@openkaiden/opnshll-sdk 0.0.111 → 0.0.115

package/dist/client.d.ts

@@ -434,6 +434,11 @@ export declare class SandboxClient {
             input: typeof import("./gen/openshell_pb.js").GetSandboxProviderEnvironmentRequestSchema;
             output: typeof import("./gen/openshell_pb.js").GetSandboxProviderEnvironmentResponseSchema;
         };
+        exchangeProviderSubjectToken: {
+            methodKind: "unary";
+            input: typeof import("./gen/openshell_pb.js").ExchangeProviderSubjectTokenRequestSchema;
+            output: typeof import("./gen/openshell_pb.js").ExchangeProviderSubjectTokenResponseSchema;
+        };
         getSandboxLogs: {
             methodKind: "unary";
             input: typeof import("./gen/openshell_pb.js").GetSandboxLogsRequestSchema;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAgB,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,SAAS,EAAe,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG/D,OAAO,EACL,KAAK,sBAAsB,EAC3B,SAAS,EACT,YAAY,EACZ,KAAK,iBAAiB,EACtB,aAAa,EACb,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAA8C,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEpH,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKrE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,CAAC;AAarB,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,cAAc,GACd,OAAO,GACP,OAAO,GACP,UAAU,GACV,SAAS,GACT,UAAU,GACV,SAAS,GACT,UAAU,CAAC;AAEf,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;AAEhF,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO,iBAAiB,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,gBAAgB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG,aAAa,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAMD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,KAAK,IAAI,IAAI,CAAC;IACd,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACvB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CAC/C;AAKD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,4CAA4C;IAC5C,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC/C,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,YAAY,EAAE,gBAAgB,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gCAAgC;IAChC,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,gEAAgE;IAChE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAMD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAU9D,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,CAK5D,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAI9D,CAAC;AACF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAItE,CAAC;AA0JF,qBAAa,QAAQ,CAAC,CAAC,CAAE,YAAW,aAAa,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGhB;IACR,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAErB,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI;IAUpB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI;IAYnB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC;CAsBlD;AAOD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2B;IAEhD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;IACvC,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;gBAKlB,SAAS,EAAE,SAAS,EAAE,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAAqC;IAM3E;;;OAGG;WACU,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAI/D,MAAM,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IA4B9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IASjE,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAazD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYtC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB/F,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1F,UAAU,CACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAC3B,cAAc,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC;IA4CxC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;IAyBxF,eAAe,CACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,sBAAsB,GAAG,IAAI,GACtC,OAAO,CAAC,sBAAsB,CAAC;IAiH5B,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;YA2G3D,iBAAiB;IAkFzB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAqBnD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASjD,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,GACrC,OAAO,CAAC,cAAc,CAAC;IAapB,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,GACrC,OAAO,CAAC,cAAc,CAAC;IAapB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IASnD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAc1E,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gBAAgB,CAAC,OAAO,mBAAmB,CAAC,EACpD,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAChC,OAAO,CAAC,kBAAkB,CAAC;IAkBxB,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,gBAAgB,CAAC,OAAO,kBAAkB,CAAC,GACjD,OAAO,CAAC,kBAAkB,CAAC;YAiBhB,iBAAiB;CAqBhC;AAID,qBAAa,eAAe;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;IACvC,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2B;IAEhD,OAAO;IAQP;;;OAGG;WACU,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAKjE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAQhC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAgB,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,SAAS,EAAe,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG/D,OAAO,EACL,KAAK,sBAAsB,EAC3B,SAAS,EACT,YAAY,EACZ,KAAK,iBAAiB,EACtB,aAAa,EACb,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAA8C,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEpH,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKrE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,CAAC;AAarB,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,cAAc,GACd,OAAO,GACP,OAAO,GACP,UAAU,GACV,SAAS,GACT,UAAU,GACV,SAAS,GACT,UAAU,CAAC;AAEf,