@openkaiden/opnshll-sdk 0.0.110 → 0.0.113

package/dist/gen/openshell_pb.d.ts

@@ -362,6 +362,20 @@ export type SandboxSpec = Message<"openshell.v1.SandboxSpec"> & {
      * @generated from field: openshell.v1.ResourceRequirements resource_requirements = 9;
      */
     resourceRequirements?: ResourceRequirements | undefined;
+    /**
+     * Canonical command launched once by the sandbox supervisor. No shell
+     * parsing is performed. The gateway normalizes an omitted command to the
+     * portable scratch login shell before persistence.
+     *
+     * @generated from field: repeated string command = 12;
+     */
+    command: string[];
+    /**
+     * Allocate a retained pseudo-terminal for the main process.
+     *
+     * @generated from field: bool tty = 13;
+     */
+    tty: boolean;
 };
 /**
  * Describes the message openshell.v1.SandboxSpec.
@@ -532,6 +546,20 @@ export type SandboxStatus = Message<"openshell.v1.SandboxStatus"> & {
      * @generated from field: uint32 current_policy_version = 7;
      */
     currentPolicyVersion: number;
+    /**
+     * Supervisor instance currently associated with the canonical main process.
+     * The gateway uses this to reject stale exit reports after a restart.
+     *
+     * @generated from field: string main_process_instance_id = 8;
+     */
+    mainProcessInstanceId: string;
+    /**
+     * Normalized main process result. Signal exits use 128 + signal number.
+     * Presence indicates that the main process exited and the sandbox is in Error.
+     *
+     * @generated from field: optional int32 exit_code = 9;
+     */
+    exitCode?: number | undefined;
 };
 /**
  * Describes the message openshell.v1.SandboxStatus.
@@ -2224,9 +2252,36 @@ export type ProviderCredentialTokenGrantAudienceOverride = Message<"openshell.v1
  */
 export declare const ProviderCredentialTokenGrantAudienceOverrideSchema: GenMessage<ProviderCredentialTokenGrantAudienceOverride>;
 /**
- * Provider credential token grant configuration.
- * When present, the credential is obtained dynamically via OAuth2 grant when needed.
- *
+ * @generated from message openshell.v1.ProviderCredentialTokenGrantSubjectToken
+ */
+export type ProviderCredentialTokenGrantSubjectToken = Message<"openshell.v1.ProviderCredentialTokenGrantSubjectToken"> & {
+    /**
+     * Source for the token exchange subject token. Phase one supports
+     * "provider_credential".
+     *
+     * @generated from field: string source = 1;
+     */
+    source: string;
+    /**
+     * Provider credential key that stores the subject token.
+     *
+     * @generated from field: string credential = 2;
+     */
+    credential: string;
+    /**
+     * OAuth2 subject_token_type. If omitted, OpenShell uses
+     * urn:ietf:params:oauth:token-type:access_token.
+     *
+     * @generated from field: string subject_token_type = 3;
+     */
+    subjectTokenType: string;
+};
+/**
+ * Describes the message openshell.v1.ProviderCredentialTokenGrantSubjectToken.
+ * Use `create(ProviderCredentialTokenGrantSubjectTokenSchema)` to create a new message.
+ */
+export declare const ProviderCredentialTokenGrantSubjectTokenSchema: GenMessage<ProviderCredentialTokenGrantSubjectToken>;
+/**
  * @generated from message openshell.v1.ProviderCredentialTokenGrant
  */
 export type ProviderCredentialTokenGrant = Message<"openshell.v1.ProviderCredentialTokenGrant"> & {
@@ -2275,6 +2330,26 @@ export type ProviderCredentialTokenGrant = Message<"openshell.v1.ProviderCredent
      * @generated from field: string client_assertion_type = 7;
      */
     clientAssertionType: string;
+    /**
+     * Grant type. If omitted/unspecified, OpenShell treats this as client_credentials
+     * for backwards compatibility.
+     *
+     * @generated from field: openshell.v1.ProviderCredentialTokenGrantType grant_type = 8;
+     */
+    grantType: ProviderCredentialTokenGrantType;
+    /**
+     * Subject token metadata for token_exchange grants.
+     *
+     * @generated from field: openshell.v1.ProviderCredentialTokenGrantSubjectToken subject_token = 9;
+     */
+    subjectToken?: ProviderCredentialTokenGrantSubjectToken | undefined;
+    /**
+     * OAuth2 requested_token_type. If omitted for token_exchange, OpenShell uses
+     * urn:ietf:params:oauth:token-type:access_token.
