@openkaiden/opnshll-sdk 0.1.2 → 0.1.4

package/dist/gen/openshell_pb.d.ts

@@ -480,6 +480,14 @@ export type Sandbox = Message<"openshell.v1.Sandbox"> & {
      * @generated from field: openshell.v1.SandboxStatus status = 3;
      */
     status?: SandboxStatus | undefined;
+    /**
+     * Read-only SSH host identity in OpenSSH SHA256:<base64> form. Stable for
+     * this sandbox's lifetime, including runtime restarts. Empty on legacy
+     * runtimes that do not provide a gateway-managed SSH identity.
+     *
+     * @generated from field: string host_key_fingerprint = 6;
+     */
+    hostKeyFingerprint: string;
     /**
      * Read-only provenance for sandboxes created from a reusable workload template.
      *
@@ -558,6 +566,13 @@ export type SandboxSpec = Message<"openshell.v1.SandboxSpec"> & {
      * @generated from field: string provider_attachment_epoch = 14;
      */
     providerAttachmentEpoch: string;
+    /**
+     * Gateway-owned policy for replacing the sandbox runtime after the canonical
+     * main process exits. Unspecified is normalized to Never before persistence.
+     *
+     * @generated from field: openshell.v1.SandboxRestartPolicy restart_policy = 15;
+     */
+    restartPolicy: SandboxRestartPolicy;
 };
 /**
  * Describes the message openshell.v1.SandboxSpec.
@@ -902,9 +917,8 @@ export type SandboxStatus = Message<"openshell.v1.SandboxStatus"> & {
      */
     mainProcessInstanceId: string;
     /**
-     * Normalized main process result. Signal exits use 128 + signal number.
-     * Presence indicates that the canonical main process exited. Exit code 0
-     * produces Completed; nonzero and signal-normalized exits produce Error.
+     * Most recent normalized main process result. Signal exits use 128 + signal number.
+     * Cleared when a replacement main process becomes ready.
      *
      * @generated from field: optional int32 exit_code = 9;
      */
@@ -930,11 +944,29 @@ export type SandboxStatus = Message<"openshell.v1.SandboxStatus"> & {
      */
     configurationActivated?: boolean | undefined;
     /**
-     * Gateway-owned repair window. Retained after timeout for inspection and retry.
+     * Gateway-owned provisioning deadlines, retained after timeout for inspection and retry.
      *
      * @generated from field: openshell.v1.SandboxProvisioning provisioning = 13;
      */
     provisioning?: SandboxProvisioning | undefined;
+    /**
+     * Consecutive policy-driven restart number in the current crash loop.
+     *
+     * @generated from field: uint32 restart_count = 14;
+     */
+    restartCount: number;
+    /**
+     * Deadline for the next restart attempt or recovery check.
+     *
+     * @generated from field: google.protobuf.Timestamp next_restart_time = 15;
+     */
+    nextRestartTime?: Timestamp | undefined;
+    /**
+     * Time when the current main process became ready.
+     *
+     * @generated from field: google.protobuf.Timestamp main_process_started_time = 16;
+     */
+    mainProcessStartedTime?: Timestamp | undefined;
 };
 /**
  * Describes the message openshell.v1.SandboxStatus.
@@ -2257,7 +2289,8 @@ export type CreateSshSessionResponse = Message<"openshell.v1.CreateSshSessionRes
      */
     gatewayScheme: string;
     /**
-     * Optional host key fingerprint. If non-empty, [A-Za-z0-9:+/=-] only.
+     * Expected sandbox SSH host identity in OpenSSH SHA256:<base64> form.
+     * Stable for the sandbox's lifetime. Empty only for legacy runtimes.
      *
      * @generated from field: string host_key_fingerprint = 7;
      */
@@ -2315,6 +2348,12 @@ export type ExposeServiceRequest = Message<"openshell.v1.ExposeServiceRequest">
      * @generated from field: string request_id = 6;
      */
     requestId: string;
+    /**
+     * Application authorization behavior. Omission resolves to STRIP.