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;AAEhF,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO,iBAAiB,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,gBAAgB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG,aAAa,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAMD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,KAAK,IAAI,IAAI,CAAC;IACd,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACvB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CAC/C;AAKD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,4CAA4C;IAC5C,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC/C,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,YAAY,EAAE,gBAAgB,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gCAAgC;IAChC,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,gEAAgE;IAChE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAMD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAU9D,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,CAK5D,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAI9D,CAAC;AACF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAItE,CAAC;AA0JF,qBAAa,QAAQ,CAAC,CAAC,CAAE,YAAW,aAAa,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGhB;IACR,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAErB,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI;IAUpB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI;IAYnB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC;CAsBlD;AAOD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2B;IAEhD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;IACvC,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;gBAKlB,SAAS,EAAE,SAAS,EAAE,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAAqC;IAM3E;;;OAGG;WACU,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAI/D,MAAM,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IA4B9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IASjE,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAazD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYtC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB/F,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1F,UAAU,CACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAC3B,cAAc,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC;IA4CxC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;IAyBxF,eAAe,CACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,sBAAsB,GAAG,IAAI,GACtC,OAAO,CAAC,sBAAsB,CAAC;IAiH5B,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;YA2G3D,iBAAiB;IAkFzB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAqBnD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASjD,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,GACrC,OAAO,CAAC,cAAc,CAAC;IAapB,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,GACrC,OAAO,CAAC,cAAc,CAAC;IAapB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IASnD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAc1E,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gBAAgB,CAAC,OAAO,mBAAmB,CAAC,EACpD,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAChC,OAAO,CAAC,kBAAkB,CAAC;IAkBxB,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,gBAAgB,CAAC,OAAO,kBAAkB,CAAC,GACjD,OAAO,CAAC,kBAAkB,CAAC;YAiBhB,iBAAiB;CAqBhC;AAID,qBAAa,eAAe;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;IACvC,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2B;IAEhD,OAAO;IAQP;;;OAGG;WACU,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAKjE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAQhC"}

package/dist/gen/openshell_pb.d.ts

@@ -2252,9 +2252,36 @@ export type ProviderCredentialTokenGrantAudienceOverride = Message<"openshell.v1
  */
 export declare const ProviderCredentialTokenGrantAudienceOverrideSchema: GenMessage<ProviderCredentialTokenGrantAudienceOverride>;
 /**
- * Provider credential token grant configuration.
- * When present, the credential is obtained dynamically via OAuth2 grant when needed.
- *
+ * @generated from message openshell.v1.ProviderCredentialTokenGrantSubjectToken
+ */
+export type ProviderCredentialTokenGrantSubjectToken = Message<"openshell.v1.ProviderCredentialTokenGrantSubjectToken"> & {
+    /**
+     * Source for the token exchange subject token. Phase one supports
+     * "provider_credential".
+     *
+     * @generated from field: string source = 1;
+     */
+    source: string;
+    /**
+     * Provider credential key that stores the subject token.
+     *
+     * @generated from field: string credential = 2;
+     */
+    credential: string;
+    /**
+     * OAuth2 subject_token_type. If omitted, OpenShell uses
+     * urn:ietf:params:oauth:token-type:access_token.
+     *
+     * @generated from field: string subject_token_type = 3;
+     */
+    subjectTokenType: string;
+};
+/**
+ * Describes the message openshell.v1.ProviderCredentialTokenGrantSubjectToken.
+ * Use `create(ProviderCredentialTokenGrantSubjectTokenSchema)` to create a new message.
+ */
+export declare const ProviderCredentialTokenGrantSubjectTokenSchema: GenMessage<ProviderCredentialTokenGrantSubjectToken>;
+/**
  * @generated from message openshell.v1.ProviderCredentialTokenGrant
  */
 export type ProviderCredentialTokenGrant = Message<"openshell.v1.ProviderCredentialTokenGrant"> & {
@@ -2303,6 +2330,26 @@ export type ProviderCredentialTokenGrant = Message<"openshell.v1.ProviderCredent
      * @generated from field: string client_assertion_type = 7;
      */
     clientAssertionType: string;
+    /**
+     * Grant type. If omitted/unspecified, OpenShell treats this as client_credentials
+     * for backwards compatibility.