+     *
+     * @generated from field: string requested_token_type = 10;
+     */
+    requestedTokenType: string;
 };
 /**
  * Describes the message openshell.v1.ProviderCredentialTokenGrant.
@@ -3287,6 +3362,63 @@ export type GetSandboxProviderEnvironmentResponse = Message<"openshell.v1.GetSan
  * Use `create(GetSandboxProviderEnvironmentResponseSchema)` to create a new message.
  */
 export declare const GetSandboxProviderEnvironmentResponseSchema: GenMessage<GetSandboxProviderEnvironmentResponse>;
+/**
+ * @generated from message openshell.v1.ExchangeProviderSubjectTokenRequest
+ */
+export type ExchangeProviderSubjectTokenRequest = Message<"openshell.v1.ExchangeProviderSubjectTokenRequest"> & {
+    /**
+     * The sandbox ID. Must match the authenticated sandbox principal.
+     *
+     * @generated from field: string sandbox_id = 1;
+     */
+    sandboxId: string;
+    /**
+     * Attached provider record holding the configured subject token credential.
+     *
+     * @generated from field: string provider = 2;
+     */
+    provider: string;
+    /**
+     * Provider profile credential that declares the token_exchange grant.
+     *
+     * @generated from field: string credential_key = 3;
+     */
+    credentialKey: string;
+    /**
+     * Supervisor JWT-SVID. The gateway verifies this and uses its `sub` claim
+     * as the requested audience for the intermediate token.
+     *
+     * @generated from field: string supervisor_jwt_svid = 4;
+     */
+    supervisorJwtSvid: string;
+};
+/**
+ * Describes the message openshell.v1.ExchangeProviderSubjectTokenRequest.
+ * Use `create(ExchangeProviderSubjectTokenRequestSchema)` to create a new message.
+ */
+export declare const ExchangeProviderSubjectTokenRequestSchema: GenMessage<ExchangeProviderSubjectTokenRequest>;
+/**
+ * @generated from message openshell.v1.ExchangeProviderSubjectTokenResponse
+ */
+export type ExchangeProviderSubjectTokenResponse = Message<"openshell.v1.ExchangeProviderSubjectTokenResponse"> & {
+    /**
+     * @generated from field: string access_token = 1;
+     */
+    accessToken: string;
+    /**
+     * @generated from field: int64 expires_in = 2;
+     */
+    expiresIn: bigint;
+    /**
+     * @generated from field: string token_type = 3;
+     */
+    tokenType: string;
+};
+/**
+ * Describes the message openshell.v1.ExchangeProviderSubjectTokenResponse.
+ * Use `create(ExchangeProviderSubjectTokenResponseSchema)` to create a new message.
+ */
+export declare const ExchangeProviderSubjectTokenResponseSchema: GenMessage<ExchangeProviderSubjectTokenResponse>;
 /**
  * Update sandbox policy request.
  *
@@ -4102,6 +4234,42 @@ export type GatewayHeartbeat = Message<"openshell.v1.GatewayHeartbeat"> & {};
  * Use `create(GatewayHeartbeatSchema)` to create a new message.
  */
 export declare const GatewayHeartbeatSchema: GenMessage<GatewayHeartbeat>;
+/**
+ * Terminal result reported before the supervisor shuts down. A successful RPC
+ * response confirms that the result was durably handled by the gateway.
+ *
+ * @generated from message openshell.v1.ReportMainProcessExitRequest
+ */
+export type ReportMainProcessExitRequest = Message<"openshell.v1.ReportMainProcessExitRequest"> & {
+    /**
+     * @generated from field: string sandbox_id = 1;
+     */
+    sandboxId: string;
+    /**
+     * @generated from field: string instance_id = 2;
+     */
+    instanceId: string;
+    /**
+     * Normalized process result. Signal exits use 128 + signal number.
+     *
+     * @generated from field: int32 exit_code = 3;
+     */
+    exitCode: number;
+};
+/**
+ * Describes the message openshell.v1.ReportMainProcessExitRequest.
+ * Use `create(ReportMainProcessExitRequestSchema)` to create a new message.
+ */
+export declare const ReportMainProcessExitRequestSchema: GenMessage<ReportMainProcessExitRequest>;
+/**
+ * @generated from message openshell.v1.ReportMainProcessExitResponse
+ */
+export type ReportMainProcessExitResponse = Message<"openshell.v1.ReportMainProcessExitResponse"> & {};
+/**
+ * Describes the message openshell.v1.ReportMainProcessExitResponse.
