
  optional DefaultJavaScriptOptimizerSettingProto DefaultJavaScriptOptimizerSetting = 237;
  optional DefaultSmartCardConnectSettingProto DefaultSmartCardConnectSetting = 315;
  optional DefaultSubAppsWithoutPromptsSettingProto DefaultSubAppsWithoutPromptsSetting = 408;
  optional DefaultThirdPartyStoragePartitioningSettingProto DefaultThirdPartyStoragePartitioningSetting = 50;
  optional DefaultWebPrintingSettingProto DefaultWebPrintingSetting = 179;
  optional DefaultWindowManagementSettingProto DefaultWindowManagementSetting = 27;
  optional DeleteKeyModifierProto DeleteKeyModifier = 164;
  optional DeletingUndecryptablePasswordsEnabledProto DeletingUndecryptablePasswordsEnabled = 245;
  optional DeskAPIDeskSaveAndShareEnabledProto DeskAPIDeskSaveAndShareEnabled = 143;
  optional DevToolsGenAiSettingsProto DevToolsGenAiSettings = 188;
  optional DevToolsGoogleDeveloperProgramProfileAvailabilityProto DevToolsGoogleDeveloperProgramProfileAvailability = 351;
  optional DeveloperToolsAvailabilityAllowlistProto DeveloperToolsAvailabilityAllowlist = 359;
  optional DeveloperToolsAvailabilityBlocklistProto DeveloperToolsAvailabilityBlocklist = 360;
  optional DeviceAttributesBlockedForOriginsProto DeviceAttributesBlockedForOrigins = 338;
  optional DirectSocketsAllowedForUrlsProto DirectSocketsAllowedForUrls = 191;
  optional DirectSocketsBlockedForUrlsProto DirectSocketsBlockedForUrls = 192;
  optional DirectSocketsPrivateNetworkAccessAllowedForUrlsProto DirectSocketsPrivateNetworkAccessAllowedForUrls = 264;
  optional DirectSocketsPrivateNetworkAccessBlockedForUrlsProto DirectSocketsPrivateNetworkAccessBlockedForUrls = 265;
  optional DnsOverHttpsExcludedDomainsProto DnsOverHttpsExcludedDomains = 242;
  optional DnsOverHttpsIncludedDomainsProto DnsOverHttpsIncludedDomains = 243;
  optional DocumentScanAPITrustedExtensionsProto DocumentScanAPITrustedExtensions = 182;
  optional DomainReliabilityAllowedProto DomainReliabilityAllowed = 18;
  optional DownloadManagerSaveToDriveSettingsProto DownloadManagerSaveToDriveSettings = 184;
  optional DriveFileSyncAvailableProto DriveFileSyncAvailable = 118;
  optional DynamicCodeSettingsProto DynamicCodeSettings = 225;
  optional EmojiPickerGifSupportEnabledProto EmojiPickerGifSupportEnabled = 82;
  optional EnableProxyOverrideRulesForAllUsersProto EnableProxyOverrideRulesForAllUsers = 366;
  optional EnableUnsafeSwiftShaderProto EnableUnsafeSwiftShader = 330;
  optional EnforceLocalAnchorConstraintsEnabledProto EnforceLocalAnchorConstraintsEnabled = 39;
  optional EnterpriseBadgingTemporarySettingProto EnterpriseBadgingTemporarySetting = 210;
  optional EnterpriseCustomLabelProto EnterpriseCustomLabel = 198;
  optional EnterpriseCustomLabelForBrowserProto EnterpriseCustomLabelForBrowser = 314;
  optional EnterpriseLogoUrlProto EnterpriseLogoUrl = 197;
  optional EnterpriseLogoUrlForBrowserProto EnterpriseLogoUrlForBrowser = 313;
  optional EnterpriseProfileBadgeToolbarSettingsProto EnterpriseProfileBadgeToolbarSettings = 262;
  optional EnterprisePublishedSkillsProto EnterprisePublishedSkills = 436;
  optional EnterpriseSearchAggregatorSettingsProto EnterpriseSearchAggregatorSettings = 268;
  optional EssentialSearchEnabledProto EssentialSearchEnabled = 60;
  optional ExtensibleEnterpriseSSOBlocklistProto ExtensibleEnterpriseSSOBlocklist = 219;
  optional ExtensionDOMActivityLoggingEnabledProto ExtensionDOMActivityLoggingEnabled = 394;
  optional ExtensionDeveloperModeSettingsProto ExtensionDeveloperModeSettings = 231;
  optional ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrlsProto ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls = 34;
  optional ExtensionForceInstallWithNonMalwareViolationsEnabledProto ExtensionForceInstallWithNonMalwareViolationsEnabled = 355;
  optional ExtensionInstallCloudPolicyChecksEnabledProto ExtensionInstallCloudPolicyChecksEnabled = 350;
  optional ExtensionInstallTypeBlocklistProto ExtensionInstallTypeBlocklist = 139;
  optional ExtensionOAuthRedirectUrlsProto ExtensionOAuthRedirectUrls = 109;
  optional ExtensionUnpublishedAvailabilityProto ExtensionUnpublishedAvailability = 31;
  optional ExternalStorageAllowlistProto ExternalStorageAllowlist = 291;
  optional F11KeyModifierProto F11KeyModifier = 160;
  optional F12KeyModifierProto F12KeyModifier = 161;
  optional FaceGazeEnabledProto FaceGazeEnabled = 310;
  optional FeedbackSurveysEnabledProto FeedbackSurveysEnabled = 142;
  optional FileOrDirectoryPickerWithoutGestureAllowedForOriginsProto FileOrDirectoryPickerWithoutGestureAllowedForOrigins = 53;
  optional FilePickerChooseFromDriveSettingsProto FilePickerChooseFromDriveSettings = 277;
  optional FindAndFillWithGeminiSettingsProto FindAndFillWithGeminiSettings = 434;
  optional FindsSettingsProto FindsSettings = 399;
  optional FloatingSsoDomainBlocklistProto FloatingSsoDomainBlocklist = 158;
  optional FloatingSsoDomainBlocklistExceptionsProto FloatingSsoDomainBlocklistExceptions = 159;
  optional FloatingSsoEnabledProto FloatingSsoEnabled = 157;
  optional FloatingSsoSessionCookiesIncludedProto FloatingSsoSessionCookiesIncluded = 339;
  optional FocusModeSoundsEnabledProto FocusModeSoundsEnabled = 230;
  optional ForceEnablePepperVideoDecoderDevAPIProto ForceEnablePepperVideoDecoderDevAPI = 17;
  optional ForceForegroundPriorityForAllTabsProto ForceForegroundPriorityForAllTabs = 391;
  optional ForceForegroundPriorityForUrlsProto ForceForegroundPriorityForUrls = 403;
  optional ForcePermissionPolicyUnloadDefaultEnabledProto ForcePermissionPolicyUnloadDefaultEnabled = 97;
  optional FullRestoreModeProto FullRestoreMode = 115;
  optional GeminiActOnWebAllowedForURLsProto GeminiActOnWebAllowedForURLs = 380;
  optional GeminiActOnWebBlockedForURLsProto GeminiActOnWebBlockedForURLs = 381;
  optional GeminiActOnWebSettingsProto GeminiActOnWebSettings = 362;
  optional GeminiChromeFileUploadSettingsProto GeminiChromeFileUploadSettings = 433;
  optional GeminiEnterpriseSettingsProto GeminiEnterpriseSettings = 417;
  optional GeminiSettingsProto GeminiSettings = 295;
  optional GeminiSparkSettingsProto GeminiSparkSettings = 412;
  optional GenAIInlineImageSettingsProto GenAIInlineImageSettings = 306;
  optional GenAILocalFoundationalModelSettingsProto GenAILocalFoundationalModelSettings = 211;
  optional GenAIPhotoEditingSettingsProto GenAIPhotoEditingSettings = 285;
  optional GenAISmartGroupingSettingsProto GenAISmartGroupingSettings = 296;
  optional GenAIVcBackgroundSettingsProto GenAIVcBackgroundSettings = 224;
  optional GenAIWallpaperSettingsProto GenAIWallpaperSettings = 223;
  optional GenAiChromeOsSmartActionsSettingsProto GenAiChromeOsSmartActionsSettings = 297;
  optional GenAiDefaultSettingsProto GenAiDefaultSettings = 256;
  optional GeolocationBlockedForUrlsProto GeolocationBlockedForUrls = 371;
  optional GlanceablesEnabledProto GlanceablesEnabled = 91;
  optional GoogleLocationServicesEnabledProto GoogleLocationServicesEnabled = 174;
  optional GoogleSearchSidePanelEnabledProto GoogleSearchSidePanelEnabled = 67;
  optional GoogleWorkspaceCloudUploadProto GoogleWorkspaceCloudUpload = 106;
  optional HappyEyeballsV3EnabledProto HappyEyeballsV3Enabled = 309;
  optional HelpMeReadSettingsProto HelpMeReadSettings = 255;
  optional HelpMeWriteSettingsProto HelpMeWriteSettings = 147;
  optional HistorySearchSettingsProto HistorySearchSettings = 235;
  optional HomeAndEndKeysModifierProto HomeAndEndKeysModifier = 165;
  optional HttpAllowlistProto HttpAllowlist = 42;
  optional HttpHeaderInjectionProto HttpHeaderInjection = 414;
  optional HttpsUpgradesEnabledProto HttpsUpgradesEnabled = 43;
  optional IPv6ReachabilityOverrideEnabledProto IPv6ReachabilityOverrideEnabled = 132;
  optional IdleDetectionAllowedForUrlsProto IdleDetectionAllowedForUrls = 368;
  optional IdleDetectionBlockedForUrlsProto IdleDetectionBlockedForUrls = 369;
  optional IncognitoModeUrlAllowlistProto IncognitoModeUrlAllowlist = 353;
  optional IncognitoModeUrlBlocklistProto IncognitoModeUrlBlocklist = 352;
  optional IndigoProto Indigo = 429;
  optional InsecureHashesInTLSHandshakesEnabledProto InsecureHashesInTLSHandshakesEnabled = 55;
  optional InsertKeyModifierProto InsertKeyModifier = 167;
  optional IsolateOriginsShortlistProto IsolateOriginsShortlist = 420;
  optional IsolatedModeSettingsProto IsolatedModeSettings = 411;
  optional IsolatedWebAppUserInstallationEnabledProto IsolatedWebAppUserInstallationEnabled = 393;
  optional JavaScriptOptimizerAllowedForSitesProto JavaScriptOptimizerAllowedForSites = 238;
  optional JavaScriptOptimizerBlockedForSitesProto JavaScriptOptimizerBlockedForSites = 239;
  optional KerberosUseCustomPrefilledConfigProto KerberosUseCustomPrefilledConfig = 13;
  optional KeyboardFocusableScrollersEnabledProto KeyboardFocusableScrollersEnabled = 218;
  optional KioskActiveWiFiCredentialsScopeChangeEnabledProto KioskActiveWiFiCredentialsScopeChangeEnabled = 257;
  optional KioskApplicationLogCollectionEnabledProto KioskApplicationLogCollectionEnabled = 329;
  optional KioskBrowserPermissionsAllowedForOriginsProto KioskBrowserPermissionsAllowedForOrigins = 233;
  optional KioskChromeAppsForceAllowedProto KioskChromeAppsForceAllowed = 304;
  optional KioskPinchToZoomAllowedProto KioskPinchToZoomAllowed = 405;
  optional KioskTroubleshootingToolsEnabledProto KioskTroubleshootingToolsEnabled = 16;
  optional KioskWebAppOfflineEnabledProto KioskWebAppOfflineEnabled = 253;
  optional KrispNoiseCancellationEnabledProto KrispNoiseCancellationEnabled = 397;
  optional LacrosSelectionProto LacrosSelection = 5;
  optional LegacyCookieScopeEnabledProto LegacyCookieScopeEnabled = 342;
  optional LegacyCookieScopeEnabledForDomainListProto LegacyCookieScopeEnabledForDomainList = 343;
  optional LegacyTechReportAllowlistProto LegacyTechReportAllowlist = 61;
  optional LensOnGalleryEnabledProto LensOnGalleryEnabled = 234;
  optional LensOverlaySettingsProto LensOverlaySettings = 226;
  optional ListenToThisPageEnabledProto ListenToThisPageEnabled = 149;
  optional LiveCaptionEnabledProto LiveCaptionEnabled = 334;
  optional LiveTranslateEnabledProto LiveTranslateEnabled = 278;
  optional LocalAuthFactorsComplexityProto LocalAuthFactorsComplexity = 363;
  optional LocalNetworkAccessAllowedForUrlsProto LocalNetworkAccessAllowedForUrls = 331;
  optional LocalNetworkAccessBlockedForUrlsProto LocalNetworkAccessBlockedForUrls = 332;
  optional LocalNetworkAccessIpAddressSpaceOverridesProto LocalNetworkAccessIpAddressSpaceOverrides = 383;
  optional LocalNetworkAccessPermissionsPolicyDefaultEnabledProto LocalNetworkAccessPermissionsPolicyDefaultEnabled = 390;
