@openkaiden/opnshll-sdk 0.1.3 → 0.1.5

package/dist/gen/openshell_pb.d.ts

@@ -1,7 +1,7 @@
 import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
 import type { ObjectMeta, Provider, Workspace, WorkspaceSelector } from "./datamodel_pb.js";
 import type { Duration, Timestamp } from "@bufbuild/protobuf/wkt";
-import type { GetGatewayConfigRequestSchema, GetGatewayConfigResponseSchema, GetSandboxConfigRequestSchema, GetSandboxConfigResponseSchema, L7DenyRule, L7Rule, NetworkBinary, NetworkEndpoint, NetworkPolicyRule, PolicySource, SandboxPolicy, SettingValue } from "./sandbox_pb.js";
+import type { GetGatewayConfigRequestSchema, GetGatewayConfigResponseSchema, GetSandboxConfigRequestSchema, GetSandboxConfigResponseSchema, L7DenyRule, L7Rule, NetworkBinary, NetworkEndpoint, NetworkPolicyRule, PolicySource, SandboxConfigSnapshot, SandboxPolicy, SettingValue } from "./sandbox_pb.js";
 import type { JsonObject, Message } from "@bufbuild/protobuf";
 /**
  * Describes the file openshell.proto.
@@ -967,6 +967,14 @@ export type SandboxStatus = Message<"openshell.v1.SandboxStatus"> & {
      * @generated from field: google.protobuf.Timestamp main_process_started_time = 16;
      */
     mainProcessStartedTime?: Timestamp | undefined;
+    /**
+     * Latest refused token grant across all outbound HTTP protocols, including
+     * failures before a configured endpoint or credential could be selected.
+     * Matching grant success or a policy, provider, or supervisor reset clears it.
+     *
+     * @generated from field: openshell.v1.TokenGrantFailureObservation last_token_grant_failure = 17;
+     */
+    lastTokenGrantFailure?: TokenGrantFailureObservation | undefined;
 };
 /**
  * Describes the message openshell.v1.SandboxStatus.
@@ -1096,7 +1104,8 @@ export type CreateSandboxRequest = Message<"openshell.v1.CreateSandboxRequest">
         [key: string]: string;
     };
     /**
-     * Optional annotations for the sandbox (non-selector metadata).
+     * Optional annotations for the sandbox (non-selector metadata). Keys under
+     * the `internal.openshell.ai/` prefix are reserved for the gateway.
      *
      * @generated from field: map<string, string> annotations = 4;
      */
@@ -3283,6 +3292,83 @@ export type GetProviderRequest = Message<"openshell.v1.GetProviderRequest"> & {
  * Use `create(GetProviderRequestSchema)` to create a new message.
  */
 export declare const GetProviderRequestSchema: GenMessage<GetProviderRequest>;
+/**
+ * Retrieve selected runtime credentials from one provider in one workspace.
+ * Refresh side effects can persist even when the complete request fails.
+ *
+ * @generated from message openshell.v1.GetProviderCredentialsRequest
+ */
+export type GetProviderCredentialsRequest = Message<"openshell.v1.GetProviderCredentialsRequest"> & {
+    /**
+     * Required named workspace selection; all_workspaces is not accepted.
+     *
+     * @generated from field: openshell.datamodel.v1.WorkspaceSelector workspace_scope = 1;
+     */
+    workspaceScope?: WorkspaceSelector | undefined;
+    /**
+     * Provider canonical name.
+     *
+     * @generated from field: string name = 2;
+     */
+    name: string;
+    /**
+     * Nonempty selection of runtime environment keys (maximum 32).
+     *
+     * @generated from field: repeated string credential_keys = 3;
+     */
+    credentialKeys: string[];
+    /**
+     * Omitted/zero uses a five-minute safety margin. Maximum is 24 hours.
+     *
+     * @generated from field: google.protobuf.Duration minimum_remaining_lifetime = 4;
+     */
+    minimumRemainingLifetime?: Duration | undefined;
+};
+/**
+ * Describes the message openshell.v1.GetProviderCredentialsRequest.
+ * Use `create(GetProviderCredentialsRequestSchema)` to create a new message.
+ */
+export declare const GetProviderCredentialsRequestSchema: GenMessage<GetProviderCredentialsRequest>;
+/**
+ * Usable runtime value, never gateway-only minting material.