+ * Use `create(ReportMainProcessExitResponseSchema)` to create a new message.
+ */
+export declare const ReportMainProcessExitResponseSchema: GenMessage<ReportMainProcessExitResponse>;
 /**
  * Gateway requests the supervisor to open a relay channel.
  *
@@ -4618,6 +4786,42 @@ export type PolicyChunk = Message<"openshell.v1.PolicyChunk"> & {
      * @generated from field: string rejection_reason = 18;
      */
     rejectionReason: string;
+    /**
+     * Gateway-side merge/application preflight failure. Kept separate from
+     * prover output and operator rejection so clients can explain why a
+     * prover-clean proposal is not currently applicable.
+     *
+     * @generated from field: string application_error = 19;
+     */
+    applicationError: string;
+    /**
+     * Opaque digest binding review to the exact live inputs and complete
+     * effective candidate evaluated by the gateway.
+     *
+     * @generated from field: string review_token = 20;
+     */
+    reviewToken: string;
+    /**
+     * Deterministic hashes for compact candidate display and diagnostics.
+     *
+     * @generated from field: string current_effective_policy_hash = 21;
+     */
+    currentEffectivePolicyHash: string;
+    /**
+     * @generated from field: string candidate_effective_policy_hash = 22;
+     */
+    candidateEffectivePolicyHash: string;
+    /**
+     * Complete effective policies used for review. These contain policy
+     * configuration only; credential secret values are never materialized.
+     *
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy current_effective_policy = 23;
+     */
+    currentEffectivePolicy?: SandboxPolicy | undefined;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy candidate_effective_policy = 24;
+     */
+    candidateEffectivePolicy?: SandboxPolicy | undefined;
 };
 /**
  * Describes the message openshell.v1.PolicyChunk.
@@ -4838,6 +5042,13 @@ export type ApproveDraftChunkRequest = Message<"openshell.v1.ApproveDraftChunkRe
      * @generated from field: string workspace = 3;
      */
     workspace: string;
+    /**
+     * Token returned with the reviewed PolicyChunk. Approval fails with
+     * FAILED_PRECONDITION if live decision inputs no longer match it.
+     *
+     * @generated from field: string review_token = 4;
+     */
+    reviewToken: string;
 };
 /**
  * Describes the message openshell.v1.ApproveDraftChunkRequest.
@@ -4914,6 +5125,24 @@ export declare const RejectDraftChunkResponseSchema: GenMessage<RejectDraftChunk
 /**
  * Approve all pending chunks.
  *
+ * @generated from message openshell.v1.DraftChunkApproval
+ */
+export type DraftChunkApproval = Message<"openshell.v1.DraftChunkApproval"> & {
+    /**
+     * @generated from field: string chunk_id = 1;
+     */
+    chunkId: string;
+    /**
+     * @generated from field: string review_token = 2;
+     */
+    reviewToken: string;
+};
+/**
+ * Describes the message openshell.v1.DraftChunkApproval.
+ * Use `create(DraftChunkApprovalSchema)` to create a new message.
+ */
+export declare const DraftChunkApprovalSchema: GenMessage<DraftChunkApproval>;
+/**
  * @generated from message openshell.v1.ApproveAllDraftChunksRequest
  */
 export type ApproveAllDraftChunksRequest = Message<"openshell.v1.ApproveAllDraftChunksRequest"> & {
@@ -4935,6 +5164,13 @@ export type ApproveAllDraftChunksRequest = Message<"openshell.v1.ApproveAllDraft
      * @generated from field: string workspace = 3;
      */
     workspace: string;
+    /**
+     * Exact reviewed chunks and tokens. The server validates them against one
+     * live snapshot, stages compatible operations in order, and writes once.
+     *
+     * @generated from field: repeated openshell.v1.DraftChunkApproval approvals = 4;
+     */
+    approvals: DraftChunkApproval[];
 };
 /**
  * Describes the message openshell.v1.ApproveAllDraftChunksRequest.
@@ -4964,7 +5200,8 @@ export type ApproveAllDraftChunksResponse = Message<"openshell.v1.ApproveAllDraf
      */
     chunksApproved: number;
     /**
-     * Number of chunks skipped (security-flagged).
+     * Number of chunks skipped for any reason, including security flags,
+     * stale or invalid candidates, and conflicts within the staged batch.