+     *
+     * @generated from field: openshell.v1.ServiceAuthorizationMode authorization_mode = 7;
+     */
+    authorizationMode: ServiceAuthorizationMode;
 };
 /**
  * Describes the message openshell.v1.ExposeServiceRequest.
@@ -2506,6 +2545,12 @@ export type ServiceEndpoint = Message<"openshell.v1.ServiceEndpoint"> & {
      * @generated from field: bool domain = 6;
      */
     domain: boolean;
+    /**
+     * Effective application authorization behavior for ingress requests.
+     *
+     * @generated from field: openshell.v1.ServiceAuthorizationMode authorization_mode = 7;
+     */
+    authorizationMode: ServiceAuthorizationMode;
 };
 /**
  * Describes the message openshell.v1.ServiceEndpoint.
@@ -3238,6 +3283,83 @@ export type GetProviderRequest = Message<"openshell.v1.GetProviderRequest"> & {
  * Use `create(GetProviderRequestSchema)` to create a new message.
  */
 export declare const GetProviderRequestSchema: GenMessage<GetProviderRequest>;
+/**
+ * Retrieve selected runtime credentials from one provider in one workspace.
+ * Refresh side effects can persist even when the complete request fails.
+ *
+ * @generated from message openshell.v1.GetProviderCredentialsRequest
+ */
+export type GetProviderCredentialsRequest = Message<"openshell.v1.GetProviderCredentialsRequest"> & {
+    /**
+     * Required named workspace selection; all_workspaces is not accepted.
+     *
+     * @generated from field: openshell.datamodel.v1.WorkspaceSelector workspace_scope = 1;
+     */
+    workspaceScope?: WorkspaceSelector | undefined;
+    /**
+     * Provider canonical name.
+     *
+     * @generated from field: string name = 2;
+     */
+    name: string;
+    /**
+     * Nonempty selection of runtime environment keys (maximum 32).
+     *
+     * @generated from field: repeated string credential_keys = 3;
+     */
+    credentialKeys: string[];
+    /**
+     * Omitted/zero uses a five-minute safety margin. Maximum is 24 hours.
+     *
+     * @generated from field: google.protobuf.Duration minimum_remaining_lifetime = 4;
+     */
+    minimumRemainingLifetime?: Duration | undefined;
+};
+/**
+ * Describes the message openshell.v1.GetProviderCredentialsRequest.
+ * Use `create(GetProviderCredentialsRequestSchema)` to create a new message.
+ */
+export declare const GetProviderCredentialsRequestSchema: GenMessage<GetProviderCredentialsRequest>;
+/**
+ * Usable runtime value, never gateway-only minting material.
+ *
+ * @generated from message openshell.v1.ProviderCredentialValue
+ */
+export type ProviderCredentialValue = Message<"openshell.v1.ProviderCredentialValue"> & {
+    /**
+     * @generated from field: string value = 1;
+     */
+    value: string;
+    /**
+     * Absent for credentials with no declared expiration.
+     *
+     * @generated from field: google.protobuf.Timestamp expiration_time = 2;
+     */
+    expirationTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message openshell.v1.ProviderCredentialValue.
+ * Use `create(ProviderCredentialValueSchema)` to create a new message.
+ */
+export declare const ProviderCredentialValueSchema: GenMessage<ProviderCredentialValue>;
+/**
+ * @generated from message openshell.v1.GetProviderCredentialsResponse
+ */
+export type GetProviderCredentialsResponse = Message<"openshell.v1.GetProviderCredentialsResponse"> & {
+    /**
+     * All requested values or an error; no partial response.
+     *
+     * @generated from field: map<string, openshell.v1.ProviderCredentialValue> credentials = 1;
+     */
+    credentials: {
+        [key: string]: ProviderCredentialValue;
+    };
+};
+/**
+ * Describes the message openshell.v1.GetProviderCredentialsResponse.
+ * Use `create(GetProviderCredentialsResponseSchema)` to create a new message.
+ */
+export declare const GetProviderCredentialsResponseSchema: GenMessage<GetProviderCredentialsResponse>;
 /**
  * List providers request.