  optional LocalNetworkAccessRestrictionsEnabledProto LocalNetworkAccessRestrictionsEnabled = 324;
  optional LocalNetworkAccessRestrictionsTemporaryOptOutProto LocalNetworkAccessRestrictionsTemporaryOptOut = 361;
  optional LocalNetworkAllowedForUrlsProto LocalNetworkAllowedForUrls = 385;
  optional LocalNetworkBlockedForUrlsProto LocalNetworkBlockedForUrls = 386;
  optional LocalUserFilesAllowedProto LocalUserFilesAllowed = 176;
  optional LocalUserFilesMigrationDestinationProto LocalUserFilesMigrationDestination = 232;
  optional LockScreenAutoStartOnlineReauthProto LockScreenAutoStartOnlineReauth = 217;
  optional LoopbackNetworkAllowedForUrlsProto LoopbackNetworkAllowedForUrls = 387;
  optional LoopbackNetworkBlockedForUrlsProto LoopbackNetworkBlockedForUrls = 388;
  optional MandatoryExtensionsForIncognitoNavigationProto MandatoryExtensionsForIncognitoNavigation = 45;
  optional MaxConnectionsPerProxyForWebSocketProto MaxConnectionsPerProxyForWebSocket = 396;
  optional MemorySaverModeSavingsProto MemorySaverModeSavings = 221;
  optional MicrosoftOfficeCloudUploadProto MicrosoftOfficeCloudUpload = 105;
  optional MicrosoftOneDriveAccountRestrictionsProto MicrosoftOneDriveAccountRestrictions = 134;
  optional MicrosoftOneDriveMountProto MicrosoftOneDriveMount = 108;
  optional MixedContentAutoupgradeEnabledProto MixedContentAutoupgradeEnabled = 32;
  optional MultiScreenCaptureAllowedForUrlsProto MultiScreenCaptureAllowedForUrls = 201;
  optional MutationEventsEnabledProto MutationEventsEnabled = 187;
  optional NTPFooterExtensionAttributionEnabledProto NTPFooterExtensionAttributionEnabled = 320;
  optional NTPFooterManagementNoticeEnabledProto NTPFooterManagementNoticeEnabled = 319;
  optional NTPOutlookCardVisibleProto NTPOutlookCardVisible = 271;
  optional NTPSharepointCardVisibleProto NTPSharepointCardVisible = 272;
  optional NTPShortcutsProto NTPShortcuts = 348;
  optional NativeClientForceAllowedProto NativeClientForceAllowed = 81;
  optional NativeHostsExecutablesLaunchDirectlyProto NativeHostsExecutablesLaunchDirectly = 141;
  optional NewBaseUrlInheritanceBehaviorAllowedProto NewBaseUrlInheritanceBehaviorAllowed = 1;
  optional OnDataCopiedEnterpriseConnectorProto OnDataCopiedEnterpriseConnector = 437;
  optional OnNetworkRequestEnterpriseConnectorProto OnNetworkRequestEnterpriseConnector = 435;
  optional OopPrintDriversAllowedProto OopPrintDriversAllowed = 144;
  optional OrcaEnabledProto OrcaEnabled = 196;
  optional OriginKeyedProcessesEnabledProto OriginKeyedProcessesEnabled = 347;
  optional OutOfProcessSystemDnsResolutionEnabledProto OutOfProcessSystemDnsResolutionEnabled = 30;
  optional PPAPISharedImagesForVideoDecoderAllowedProto PPAPISharedImagesForVideoDecoderAllowed = 123;
  optional PPAPISharedImagesSwapChainAllowedProto PPAPISharedImagesSwapChainAllowed = 7;
  optional PageUpAndPageDownKeysModifierProto PageUpAndPageDownKeysModifier = 166;
  optional ParcelTrackingEnabledProto ParcelTrackingEnabled = 140;
  optional PartitionedBlobUrlUsageProto PartitionedBlobUrlUsage = 286;
  optional PasswordManagerBlocklistProto PasswordManagerBlocklist = 322;
  optional PasswordManagerPasskeysEnabledProto PasswordManagerPasskeysEnabled = 276;
  optional PasswordSharingEnabledProto PasswordSharingEnabled = 130;
  optional PdfUseSkiaRendererEnabledProto PdfUseSkiaRendererEnabled = 68;
  optional PdfViewerOutOfProcessIframeEnabledProto PdfViewerOutOfProcessIframeEnabled = 216;
  optional PdfXfaFormsEnabledProto PdfXfaFormsEnabled = 372;
  optional PhysicalKeyboardAutocorrectProto PhysicalKeyboardAutocorrect = 78;
  optional PhysicalKeyboardPredictiveWritingProto PhysicalKeyboardPredictiveWriting = 79;
  optional PolicyTestPageEnabledProto PolicyTestPageEnabled = 72;
  optional PostQuantumKeyAgreementEnabledProto PostQuantumKeyAgreementEnabled = 77;
  optional PreciseGeolocationAllowedForUrlsProto PreciseGeolocationAllowedForUrls = 370;
  optional PreferSlowCiphersProto PreferSlowCiphers = 358;
  optional PreferSlowKexAlgorithmsProto PreferSlowKexAlgorithms = 354;
  optional PrefetchWithServiceWorkerEnabledProto PrefetchWithServiceWorkerEnabled = 325;
  optional PrefixedVideoFullscreenApiAvailabilityProto PrefixedVideoFullscreenApiAvailability = 194;
  optional PrintingLPACSandboxEnabledProto PrintingLPACSandboxEnabled = 248;
  optional PrivacySandboxAdMeasurementEnabledProto PrivacySandboxAdMeasurementEnabled = 11;
  optional PrivacySandboxAdTopicsEnabledProto PrivacySandboxAdTopicsEnabled = 9;
  optional PrivacySandboxFingerprintingProtectionEnabledProto PrivacySandboxFingerprintingProtectionEnabled = 200;
  optional PrivacySandboxIpProtectionEnabledProto PrivacySandboxIpProtectionEnabled = 195;
  optional PrivacySandboxPromptEnabledProto PrivacySandboxPromptEnabled = 8;
  optional PrivacySandboxSiteEnabledAdsEnabledProto PrivacySandboxSiteEnabledAdsEnabled = 10;
  optional PrivateNetworkAccessRestrictionsEnabledProto PrivateNetworkAccessRestrictionsEnabled = 137;
  optional ProcessIsolationEnabledProto ProcessIsolationEnabled = 428;
  optional ProfileLabelProto ProfileLabel = 199;
  optional ProfileReauthPromptProto ProfileReauthPrompt = 124;
  optional ProfileSeparationDataMigrationSettingsProto ProfileSeparationDataMigrationSettings = 113;
  optional ProfileSeparationDomainExceptionListProto ProfileSeparationDomainExceptionList = 114;
  optional ProfileSeparationSettingsProto ProfileSeparationSettings = 112;
  optional PromotionsEnabledProto PromotionsEnabled = 240;
  optional ProtectedContentIdentifiersAllowedProto ProtectedContentIdentifiersAllowed = 341;
  optional ProvisionManagedClientCertificateForBrowserProto ProvisionManagedClientCertificateForBrowser = 294;
  optional ProvisionManagedClientCertificateForUserProto ProvisionManagedClientCertificateForUser = 175;
  optional ProvisionalNotificationsAllowedProto ProvisionalNotificationsAllowed = 311;
  optional ProxyOverrideRulesProto ProxyOverrideRules = 364;
  optional ProxyProvisioningDomainsProto ProxyProvisioningDomains = 426;
  optional QRCodeGeneratorEnabledProto QRCodeGeneratorEnabled = 241;
  optional QuickOfficeForceFileDownloadEnabledProto QuickOfficeForceFileDownloadEnabled = 111;
  optional RSAKeyUsageForLocalAnchorsEnabledProto RSAKeyUsageForLocalAnchorsEnabled = 70;
  optional ReduceAcceptLanguageEnabledProto ReduceAcceptLanguageEnabled = 305;
  optional RelatedWebsiteSetsEnabledProto RelatedWebsiteSetsEnabled = 125;
  optional RelatedWebsiteSetsOverridesProto RelatedWebsiteSetsOverrides = 128;
  optional RelaunchFastIfOutdatedProto RelaunchFastIfOutdated = 298;
  optional RemoteAccessHostAllowEnterpriseFileTransferProto RemoteAccessHostAllowEnterpriseFileTransfer = 87;
  optional RemoteAccessHostAllowEnterpriseRemoteSupportConnectionsProto RemoteAccessHostAllowEnterpriseRemoteSupportConnections = 47;
  optional RemoteAccessHostAllowPinAuthenticationProto RemoteAccessHostAllowPinAuthentication = 183;
  optional RemoteAccessHostAllowUrlForwardingProto RemoteAccessHostAllowUrlForwarding = 170;
  optional ReportAppInventoryProto ReportAppInventory = 62;
  optional ReportAppUsageProto ReportAppUsage = 63;
  optional ReportAppUsageCollectionRateMsProto ReportAppUsageCollectionRateMs = 64;
  optional ReportWebsiteActivityAllowlistProto ReportWebsiteActivityAllowlist = 98;
  optional ReportWebsiteTelemetryProto ReportWebsiteTelemetry = 103;
  optional ReportWebsiteTelemetryAllowlistProto ReportWebsiteTelemetryAllowlist = 99;
  optional ReportWebsiteTelemetryCollectionRateMsProto ReportWebsiteTelemetryCollectionRateMs = 100;
  optional RestrictBackgroundFetchFromServiceWorkerEnabledProto RestrictBackgroundFetchFromServiceWorkerEnabled = 416;
  optional RestrictCoreSharingOnRendererProto RestrictCoreSharingOnRenderer = 346;
  optional RestrictPdfSaveToGoogleDriveAccountsToPatternProto RestrictPdfSaveToGoogleDriveAccountsToPattern = 384;
  optional RestrictYouTubeCookiesDeletionProto RestrictYouTubeCookiesDeletion = 418;
  optional SaasUsageReportingDomainUrlsForBrowsersProto SaasUsageReportingDomainUrlsForBrowsers = 378;
  optional SaasUsageReportingDomainUrlsForProfilesProto SaasUsageReportingDomainUrlsForProfiles = 379;
  optional SafeBrowsingDeepScanningEnabledProto SafeBrowsingDeepScanningEnabled = 117;
  optional SafeBrowsingProxiedRealTimeChecksAllowedProto SafeBrowsingProxiedRealTimeChecksAllowed = 76;
  optional SafeBrowsingSurveysEnabledProto SafeBrowsingSurveysEnabled = 101;
  optional ScreenCaptureLocationProto ScreenCaptureLocation = 171;
  optional ScreenCaptureWithoutGestureAllowedForOriginsProto ScreenCaptureWithoutGestureAllowedForOrigins = 52;
  optional ScreensaverLockScreenEnabledProto ScreensaverLockScreenEnabled = 19;
  optional ScreensaverLockScreenIdleTimeoutSecondsProto ScreensaverLockScreenIdleTimeoutSeconds = 20;
  optional ScreensaverLockScreenImageDisplayIntervalSecondsProto ScreensaverLockScreenImageDisplayIntervalSeconds = 21;
  optional ScreensaverLockScreenImagesProto ScreensaverLockScreenImages = 22;
  optional SearchContentSharingSettingsProto SearchContentSharingSettings = 376;
  optional SecuritySignalsClientCertificatesSelectorsProto SecuritySignalsClientCertificatesSelectors = 406;
  optional SelectParserRelaxationEnabledProto SelectParserRelaxationEnabled = 266;
  optional ServiceWorkerAutoPreloadEnabledProto ServiceWorkerAutoPreloadEnabled = 340;
  optional ServiceWorkerToControlSrcdocIframeEnabledProto ServiceWorkerToControlSrcdocIframeEnabled = 293;
  optional SharedWorkerBlobURLFixEnabledProto SharedWorkerBlobURLFixEnabled = 273;
  optional SharedWorkerExtendedLifetimeEnabledProto SharedWorkerExtendedLifetimeEnabled = 395;
  optional ShortcutCustomizationAllowedProto ShortcutCustomizationAllowed = 107;
  optional ShowAiIntroScreenEnabledProto ShowAiIntroScreenEnabled = 208;
  optional ShowCastSessionsStartedByOtherDevicesProto ShowCastSessionsStartedByOtherDevices = 2;
  optional ShowDisplaySizeScreenEnabledProto ShowDisplaySizeScreenEnabled = 59;
  optional ShowGeminiIntroScreenEnabledProto ShowGeminiIntroScreenEnabled = 249;
  optional ShowHumanPresenceSensorScreenEnabledProto ShowHumanPresenceSensorScreenEnabled = 129;
  optional ShowTouchpadScrollScreenEnabledProto ShowTouchpadScrollScreenEnabled = 40;
  optional SilentPrintingEnabledProto SilentPrintingEnabled = 357;
  optional SiteSearchSettingsProto SiteSearchSettings = 136;
  optional SmartCardConnectAllowedForUrlsProto SmartCardConnectAllowedForUrls = 280;
  optional SmartCardConnectBlockedForUrlsProto SmartCardConnectBlockedForUrls = 281;