+ *
+ * @generated from message openshell.v1.ProviderCredentialValue
+ */
+export type ProviderCredentialValue = Message<"openshell.v1.ProviderCredentialValue"> & {
+    /**
+     * @generated from field: string value = 1;
+     */
+    value: string;
+    /**
+     * Absent for credentials with no declared expiration.
+     *
+     * @generated from field: google.protobuf.Timestamp expiration_time = 2;
+     */
+    expirationTime?: Timestamp | undefined;
+};
+/**
+ * Describes the message openshell.v1.ProviderCredentialValue.
+ * Use `create(ProviderCredentialValueSchema)` to create a new message.
+ */
+export declare const ProviderCredentialValueSchema: GenMessage<ProviderCredentialValue>;
+/**
+ * @generated from message openshell.v1.GetProviderCredentialsResponse
+ */
+export type GetProviderCredentialsResponse = Message<"openshell.v1.GetProviderCredentialsResponse"> & {
+    /**
+     * All requested values or an error; no partial response.
+     *
+     * @generated from field: map<string, openshell.v1.ProviderCredentialValue> credentials = 1;
+     */
+    credentials: {
+        [key: string]: ProviderCredentialValue;
+    };
+};
+/**
+ * Describes the message openshell.v1.GetProviderCredentialsResponse.
+ * Use `create(GetProviderCredentialsResponseSchema)` to create a new message.
+ */
+export declare const GetProviderCredentialsResponseSchema: GenMessage<GetProviderCredentialsResponse>;
 /**
  * List providers request.
  *
@@ -3309,6 +3395,12 @@ export type ListProvidersRequest = Message<"openshell.v1.ListProvidersRequest">
      * @generated from field: string page_token = 2;
      */
     pageToken: string;
+    /**
+     * Optional label selector for filtering (format: "key1=value1,key2=value2").
+     *
+     * @generated from field: string label_selector = 4;
+     */
+    labelSelector: string;
 };
 /**
  * Describes the message openshell.v1.ListProvidersRequest.
@@ -3752,6 +3844,16 @@ export type ProviderProfileCredential = Message<"openshell.v1.ProviderProfileCre
      * @generated from field: repeated string token_grant_owners = 11;
      */
     tokenGrantOwners: string[];
+    /**
+     * Opt in to an opaque identity-bound environment placeholder for every env
+     * var declared by this credential. Use this only when an external credential
+     * updater requires one placeholder across value-only provider revisions.
+     * Gateway-managed refresh and token-grant credentials cannot opt in because
+     * they require identity-bearing handles for authorization-epoch revocation.
+     *
+     * @generated from field: bool stable_placeholder = 12;
+     */
+    stablePlaceholder: boolean;
 };
 /**
  * Describes the message openshell.v1.ProviderProfileCredential.
@@ -4449,6 +4551,13 @@ export type LintProviderProfilesResponse = Message<"openshell.v1.LintProviderPro
      * @generated from field: bool valid = 2;
      */
     valid: boolean;
+    /**
+     * Clients enabling stable_placeholder check this before import or update,
+     * since older gateways silently discard unknown credential fields.
+     *
+     * @generated from field: bool supports_stable_placeholder = 3;
+     */
+    supportsStablePlaceholder: boolean;
 };
 /**
  * Describes the message openshell.v1.LintProviderProfilesResponse.
@@ -4540,6 +4649,14 @@ export type GetSandboxProviderEnvironmentRequest = Message<"openshell.v1.GetSand
      * @generated from field: bool supports_static_credential_bindings = 2;
      */
     supportsStaticCredentialBindings: boolean;
+    /**
+     * Whether the requesting supervisor understands stable external-placeholder
+     * metadata. Gateways withhold credentials that require this behavior when
+     * the capability is absent.
+     *
+     * @generated from field: bool supports_stable_placeholder_environment_keys = 3;
+     */
+    supportsStablePlaceholderEnvironmentKeys: boolean;
 };
 /**
  * Describes the message openshell.v1.GetSandboxProviderEnvironmentRequest.
@@ -4589,11 +4706,11 @@ export type StaticCredentialBinding = Message<"openshell.v1.StaticCredentialBind
      */
     credentialIdentity: string;
     /**
-     * Opaque gateway-issued handle for a refresh-managed credential identity
-     * epoch. When non-empty, supervisors keep the workload placeholder stable
-     * across access-token rotations and replace only the resolver value. The
-     * handle changes when the sandbox, provider, credential key, refresh
-     * authorization epoch, or endpoint authorization boundary changes.