  *
@@ -3264,6 +3386,12 @@ export type ListProvidersRequest = Message<"openshell.v1.ListProvidersRequest">
      * @generated from field: string page_token = 2;
      */
     pageToken: string;
+    /**
+     * Optional label selector for filtering (format: "key1=value1,key2=value2").
+     *
+     * @generated from field: string label_selector = 4;
+     */
+    labelSelector: string;
 };
 /**
  * Describes the message openshell.v1.ListProvidersRequest.
@@ -3697,6 +3825,26 @@ export type ProviderProfileCredential = Message<"openshell.v1.ProviderProfileCre
      * @generated from field: openshell.v1.ProviderCredentialTokenGrant token_grant = 10;
      */
     tokenGrant?: ProviderCredentialTokenGrant | undefined;
+    /**
+     * Output-only gateway-derived endpoint authorities for resolved token grants.
+     * For inspected L7 requests, empty means no endpoint may obtain this grant.
+     * L4 injection uses selectors without checking these authorities.
+     * Profile-authored values are ignored; normal policies name the originating
+     * provider endpoint, while a global policy uses its own endpoint authorities.
+     *
+     * @generated from field: repeated string token_grant_owners = 11;
+     */
+    tokenGrantOwners: string[];
+    /**
+     * Opt in to an opaque identity-bound environment placeholder for every env
+     * var declared by this credential. Use this only when an external credential
+     * updater requires one placeholder across value-only provider revisions.
+     * Gateway-managed refresh and token-grant credentials cannot opt in because
+     * they require identity-bearing handles for authorization-epoch revocation.
+     *
+     * @generated from field: bool stable_placeholder = 12;
+     */
+    stablePlaceholder: boolean;
 };
 /**
  * Describes the message openshell.v1.ProviderProfileCredential.
@@ -4156,12 +4304,49 @@ export type ProviderProfile = Message<"openshell.v1.ProviderProfile"> & {
      * @generated from field: string scope = 13;
      */
     scope: string;
+    /**
+     * EXPERIMENTAL: Non-secret files rendered from provider configuration for the
+     * workload. This API and its behavior may change or be removed.
+     *
+     * @generated from field: repeated openshell.v1.ProviderProfileFile files = 14;
+     */
+    files: ProviderProfileFile[];
 };
 /**
  * Describes the message openshell.v1.ProviderProfile.
  * Use `create(ProviderProfileSchema)` to create a new message.
  */
 export declare const ProviderProfileSchema: GenMessage<ProviderProfile>;
+/**
+ * EXPERIMENTAL: Provider file templates may change or be removed.
+ *
+ * @generated from message openshell.v1.ProviderProfileFile
+ */
+export type ProviderProfileFile = Message<"openshell.v1.ProviderProfileFile"> & {
+    /**
+     * One virtual file name below /run/openshell/providers/<provider>/.
+     *
+     * @generated from field: string path = 1;
+     */
+    path: string;
+    /**
+     * UTF-8 template. Only {{config.KEY}} references are supported.
+     *
+     * @generated from field: string content = 2;
+     */
+    content: string;
+    /**
+     * Optional environment variable containing the virtual absolute path.
+     *
+     * @generated from field: string env_var = 3;
+     */
+    envVar: string;
+};
+/**
+ * Describes the message openshell.v1.ProviderProfileFile.
+ * Use `create(ProviderProfileFileSchema)` to create a new message.
+ */
+export declare const ProviderProfileFileSchema: GenMessage<ProviderProfileFile>;
 /**
  * Provider profile response.
  *
@@ -4357,6 +4542,13 @@ export type LintProviderProfilesResponse = Message<"openshell.v1.LintProviderPro
      * @generated from field: bool valid = 2;
      */
     valid: boolean;
+    /**
+     * Clients enabling stable_placeholder check this before import or update,
+     * since older gateways silently discard unknown credential fields.
+     *
+     * @generated from field: bool supports_stable_placeholder = 3;
+     */
+    supportsStablePlaceholder: boolean;
 };
 /**
  * Describes the message openshell.v1.LintProviderProfilesResponse.