  optional SmartTabSharingSettingsProto SmartTabSharingSettings = 413;
  optional StandardizedBrowserZoomEnabledProto StandardizedBrowserZoomEnabled = 246;
  optional StaticStorageQuotaEnabledProto StaticStorageQuotaEnabled = 377;
  optional SubAppsAPIsAllowedWithoutGestureAndAuthorizationForOriginsProto SubAppsAPIsAllowedWithoutGestureAndAuthorizationForOrigins = 178;
  optional SubAppsWithoutPromptsAllowedForOriginsProto SubAppsWithoutPromptsAllowedForOrigins = 409;
  optional SubAppsWithoutPromptsBlockedForOriginsProto SubAppsWithoutPromptsBlockedForOrigins = 410;
  optional SystemShortcutBehaviorProto SystemShortcutBehavior = 244;
  optional TLS13EarlyDataEnabledProto TLS13EarlyDataEnabled = 323;
  optional TabCompareSettingsProto TabCompareSettings = 251;
  optional TabGroupSharingSettingsProto TabGroupSharingSettings = 318;
  optional TabOrganizerSettingsProto TabOrganizerSettings = 146;
  optional ThirdPartyAiChatSettingsProto ThirdPartyAiChatSettings = 427;
  optional ThirdPartyPasswordManagersAllowedProto ThirdPartyPasswordManagersAllowed = 227;
  optional ThirdPartyStoragePartitioningBlockedForOriginsProto ThirdPartyStoragePartitioningBlockedForOrigins = 51;
  optional ToolbarAvatarLabelSettingsProto ToolbarAvatarLabelSettings = 168;
  optional TranslatorAPIAllowedProto TranslatorAPIAllowed = 269;
  optional UiAutomationProviderEnabledProto UiAutomationProviderEnabled = 205;
  optional UnaffiliatedDeviceArcAllowedProto UnaffiliatedDeviceArcAllowed = 127;
  optional UpdateOnZeroWindowEnabledProto UpdateOnZeroWindowEnabled = 431;
  optional UrlKeyedMetricsAllowedProto UrlKeyedMetricsAllowed = 73;
  optional UsbDetectorNotificationEnabledProto UsbDetectorNotificationEnabled = 4;
  optional UseMojoVideoDecoderForPepperAllowedProto UseMojoVideoDecoderForPepperAllowed = 6;
  optional UserAvatarCustomizationSelectorsEnabledProto UserAvatarCustomizationSelectorsEnabled = 49;
  optional UserContextAwareAccessSignalsAllowlistProto UserContextAwareAccessSignalsAllowlist = 66;
  optional UserFeedbackWithLowLevelDebugDataAllowedProto UserFeedbackWithLowLevelDebugDataAllowed = 133;
  optional UserSecurityAuthenticatedReportingProto UserSecurityAuthenticatedReporting = 308;
  optional UserSecuritySignalsReportingProto UserSecuritySignalsReporting = 307;
  optional VirtualKeyboardSmartVisibilityEnabledProto VirtualKeyboardSmartVisibilityEnabled = 162;
  optional VoiceTypingSettingsProto VoiceTypingSettings = 425;
  optional WallpaperGooglePhotosIntegrationEnabledProto WallpaperGooglePhotosIntegrationEnabled = 37;
  optional WatermarkStyleProto WatermarkStyle = 328;
  optional WebAnnotationsProto WebAnnotations = 163;
  optional WebAppInstallByUserEnabledProto WebAppInstallByUserEnabled = 382;
  optional WebAudioOutputBufferingEnabledProto WebAudioOutputBufferingEnabled = 270;
  optional WebAuthenticationRemoteDesktopAllowedOriginsProto WebAuthenticationRemoteDesktopAllowedOrigins = 292;
  optional WebPrintingAllowedForUrlsProto WebPrintingAllowedForUrls = 180;
  optional WebPrintingBlockedForUrlsProto WebPrintingBlockedForUrls = 181;
  optional WebRtcDiagnosticLogCollectionAllowedForOriginsProto WebRtcDiagnosticLogCollectionAllowedForOrigins = 392;
  optional WebRtcIPHandlingUrlProto WebRtcIPHandlingUrl = 284;
  optional WebRtcPostQuantumKeyAgreementProto WebRtcPostQuantumKeyAgreement = 344;
  optional WebRtcTextLogCollectionAllowedProto WebRtcTextLogCollectionAllowed = 38;
  optional WindowManagementAllowedForUrlsProto WindowManagementAllowedForUrls = 28;
  optional WindowManagementBlockedForUrlsProto WindowManagementBlockedForUrls = 29;
  optional XSLTEnabledProto XSLTEnabled = 389;
  optional ZstdContentEncodingEnabledProto ZstdContentEncodingEnabled = 131;
}

// --------------------------------------------------
// Big wrapper PB containing the above groups.

message ChromeSettingsProto {
  optional AbusiveExperienceInterventionEnforceProto AbusiveExperienceInterventionEnforce = 406;
  optional AccessCodeCastDeviceDurationProto AccessCodeCastDeviceDuration = 910;
  optional AccessCodeCastEnabledProto AccessCodeCastEnabled = 909;
  optional AccessControlAllowMethodsInCORSPreflightSpecConformantProto AccessControlAllowMethodsInCORSPreflightSpecConformant = 1030;
  optional AccessibilityImageLabelsEnabledProto AccessibilityImageLabelsEnabled = 705;
  optional AccessibilityShortcutsEnabledProto AccessibilityShortcutsEnabled = 661;
  optional AdditionalDnsQueryTypesEnabledProto AdditionalDnsQueryTypesEnabled = 859;
  optional AdsSettingForIntrusiveAdsSitesProto AdsSettingForIntrusiveAdsSites = 411;
  optional AdvancedProtectionAllowedProto AdvancedProtectionAllowed = 687;
  optional AdvancedProtectionDeepScanningEnabledProto AdvancedProtectionDeepScanningEnabled = 669;
  optional AllHttpAuthSchemesAllowedForOriginsProto AllHttpAuthSchemesAllowedForOrigins = 952;
  optional AllowChromeDataInBackupsProto AllowChromeDataInBackups = 970;
  optional AllowCrossOriginAuthPromptProto AllowCrossOriginAuthPrompt = 91;
  optional AllowDeletingBrowserHistoryProto AllowDeletingBrowserHistory = 189;
  optional AllowDinosaurEasterEggProto AllowDinosaurEasterEgg = 311;
  optional AllowFileSelectionDialogsProto AllowFileSelectionDialogs = 86;
  optional AllowNativeNotificationsProto AllowNativeNotifications = 680;
  optional AllowOutdatedPluginsProto AllowOutdatedPlugins = 83;
  optional AllowPopupsDuringPageUnloadProto AllowPopupsDuringPageUnload = 535;
  optional AllowScreenLockProto AllowScreenLock = 331;
  optional AllowScreenWakeLocksProto AllowScreenWakeLocks = 205;
  optional AllowSyncXHRInPageDismissalProto AllowSyncXHRInPageDismissal = 606;
  optional AllowSystemNotificationsProto AllowSystemNotifications = 830;
  optional AllowWakeLocksProto AllowWakeLocks = 493;
  optional AllowWebAuthnWithBrokenTlsCertsProto AllowWebAuthnWithBrokenTlsCerts = 1031;
  optional AllowedDomainsForAppsProto AllowedDomainsForApps = 333;
  optional AllowedInputMethodsProto AllowedInputMethods = 458;
  optional AllowedLanguagesProto AllowedLanguages = 446;
  optional AlternateErrorPagesEnabledProto AlternateErrorPagesEnabled = 7;
  optional AlternativeBrowserParametersProto AlternativeBrowserParameters = 497;
  optional AlternativeBrowserPathProto AlternativeBrowserPath = 496;
  optional AlwaysAuthorizePluginsProto AlwaysAuthorizePlugins = 88;
  optional AlwaysOpenPdfExternallyProto AlwaysOpenPdfExternally = 349;
  optional AmbientAuthenticationInPrivateModesEnabledProto AmbientAuthenticationInPrivateModesEnabled = 652;
  optional AppCacheForceEnabledProto AppCacheForceEnabled = 706;
  optional AppRecommendationZeroStateEnabledProto AppRecommendationZeroStateEnabled = 565;
  optional ApplicationLocaleValueProto ApplicationLocaleValue = 6;
  optional ArcAppInstallEventLoggingEnabledProto ArcAppInstallEventLoggingEnabled = 449;
  optional ArcAppToWebAppSharingEnabledProto ArcAppToWebAppSharingEnabled = 889;
  optional ArcBackupRestoreEnabledProto ArcBackupRestoreEnabled = 339;
  optional ArcBackupRestoreServiceEnabledProto ArcBackupRestoreServiceEnabled = 451;
  optional ArcCertificatesSyncModeProto ArcCertificatesSyncMode = 332;
  optional ArcEnabledProto ArcEnabled = 319;
  optional ArcGoogleLocationServicesEnabledProto ArcGoogleLocationServicesEnabled = 452;
  optional ArcLocationServiceEnabledProto ArcLocationServiceEnabled = 365;
  optional ArcPolicyProto ArcPolicy = 320;
  optional AssistantOnboardingModeProto AssistantOnboardingMode = 731;
  optional AssistantVoiceMatchEnabledDuringOobeProto AssistantVoiceMatchEnabledDuringOobe = 887;
  optional AssistantWebEnabledProto AssistantWebEnabled = 1013;
  optional AttestationEnabledForUserProto AttestationEnabledForUser = 202;
  optional AttestationExtensionAllowlistProto AttestationExtensionAllowlist = 787;
  optional AttestationExtensionWhitelistProto AttestationExtensionWhitelist = 203;
  optional AudioCaptureAllowedProto AudioCaptureAllowed = 162;
  optional AudioCaptureAllowedUrlsProto AudioCaptureAllowedUrls = 210;
  optional AudioOutputAllowedProto AudioOutputAllowed = 161;
  optional AudioProcessHighPriorityEnabledProto AudioProcessHighPriorityEnabled = 838;
  optional AudioSandboxEnabledProto AudioSandboxEnabled = 629;
  optional AuthAndroidNegotiateAccountTypeProto AuthAndroidNegotiateAccountType = 307;
  optional AuthNegotiateDelegateAllowlistProto AuthNegotiateDelegateAllowlist = 748;
  optional AuthNegotiateDelegateByKdcPolicyProto AuthNegotiateDelegateByKdcPolicy = 530;
  optional AuthNegotiateDelegateWhitelistProto AuthNegotiateDelegateWhitelist = 32;
  optional AuthSchemesProto AuthSchemes = 28;
  optional AuthServerAllowlistProto AuthServerAllowlist = 749;
  optional AuthServerWhitelistProto AuthServerWhitelist = 31;
  optional AutoFillEnabledProto AutoFillEnabled = 20;
  optional AutoLaunchProtocolsFromOriginsProto AutoLaunchProtocolsFromOrigins = 724;
  optional AutoOpenAllowedForURLsProto AutoOpenAllowedForURLs = 709;
  optional AutoOpenFileTypesProto AutoOpenFileTypes = 702;
  optional AutoSelectCertificateForUrlsProto AutoSelectCertificateForUrls = 104;
  optional AutoclickEnabledProto AutoclickEnabled = 599;
  optional AutofillAddressEnabledProto AutofillAddressEnabled = 461;
  optional AutofillCreditCardEnabledProto AutofillCreditCardEnabled = 394;
  optional AutoplayAllowedProto AutoplayAllowed = 432;
  optional AutoplayAllowlistProto AutoplayAllowlist = 744;
  optional AutoplayWhitelistProto AutoplayWhitelist = 433;
  optional BackForwardCacheEnabledProto BackForwardCacheEnabled = 760;
  optional BackgroundModeEnabledProto BackgroundModeEnabled = 140;
  optional BasicAuthOverHttpEnabledProto BasicAuthOverHttpEnabled = 808;
  optional BatterySaverModeAvailabilityProto BatterySaverModeAvailability = 1011;
  optional BlockExternalExtensionsProto BlockExternalExtensions = 639;
  optional BlockThirdPartyCookiesProto BlockThirdPartyCookies = 41;
  optional BookmarkBarEnabledProto BookmarkBarEnabled = 84;
  optional BrowserAddPersonEnabledProto BrowserAddPersonEnabled = 278;
  optional BrowserGuestModeEnabledProto BrowserGuestModeEnabled = 277;
  optional BrowserGuestModeEnforcedProto BrowserGuestModeEnforced = 576;
  optional BrowserLabsEnabledProto BrowserLabsEnabled = 818;
  optional BrowserLegacyExtensionPointsBlockedProto BrowserLegacyExtensionPointsBlocked = 895;
  optional BrowserNetworkTimeQueriesEnabledProto BrowserNetworkTimeQueriesEnabled = 372;
  optional BrowserSigninProto BrowserSignin = 489;
  optional BrowserSwitcherChromeParametersProto BrowserSwitcherChromeParameters = 533;
  optional BrowserSwitcherChromePathProto BrowserSwitcherChromePath = 532;