+     *
+     * @generated from field: openshell.v1.ProviderCredentialTokenGrantType grant_type = 8;
+     */
+    grantType: ProviderCredentialTokenGrantType;
+    /**
+     * Subject token metadata for token_exchange grants.
+     *
+     * @generated from field: openshell.v1.ProviderCredentialTokenGrantSubjectToken subject_token = 9;
+     */
+    subjectToken?: ProviderCredentialTokenGrantSubjectToken | undefined;
+    /**
+     * OAuth2 requested_token_type. If omitted for token_exchange, OpenShell uses
+     * urn:ietf:params:oauth:token-type:access_token.
+     *
+     * @generated from field: string requested_token_type = 10;
+     */
+    requestedTokenType: string;
 };
 /**
  * Describes the message openshell.v1.ProviderCredentialTokenGrant.
@@ -2481,6 +2528,11 @@ export type ProviderCredentialRefreshStatus = Message<"openshell.v1.ProviderCred
      */
     expiresAtMs: bigint;
     /**
+     * Next automatic refresh time in Unix epoch milliseconds. A value of
+     * 9223372036854775807 (int64 max) means no automatic retry is scheduled;
+     * consumers should render it as unset and use recovery_action to determine
+     * the required recovery workflow.
+     *
      * @generated from field: int64 next_refresh_at_ms = 7;
      */
     nextRefreshAtMs: bigint;
@@ -2492,6 +2544,30 @@ export type ProviderCredentialRefreshStatus = Message<"openshell.v1.ProviderCred
      * @generated from field: string last_error = 9;
      */
     lastError: string;
+    /**
+     * @generated from field: openshell.v1.ProviderCredentialRefreshRecoveryAction recovery_action = 10;
+     */
+    recoveryAction: ProviderCredentialRefreshRecoveryAction;
+    /**
+     * Stable gateway-owned failure identifier, for example
+     * "oauth_invalid_grant". This is not provider-controlled prose and
+     * incorporates any recognized top-level OAuth error classification.
+     *
+     * @generated from field: string failure_code = 11;
+     */
+    failureCode: string;
+    /**
+     * A bounded, recognized provider subtype that refines failure_code; clients
+     * do not need a separate provider_error field. Unknown provider-controlled
+     * values are not persisted or returned.
+     *
+     * @generated from field: string provider_error_subtype = 12;
+     */
+    providerErrorSubtype: string;
+    /**
+     * @generated from field: int64 last_error_at_ms = 13;
+     */
+    lastErrorAtMs: bigint;
 };
 /**
  * Describes the message openshell.v1.ProviderCredentialRefreshStatus.
@@ -2559,6 +2635,8 @@ export type StoredProviderCredentialRefreshState = Message<"openshell.v1.StoredP
      */
     expiresAtMs: bigint;
     /**
+     * int64 max parks the refresh until an explicit rotation or reconfiguration.
+     *
      * @generated from field: int64 next_refresh_at_ms = 9;
      */
     nextRefreshAtMs: bigint;
@@ -2630,6 +2708,25 @@ export type StoredProviderCredentialRefreshState = Message<"openshell.v1.StoredP
      * @generated from field: repeated openshell.v1.StoredRefreshMaterialDeletion pending_secret_deletions = 20;
      */
     pendingSecretDeletions: StoredRefreshMaterialDeletion[];
+    /**
+     * Structured recovery details for the most recent refresh failure. These
+     * fields contain only gateway-owned codes and recognized bounded values.
+     *
+     * @generated from field: openshell.v1.ProviderCredentialRefreshRecoveryAction recovery_action = 21;
+     */
+    recoveryAction: ProviderCredentialRefreshRecoveryAction;
+    /**
+     * @generated from field: string failure_code = 22;
+     */
+    failureCode: string;
+    /**
+     * @generated from field: string provider_error_subtype = 23;
+     */
+    providerErrorSubtype: string;
+    /**
+     * @generated from field: int64 last_error_at_ms = 24;
+     */
+    lastErrorAtMs: bigint;
 };
 /**
  * Describes the message openshell.v1.StoredProviderCredentialRefreshState.