@@ -4448,6 +4640,14 @@ export type GetSandboxProviderEnvironmentRequest = Message<"openshell.v1.GetSand
      * @generated from field: bool supports_static_credential_bindings = 2;
      */
     supportsStaticCredentialBindings: boolean;
+    /**
+     * Whether the requesting supervisor understands stable external-placeholder
+     * metadata. Gateways withhold credentials that require this behavior when
+     * the capability is absent.
+     *
+     * @generated from field: bool supports_stable_placeholder_environment_keys = 3;
+     */
+    supportsStablePlaceholderEnvironmentKeys: boolean;
 };
 /**
  * Describes the message openshell.v1.GetSandboxProviderEnvironmentRequest.
@@ -4497,11 +4697,11 @@ export type StaticCredentialBinding = Message<"openshell.v1.StaticCredentialBind
      */
     credentialIdentity: string;
     /**
-     * Opaque gateway-issued handle for a refresh-managed credential identity
-     * epoch. When non-empty, supervisors keep the workload placeholder stable
-     * across access-token rotations and replace only the resolver value. The
-     * handle changes when the sandbox, provider, credential key, refresh
-     * authorization epoch, or endpoint authorization boundary changes.
+     * Opaque gateway-issued handle for a stable credential lifecycle. When
+     * non-empty, supervisors keep the workload placeholder stable across value
+     * updates and replace only the resolver value. The handle changes when the
+     * sandbox, provider, credential key, endpoint authorization, or an applicable
+     * refresh authorization epoch changes.
      *
      * @generated from field: string workload_credential_handle = 3;
      */
@@ -4586,6 +4786,31 @@ export type GetSandboxProviderEnvironmentResponse = Message<"openshell.v1.GetSan
      * @generated from field: openshell.v1.ProviderReadinessReason readiness_reason = 9;
      */
     readinessReason: ProviderReadinessReason;
+    /**
+     * Complete desired set of non-secret managed files, keyed by absolute path.
+     *
+     * @generated from field: map<string, string> files = 10;
+     */
+    files: {
+        [key: string]: string;
+    };
+    /**
+     * Credential environment variables whose opaque resolver handle remains
+     * stable across value-only provider revisions. These keys are still secrets;
+     * this metadata only selects the stable external-placeholder behavior.
+     *
+     * @generated from field: repeated string stable_placeholder_environment_keys = 11;
+     */
+    stablePlaceholderEnvironmentKeys: string[];
+    /**
+     * Supporting gateways always acknowledge the stable-placeholder delivery
+     * contract, including responses without opted-in credentials. Supervisors
+     * require acknowledgment for declared or previously activated external
+     * stable credentials; ordinary legacy delivery does not require it.
+     *
+     * @generated from field: bool supports_stable_placeholder_environment_keys = 12;
+     */
+    supportsStablePlaceholderEnvironmentKeys: boolean;
 };
 /**
  * Describes the message openshell.v1.GetSandboxProviderEnvironmentResponse.
@@ -5493,6 +5718,12 @@ export type GatewayMessage = Message<"openshell.v1.GatewayMessage"> & {
          */
         value: RelayClose;
         case: "relayClose";
+    } | {
+        /**
+         * @generated from field: openshell.v1.SessionRedirect session_redirect = 6;
+         */
+        value: SessionRedirect;
+        case: "sessionRedirect";
     } | {
         case: undefined;
         value?: undefined;
@@ -5534,6 +5765,22 @@ export type SupervisorHello = Message<"openshell.v1.SupervisorHello"> & {
      * @generated from field: bool supports_provider_readiness = 4;
      */
     supportsProviderReadiness: boolean;
+    /**
+     * Set when this connection is the result of following a SessionRedirect. The
+     * receiving gateway serves a redirected hello locally instead of redirecting
+     * again, so a disagreement about membership cannot bounce the supervisor
+     * between replicas. A gateway that is shutting down may still redirect it.
+     *
+     * @generated from field: bool redirected = 5;
+     */
+    redirected: boolean;
+    /**
+     * The supervisor understands SessionRedirect. Gateways never redirect a
+     * supervisor that does not set this.