  optional BrowserSwitcherDelayProto BrowserSwitcherDelay = 526;
  optional BrowserSwitcherEnabledProto BrowserSwitcherEnabled = 519;
  optional BrowserSwitcherExternalGreylistUrlProto BrowserSwitcherExternalGreylistUrl = 566;
  optional BrowserSwitcherExternalSitelistUrlProto BrowserSwitcherExternalSitelistUrl = 513;
  optional BrowserSwitcherKeepLastChromeTabProto BrowserSwitcherKeepLastChromeTab = 521;
  optional BrowserSwitcherParsingModeProto BrowserSwitcherParsingMode = 868;
  optional BrowserSwitcherUrlGreylistProto BrowserSwitcherUrlGreylist = 499;
  optional BrowserSwitcherUrlListProto BrowserSwitcherUrlList = 498;
  optional BrowserSwitcherUseIeSitelistProto BrowserSwitcherUseIeSitelist = 500;
  optional BrowserThemeColorProto BrowserThemeColor = 842;
  optional BrowsingDataLifetimeProto BrowsingDataLifetime = 793;
  optional BruschettaVMConfigurationProto BruschettaVMConfiguration = 1035;
  optional BuiltInDnsClientEnabledProto BuiltInDnsClientEnabled = 167;
  optional BuiltinCertificateVerifierEnabledProto BuiltinCertificateVerifierEnabled = 577;
  optional CACertificateManagementAllowedProto CACertificateManagementAllowed = 581;
  optional CCTToSDialogEnabledProto CCTToSDialogEnabled = 762;
  optional CECPQ2EnabledProto CECPQ2Enabled = 843;
  optional CORSNonWildcardRequestHeadersSupportProto CORSNonWildcardRequestHeadersSupport = 923;
  optional CalendarIntegrationEnabledProto CalendarIntegrationEnabled = 1017;
  optional CaptivePortalAuthenticationIgnoresProxyProto CaptivePortalAuthenticationIgnoresProxy = 297;
  optional CaretHighlightEnabledProto CaretHighlightEnabled = 597;
  optional CastReceiverEnabledProto CastReceiverEnabled = 380;
  optional CertificateTransparencyEnforcementDisabledForCasProto CertificateTransparencyEnforcementDisabledForCas = 437;
  optional CertificateTransparencyEnforcementDisabledForLegacyCasProto CertificateTransparencyEnforcementDisabledForLegacyCas = 438;
  optional CertificateTransparencyEnforcementDisabledForUrlsProto CertificateTransparencyEnforcementDisabledForUrls = 337;
  optional ChromeAppsEnabledProto ChromeAppsEnabled = 894;
  optional ChromeCleanupEnabledProto ChromeCleanupEnabled = 443;
  optional ChromeCleanupReportingEnabledProto ChromeCleanupReportingEnabled = 444;
  optional ChromeOsLockOnIdleSuspendProto ChromeOsLockOnIdleSuspend = 63;
  optional ChromeOsMultiProfileUserBehaviorProto ChromeOsMultiProfileUserBehavior = 246;
  optional ChromeRootStoreEnabledProto ChromeRootStoreEnabled = 994;
  optional ChromeVariationsProto ChromeVariations = 665;
  optional ClearBrowsingDataOnExitListProto ClearBrowsingDataOnExitList = 811;
  optional ClearSiteDataOnExitProto ClearSiteDataOnExit = 67;
  optional ClickToCallEnabledProto ClickToCallEnabled = 647;
  optional ClientCertificateManagementAllowedProto ClientCertificateManagementAllowed = 520;
  optional ClipboardAllowedForUrlsProto ClipboardAllowedForUrls = 986;
  optional ClipboardBlockedForUrlsProto ClipboardBlockedForUrls = 987;
  optional CloudExtensionRequestEnabledProto CloudExtensionRequestEnabled = 610;
  optional CloudManagementEnrollmentMandatoryProto CloudManagementEnrollmentMandatory = 507;
  optional CloudManagementEnrollmentTokenProto CloudManagementEnrollmentToken = 512;
  optional CloudPolicyOverridesPlatformPolicyProto CloudPolicyOverridesPlatformPolicy = 383;
  optional CloudPrintProxyEnabledProto CloudPrintProxyEnabled = 15;
  optional CloudPrintSubmitEnabledProto CloudPrintSubmitEnabled = 111;
  optional CloudPrintWarningsSuppressedProto CloudPrintWarningsSuppressed = 783;
  optional CloudProfileReportingEnabledProto CloudProfileReportingEnabled = 944;
  optional CloudReportingEnabledProto CloudReportingEnabled = 495;
  optional CloudReportingUploadFrequencyProto CloudReportingUploadFrequency = 964;
  optional CloudUserPolicyMergeProto CloudUserPolicyMerge = 861;
  optional CloudUserPolicyOverridesCloudMachinePolicyProto CloudUserPolicyOverridesCloudMachinePolicy = 901;
  optional CoalesceH2ConnectionsWithClientCertificatesForHostsProto CoalesceH2ConnectionsWithClientCertificatesForHosts = 468;
  optional CommandLineFlagSecurityWarningsEnabledProto CommandLineFlagSecurityWarningsEnabled = 568;
  optional ComponentUpdatesEnabledProto ComponentUpdatesEnabled = 344;
  optional ContextAwareAccessSignalsAllowlistProto ContextAwareAccessSignalsAllowlist = 828;
  optional ContextualSearchEnabledProto ContextualSearchEnabled = 283;
  optional ContextualSuggestionsEnabledProto ContextualSuggestionsEnabled = 454;
  optional CookiesAllowedForUrlsProto CookiesAllowedForUrls = 79;
  optional CookiesBlockedForUrlsProto CookiesBlockedForUrls = 69;
  optional CookiesSessionOnlyForUrlsProto CookiesSessionOnlyForUrls = 70;
  optional CopyPreventionSettingsProto CopyPreventionSettings = 930;
  optional CorsLegacyModeEnabledProto CorsLegacyModeEnabled = 632;
  optional CorsMitigationListProto CorsMitigationList = 631;
  optional CrossOriginWebAssemblyModuleSharingEnabledProto CrossOriginWebAssemblyModuleSharingEnabled = 880;
  optional CrostiniAllowedProto CrostiniAllowed = 483;
  optional CrostiniAnsiblePlaybookProto CrostiniAnsiblePlaybook = 641;
  optional CrostiniArcAdbSideloadingAllowedProto CrostiniArcAdbSideloadingAllowed = 692;
  optional CrostiniExportImportUIAllowedProto CrostiniExportImportUIAllowed = 525;
  optional CrostiniPortForwardingAllowedProto CrostiniPortForwardingAllowed = 718;
  optional CrostiniRootAccessAllowedProto CrostiniRootAccessAllowed = 578;
  optional CursorHighlightEnabledProto CursorHighlightEnabled = 596;
  optional DHEEnabledProto DHEEnabled = 336;
  optional DNSInterceptionChecksEnabledProto DNSInterceptionChecksEnabled = 656;
  optional DataCompressionProxyEnabledProto DataCompressionProxyEnabled = 243;
  optional DataLeakPreventionClipboardCheckSizeLimitProto DataLeakPreventionClipboardCheckSizeLimit = 879;
  optional DataLeakPreventionReportingEnabledProto DataLeakPreventionReportingEnabled = 858;
  optional DataLeakPreventionRulesListProto DataLeakPreventionRulesList = 788;
  optional DefaultBrowserSettingEnabledProto DefaultBrowserSettingEnabled = 5;
  optional DefaultClipboardSettingProto DefaultClipboardSetting = 985;
  optional DefaultCookiesSettingProto DefaultCookiesSetting = 50;
  optional DefaultDownloadDirectoryProto DefaultDownloadDirectory = 403;
  optional DefaultFileHandlingGuardSettingProto DefaultFileHandlingGuardSetting = 847;
  optional DefaultFileSystemReadGuardSettingProto DefaultFileSystemReadGuardSetting = 775;
  optional DefaultFileSystemWriteGuardSettingProto DefaultFileSystemWriteGuardSetting = 776;
  optional DefaultGeolocationSettingProto DefaultGeolocationSetting = 56;
  optional DefaultHandlersForFileExtensionsProto DefaultHandlersForFileExtensions = 1023;
  optional DefaultImagesSettingProto DefaultImagesSetting = 51;
  optional DefaultInsecureContentSettingProto DefaultInsecureContentSetting = 635;
  optional DefaultJavaScriptJitSettingProto DefaultJavaScriptJitSetting = 869;
  optional DefaultJavaScriptSettingProto DefaultJavaScriptSetting = 52;
  optional DefaultKeygenSettingProto DefaultKeygenSetting = 315;
  optional DefaultLocalFontsSettingProto DefaultLocalFontsSetting = 979;
  optional DefaultMediaStreamSettingProto DefaultMediaStreamSetting = 151;
  optional DefaultNotificationsSettingProto DefaultNotificationsSetting = 55;
  optional DefaultPluginsSettingProto DefaultPluginsSetting = 53;
  optional DefaultPopupsSettingProto DefaultPopupsSetting = 54;
  optional DefaultPrinterSelectionProto DefaultPrinterSelection = 310;
  optional DefaultSearchProviderAlternateURLsProto DefaultSearchProviderAlternateURLs = 163;
  optional DefaultSearchProviderContextMenuAccessAllowedProto DefaultSearchProviderContextMenuAccessAllowed = 717;
  optional DefaultSearchProviderEnabledProto DefaultSearchProviderEnabled = 42;
  optional DefaultSearchProviderEncodingsProto DefaultSearchProviderEncodings = 49;
  optional DefaultSearchProviderIconURLProto DefaultSearchProviderIconURL = 48;
  optional DefaultSearchProviderImageURLProto DefaultSearchProviderImageURL = 231;
  optional DefaultSearchProviderImageURLPostParamsProto DefaultSearchProviderImageURLPostParams = 235;
  optional DefaultSearchProviderInstantURLProto DefaultSearchProviderInstantURL = 47;
  optional DefaultSearchProviderInstantURLPostParamsProto DefaultSearchProviderInstantURLPostParams = 234;
  optional DefaultSearchProviderKeywordProto DefaultSearchProviderKeyword = 44;
  optional DefaultSearchProviderNameProto DefaultSearchProviderName = 43;
  optional DefaultSearchProviderNewTabURLProto DefaultSearchProviderNewTabURL = 239;
  optional DefaultSearchProviderSearchTermsReplacementKeyProto DefaultSearchProviderSearchTermsReplacementKey = 173;
  optional DefaultSearchProviderSearchURLProto DefaultSearchProviderSearchURL = 45;
  optional DefaultSearchProviderSearchURLPostParamsProto DefaultSearchProviderSearchURLPostParams = 232;
  optional DefaultSearchProviderSuggestURLProto DefaultSearchProviderSuggestURL = 46;
  optional DefaultSearchProviderSuggestURLPostParamsProto DefaultSearchProviderSuggestURLPostParams = 233;
  optional DefaultSensorsSettingProto DefaultSensorsSetting = 756;
  optional DefaultSerialGuardSettingProto DefaultSerialGuardSetting = 753;
  optional DefaultWebBluetoothGuardSettingProto DefaultWebBluetoothGuardSetting = 322;
  optional DefaultWebHidGuardSettingProto DefaultWebHidGuardSetting = 945;
  optional DefaultWebUsbGuardSettingProto DefaultWebUsbGuardSetting = 436;
  optional DefaultWindowPlacementSettingProto DefaultWindowPlacementSetting = 953;
  optional DeletePrintJobHistoryAllowedProto DeletePrintJobHistoryAllowed = 722;
  optional DeskAPIThirdPartyAccessEnabledProto DeskAPIThirdPartyAccessEnabled = 1021;
  optional DeskAPIThirdPartyAllowlistProto DeskAPIThirdPartyAllowlist = 1025;
  optional DeskTemplatesEnabledProto DeskTemplatesEnabled = 912;
  optional DesktopSharingHubEnabledProto DesktopSharingHubEnabled = 873;
  optional DeveloperToolsAvailabilityProto DeveloperToolsAvailability = 445;
  optional DeveloperToolsDisabledProto DeveloperToolsDisabled = 38;
  optional DeviceAttributesAllowedForOriginsProto DeviceAttributesAllowedForOrigins = 867;
  optional DeviceLocalAccountManagedSessionEnabledProto DeviceLocalAccountManagedSessionEnabled = 465;
  optional DevicePowerAdaptiveChargingEnabledProto DevicePowerAdaptiveChargingEnabled = 973;
  optional DictationEnabledProto DictationEnabled = 594;
  optional Disable3DAPIsProto Disable3DAPIs = 57;
  optional DisableAuthNegotiateCnameLookupProto DisableAuthNegotiateCnameLookup = 29;