+     * Opaque gateway-issued handle for a stable credential lifecycle. When
+     * non-empty, supervisors keep the workload placeholder stable across value
+     * updates and replace only the resolver value. The handle changes when the
+     * sandbox, provider, credential key, endpoint authorization, or an applicable
+     * refresh authorization epoch changes.
      *
      * @generated from field: string workload_credential_handle = 3;
      */
@@ -4605,7 +4722,9 @@ export type StaticCredentialBinding = Message<"openshell.v1.StaticCredentialBind
  */
 export declare const StaticCredentialBindingSchema: GenMessage<StaticCredentialBinding>;
 /**
- * Get sandbox provider environment response.
+ * Polling projection of ProviderEnvironmentSnapshot. The parallel maps below
+ * are keyed by the same environment variable names. Removed with the polling
+ * RPCs; new provider environment fields belong on the snapshot first.
  *
  * @generated from message openshell.v1.GetSandboxProviderEnvironmentResponse
  */
@@ -4686,12 +4805,124 @@ export type GetSandboxProviderEnvironmentResponse = Message<"openshell.v1.GetSan
     files: {
         [key: string]: string;
     };
+    /**
+     * Credential environment variables whose opaque resolver handle remains
+     * stable across value-only provider revisions. These keys are still secrets;
+     * this metadata only selects the stable external-placeholder behavior.
+     *
+     * @generated from field: repeated string stable_placeholder_environment_keys = 11;
+     */
+    stablePlaceholderEnvironmentKeys: string[];
+    /**
+     * Supporting gateways always acknowledge the stable-placeholder delivery
+     * contract, including responses without opted-in credentials. Supervisors
+     * require acknowledgment for declared or previously activated external
+     * stable credentials; ordinary legacy delivery does not require it.
+     *
+     * @generated from field: bool supports_stable_placeholder_environment_keys = 12;
+     */
+    supportsStablePlaceholderEnvironmentKeys: boolean;
 };
 /**
  * Describes the message openshell.v1.GetSandboxProviderEnvironmentResponse.
  * Use `create(GetSandboxProviderEnvironmentResponseSchema)` to create a new message.
  */
 export declare const GetSandboxProviderEnvironmentResponseSchema: GenMessage<GetSandboxProviderEnvironmentResponse>;
+/**
+ * One environment value and all metadata that shares its key. Names are unique
+ * within a snapshot. static_credential_binding is present exactly when
+ * classification is STATIC_CREDENTIAL. Snapshots that violate either rule are
+ * invalid.
+ *
+ * @generated from message openshell.v1.ProviderEnvironmentValue
+ */
+export type ProviderEnvironmentValue = Message<"openshell.v1.ProviderEnvironmentValue"> & {
+    /**
+     * @generated from field: string name = 1;
+     */
+    name: string;
+    /**
+     * @generated from field: string value = 2;
+     */
+    value: string;
+    /**
+     * @generated from field: openshell.v1.ProviderEnvironmentValueClassification classification = 4;
+     */
+    classification: ProviderEnvironmentValueClassification;
+    /**
+     * @generated from field: openshell.v1.StaticCredentialBinding static_credential_binding = 5;
+     */
+    staticCredentialBinding?: StaticCredentialBinding | undefined;
+    /**
+     * Absolute expiration time. Absence means no expiry.
+     *
+     * @generated from field: google.protobuf.Timestamp expiration_time = 3;
+     */
+    expirationTime?: Timestamp | undefined;
+    /**
+     * The static credential keeps one opaque resolver handle across value-only
+     * provider revisions. Set only for STATIC_CREDENTIAL values whose binding
+     * carries a workload_credential_handle.
+     *
+     * @generated from field: bool stable_placeholder = 6;
+     */
+    stablePlaceholder: boolean;
+};
+/**
+ * Describes the message openshell.v1.ProviderEnvironmentValue.
+ * Use `create(ProviderEnvironmentValueSchema)` to create a new message.
+ */
+export declare const ProviderEnvironmentValueSchema: GenMessage<ProviderEnvironmentValue>;
+/**
+ * Complete provider environment state delivered to a supervisor. This is the
+ * canonical provider environment shape; GetSandboxProviderEnvironmentResponse
+ * is its polling projection and is removed with the polling RPCs. Dynamic
+ * credentials are endpoint selectors rather than environment values and stay
+ * in their own collection.