      *
      * @generated from field: uint32 chunks_skipped = 4;
      */
@@ -5311,6 +5548,30 @@ export type DraftChunkPayload = Message<"openshell.v1.DraftChunkPayload"> & {
      * @generated from field: string rejection_reason = 12;
      */
     rejectionReason: string;
+    /**
+     * @generated from field: string application_error = 13;
+     */
+    applicationError: string;
+    /**
+     * @generated from field: string review_token = 14;
+     */
+    reviewToken: string;
+    /**
+     * @generated from field: string current_effective_policy_hash = 15;
+     */
+    currentEffectivePolicyHash: string;
+    /**
+     * @generated from field: string candidate_effective_policy_hash = 16;
+     */
+    candidateEffectivePolicyHash: string;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy current_effective_policy = 17;
+     */
+    currentEffectivePolicy?: SandboxPolicy | undefined;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy candidate_effective_policy = 18;
+     */
+    candidateEffectivePolicy?: SandboxPolicy | undefined;
 };
 /**
  * Describes the message openshell.v1.DraftChunkPayload.
@@ -5457,6 +5718,30 @@ export type StoredDraftChunk = Message<"openshell.v1.StoredDraftChunk"> & {
      * @generated from field: string rejection_reason = 19;
      */
     rejectionReason: string;
+    /**
+     * @generated from field: string application_error = 20;
+     */
+    applicationError: string;
+    /**
+     * @generated from field: string review_token = 21;
+     */
+    reviewToken: string;
+    /**
+     * @generated from field: string current_effective_policy_hash = 22;
+     */
+    currentEffectivePolicyHash: string;
+    /**
+     * @generated from field: string candidate_effective_policy_hash = 23;
+     */
+    candidateEffectivePolicyHash: string;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy current_effective_policy = 24;
+     */
+    currentEffectivePolicy?: SandboxPolicy | undefined;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy candidate_effective_policy = 25;
+     */
+    candidateEffectivePolicy?: SandboxPolicy | undefined;
 };
 /**
  * Describes the message openshell.v1.StoredDraftChunk.
@@ -5854,6 +6139,30 @@ export declare enum SandboxPhase {
  * Describes the enum openshell.v1.SandboxPhase.
  */
 export declare const SandboxPhaseSchema: GenEnum<SandboxPhase>;
+/**
+ * Provider credential token grant configuration.
+ * When present, the credential is obtained dynamically via OAuth2 grant when needed.
+ *
+ * @generated from enum openshell.v1.ProviderCredentialTokenGrantType
+ */
+export declare enum ProviderCredentialTokenGrantType {
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_CLIENT_CREDENTIALS = 1;
+     */
+    CLIENT_CREDENTIALS = 1,
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_TOKEN_EXCHANGE = 2;
+     */
+    TOKEN_EXCHANGE = 2
+}
+/**
+ * Describes the enum openshell.v1.ProviderCredentialTokenGrantType.
+ */
+export declare const ProviderCredentialTokenGrantTypeSchema: GenEnum<ProviderCredentialTokenGrantType>;
 /**
  * @generated from enum openshell.v1.ProviderCredentialRefreshStrategy
  */
@@ -6475,6 +6784,17 @@ export declare const OpenShell: GenService<{
         input: typeof GetSandboxProviderEnvironmentRequestSchema;
         output: typeof GetSandboxProviderEnvironmentResponseSchema;
     };
+    /**
+     * Exchange a stored provider subject token for an intermediate token scoped
+     * to the calling supervisor's SPIFFE identity.
+     *
+     * @generated from rpc openshell.v1.OpenShell.ExchangeProviderSubjectToken
+     */
+    exchangeProviderSubjectToken: {
+        methodKind: "unary";
+        input: typeof ExchangeProviderSubjectTokenRequestSchema;
+        output: typeof ExchangeProviderSubjectTokenResponseSchema;
+    };
     /**
      * Fetch recent sandbox logs (one-shot).
      *
@@ -6511,6 +6831,16 @@ export declare const OpenShell: GenService<{
         input: typeof SupervisorMessageSchema;
         output: typeof GatewayMessageSchema;
     };
+    /**
+     * Persist the canonical main process result before the supervisor exits.
+     *
+     * @generated from rpc openshell.v1.OpenShell.ReportMainProcessExit
+     */
+    reportMainProcessExit: {
+        methodKind: "unary";
+        input: typeof ReportMainProcessExitRequestSchema;
+        output: typeof ReportMainProcessExitResponseSchema;
+    };
     /**
      * Raw byte relay between supervisor and gateway.
      *