+     *
+     * @generated from field: bool supports_session_redirect = 6;
+     */
+    supportsSessionRedirect: boolean;
 };
 /**
  * Describes the message openshell.v1.SupervisorHello.
@@ -5582,6 +5829,36 @@ export type SessionRejected = Message<"openshell.v1.SessionRejected"> & {
  * Use `create(SessionRejectedSchema)` to create a new message.
  */
 export declare const SessionRejectedSchema: GenMessage<SessionRejected>;
+/**
+ * Gateway declines to own this session and names the replica that should.
+ *
+ * Sent instead of SessionAccepted when the placement ring puts the sandbox on
+ * a different live replica, and to established sessions when their gateway
+ * shuts down. The supervisor reconnects to peer_endpoint once with
+ * SupervisorHello.redirected set, and falls back to its configured gateway
+ * address if that fails.
+ *
+ * @generated from message openshell.v1.SessionRedirect
+ */
+export type SessionRedirect = Message<"openshell.v1.SessionRedirect"> & {
+    /**
+     * Peer endpoint of the replica that should own this sandbox.
+     *
+     * @generated from field: string peer_endpoint = 1;
+     */
+    peerEndpoint: string;
+    /**
+     * Replica ID that should own this sandbox, for logging.
+     *
+     * @generated from field: string owner_replica_id = 2;
+     */
+    ownerReplicaId: string;
+};
+/**
+ * Describes the message openshell.v1.SessionRedirect.
+ * Use `create(SessionRedirectSchema)` to create a new message.
+ */
+export declare const SessionRedirectSchema: GenMessage<SessionRedirect>;
 /**
  * Supervisor heartbeat.
  *
@@ -7478,7 +7755,7 @@ export type SandboxProvisioning = Message<"openshell.v1.SandboxProvisioning"> &
      */
     firstRejectionTime?: Timestamp | undefined;
     /**
-     * Present only while the repair window is armed.
+     * Active preparation or admission-repair deadline. Absent after Ready/timeout.
      *
      * @generated from field: google.protobuf.Timestamp deadline = 5;
      */
@@ -7515,6 +7792,40 @@ export type SandboxProvisioning = Message<"openshell.v1.SandboxProvisioning"> &
      * @generated from field: google.protobuf.Timestamp attachment_change_time = 11;
      */
     attachmentChangeTime?: Timestamp | undefined;
+    /**
+     * Absolute ceiling for image preparation and initial supervisor startup.
+     * Set once per new attempt; progress, configuration writes, and restarts
+     * cannot extend it. Absent on attempts created before preparation timing.
+     *
+     * @generated from field: google.protobuf.Timestamp preparation_deadline = 12;
+     */
+    preparationDeadline?: Timestamp | undefined;
+    /**
+     * First authenticated supervisor configuration report for this attempt.
+     * Starts the admission repair window. Absent while preparing, including
+     * after a preparation timeout. Duplicate reports never change this value.
+     *
+     * @generated from field: google.protobuf.Timestamp admission_start_time = 13;
+     */
+    admissionStartTime?: Timestamp | undefined;
+    /**
+     * An owned driver create/start future is still pending. Claimed before
+     * dispatch and cleared on its actual success or error response. Monitor
+     * interruption, owner loss, and StopSandbox/NotFound do not clear it.
+     * While set, cleanup cannot complete and retry/deletion remain blocked.
+     * This does not strengthen a driver's transport-error settlement contract.
+     *
+     * @generated from field: bool driver_operation_pending = 14;
+     */
+    driverOperationPending: boolean;
+    /**
+     * Unique for each claimed driver operation, including recovery and automatic
+     * restart. Retained after settlement to reject delayed callbacks from an
+     * earlier operation on the same attempt and runtime generation.
+     *
+     * @generated from field: string driver_operation_id = 15;
+     */
+    driverOperationId: string;
 };
 /**
  * Describes the message openshell.v1.SandboxProvisioning.