  optional DisablePluginFinderProto DisablePluginFinder = 68;
  optional DisablePrintPreviewProto DisablePrintPreview = 119;
  optional DisableSSLRecordSplittingProto DisableSSLRecordSplitting = 120;
  optional DisableSafeBrowsingProceedAnywayProto DisableSafeBrowsingProceedAnyway = 152;
  optional DisableScreenshotsProto DisableScreenshots = 155;
  optional DisableSpdyProto DisableSpdy = 10;
  optional DisabledPluginsProto DisabledPlugins = 21;
  optional DisabledPluginsExceptionsProto DisabledPluginsExceptions = 81;
  optional DisabledSchemesProto DisabledSchemes = 87;
  optional DiskCacheDirProto DiskCacheDir = 90;
  optional DiskCacheSizeProto DiskCacheSize = 112;
  optional DisplayCapturePermissionsPolicyEnabledProto DisplayCapturePermissionsPolicyEnabled = 882;
  optional DnsOverHttpsModeProto DnsOverHttpsMode = 584;
  optional DnsOverHttpsSaltProto DnsOverHttpsSalt = 1036;
  optional DnsOverHttpsTemplatesProto DnsOverHttpsTemplates = 644;
  optional DnsOverHttpsTemplatesWithIdentifiersProto DnsOverHttpsTemplatesWithIdentifiers = 1037;
  optional DnsPrefetchingEnabledProto DnsPrefetchingEnabled = 9;
  optional DownloadBubbleEnabledProto DownloadBubbleEnabled = 972;
  optional DownloadDirectoryProto DownloadDirectory = 66;
  optional DownloadRestrictionsProto DownloadRestrictions = 373;
  optional DriveDisabledProto DriveDisabled = 141;
  optional DriveDisabledOverCellularProto DriveDisabledOverCellular = 142;
  optional EasyUnlockAllowedProto EasyUnlockAllowed = 274;
  optional EcheAllowedProto EcheAllowed = 939;
  optional EcryptfsMigrationStrategyProto EcryptfsMigrationStrategy = 378;
  optional EditBookmarksEnabledProto EditBookmarksEnabled = 85;
  optional EduCoexistenceToSVersionProto EduCoexistenceToSVersion = 792;
  optional EmojiSuggestionEnabledProto EmojiSuggestionEnabled = 723;
  optional EnableAuthNegotiatePortProto EnableAuthNegotiatePort = 30;
  optional EnableCommonNameFallbackForLocalAnchorsProto EnableCommonNameFallbackForLocalAnchors = 368;
  optional EnableDeprecatedPrivetPrintingProto EnableDeprecatedPrivetPrinting = 817;
  optional EnableDeprecatedWebBasedSigninProto EnableDeprecatedWebBasedSignin = 267;
  optional EnableDeprecatedWebPlatformFeaturesProto EnableDeprecatedWebPlatformFeatures = 272;
  optional EnableExperimentalPoliciesProto EnableExperimentalPolicies = 713;
  optional EnableMediaRouterProto EnableMediaRouter = 335;
  optional EnableOnlineRevocationChecksProto EnableOnlineRevocationChecks = 131;
  optional EnableSha1ForLocalAnchorsProto EnableSha1ForLocalAnchors = 342;
  optional EnableSymantecLegacyInfrastructureProto EnableSymantecLegacyInfrastructure = 415;
  optional EnableSyncConsentProto EnableSyncConsent = 453;
  optional EnabledPluginsProto EnabledPlugins = 80;
  optional EncryptedClientHelloEnabledProto EncryptedClientHelloEnabled = 998;
  optional EnhancedNetworkVoicesInSelectToSpeakAllowedProto EnhancedNetworkVoicesInSelectToSpeakAllowed = 890;
  optional EnterpriseAuthenticationAppLinkPolicyProto EnterpriseAuthenticationAppLinkPolicy = 978;
  optional EnterpriseHardwarePlatformAPIEnabledProto EnterpriseHardwarePlatformAPIEnabled = 485;
  optional EnterpriseProfileCreationKeepBrowsingDataProto EnterpriseProfileCreationKeepBrowsingData = 1000;
  optional EnterpriseRealTimeUrlCheckModeProto EnterpriseRealTimeUrlCheckMode = 730;
  optional EnterpriseWebStoreNameProto EnterpriseWebStoreName = 115;
  optional EnterpriseWebStoreURLProto EnterpriseWebStoreURL = 114;
  optional EventPathEnabledProto EventPathEnabled = 992;
  optional ExemptDomainFileTypePairsFromFileTypeDownloadWarningsProto ExemptDomainFileTypePairsFromFileTypeDownloadWarnings = 949;
  optional ExplicitlyAllowedNetworkPortsProto ExplicitlyAllowedNetworkPorts = 851;
  optional ExtensionAllowInsecureUpdatesProto ExtensionAllowInsecureUpdates = 518;
  optional ExtensionAllowedTypesProto ExtensionAllowedTypes = 170;
  optional ExtensionInstallAllowlistProto ExtensionInstallAllowlist = 740;
  optional ExtensionInstallBlacklistProto ExtensionInstallBlacklist = 34;
  optional ExtensionInstallBlocklistProto ExtensionInstallBlocklist = 742;
  optional ExtensionInstallEventLoggingEnabledProto ExtensionInstallEventLoggingEnabled = 729;
  optional ExtensionInstallForcelistProto ExtensionInstallForcelist = 36;
  optional ExtensionInstallSourcesProto ExtensionInstallSources = 150;
  optional ExtensionInstallWhitelistProto ExtensionInstallWhitelist = 35;
  optional ExtensionManifestV2AvailabilityProto ExtensionManifestV2Availability = 1032;
  optional ExtensionSettingsProto ExtensionSettings = 280;
  optional ExternalPrintServersProto ExternalPrintServers = 574;
  optional ExternalPrintServersAllowlistProto ExternalPrintServersAllowlist = 752;
  optional ExternalPrintServersWhitelistProto ExternalPrintServersWhitelist = 633;
  optional ExternalProtocolDialogShowAlwaysOpenCheckboxProto ExternalProtocolDialogShowAlwaysOpenCheckbox = 634;
  optional ExternalStorageDisabledProto ExternalStorageDisabled = 154;
  optional ExternalStorageReadOnlyProto ExternalStorageReadOnly = 345;
  optional FastPairEnabledProto FastPairEnabled = 914;
  optional FetchKeepaliveDurationSecondsOnShutdownProto FetchKeepaliveDurationSecondsOnShutdown = 829;
  optional FileHandlingAllowedForUrlsProto FileHandlingAllowedForUrls = 848;
  optional FileHandlingBlockedForUrlsProto FileHandlingBlockedForUrls = 849;
  optional FileSystemReadAskForUrlsProto FileSystemReadAskForUrls = 777;
  optional FileSystemReadBlockedForUrlsProto FileSystemReadBlockedForUrls = 778;
  optional FileSystemSyncAccessHandleAsyncInterfaceEnabledProto FileSystemSyncAccessHandleAsyncInterfaceEnabled = 1022;
  optional FileSystemWriteAskForUrlsProto FileSystemWriteAskForUrls = 779;
  optional FileSystemWriteBlockedForUrlsProto FileSystemWriteBlockedForUrls = 780;
  optional FirstPartySetsEnabledProto FirstPartySetsEnabled = 950;
  optional FirstPartySetsOverridesProto FirstPartySetsOverrides = 971;
  optional FloatingAccessibilityMenuEnabledProto FloatingAccessibilityMenuEnabled = 693;
  optional FloatingWorkspaceEnabledProto FloatingWorkspaceEnabled = 961;
  optional FloatingWorkspaceV2EnabledProto FloatingWorkspaceV2Enabled = 1041;
  optional ForceBrowserSigninProto ForceBrowserSignin = 348;
  optional ForceEphemeralProfilesProto ForceEphemeralProfiles = 247;
  optional ForceGoogleSafeSearchProto ForceGoogleSafeSearch = 284;
  optional ForceLegacyDefaultReferrerPolicyProto ForceLegacyDefaultReferrerPolicy = 650;
  optional ForceLogoutUnauthenticatedUserEnabledProto ForceLogoutUnauthenticatedUserEnabled = 681;
  optional ForceMajorVersionToMinorPositionInUserAgentProto ForceMajorVersionToMinorPositionInUserAgent = 951;
  optional ForceMaximizeOnFirstRunProto ForceMaximizeOnFirstRun = 300;
  optional ForceNetworkInProcessProto ForceNetworkInProcess = 523;
  optional ForceSafeSearchProto ForceSafeSearch = 164;
  optional ForceYouTubeRestrictProto ForceYouTubeRestrict = 350;
  optional ForceYouTubeSafetyModeProto ForceYouTubeSafetyMode = 285;
  optional ForcedLanguagesProto ForcedLanguages = 841;
  optional FullRestoreEnabledProto FullRestoreEnabled = 899;
  optional FullscreenAlertEnabledProto FullscreenAlertEnabled = 806;
  optional FullscreenAllowedProto FullscreenAllowed = 242;
  optional GSSAPILibraryNameProto GSSAPILibraryName = 33;
  optional GaiaLockScreenOfflineSigninTimeLimitDaysProto GaiaLockScreenOfflineSigninTimeLimitDays = 835;
  optional GaiaOfflineSigninTimeLimitDaysProto GaiaOfflineSigninTimeLimitDays = 823;
  optional GetDisplayMediaSetSelectAllScreensAllowedForUrlsProto GetDisplayMediaSetSelectAllScreensAllowedForUrls = 974;
  optional GhostWindowEnabledProto GhostWindowEnabled = 900;
  optional GloballyScopeHTTPAuthCacheEnabledProto GloballyScopeHTTPAuthCacheEnabled = 645;
  optional HSTSPolicyBypassListProto HSTSPolicyBypassList = 603;
  optional HardwareAccelerationModeEnabledProto HardwareAccelerationModeEnabled = 306;
  optional HeadlessModeProto HeadlessMode = 844;
  optional HideWebStoreIconProto HideWebStoreIcon = 191;
  optional HideWebStorePromoProto HideWebStorePromo = 98;
  optional HighContrastEnabledProto HighContrastEnabled = 215;
  optional HighEfficiencyModeEnabledProto HighEfficiencyModeEnabled = 1008;
  optional HindiInscriptLayoutEnabledProto HindiInscriptLayoutEnabled = 1027;
  optional HistoryClustersVisibleProto HistoryClustersVisible = 928;
  optional HomepageIsNewTabPageProto HomepageIsNewTabPage = 4;
  optional HomepageLocationProto HomepageLocation = 3;
  optional Http09OnNonDefaultPortsEnabledProto Http09OnNonDefaultPortsEnabled = 347;
  optional HttpsOnlyModeProto HttpsOnlyMode = 872;
  optional IdleActionProto IdleAction = 182;
  optional IdleActionACProto IdleActionAC = 228;
  optional IdleActionBatteryProto IdleActionBattery = 224;
  optional IdleDelayACProto IdleDelayAC = 177;
  optional IdleDelayBatteryProto IdleDelayBattery = 181;
  optional IdleTimeoutProto IdleTimeout = 996;
  optional IdleTimeoutActionsProto IdleTimeoutActions = 1038;
  optional IdleWarningDelayACProto IdleWarningDelayAC = 199;
  optional IdleWarningDelayBatteryProto IdleWarningDelayBattery = 200;
  optional ImagesAllowedForUrlsProto ImagesAllowedForUrls = 71;
  optional ImagesBlockedForUrlsProto ImagesBlockedForUrls = 72;
  optional ImportAutofillFormDataProto ImportAutofillFormData = 279;
  optional ImportBookmarksProto ImportBookmarks = 99;
  optional ImportHistoryProto ImportHistory = 100;
  optional ImportHomepageProto ImportHomepage = 101;
  optional ImportSavedPasswordsProto ImportSavedPasswords = 103;
  optional ImportSearchEngineProto ImportSearchEngine = 102;
  optional IncognitoEnabledProto IncognitoEnabled = 12;
  optional IncognitoModeAvailabilityProto IncognitoModeAvailability = 95;
  optional InsecureContentAllowedForUrlsProto InsecureContentAllowedForUrls = 636;
  optional InsecureContentBlockedForUrlsProto InsecureContentBlockedForUrls = 637;
  optional InsecureFormsWarningsEnabledProto InsecureFormsWarningsEnabled = 750;
  optional InsecurePrivateNetworkRequestsAllowedProto InsecurePrivateNetworkRequestsAllowed = 768;
  optional InsecurePrivateNetworkRequestsAllowedForUrlsProto InsecurePrivateNetworkRequestsAllowedForUrls = 769;
  optional InsightsExtensionEnabledProto InsightsExtensionEnabled = 977;
  optional InstantEnabledProto InstantEnabled = 64;
  optional InstantTetheringAllowedProto InstantTetheringAllowed = 369;
  optional IntegratedWebAuthenticationAllowedProto IntegratedWebAuthenticationAllowed = 810;
  optional IntensiveWakeUpThrottlingEnabledProto IntensiveWakeUpThrottlingEnabled = 715;