+ *
+ * @generated from message openshell.v1.ProviderEnvironmentSnapshot
+ */
+export type ProviderEnvironmentSnapshot = Message<"openshell.v1.ProviderEnvironmentSnapshot"> & {
+    /**
+     * @generated from field: uint64 provider_env_revision = 1;
+     */
+    providerEnvRevision: bigint;
+    /**
+     * @generated from field: repeated openshell.v1.ProviderEnvironmentValue values = 2;
+     */
+    values: ProviderEnvironmentValue[];
+    /**
+     * @generated from field: map<string, openshell.v1.ProviderProfileCredential> dynamic_credentials = 3;
+     */
+    dynamicCredentials: {
+        [key: string]: ProviderProfileCredential;
+    };
+    /**
+     * @generated from field: string provider_attachment_epoch = 4;
+     */
+    providerAttachmentEpoch: string;
+    /**
+     * @generated from field: string policy_hash = 5;
+     */
+    policyHash: string;
+    /**
+     * @generated from field: openshell.v1.ProviderReadinessReason readiness_reason = 6;
+     */
+    readinessReason: ProviderReadinessReason;
+    /**
+     * Complete desired set of non-secret managed files, keyed by absolute path.
+     *
+     * @generated from field: map<string, string> files = 7;
+     */
+    files: {
+        [key: string]: string;
+    };
+};
+/**
+ * Describes the message openshell.v1.ProviderEnvironmentSnapshot.
+ * Use `create(ProviderEnvironmentSnapshotSchema)` to create a new message.
+ */
+export declare const ProviderEnvironmentSnapshotSchema: GenMessage<ProviderEnvironmentSnapshot>;
 /**
  * @generated from message openshell.v1.ExchangeProviderSubjectTokenRequest
  */
@@ -4821,7 +5052,8 @@ export type UpdateConfigRequest = Message<"openshell.v1.UpdateConfigRequest"> &
      * not interpret or verify their semantics. For policy updates, the gateway
      * stores the annotations immutably with the revision and merges them into
      * sandbox metadata as a convenience projection. For setting-only updates, it
-     * only merges them into sandbox metadata.
+     * only merges them into sandbox metadata. Keys under the
+     * `internal.openshell.ai/` prefix are reserved for the gateway.
      *
      * @generated from field: map<string, string> annotations = 9;
      */
@@ -5544,6 +5776,12 @@ export type SupervisorMessage = Message<"openshell.v1.SupervisorMessage"> & {
          */
         value: RelayClose;
         case: "relayClose";
+    } | {
+        /**
+         * @generated from field: openshell.v1.ConfigUpdateResult config_update_result = 5;
+         */
+        value: ConfigUpdateResult;
+        case: "configUpdateResult";
     } | {
         case: undefined;
         value?: undefined;
@@ -5599,6 +5837,12 @@ export type GatewayMessage = Message<"openshell.v1.GatewayMessage"> & {
          */
         value: SessionRedirect;
         case: "sessionRedirect";
+    } | {
+        /**
+         * @generated from field: openshell.v1.ConfigUpdate config_update = 7;
+         */
+        value: ConfigUpdate;
+        case: "configUpdate";
     } | {
         case: undefined;
         value?: undefined;
@@ -5656,6 +5900,15 @@ export type SupervisorHello = Message<"openshell.v1.SupervisorHello"> & {
      * @generated from field: bool supports_session_redirect = 6;
      */
     supportsSessionRedirect: boolean;
+    /**
+     * The supervisor can receive its configuration over this stream instead of
+     * polling for it: it applies the bootstrap ConfigUpdate and later
+     * ConfigUpdate payloads, and answers each with its result and admission.
+     * Gateways push configuration only to supervisors that set this.
+     *
+     * @generated from field: bool supports_config_push = 7;
+     */
+    supportsConfigPush: boolean;
 };
 /**
  * Describes the message openshell.v1.SupervisorHello.
@@ -5674,6 +5927,22 @@ export type SessionAccepted = Message<"openshell.v1.SessionAccepted"> & {
      * @generated from field: string session_id = 1;
      */
     sessionId: string;
+    /**
+     * The session's first configuration update. Present exactly when
+     * config_push_enabled is set.
+     *
+     * @generated from field: openshell.v1.ConfigUpdate bootstrap = 3;
+     */
+    bootstrap?: ConfigUpdate | undefined;
+    /**
+     * The gateway pushes configuration authoritatively on this stream instead
+     * of the supervisor polling for it: the bootstrap is required, ConfigUpdate
+     * payloads are applied and acknowledged, and the supervisor stops polling.
+     * Set only for supervisors that set SupervisorHello.supports_config_push.