@@ -7539,6 +7850,12 @@ export type SandboxServiceExposure = Message<"openshell.v1.SandboxServiceExposur
      * @generated from field: uint32 target_port = 2;
      */
     targetPort: number;
+    /**
+     * Application authorization behavior. Omission resolves to STRIP.
+     *
+     * @generated from field: openshell.v1.ServiceAuthorizationMode authorization_mode = 3;
+     */
+    authorizationMode: ServiceAuthorizationMode;
 };
 /**
  * Describes the message openshell.v1.SandboxServiceExposure.
@@ -8145,6 +8462,35 @@ export declare enum ProviderCredentialRefreshRecoveryAction {
  * Describes the enum openshell.v1.ProviderCredentialRefreshRecoveryAction.
  */
 export declare const ProviderCredentialRefreshRecoveryActionSchema: GenEnum<ProviderCredentialRefreshRecoveryAction>;
+/**
+ * Policy applied when the canonical main process exits outside an intentional
+ * stop or delete operation. Kept after existing enums so generated enum
+ * descriptors remain stable.
+ *
+ * @generated from enum openshell.v1.SandboxRestartPolicy
+ */
+export declare enum SandboxRestartPolicy {
+    /**
+     * @generated from enum value: SANDBOX_RESTART_POLICY_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: SANDBOX_RESTART_POLICY_NEVER = 1;
+     */
+    NEVER = 1,
+    /**
+     * @generated from enum value: SANDBOX_RESTART_POLICY_ON_FAILURE = 2;
+     */
+    ON_FAILURE = 2,
+    /**
+     * @generated from enum value: SANDBOX_RESTART_POLICY_ALWAYS = 3;
+     */
+    ALWAYS = 3
+}
+/**
+ * Describes the enum openshell.v1.SandboxRestartPolicy.
+ */
+export declare const SandboxRestartPolicySchema: GenEnum<SandboxRestartPolicy>;
 /**
  * Result of a public delete, membership removal, or session revocation.
  * Default requests return NOT_FOUND for a missing target. With allow_missing,
@@ -8245,6 +8591,36 @@ export declare enum EndpointResult {
  * Describes the enum openshell.v1.EndpointResult.
  */
 export declare const EndpointResultSchema: GenEnum<EndpointResult>;
+/**
+ * Controls whether an exposed service receives the request's application
+ * Authorization header.
+ *
+ * @generated from enum openshell.v1.ServiceAuthorizationMode
+ */
+export declare enum ServiceAuthorizationMode {
+    /**
+     * Omission preserves the secure legacy behavior and resolves to STRIP.
+     *
+     * @generated from enum value: SERVICE_AUTHORIZATION_MODE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Remove Authorization before forwarding to the sandbox service.
+     *
+     * @generated from enum value: SERVICE_AUTHORIZATION_MODE_STRIP = 1;
+     */
+    STRIP = 1,
+    /**
+     * Forward one syntactically valid bearer Authorization header unchanged.
+     *
+     * @generated from enum value: SERVICE_AUTHORIZATION_MODE_BEARER_PASSTHROUGH = 2;
+     */
+    BEARER_PASSTHROUGH = 2
+}
+/**
+ * Describes the enum openshell.v1.ServiceAuthorizationMode.
+ */
+export declare const ServiceAuthorizationModeSchema: GenEnum<ServiceAuthorizationMode>;
 /**
  * OpenShell service provides sandbox, provider, and runtime management capabilities.
  *
@@ -8557,6 +8933,17 @@ export declare const OpenShell: GenService<{
         input: typeof GetProviderRequestSchema;
         output: typeof ProviderResponseSchema;
     };
+    /**
+     * Export selected usable runtime credentials. Only directly authenticated
+     * mTLS operators may call this method; refresh material is never returned.
+     *
+     * @generated from rpc openshell.v1.OpenShell.GetProviderCredentials
+     */
+    getProviderCredentials: {
+        methodKind: "unary";
+        input: typeof GetProviderCredentialsRequestSchema;
+        output: typeof GetProviderCredentialsResponseSchema;
+    };
     /**
      * List providers.
      *