@@ -3315,6 +3412,63 @@ export type GetSandboxProviderEnvironmentResponse = Message<"openshell.v1.GetSan
  * Use `create(GetSandboxProviderEnvironmentResponseSchema)` to create a new message.
  */
 export declare const GetSandboxProviderEnvironmentResponseSchema: GenMessage<GetSandboxProviderEnvironmentResponse>;
+/**
+ * @generated from message openshell.v1.ExchangeProviderSubjectTokenRequest
+ */
+export type ExchangeProviderSubjectTokenRequest = Message<"openshell.v1.ExchangeProviderSubjectTokenRequest"> & {
+    /**
+     * The sandbox ID. Must match the authenticated sandbox principal.
+     *
+     * @generated from field: string sandbox_id = 1;
+     */
+    sandboxId: string;
+    /**
+     * Attached provider record holding the configured subject token credential.
+     *
+     * @generated from field: string provider = 2;
+     */
+    provider: string;
+    /**
+     * Provider profile credential that declares the token_exchange grant.
+     *
+     * @generated from field: string credential_key = 3;
+     */
+    credentialKey: string;
+    /**
+     * Supervisor JWT-SVID. The gateway verifies this and uses its `sub` claim
+     * as the requested audience for the intermediate token.
+     *
+     * @generated from field: string supervisor_jwt_svid = 4;
+     */
+    supervisorJwtSvid: string;
+};
+/**
+ * Describes the message openshell.v1.ExchangeProviderSubjectTokenRequest.
+ * Use `create(ExchangeProviderSubjectTokenRequestSchema)` to create a new message.
+ */
+export declare const ExchangeProviderSubjectTokenRequestSchema: GenMessage<ExchangeProviderSubjectTokenRequest>;
+/**
+ * @generated from message openshell.v1.ExchangeProviderSubjectTokenResponse
+ */
+export type ExchangeProviderSubjectTokenResponse = Message<"openshell.v1.ExchangeProviderSubjectTokenResponse"> & {
+    /**
+     * @generated from field: string access_token = 1;
+     */
+    accessToken: string;
+    /**
+     * @generated from field: int64 expires_in = 2;
+     */
+    expiresIn: bigint;
+    /**
+     * @generated from field: string token_type = 3;
+     */
+    tokenType: string;
+};
+/**
+ * Describes the message openshell.v1.ExchangeProviderSubjectTokenResponse.
+ * Use `create(ExchangeProviderSubjectTokenResponseSchema)` to create a new message.
+ */
+export declare const ExchangeProviderSubjectTokenResponseSchema: GenMessage<ExchangeProviderSubjectTokenResponse>;
 /**
  * Update sandbox policy request.
  *
@@ -4682,6 +4836,42 @@ export type PolicyChunk = Message<"openshell.v1.PolicyChunk"> & {
      * @generated from field: string rejection_reason = 18;
      */
     rejectionReason: string;
+    /**
+     * Gateway-side merge/application preflight failure. Kept separate from
+     * prover output and operator rejection so clients can explain why a
+     * prover-clean proposal is not currently applicable.
+     *
+     * @generated from field: string application_error = 19;
+     */
+    applicationError: string;
+    /**
+     * Opaque digest binding review to the exact live inputs and complete
+     * effective candidate evaluated by the gateway.
+     *
+     * @generated from field: string review_token = 20;
+     */
+    reviewToken: string;
+    /**
+     * Deterministic hashes for compact candidate display and diagnostics.
+     *
+     * @generated from field: string current_effective_policy_hash = 21;
+     */
+    currentEffectivePolicyHash: string;
+    /**
+     * @generated from field: string candidate_effective_policy_hash = 22;
+     */
+    candidateEffectivePolicyHash: string;
+    /**
+     * Complete effective policies used for review. These contain policy
+     * configuration only; credential secret values are never materialized.
+     *
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy current_effective_policy = 23;
+     */
+    currentEffectivePolicy?: SandboxPolicy | undefined;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy candidate_effective_policy = 24;
+     */
+    candidateEffectivePolicy?: SandboxPolicy | undefined;
 };
 /**
  * Describes the message openshell.v1.PolicyChunk.