+     *
+     * @generated from field: bool config_push_enabled = 4;
+     */
+    configPushEnabled: boolean;
     /**
      * Recommended heartbeat interval.
      *
@@ -5686,6 +5955,131 @@ export type SessionAccepted = Message<"openshell.v1.SessionAccepted"> & {
  * Use `create(SessionAcceptedSchema)` to create a new message.
  */
 export declare const SessionAcceptedSchema: GenMessage<SessionAccepted>;
+/**
+ * Complete gateway-owned configuration for a supervisor session. Each update
+ * replaces the previous one. The supervisor applies the two parts together
+ * and answers every update with one ConfigUpdateResult before the gateway
+ * sends the next.
+ *
+ * @generated from message openshell.v1.ConfigUpdate
+ */
+export type ConfigUpdate = Message<"openshell.v1.ConfigUpdate"> & {
+    /**
+     * Opaque non-empty identifier scoped to the active supervisor session.
+     *
+     * @generated from field: string update_id = 1;
+     */
+    updateId: string;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxConfigSnapshot sandbox_config = 2;
+     */
+    sandboxConfig?: SandboxConfigSnapshot | undefined;
+    /**
+     * The provider environment the sandbox configuration names through its
+     * provider revision, attachment epoch, and policy hash.
+     *
+     * @generated from field: openshell.v1.ProviderEnvironmentSnapshot provider_environment = 3;
+     */
+    providerEnvironment?: ProviderEnvironmentSnapshot | undefined;
+};
+/**
+ * Describes the message openshell.v1.ConfigUpdate.
+ * Use `create(ConfigUpdateSchema)` to create a new message.
+ */
+export declare const ConfigUpdateSchema: GenMessage<ConfigUpdate>;
+/**
+ * Sanitized application failure. Messages must not contain configuration
+ * payloads, credentials, or provider values.
+ *
+ * @generated from message openshell.v1.ConfigApplyFailure
+ */
+export type ConfigApplyFailure = Message<"openshell.v1.ConfigApplyFailure"> & {
+    /**
+     * @generated from field: string code = 1;
+     */
+    code: string;
+    /**
+     * @generated from field: string message = 2;
+     */
+    message: string;
+    /**
+     * @generated from field: bool retryable = 3;
+     */
+    retryable: boolean;
+};
+/**
+ * Describes the message openshell.v1.ConfigApplyFailure.
+ * Use `create(ConfigApplyFailureSchema)` to create a new message.
+ */
+export declare const ConfigApplyFailureSchema: GenMessage<ConfigApplyFailure>;
+/**
+ * Application result for one ConfigUpdate, including the bootstrap.
+ *
+ * @generated from message openshell.v1.ConfigUpdateResult
+ */
+export type ConfigUpdateResult = Message<"openshell.v1.ConfigUpdateResult"> & {
+    /**
+     * Echoes ConfigUpdate.update_id for session-local correlation.
+     *
+     * @generated from field: string update_id = 1;
+     */
+    updateId: string;
+    /**
+     * @generated from field: openshell.v1.ConfigApplyOutcome outcome = 2;
+     */
+    outcome: ConfigApplyOutcome;
+    /**
+     * Why the update did not take effect. Omitted when it did.
+     *
+     * @generated from field: openshell.v1.ConfigApplyFailure failure = 3;
+     */
+    failure?: ConfigApplyFailure | undefined;
+    /**
+     * Admission state of the delivered sandbox configuration.
+     *
+     * @generated from field: openshell.v1.SandboxConfigurationAdmission admission = 4;
+     */
+    admission?: SandboxConfigurationAdmission | undefined;
+    /**
+     * Load result of the sandbox policy revision the update changed, as a
+     * polling supervisor reports it with ReportPolicyStatus. Omitted when the
+     * update did not change the sandbox policy.
+     *
+     * @generated from field: openshell.v1.PolicyLoadResult policy_load = 5;
+     */
+    policyLoad?: PolicyLoadResult | undefined;
+};
+/**
+ * Describes the message openshell.v1.ConfigUpdateResult.
+ * Use `create(ConfigUpdateResultSchema)` to create a new message.
+ */
+export declare const ConfigUpdateResultSchema: GenMessage<ConfigUpdateResult>;
+/**
+ * Load result of one sandbox policy revision.
+ *
+ * @generated from message openshell.v1.PolicyLoadResult
+ */
+export type PolicyLoadResult = Message<"openshell.v1.PolicyLoadResult"> & {
+    /**
+     * @generated from field: uint32 version = 1;
+     */
+    version: number;
+    /**
+     * @generated from field: bool loaded = 2;
+     */
+    loaded: boolean;
+    /**
+     * Sanitized load error. Empty when loaded.