  optional IntranetRedirectBehaviorProto IntranetRedirectBehavior = 794;
  optional IsolateOriginsProto IsolateOrigins = 400;
  optional IsolateOriginsAndroidProto IsolateOriginsAndroid = 447;
  optional IsolatedWebAppInstallForceListProto IsolatedWebAppInstallForceList = 1024;
  optional JavaScriptAllowedForUrlsProto JavaScriptAllowedForUrls = 73;
  optional JavaScriptBlockedForUrlsProto JavaScriptBlockedForUrls = 74;
  optional JavaScriptJitAllowedForSitesProto JavaScriptJitAllowedForSites = 870;
  optional JavaScriptJitBlockedForSitesProto JavaScriptJitBlockedForSites = 871;
  optional JavascriptEnabledProto JavascriptEnabled = 11;
  optional KeepFullscreenWithoutNotificationUrlAllowListProto KeepFullscreenWithoutNotificationUrlAllowList = 932;
  optional KerberosAccountsProto KerberosAccounts = 562;
  optional KerberosAddAccountsAllowedProto KerberosAddAccountsAllowed = 561;
  optional KerberosCustomPrefilledConfigProto KerberosCustomPrefilledConfig = 1002;
  optional KerberosDomainAutocompleteProto KerberosDomainAutocomplete = 1001;
  optional KerberosEnabledProto KerberosEnabled = 559;
  optional KerberosRememberPasswordEnabledProto KerberosRememberPasswordEnabled = 560;
  optional KeyPermissionsProto KeyPermissions = 304;
  optional KeyboardDefaultToFunctionKeysProto KeyboardDefaultToFunctionKeys = 262;
  optional KeyboardFocusHighlightEnabledProto KeyboardFocusHighlightEnabled = 595;
  optional KeygenAllowedForUrlsProto KeygenAllowedForUrls = 316;
  optional KeygenBlockedForUrlsProto KeygenBlockedForUrls = 317;
  optional LacrosAllowedProto LacrosAllowed = 795;
  optional LacrosAvailabilityProto LacrosAvailability = 857;
  optional LacrosDataBackwardMigrationModeProto LacrosDataBackwardMigrationMode = 1014;
  optional LacrosSecondaryProfilesAllowedProto LacrosSecondaryProfilesAllowed = 834;
  optional LargeCursorEnabledProto LargeCursorEnabled = 213;
  optional LegacySameSiteCookieBehaviorEnabledProto LegacySameSiteCookieBehaviorEnabled = 625;
  optional LegacySameSiteCookieBehaviorEnabledForDomainListProto LegacySameSiteCookieBehaviorEnabledForDomainList = 626;
  optional LensCameraAssistedSearchEnabledProto LensCameraAssistedSearchEnabled = 855;
  optional LensDesktopNTPSearchEnabledProto LensDesktopNTPSearchEnabled = 1029;
  optional LensRegionSearchEnabledProto LensRegionSearchEnabled = 888;
  optional LidCloseActionProto LidCloseAction = 183;
  optional LoadCryptoTokenExtensionProto LoadCryptoTokenExtension = 1007;
  optional LocalDiscoveryEnabledProto LocalDiscoveryEnabled = 664;
  optional LocalFontsAllowedForUrlsProto LocalFontsAllowedForUrls = 980;
  optional LocalFontsBlockedForUrlsProto LocalFontsBlockedForUrls = 981;
  optional LockIconInAddressBarEnabledProto LockIconInAddressBarEnabled = 863;
  optional LockScreenMediaPlaybackEnabledProto LockScreenMediaPlaybackEnabled = 583;
  optional LockScreenReauthenticationEnabledProto LockScreenReauthenticationEnabled = 721;
  optional LoginDisplayPasswordButtonEnabledProto LoginDisplayPasswordButtonEnabled = 703;
  optional LookalikeWarningAllowlistDomainsProto LookalikeWarningAllowlistDomains = 784;
  optional MachineLevelUserCloudPolicyEnrollmentTokenProto MachineLevelUserCloudPolicyEnrollmentToken = 430;
  optional ManagedAccountsSigninRestrictionProto ManagedAccountsSigninRestriction = 862;
  optional ManagedBookmarksProto ManagedBookmarks = 229;
  optional ManagedConfigurationPerOriginProto ManagedConfigurationPerOrigin = 815;
  optional ManagedGuestSessionAutoLaunchNotificationReducedProto ManagedGuestSessionAutoLaunchNotificationReduced = 690;
  optional MaxConnectionsPerProxyProto MaxConnectionsPerProxy = 94;
  optional MaxInvalidationFetchDelayProto MaxInvalidationFetchDelay = 230;
  optional MediaCacheSizeProto MediaCacheSize = 113;
  optional MediaRecommendationsEnabledProto MediaRecommendationsEnabled = 790;
  optional MediaRouterCastAllowAllIPsProto MediaRouterCastAllowAllIPs = 439;
  optional MetricsReportingEnabledProto MetricsReportingEnabled = 17;
  optional MonoAudioEnabledProto MonoAudioEnabled = 598;
  optional NTLMShareAuthenticationEnabledProto NTLMShareAuthenticationEnabled = 491;
  optional NTPCardsVisibleProto NTPCardsVisible = 807;
  optional NTPContentSuggestionsEnabledProto NTPContentSuggestionsEnabled = 340;
  optional NTPCustomBackgroundEnabledProto NTPCustomBackgroundEnabled = 655;
  optional NTPMiddleSlotAnnouncementVisibleProto NTPMiddleSlotAnnouncementVisible = 943;
  optional NativeMessagingAllowlistProto NativeMessagingAllowlist = 747;
  optional NativeMessagingBlacklistProto NativeMessagingBlacklist = 253;
  optional NativeMessagingBlocklistProto NativeMessagingBlocklist = 746;
  optional NativeMessagingUserLevelHostsProto NativeMessagingUserLevelHosts = 255;
  optional NativeMessagingWhitelistProto NativeMessagingWhitelist = 254;
  optional NativePrintersProto NativePrinters = 352;
  optional NativePrintersBulkAccessModeProto NativePrintersBulkAccessMode = 385;
  optional NativePrintersBulkBlacklistProto NativePrintersBulkBlacklist = 386;
  optional NativePrintersBulkConfigurationProto NativePrintersBulkConfiguration = 384;
  optional NativePrintersBulkWhitelistProto NativePrintersBulkWhitelist = 387;
  optional NativeWindowOcclusionEnabledProto NativeWindowOcclusionEnabled = 677;
  optional NearbyShareAllowedProto NearbyShareAllowed = 763;
  optional NetBiosShareDiscoveryEnabledProto NetBiosShareDiscoveryEnabled = 469;
  optional NetworkFileSharesAllowedProto NetworkFileSharesAllowed = 464;
  optional NetworkFileSharesPreconfiguredSharesProto NetworkFileSharesPreconfiguredShares = 492;
  optional NetworkPredictionOptionsProto NetworkPredictionOptions = 275;
  optional NetworkServiceSandboxEnabledProto NetworkServiceSandboxEnabled = 911;
  optional NewTabPageLocationProto NewTabPageLocation = 362;
  optional NewWindowsInKioskAllowedProto NewWindowsInKioskAllowed = 997;
  optional NoteTakingAppsLockScreenAllowlistProto NoteTakingAppsLockScreenAllowlist = 761;
  optional NoteTakingAppsLockScreenWhitelistProto NoteTakingAppsLockScreenWhitelist = 379;
  optional NotificationsAllowedForUrlsProto NotificationsAllowedForUrls = 107;
  optional NotificationsBlockedForUrlsProto NotificationsBlockedForUrls = 108;
  optional NtlmV2EnabledProto NtlmV2Enabled = 395;
  optional OffsetParentNewSpecBehaviorEnabledProto OffsetParentNewSpecBehaviorEnabled = 1033;
  optional OnBulkDataEntryEnterpriseConnectorProto OnBulkDataEntryEnterpriseConnector = 699;
  optional OnFileAttachedEnterpriseConnectorProto OnFileAttachedEnterpriseConnector = 695;
  optional OnFileDownloadedEnterpriseConnectorProto OnFileDownloadedEnterpriseConnector = 698;
  optional OnFileTransferEnterpriseConnectorProto OnFileTransferEnterpriseConnector = 993;
  optional OnPrintEnterpriseConnectorProto OnPrintEnterpriseConnector = 933;
  optional OnSecurityEventEnterpriseConnectorProto OnSecurityEventEnterpriseConnector = 701;
  optional OpenNetworkConfigurationProto OpenNetworkConfiguration = 109;
  optional OptimizationGuideFetchingEnabledProto OptimizationGuideFetchingEnabled = 965;
  optional OriginAgentClusterDefaultEnabledProto OriginAgentClusterDefaultEnabled = 935;
  optional OsColorModeProto OsColorMode = 988;
  optional OverrideSecurityRestrictionsOnInsecureOriginProto OverrideSecurityRestrictionsOnInsecureOrigin = 459;
  optional PacHttpsUrlStrippingEnabledProto PacHttpsUrlStrippingEnabled = 334;
  optional ParentAccessCodeConfigProto ParentAccessCodeConfig = 509;
  optional PasswordDismissCompromisedAlertEnabledProto PasswordDismissCompromisedAlertEnabled = 948;
  optional PasswordLeakDetectionEnabledProto PasswordLeakDetectionEnabled = 582;
  optional PasswordManagerAllowShowPasswordsProto PasswordManagerAllowShowPasswords = 19;
  optional PasswordManagerEnabledProto PasswordManagerEnabled = 18;
  optional PasswordProtectionChangePasswordURLProto PasswordProtectionChangePasswordURL = 426;
  optional PasswordProtectionLoginURLsProto PasswordProtectionLoginURLs = 425;
  optional PasswordProtectionWarningTriggerProto PasswordProtectionWarningTrigger = 413;
  optional PaymentMethodQueryEnabledProto PaymentMethodQueryEnabled = 653;
  optional PdfAnnotationsEnabledProto PdfAnnotationsEnabled = 846;
  optional PdfLocalFileAccessAllowedForDomainsProto PdfLocalFileAccessAllowedForDomains = 1040;
  optional PerAppTimeLimitsProto PerAppTimeLimits = 643;
  optional PerAppTimeLimitsAllowlistProto PerAppTimeLimitsAllowlist = 764;
  optional PerAppTimeLimitsWhitelistProto PerAppTimeLimitsWhitelist = 660;
  optional PersistentQuotaEnabledProto PersistentQuotaEnabled = 1004;
  optional PhoneHubAllowedProto PhoneHubAllowed = 797;
  optional PhoneHubCameraRollAllowedProto PhoneHubCameraRollAllowed = 938;
  optional PhoneHubNotificationsAllowedProto PhoneHubNotificationsAllowed = 798;
  optional PhoneHubTaskContinuationAllowedProto PhoneHubTaskContinuationAllowed = 799;
  optional PinUnlockAutosubmitEnabledProto PinUnlockAutosubmitEnabled = 720;
  optional PinUnlockMaximumLengthProto PinUnlockMaximumLength = 357;
  optional PinUnlockMinimumLengthProto PinUnlockMinimumLength = 356;
  optional PinUnlockWeakPinsAllowedProto PinUnlockWeakPinsAllowed = 358;
  optional PinnedLauncherAppsProto PinnedLauncherApps = 146;
  optional PluginVmDataCollectionAllowedProto PluginVmDataCollectionAllowed = 714;
  optional PluginVmImageProto PluginVmImage = 506;
  optional PluginVmRequiredFreeDiskSpaceProto PluginVmRequiredFreeDiskSpace = 726;
  optional PluginVmUserIdProto PluginVmUserId = 700;
  optional PluginsAllowedForUrlsProto PluginsAllowedForUrls = 75;
  optional PluginsBlockedForUrlsProto PluginsBlockedForUrls = 76;
  optional PolicyAtomicGroupsEnabledProto PolicyAtomicGroupsEnabled = 586;
  optional PolicyDictionaryMultipleSourceMergeListProto PolicyDictionaryMultipleSourceMergeList = 567;
  optional PolicyListMultipleSourceMergeListProto PolicyListMultipleSourceMergeList = 556;
  optional PolicyRefreshRateProto PolicyRefreshRate = 58;
  optional PolicyScopeDetectionProto PolicyScopeDetection = 991;
  optional PopupsAllowedForUrlsProto PopupsAllowedForUrls = 77;
  optional PopupsBlockedForUrlsProto PopupsBlockedForUrls = 78;
  optional PowerManagementIdleSettingsProto PowerManagementIdleSettings = 260;
  optional PowerManagementUsesAudioActivityProto PowerManagementUsesAudioActivity = 184;
  optional PowerManagementUsesVideoActivityProto PowerManagementUsesVideoActivity = 185;
  optional PowerSmartDimEnabledProto PowerSmartDimEnabled = 467;
  optional PreconfiguredDeskTemplatesProto PreconfiguredDeskTemplates = 913;
  optional PrefixedStorageInfoEnabledProto PrefixedStorageInfoEnabled = 1006;