@@ -4902,6 +5092,13 @@ export type ApproveDraftChunkRequest = Message<"openshell.v1.ApproveDraftChunkRe
      * @generated from field: string workspace = 3;
      */
     workspace: string;
+    /**
+     * Token returned with the reviewed PolicyChunk. Approval fails with
+     * FAILED_PRECONDITION if live decision inputs no longer match it.
+     *
+     * @generated from field: string review_token = 4;
+     */
+    reviewToken: string;
 };
 /**
  * Describes the message openshell.v1.ApproveDraftChunkRequest.
@@ -4978,6 +5175,24 @@ export declare const RejectDraftChunkResponseSchema: GenMessage<RejectDraftChunk
 /**
  * Approve all pending chunks.
  *
+ * @generated from message openshell.v1.DraftChunkApproval
+ */
+export type DraftChunkApproval = Message<"openshell.v1.DraftChunkApproval"> & {
+    /**
+     * @generated from field: string chunk_id = 1;
+     */
+    chunkId: string;
+    /**
+     * @generated from field: string review_token = 2;
+     */
+    reviewToken: string;
+};
+/**
+ * Describes the message openshell.v1.DraftChunkApproval.
+ * Use `create(DraftChunkApprovalSchema)` to create a new message.
+ */
+export declare const DraftChunkApprovalSchema: GenMessage<DraftChunkApproval>;
+/**
  * @generated from message openshell.v1.ApproveAllDraftChunksRequest
  */
 export type ApproveAllDraftChunksRequest = Message<"openshell.v1.ApproveAllDraftChunksRequest"> & {
@@ -4999,6 +5214,13 @@ export type ApproveAllDraftChunksRequest = Message<"openshell.v1.ApproveAllDraft
      * @generated from field: string workspace = 3;
      */
     workspace: string;
+    /**
+     * Exact reviewed chunks and tokens. The server validates them against one
+     * live snapshot, stages compatible operations in order, and writes once.
+     *
+     * @generated from field: repeated openshell.v1.DraftChunkApproval approvals = 4;
+     */
+    approvals: DraftChunkApproval[];
 };
 /**
  * Describes the message openshell.v1.ApproveAllDraftChunksRequest.
@@ -5028,7 +5250,8 @@ export type ApproveAllDraftChunksResponse = Message<"openshell.v1.ApproveAllDraf
      */
     chunksApproved: number;
     /**
-     * Number of chunks skipped (security-flagged).
+     * Number of chunks skipped for any reason, including security flags,
+     * stale or invalid candidates, and conflicts within the staged batch.
      *
      * @generated from field: uint32 chunks_skipped = 4;
      */
@@ -5375,6 +5598,30 @@ export type DraftChunkPayload = Message<"openshell.v1.DraftChunkPayload"> & {
      * @generated from field: string rejection_reason = 12;
      */
     rejectionReason: string;
+    /**
+     * @generated from field: string application_error = 13;
+     */
+    applicationError: string;
+    /**
+     * @generated from field: string review_token = 14;
+     */
+    reviewToken: string;
+    /**
+     * @generated from field: string current_effective_policy_hash = 15;
+     */
+    currentEffectivePolicyHash: string;
+    /**
+     * @generated from field: string candidate_effective_policy_hash = 16;
+     */
+    candidateEffectivePolicyHash: string;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy current_effective_policy = 17;
+     */
+    currentEffectivePolicy?: SandboxPolicy | undefined;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy candidate_effective_policy = 18;
+     */
+    candidateEffectivePolicy?: SandboxPolicy | undefined;
 };
 /**
  * Describes the message openshell.v1.DraftChunkPayload.