+     *
+     * @generated from field: string error = 3;
+     */
+    error: string;
+};
+/**
+ * Describes the message openshell.v1.PolicyLoadResult.
+ * Use `create(PolicyLoadResultSchema)` to create a new message.
+ */
+export declare const PolicyLoadResultSchema: GenMessage<PolicyLoadResult>;
 /**
  * Gateway rejects the supervisor session.
  *
@@ -6022,6 +6416,103 @@ export type PeerRelayFrame = Message<"openshell.v1.PeerRelayFrame"> & {
  * Use `create(PeerRelayFrameSchema)` to create a new message.
  */
 export declare const PeerRelayFrameSchema: GenMessage<PeerRelayFrame>;
+/**
+ * @generated from message openshell.v1.PeerConfigSandboxTarget
+ */
+export type PeerConfigSandboxTarget = Message<"openshell.v1.PeerConfigSandboxTarget"> & {
+    /**
+     * @generated from field: string sandbox_id = 1;
+     */
+    sandboxId: string;
+    /**
+     * Fences a targeted notification to the session observed by the sending replica.
+     *
+     * @generated from field: string session_id = 2;
+     */
+    sessionId: string;
+};
+/**
+ * Describes the message openshell.v1.PeerConfigSandboxTarget.
+ * Use `create(PeerConfigSandboxTargetSchema)` to create a new message.
+ */
+export declare const PeerConfigSandboxTargetSchema: GenMessage<PeerConfigSandboxTarget>;
+/**
+ * Sandboxes in a workspace that attach the named provider.
+ *
+ * @generated from message openshell.v1.PeerConfigProviderTarget
+ */
+export type PeerConfigProviderTarget = Message<"openshell.v1.PeerConfigProviderTarget"> & {
+    /**
+     * @generated from field: string workspace = 1;
+     */
+    workspace: string;
+    /**
+     * @generated from field: string name = 2;
+     */
+    name: string;
+};
+/**
+ * Describes the message openshell.v1.PeerConfigProviderTarget.
+ * Use `create(PeerConfigProviderTargetSchema)` to create a new message.
+ */
+export declare const PeerConfigProviderTargetSchema: GenMessage<PeerConfigProviderTarget>;
+/**
+ * @generated from message openshell.v1.PeerNotifyConfigUpdateRequest
+ */
+export type PeerNotifyConfigUpdateRequest = Message<"openshell.v1.PeerNotifyConfigUpdateRequest"> & {
+    /**
+     * @generated from oneof openshell.v1.PeerNotifyConfigUpdateRequest.scope
+     */
+    scope: {
+        /**
+         * @generated from field: openshell.v1.PeerConfigSandboxTarget sandbox = 1;
+         */
+        value: PeerConfigSandboxTarget;
+        case: "sandbox";
+    } | {
+        /**
+         * @generated from field: string workspace = 2;
+         */
+        value: string;
+        case: "workspace";
+    } | {
+        /**
+         * @generated from field: bool all_connected = 3;
+         */
+        value: boolean;
+        case: "allConnected";
+    } | {
+        /**
+         * @generated from field: openshell.v1.PeerConfigProviderTarget provider = 4;
+         */
+        value: PeerConfigProviderTarget;
+        case: "provider";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message openshell.v1.PeerNotifyConfigUpdateRequest.
+ * Use `create(PeerNotifyConfigUpdateRequestSchema)` to create a new message.
+ */
+export declare const PeerNotifyConfigUpdateRequestSchema: GenMessage<PeerNotifyConfigUpdateRequest>;
+/**
+ * @generated from message openshell.v1.PeerNotifyConfigUpdateResponse
+ */
+export type PeerNotifyConfigUpdateResponse = Message<"openshell.v1.PeerNotifyConfigUpdateResponse"> & {
+    /**
+     * The targeted session moved before the receiving replica accepted the notification.
+     *
+     * @generated from field: bool stale_owner = 1;
+     */
+    staleOwner: boolean;
+};
+/**
+ * Describes the message openshell.v1.PeerNotifyConfigUpdateResponse.
+ * Use `create(PeerNotifyConfigUpdateResponseSchema)` to create a new message.
+ */
+export declare const PeerNotifyConfigUpdateResponseSchema: GenMessage<PeerNotifyConfigUpdateResponse>;
 /**
  * Supervisor reports the result of a relay open request.