  optional PresentationIdleDelayScaleProto PresentationIdleDelayScale = 186;
  optional PresentationScreenDimDelayScaleProto PresentationScreenDimDelayScale = 222;
  optional PrimaryMouseButtonSwitchProto PrimaryMouseButtonSwitch = 657;
  optional PrintHeaderFooterProto PrintHeaderFooter = 482;
  optional PrintJobHistoryExpirationPeriodProto PrintJobHistoryExpirationPeriod = 627;
  optional PrintPdfAsImageAvailabilityProto PrintPdfAsImageAvailability = 891;
  optional PrintPdfAsImageDefaultProto PrintPdfAsImageDefault = 898;
  optional PrintPostScriptModeProto PrintPostScriptMode = 897;
  optional PrintPreviewUseSystemDefaultPrinterProto PrintPreviewUseSystemDefaultPrinter = 375;
  optional PrintRasterizationModeProto PrintRasterizationMode = 708;
  optional PrintRasterizePdfDpiProto PrintRasterizePdfDpi = 892;
  optional PrinterTypeDenyListProto PrinterTypeDenyList = 649;
  optional PrintersProto Printers = 771;
  optional PrintersBulkAccessModeProto PrintersBulkAccessMode = 774;
  optional PrintersBulkAllowlistProto PrintersBulkAllowlist = 782;
  optional PrintersBulkBlocklistProto PrintersBulkBlocklist = 781;
  optional PrintersBulkConfigurationProto PrintersBulkConfiguration = 772;
  optional PrintingAPIExtensionsAllowlistProto PrintingAPIExtensionsAllowlist = 785;
  optional PrintingAPIExtensionsWhitelistProto PrintingAPIExtensionsWhitelist = 666;
  optional PrintingAllowedBackgroundGraphicsModesProto PrintingAllowedBackgroundGraphicsModes = 623;
  optional PrintingAllowedColorModesProto PrintingAllowedColorModes = 476;
  optional PrintingAllowedDuplexModesProto PrintingAllowedDuplexModes = 477;
  optional PrintingAllowedPinModesProto PrintingAllowedPinModes = 527;
  optional PrintingBackgroundGraphicsDefaultProto PrintingBackgroundGraphicsDefault = 624;
  optional PrintingColorDefaultProto PrintingColorDefault = 479;
  optional PrintingDuplexDefaultProto PrintingDuplexDefault = 480;
  optional PrintingEnabledProto PrintingEnabled = 14;
  optional PrintingMaxSheetsAllowedProto PrintingMaxSheetsAllowed = 694;
  optional PrintingPaperSizeDefaultProto PrintingPaperSizeDefault = 481;
  optional PrintingPinDefaultProto PrintingPinDefault = 528;
  optional PrintingSendUsernameAndFilenameEnabledProto PrintingSendUsernameAndFilenameEnabled = 508;
  optional PrivacyScreenEnabledProto PrivacyScreenEnabled = 679;
  optional ProfilePickerOnStartupAvailabilityProto ProfilePickerOnStartupAvailability = 812;
  optional ProjectorDogfoodForFamilyLinkEnabledProto ProjectorDogfoodForFamilyLinkEnabled = 982;
  optional ProjectorEnabledProto ProjectorEnabled = 937;
  optional PromotionalTabsEnabledProto PromotionalTabsEnabled = 456;
  optional PromptForDownloadLocationProto PromptForDownloadLocation = 397;
  optional PromptOnMultipleMatchingCertificatesProto PromptOnMultipleMatchingCertificates = 907;
  optional ProxyBypassListProto ProxyBypassList = 27;
  optional ProxyModeProto ProxyMode = 23;
  optional ProxyPacUrlProto ProxyPacUrl = 26;
  optional ProxyServerProto ProxyServer = 25;
  optional ProxyServerModeProto ProxyServerMode = 24;
  optional ProxySettingsProto ProxySettings = 118;
  optional QuicAllowedProto QuicAllowed = 303;
  optional QuickAnswersDefinitionEnabledProto QuickAnswersDefinitionEnabled = 920;
  optional QuickAnswersEnabledProto QuickAnswersEnabled = 919;
  optional QuickAnswersTranslationEnabledProto QuickAnswersTranslationEnabled = 921;
  optional QuickAnswersUnitConversionEnabledProto QuickAnswersUnitConversionEnabled = 922;
  optional QuickUnlockModeAllowlistProto QuickUnlockModeAllowlist = 786;
  optional QuickUnlockModeWhitelistProto QuickUnlockModeWhitelist = 354;
  optional QuickUnlockTimeoutProto QuickUnlockTimeout = 355;
  optional RC4EnabledProto RC4Enabled = 312;
  optional RecoveryFactorBehaviorProto RecoveryFactorBehavior = 1016;
  optional RegisteredProtocolHandlersProto RegisteredProtocolHandlers = 270;
  optional RelaunchHeadsUpPeriodProto RelaunchHeadsUpPeriod = 569;
  optional RelaunchNotificationProto RelaunchNotification = 421;
  optional RelaunchNotificationPeriodProto RelaunchNotificationPeriod = 422;
  optional RelaunchWindowProto RelaunchWindow = 856;
  optional RemoteAccessClientFirewallTraversalProto RemoteAccessClientFirewallTraversal = 96;
  optional RemoteAccessHostAllowClientPairingProto RemoteAccessHostAllowClientPairing = 236;
  optional RemoteAccessHostAllowFileTransferProto RemoteAccessHostAllowFileTransfer = 536;
  optional RemoteAccessHostAllowGnubbyAuthProto RemoteAccessHostAllowGnubbyAuth = 259;
  optional RemoteAccessHostAllowRelayedConnectionProto RemoteAccessHostAllowRelayedConnection = 265;
  optional RemoteAccessHostAllowRemoteAccessConnectionsProto RemoteAccessHostAllowRemoteAccessConnections = 814;
  optional RemoteAccessHostAllowRemoteSupportConnectionsProto RemoteAccessHostAllowRemoteSupportConnections = 925;
  optional RemoteAccessHostAllowUiAccessForRemoteAssistanceProto RemoteAccessHostAllowUiAccessForRemoteAssistance = 346;
  optional RemoteAccessHostClientDomainProto RemoteAccessHostClientDomain = 318;
  optional RemoteAccessHostClientDomainListProto RemoteAccessHostClientDomainList = 371;
  optional RemoteAccessHostClipboardSizeBytesProto RemoteAccessHostClipboardSizeBytes = 924;
  optional RemoteAccessHostDebugOverridePoliciesProto RemoteAccessHostDebugOverridePolicies = 291;
  optional RemoteAccessHostDomainProto RemoteAccessHostDomain = 156;
  optional RemoteAccessHostDomainListProto RemoteAccessHostDomainList = 370;
  optional RemoteAccessHostEnableUserInterfaceProto RemoteAccessHostEnableUserInterface = 805;
  optional RemoteAccessHostFirewallTraversalProto RemoteAccessHostFirewallTraversal = 97;
  optional RemoteAccessHostMatchUsernameProto RemoteAccessHostMatchUsername = 287;
  optional RemoteAccessHostMaximumSessionDurationMinutesProto RemoteAccessHostMaximumSessionDurationMinutes = 816;
  optional RemoteAccessHostRequireCurtainProto RemoteAccessHostRequireCurtain = 159;
  optional RemoteAccessHostRequireTwoFactorProto RemoteAccessHostRequireTwoFactor = 157;
  optional RemoteAccessHostTalkGadgetPrefixProto RemoteAccessHostTalkGadgetPrefix = 158;
  optional RemoteAccessHostTokenUrlProto RemoteAccessHostTokenUrl = 288;
  optional RemoteAccessHostTokenValidationCertificateIssuerProto RemoteAccessHostTokenValidationCertificateIssuer = 290;
  optional RemoteAccessHostTokenValidationUrlProto RemoteAccessHostTokenValidationUrl = 289;
  optional RemoteAccessHostUdpPortRangeProto RemoteAccessHostUdpPortRange = 266;
  optional RemoteDebuggingAllowedProto RemoteDebuggingAllowed = 866;
  optional RendererAppContainerEnabledProto RendererAppContainerEnabled = 989;
  optional RendererCodeIntegrityEnabledProto RendererCodeIntegrityEnabled = 600;
  optional ReportArcStatusEnabledProto ReportArcStatusEnabled = 351;
  optional ReportCrostiniUsageEnabledProto ReportCrostiniUsageEnabled = 486;
  optional ReportExtensionsAndPluginsDataProto ReportExtensionsAndPluginsData = 501;
  optional ReportMachineIDDataProto ReportMachineIDData = 474;
  optional ReportPolicyDataProto ReportPolicyData = 473;
  optional ReportSafeBrowsingDataProto ReportSafeBrowsingData = 502;
  optional ReportUserIDDataProto ReportUserIDData = 475;
  optional ReportVersionDataProto ReportVersionData = 472;
  optional RequireOnlineRevocationChecksForLocalAnchorsProto RequireOnlineRevocationChecksForLocalAnchors = 237;
  optional RequiredClientCertificateForUserProto RequiredClientCertificateForUser = 682;
  optional RestoreOnStartupProto RestoreOnStartup = 39;
  optional RestoreOnStartupURLsProto RestoreOnStartupURLs = 40;
  optional RestrictAccountsToPatternsProto RestrictAccountsToPatterns = 412;
  optional RestrictSigninToPatternProto RestrictSigninToPattern = 149;
  optional RestrictedManagedGuestSessionExtensionCleanupExemptListProto RestrictedManagedGuestSessionExtensionCleanupExemptList = 881;
  optional RoamingProfileLocationProto RoamingProfileLocation = 361;
  optional RoamingProfileSupportEnabledProto RoamingProfileSupportEnabled = 360;
  optional RunAllFlashInAllowModeProto RunAllFlashInAllowMode = 393;
  optional SAMLOfflineSigninTimeLimitProto SAMLOfflineSigninTimeLimit = 256;
  optional SSLErrorOverrideAllowedProto SSLErrorOverrideAllowed = 302;
  optional SSLErrorOverrideAllowedForOriginsProto SSLErrorOverrideAllowedForOrigins = 821;
  optional SSLVersionFallbackMinProto SSLVersionFallbackMin = 282;
  optional SSLVersionMaxProto SSLVersionMax = 363;
  optional SSLVersionMinProto SSLVersionMin = 281;
  optional SafeBrowsingAllowlistDomainsProto SafeBrowsingAllowlistDomains = 734;
  optional SafeBrowsingEnabledProto SafeBrowsingEnabled = 16;
  optional SafeBrowsingExtendedReportingEnabledProto SafeBrowsingExtendedReportingEnabled = 431;
  optional SafeBrowsingExtendedReportingOptInAllowedProto SafeBrowsingExtendedReportingOptInAllowed = 301;
  optional SafeBrowsingForTrustedSourcesEnabledProto SafeBrowsingForTrustedSourcesEnabled = 377;
  optional SafeBrowsingProtectionLevelProto SafeBrowsingProtectionLevel = 686;
  optional SafeBrowsingWhitelistDomainsProto SafeBrowsingWhitelistDomains = 424;
  optional SafeSitesFilterBehaviorProto SafeSitesFilterBehavior = 457;
  optional SameOriginTabCaptureAllowedByOriginsProto SameOriginTabCaptureAllowedByOrigins = 886;
  optional SamlInSessionPasswordChangeEnabledProto SamlInSessionPasswordChangeEnabled = 547;
  optional SamlLockScreenOfflineSigninTimeLimitDaysProto SamlLockScreenOfflineSigninTimeLimitDays = 836;
  optional SamlPasswordExpirationAdvanceWarningDaysProto SamlPasswordExpirationAdvanceWarningDays = 557;
  optional SandboxExternalProtocolBlockedProto SandboxExternalProtocolBlocked = 915;
  optional SavingBrowserHistoryDisabledProto SavingBrowserHistoryDisabled = 13;
  optional SchedulerConfigurationProto SchedulerConfiguration = 524;
  optional ScreenBrightnessPercentProto ScreenBrightnessPercent = 494;
  optional ScreenCaptureAllowedProto ScreenCaptureAllowed = 668;
  optional ScreenCaptureAllowedByOriginsProto ScreenCaptureAllowedByOrigins = 883;
  optional ScreenDimDelayACProto ScreenDimDelayAC = 174;
  optional ScreenDimDelayBatteryProto ScreenDimDelayBattery = 178;
  optional ScreenLockDelayACProto ScreenLockDelayAC = 176;
  optional ScreenLockDelayBatteryProto ScreenLockDelayBattery = 180;
  optional ScreenLockDelaysProto ScreenLockDelays = 261;
  optional ScreenMagnifierTypeProto ScreenMagnifierType = 216;
  optional ScreenOffDelayACProto ScreenOffDelayAC = 175;
  optional ScreenOffDelayBatteryProto ScreenOffDelayBattery = 179;
  optional ScrollToTextFragmentEnabledProto ScrollToTextFragmentEnabled = 689;