@@ -5521,6 +5768,30 @@ export type StoredDraftChunk = Message<"openshell.v1.StoredDraftChunk"> & {
      * @generated from field: string rejection_reason = 19;
      */
     rejectionReason: string;
+    /**
+     * @generated from field: string application_error = 20;
+     */
+    applicationError: string;
+    /**
+     * @generated from field: string review_token = 21;
+     */
+    reviewToken: string;
+    /**
+     * @generated from field: string current_effective_policy_hash = 22;
+     */
+    currentEffectivePolicyHash: string;
+    /**
+     * @generated from field: string candidate_effective_policy_hash = 23;
+     */
+    candidateEffectivePolicyHash: string;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy current_effective_policy = 24;
+     */
+    currentEffectivePolicy?: SandboxPolicy | undefined;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxPolicy candidate_effective_policy = 25;
+     */
+    candidateEffectivePolicy?: SandboxPolicy | undefined;
 };
 /**
  * Describes the message openshell.v1.StoredDraftChunk.
@@ -5918,6 +6189,30 @@ export declare enum SandboxPhase {
  * Describes the enum openshell.v1.SandboxPhase.
  */
 export declare const SandboxPhaseSchema: GenEnum<SandboxPhase>;
+/**
+ * Provider credential token grant configuration.
+ * When present, the credential is obtained dynamically via OAuth2 grant when needed.
+ *
+ * @generated from enum openshell.v1.ProviderCredentialTokenGrantType
+ */
+export declare enum ProviderCredentialTokenGrantType {
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_CLIENT_CREDENTIALS = 1;
+     */
+    CLIENT_CREDENTIALS = 1,
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_TOKEN_GRANT_TYPE_TOKEN_EXCHANGE = 2;
+     */
+    TOKEN_EXCHANGE = 2
+}
+/**
+ * Describes the enum openshell.v1.ProviderCredentialTokenGrantType.
+ */
+export declare const ProviderCredentialTokenGrantTypeSchema: GenEnum<ProviderCredentialTokenGrantType>;
 /**
  * @generated from enum openshell.v1.ProviderCredentialRefreshStrategy
  */
@@ -6087,6 +6382,40 @@ export declare enum WorkspaceRole {
  * Describes the enum openshell.v1.WorkspaceRole.
  */
 export declare const WorkspaceRoleSchema: GenEnum<WorkspaceRole>;
+/**
+ * Stable recovery action for the most recent provider credential refresh
+ * failure. Kept after the pre-existing enums so adding it does not renumber
+ * their generated descriptors. Clients should use this field instead of
+ * parsing last_error.
+ *
+ * @generated from enum openshell.v1.ProviderCredentialRefreshRecoveryAction
+ */
+export declare enum ProviderCredentialRefreshRecoveryAction {
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_RETRY = 1;
+     */
+    RETRY = 1,
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_REAUTHORIZE = 2;
+     */
+    REAUTHORIZE = 2,
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_FIX_CONFIGURATION = 3;
+     */
+    FIX_CONFIGURATION = 3,
+    /**
+     * @generated from enum value: PROVIDER_CREDENTIAL_REFRESH_RECOVERY_ACTION_INVESTIGATE = 4;
+     */
+    INVESTIGATE = 4
+}
+/**
+ * Describes the enum openshell.v1.ProviderCredentialRefreshRecoveryAction.
+ */
+export declare const ProviderCredentialRefreshRecoveryActionSchema: GenEnum<ProviderCredentialRefreshRecoveryAction>;
 /**
  * OpenShell service provides sandbox, provider, and runtime management capabilities.
  *
@@ -6539,6 +6868,17 @@ export declare const OpenShell: GenService<{
         input: typeof GetSandboxProviderEnvironmentRequestSchema;
         output: typeof GetSandboxProviderEnvironmentResponseSchema;
     };
+    /**
+     * Exchange a stored provider subject token for an intermediate token scoped
+     * to the calling supervisor's SPIFFE identity.
+     *
+     * @generated from rpc openshell.v1.OpenShell.ExchangeProviderSubjectToken
+     */
+    exchangeProviderSubjectToken: {
+        methodKind: "unary";
+        input: typeof ExchangeProviderSubjectTokenRequestSchema;
+        output: typeof ExchangeProviderSubjectTokenResponseSchema;
+    };
     /**
      * Fetch recent sandbox logs (one-shot).
      *