  *
@@ -7480,6 +7971,13 @@ export type EndpointObservation = Message<"openshell.v1.EndpointObservation"> &
      * @generated from field: openshell.v1.EndpointResult result = 2;
      */
     result: EndpointResult;
+    /**
+     * Bounded cause of result, when the supervisor classified it. Each failure
+     * domain names the results it can explain.
+     *
+     * @generated from field: openshell.v1.EndpointFailure failure = 3;
+     */
+    failure?: EndpointFailure | undefined;
 };
 /**
  * Describes the message openshell.v1.EndpointObservation.
@@ -7537,12 +8035,67 @@ export type ReportEndpointStatusRequest = Message<"openshell.v1.ReportEndpointSt
      * @generated from field: uint64 report_sequence = 7;
      */
     reportSequence: bigint;
+    /**
+     * Complete latest grant state. Omission retains legacy compatibility;
+     * a present message with no last_failure explicitly clears the prior cause.
+     *
+     * @generated from field: openshell.v1.TokenGrantStatus token_grant_status = 8;
+     */
+    tokenGrantStatus?: TokenGrantStatus | undefined;
 };
 /**
  * Describes the message openshell.v1.ReportEndpointStatusRequest.
  * Use `create(ReportEndpointStatusRequestSchema)` to create a new message.
  */
 export declare const ReportEndpointStatusRequestSchema: GenMessage<ReportEndpointStatusRequest>;
+/**
+ * Latest token-grant state sent by the authenticated supervisor.
+ *
+ * @generated from message openshell.v1.TokenGrantStatus
+ */
+export type TokenGrantStatus = Message<"openshell.v1.TokenGrantStatus"> & {
+    /**
+     * @generated from field: openshell.v1.TokenGrantFailureObservation last_failure = 1;
+     */
+    lastFailure?: TokenGrantFailureObservation | undefined;
+};
+/**
+ * Describes the message openshell.v1.TokenGrantStatus.
+ * Use `create(TokenGrantStatusSchema)` to create a new message.
+ */
+export declare const TokenGrantStatusSchema: GenMessage<TokenGrantStatus>;
+/**
+ * A refused grant and its destination, without request paths or remote text.
+ * This describes the failed attempt, not the destination's current health.
+ *
+ * @generated from message openshell.v1.TokenGrantFailureObservation
+ */
+export type TokenGrantFailureObservation = Message<"openshell.v1.TokenGrantFailureObservation"> & {
+    /**
+     * Canonical observed host or IP address, bounded to 253 ASCII bytes.
+     *
+     * @generated from field: string destination_host = 1;
+     */
+    destinationHost: string;
+    /**
+     * Observed destination port in the range 1 through 65535.
+     *
+     * @generated from field: uint32 destination_port = 2;
+     */
+    destinationPort: number;
+    /**
+     * Bounded token_grant cause. Provider and credential may be absent when
+     * selection failed; the request ID still identifies the refused exchange.
+     *
+     * @generated from field: openshell.v1.EndpointFailure failure = 3;
+     */
+    failure?: EndpointFailure | undefined;
+};
+/**
+ * Describes the message openshell.v1.TokenGrantFailureObservation.
+ * Use `create(TokenGrantFailureObservationSchema)` to create a new message.
+ */
+export declare const TokenGrantFailureObservationSchema: GenMessage<TokenGrantFailureObservation>;
 /**
  * Empty acknowledgement for a persisted endpoint status report.
  *
@@ -7601,6 +8154,15 @@ export type EndpointStatus = Message<"openshell.v1.EndpointStatus"> & {
      * @generated from field: google.protobuf.Timestamp last_reported_time = 106;
      */
     lastReportedTime?: Timestamp | undefined;
+    /**
+     * Bounded cause of last_result, when the supervisor classified it. Each
+     * failure domain names the results it can explain. Replaced or cleared by
+     * every later observation, and cleared by the same resets that clear
+     * last_result.
+     *
+     * @generated from field: openshell.v1.EndpointFailure last_failure = 7;
+     */
+    lastFailure?: EndpointFailure | undefined;
 };
 /**
  * Describes the message openshell.v1.EndpointStatus.
@@ -7737,6 +8299,70 @@ export type SandboxServiceExposure = Message<"openshell.v1.SandboxServiceExposur
  * Use `create(SandboxServiceExposureSchema)` to create a new message.