  optional SearchSuggestEnabledProto SearchSuggestEnabled = 8;
  optional SecondaryGoogleAccountSigninAllowedProto SecondaryGoogleAccountSigninAllowed = 408;
  optional SecondaryGoogleAccountUsageProto SecondaryGoogleAccountUsage = 958;
  optional SecurityKeyPermitAttestationProto SecurityKeyPermitAttestation = 404;
  optional SecurityTokenSessionBehaviorProto SecurityTokenSessionBehavior = 801;
  optional SecurityTokenSessionNotificationSecondsProto SecurityTokenSessionNotificationSeconds = 802;
  optional SelectToSpeakEnabledProto SelectToSpeakEnabled = 575;
  optional SendMouseEventsDisabledFormControlsEnabledProto SendMouseEventsDisabledFormControlsEnabled = 1034;
  optional SensorsAllowedForUrlsProto SensorsAllowedForUrls = 757;
  optional SensorsBlockedForUrlsProto SensorsBlockedForUrls = 758;
  optional SerialAllowAllPortsForUrlsProto SerialAllowAllPortsForUrls = 839;
  optional SerialAllowUsbDevicesForUrlsProto SerialAllowUsbDevicesForUrls = 840;
  optional SerialAskForUrlsProto SerialAskForUrls = 754;
  optional SerialBlockedForUrlsProto SerialBlockedForUrls = 755;
  optional SessionLengthLimitProto SessionLengthLimit = 172;
  optional SessionLocalesProto SessionLocales = 276;
  optional SetTimeoutWithout1MsClampEnabledProto SetTimeoutWithout1MsClampEnabled = 969;
  optional SharedArrayBufferUnrestrictedAccessAllowedProto SharedArrayBufferUnrestrictedAccessAllowed = 854;
  optional SharedClipboardEnabledProto SharedClipboardEnabled = 612;
  optional ShelfAlignmentProto ShelfAlignment = 622;
  optional ShelfAutoHideBehaviorProto ShelfAutoHideBehavior = 168;
  optional ShoppingListEnabledProto ShoppingListEnabled = 1020;
  optional ShowAccessibilityOptionsInSystemTrayMenuProto ShowAccessibilityOptionsInSystemTrayMenu = 190;
  optional ShowAppsShortcutInBookmarkBarProto ShowAppsShortcutInBookmarkBar = 269;
  optional ShowCastIconInToolbarProto ShowCastIconInToolbar = 364;
  optional ShowFullUrlsInAddressBarProto ShowFullUrlsInAddressBar = 741;
  optional ShowHomeButtonProto ShowHomeButton = 37;
  optional ShowLogoutButtonInTrayProto ShowLogoutButtonInTray = 166;
  optional SideSearchEnabledProto SideSearchEnabled = 908;
  optional SignedHTTPExchangeEnabledProto SignedHTTPExchangeEnabled = 544;
  optional SigninAllowedProto SigninAllowed = 192;
  optional SigninInterceptionEnabledProto SigninInterceptionEnabled = 813;
  optional SitePerProcessProto SitePerProcess = 401;
  optional SitePerProcessAndroidProto SitePerProcessAndroid = 448;
  optional SmartLockSigninAllowedProto SmartLockSigninAllowed = 490;
  optional SmsMessagesAllowedProto SmsMessagesAllowed = 471;
  optional SpellCheckServiceEnabledProto SpellCheckServiceEnabled = 153;
  optional SpellcheckEnabledProto SpellcheckEnabled = 410;
  optional SpellcheckLanguageProto SpellcheckLanguage = 407;
  optional SpellcheckLanguageBlacklistProto SpellcheckLanguageBlacklist = 538;
  optional SpellcheckLanguageBlocklistProto SpellcheckLanguageBlocklist = 751;
  optional SpokenFeedbackEnabledProto SpokenFeedbackEnabled = 214;
  optional StartupBrowserWindowLaunchSuppressedProto StartupBrowserWindowLaunchSuppressed = 570;
  optional StickyKeysEnabledProto StickyKeysEnabled = 563;
  optional StrictMimetypeCheckForWorkerScriptsEnabledProto StrictMimetypeCheckForWorkerScriptsEnabled = 1015;
  optional StricterMixedContentTreatmentEnabledProto StricterMixedContentTreatmentEnabled = 654;
  optional SuggestLogoutAfterClosingLastWindowProto SuggestLogoutAfterClosingLastWindow = 853;
  optional SuggestedContentEnabledProto SuggestedContentEnabled = 728;
  optional SupervisedUserContentProviderEnabledProto SupervisedUserContentProviderEnabled = 314;
  optional SupervisedUserCreationEnabledProto SupervisedUserCreationEnabled = 225;
  optional SuppressDifferentOriginSubframeDialogsProto SuppressDifferentOriginSubframeDialogs = 831;
  optional SuppressUnsupportedOSWarningProto SuppressUnsupportedOSWarning = 326;
  optional SyncDisabledProto SyncDisabled = 22;
  optional SyncTypesListDisabledProto SyncTypesListDisabled = 651;
  optional SystemFeaturesDisableListProto SystemFeaturesDisableList = 691;
  optional SystemFeaturesDisableModeProto SystemFeaturesDisableMode = 809;
  optional SystemTerminalSshAllowedProto SystemTerminalSshAllowed = 976;
  optional TLS13HardeningForLocalAnchorsEnabledProto TLS13HardeningForLocalAnchorsEnabled = 628;
  optional TabCaptureAllowedByOriginsProto TabCaptureAllowedByOrigins = 885;
  optional TabDiscardingExceptionsProto TabDiscardingExceptions = 1012;
  optional TabFreezingEnabledProto TabFreezingEnabled = 462;
  optional TabUnderAllowedProto TabUnderAllowed = 434;
  optional TargetBlankImpliesNoOpenerProto TargetBlankImpliesNoOpener = 804;
  optional TaskManagerEndProcessEnabledProto TaskManagerEndProcessEnabled = 329;
  optional TermsOfServiceURLProto TermsOfServiceURL = 188;
  optional ThirdPartyBlockingEnabledProto ThirdPartyBlockingEnabled = 409;
  optional ThrottleNonVisibleCrossOriginIframesAllowedProto ThrottleNonVisibleCrossOriginIframesAllowed = 1039;
  optional TosDialogBehaviorProto TosDialogBehavior = 803;
  optional TotalMemoryLimitMbProto TotalMemoryLimitMb = 618;
  optional TouchVirtualKeyboardEnabledProto TouchVirtualKeyboardEnabled = 271;
  optional TranslateEnabledProto TranslateEnabled = 82;
  optional TrashEnabledProto TrashEnabled = 1019;
  optional TripleDESEnabledProto TripleDESEnabled = 860;
  optional U2fSecurityKeyApiEnabledProto U2fSecurityKeyApiEnabled = 905;
  optional URLAllowlistProto URLAllowlist = 739;
  optional URLBlacklistProto URLBlacklist = 105;
  optional URLBlocklistProto URLBlocklist = 738;
  optional URLWhitelistProto URLWhitelist = 106;
  optional UnifiedDesktopEnabledByDefaultProto UnifiedDesktopEnabledByDefault = 309;
  optional UnmanagedDeviceSignalsConsentFlowEnabledProto UnmanagedDeviceSignalsConsentFlowEnabled = 1003;
  optional UnsafelyTreatInsecureOriginAsSecureProto UnsafelyTreatInsecureOriginAsSecure = 402;
  optional UnthrottledNestedTimeoutEnabledProto UnthrottledNestedTimeoutEnabled = 990;
  optional UrlKeyedAnonymizedDataCollectionEnabledProto UrlKeyedAnonymizedDataCollectionEnabled = 463;
  optional UrlParamFilterEnabledProto UrlParamFilterEnabled = 983;
  optional UsageTimeLimitProto UsageTimeLimit = 450;
  optional UseLegacyFormControlsProto UseLegacyFormControls = 685;
  optional UserActivityScreenDimDelayScaleProto UserActivityScreenDimDelayScale = 212;
  optional UserAgentClientHintsEnabledProto UserAgentClientHintsEnabled = 727;
  optional UserAgentClientHintsGREASEUpdateEnabledProto UserAgentClientHintsGREASEUpdateEnabled = 926;
  optional UserAgentReductionProto UserAgentReduction = 934;
  optional UserAvatarImageProto UserAvatarImage = 251;
  optional UserBorealisAllowedProto UserBorealisAllowed = 833;
  optional UserDataDirProto UserDataDir = 65;
  optional UserDataSnapshotRetentionLimitProto UserDataSnapshotRetentionLimit = 675;
  optional UserDisplayNameProto UserDisplayName = 171;
  optional UserFeedbackAllowedProto UserFeedbackAllowed = 572;
  optional UserNativePrintersAllowedProto UserNativePrintersAllowed = 435;
  optional UserPluginVmAllowedProto UserPluginVmAllowed = 707;
  optional UserPrintersAllowedProto UserPrintersAllowed = 770;
  optional VariationsRestrictParameterProto VariationsRestrictParameter = 198;
  optional VideoCaptureAllowedProto VideoCaptureAllowed = 169;
  optional VideoCaptureAllowedUrlsProto VideoCaptureAllowedUrls = 211;
  optional VirtualKeyboardEnabledProto VirtualKeyboardEnabled = 257;
  optional VirtualKeyboardFeaturesProto VirtualKeyboardFeatures = 719;
  optional VirtualKeyboardResizesLayoutByDefaultProto VirtualKeyboardResizesLayoutByDefault = 1026;
  optional VmManagementCliAllowedProto VmManagementCliAllowed = 579;
  optional VoiceInteractionContextEnabledProto VoiceInteractionContextEnabled = 529;
  optional VoiceInteractionHotwordEnabledProto VoiceInteractionHotwordEnabled = 531;
  optional VoiceInteractionQuickAnswersEnabledProto VoiceInteractionQuickAnswersEnabled = 696;
  optional VpnConfigAllowedProto VpnConfigAllowed = 487;
  optional WPADQuickCheckEnabledProto WPADQuickCheckEnabled = 263;
  optional WaitForInitialUserActivityProto WaitForInitialUserActivity = 249;
  optional WallpaperImageProto WallpaperImage = 264;
  optional WarnBeforeQuittingEnabledProto WarnBeforeQuittingEnabled = 975;
  optional WebAppInstallForceListProto WebAppInstallForceList = 470;
  optional WebAppSettingsProto WebAppSettings = 826;
  optional WebAuthenticationRemoteProxiedRequestsAllowedProto WebAuthenticationRemoteProxiedRequestsAllowed = 967;
  optional WebAuthnFactorsProto WebAuthnFactors = 966;
  optional WebComponentsV0EnabledProto WebComponentsV0Enabled = 646;
  optional WebDriverOverridesIncompatiblePoliciesProto WebDriverOverridesIncompatiblePolicies = 416;
  optional WebHidAllowAllDevicesForUrlsProto WebHidAllowAllDevicesForUrls = 955;
  optional WebHidAllowDevicesForUrlsProto WebHidAllowDevicesForUrls = 956;
  optional WebHidAllowDevicesWithHidUsagesForUrlsProto WebHidAllowDevicesWithHidUsagesForUrls = 957;
  optional WebHidAskForUrlsProto WebHidAskForUrls = 946;
  optional WebHidBlockedForUrlsProto WebHidBlockedForUrls = 947;
  optional WebRtcAllowLegacyTLSProtocolsProto WebRtcAllowLegacyTLSProtocols = 789;
  optional WebRtcEventLogCollectionAllowedProto WebRtcEventLogCollectionAllowed = 466;
  optional WebRtcIPHandlingProto WebRtcIPHandling = 845;
  optional WebRtcLocalIpsAllowedUrlsProto WebRtcLocalIpsAllowedUrls = 642;
  optional WebRtcUdpPortRangeProto WebRtcUdpPortRange = 341;
  optional WebSQLAccessProto WebSQLAccess = 968;
  optional WebSQLInThirdPartyContextEnabledProto WebSQLInThirdPartyContextEnabled = 904;
  optional WebSQLNonSecureContextEnabledProto WebSQLNonSecureContextEnabled = 995;
  optional WebUsbAllowDevicesForUrlsProto WebUsbAllowDevicesForUrls = 488;
  optional WebUsbAskForUrlsProto WebUsbAskForUrls = 441;
  optional WebUsbBlockedForUrlsProto WebUsbBlockedForUrls = 442;
  optional WebXRImmersiveArEnabledProto WebXRImmersiveArEnabled = 822;
  optional WelcomePageOnOSUpgradeEnabledProto WelcomePageOnOSUpgradeEnabled = 305;
  optional WifiSyncAndroidAllowedProto WifiSyncAndroidAllowed = 800;
  optional WindowCaptureAllowedByOriginsProto WindowCaptureAllowedByOrigins = 884;
  optional WindowOcclusionEnabledProto WindowOcclusionEnabled = 819;
  optional WindowPlacementAllowedForUrlsProto WindowPlacementAllowedForUrls = 962;
  optional WindowPlacementBlockedForUrlsProto WindowPlacementBlockedForUrls = 963;
  optional ChromeSettingsSubProto1 subProto1 = 1043;
}