  */
 export declare const SandboxServiceExposureSchema: GenMessage<SandboxServiceExposure>;
+/**
+ * Bounded cause of a failed endpoint observation, including failures before
+ * any request reaches the endpoint. No field carries remote
+ * text: code and stage come from the domain's closed sets, provider and
+ * credential_key are configured names, and request_id is an opaque random ID.
+ *
+ * @generated from message openshell.v1.EndpointFailure
+ */
+export type EndpointFailure = Message<"openshell.v1.EndpointFailure"> & {
+    /**
+     * @generated from field: openshell.v1.EndpointFailureDomain domain = 1;
+     */
+    domain: EndpointFailureDomain;
+    /**
+     * Stable lower_snake_case code from the domain's closed set, such as
+     * provider_authorization_required.
+     *
+     * @generated from field: string code = 2;
+     */
+    code: string;
+    /**
+     * Who can resolve the failure; always the action documented for the code.
+     *
+     * @generated from field: openshell.v1.ProviderCredentialRefreshRecoveryAction recovery_action = 3;
+     */
+    recoveryAction: ProviderCredentialRefreshRecoveryAction;
+    /**
+     * Provider whose credential failed. Empty when the failure happened before
+     * a credential was selected.
+     *
+     * @generated from field: string provider = 4;
+     */
+    provider: string;
+    /**
+     * Credential name within the provider. Never a credential value.
+     *
+     * @generated from field: string credential_key = 5;
+     */
+    credentialKey: string;
+    /**
+     * Step that observed the failure, from the domain's closed set.
+     *
+     * @generated from field: string stage = 6;
+     */
+    stage: string;
+    /**
+     * HTTP status a token service returned, when one was received.
+     *
+     * @generated from field: optional uint32 upstream_http_status = 7;
+     */
+    upstreamHttpStatus?: number | undefined;
+    /**
+     * Supervisor-minted UUID of the refused exchange. The workload receives the
+     * same value in the x-openshell-request-id response header.
+     *
+     * @generated from field: string request_id = 8;
+     */
+    requestId: string;
+};
+/**
+ * Describes the message openshell.v1.EndpointFailure.
+ * Use `create(EndpointFailureSchema)` to create a new message.
+ */
+export declare const EndpointFailureSchema: GenMessage<EndpointFailure>;
 /**
  * @generated from enum openshell.v1.ExtensionKind
  */
@@ -8187,6 +8813,29 @@ export declare enum ProviderProfileCategory {
  * Describes the enum openshell.v1.ProviderProfileCategory.
  */
 export declare const ProviderProfileCategorySchema: GenEnum<ProviderProfileCategory>;
+/**
+ * Receivers treat UNSPECIFIED and unknown values as secret.
+ *
+ * @generated from enum openshell.v1.ProviderEnvironmentValueClassification
+ */
+export declare enum ProviderEnvironmentValueClassification {
+    /**
+     * @generated from enum value: PROVIDER_ENVIRONMENT_VALUE_CLASSIFICATION_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: PROVIDER_ENVIRONMENT_VALUE_CLASSIFICATION_NON_SECRET = 1;
+     */
+    NON_SECRET = 1,
+    /**
+     * @generated from enum value: PROVIDER_ENVIRONMENT_VALUE_CLASSIFICATION_STATIC_CREDENTIAL = 2;
+     */
+    STATIC_CREDENTIAL = 2
+}
+/**
+ * Describes the enum openshell.v1.ProviderEnvironmentValueClassification.
+ */
+export declare const ProviderEnvironmentValueClassificationSchema: GenEnum<ProviderEnvironmentValueClassification>;
 /**
  * @generated from enum openshell.v1.ConfigurationAdmissionState
  */
@@ -8496,6 +9145,32 @@ export declare enum ServiceAuthorizationMode {
  * Describes the enum openshell.v1.ServiceAuthorizationMode.
  */
 export declare const ServiceAuthorizationModeSchema: GenEnum<ServiceAuthorizationMode>;
+/**
+ * Subsystem whose closed code set explains an endpoint failure. Each domain
+ * defines its codes, stages, recovery actions, and the endpoint results it
+ * can explain. Kept at the end of the file so adding it does not renumber
+ * existing generated descriptors.
+ *
+ * @generated from enum openshell.v1.EndpointFailureDomain
+ */
+export declare enum EndpointFailureDomain {
+    /**
+     * @generated from enum value: ENDPOINT_FAILURE_DOMAIN_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * A dynamic token grant for a provider credential failed, so OpenShell
+     * refused the request before any of it reached the endpoint. Explains
+     * ENDPOINT_RESULT_CREDENTIAL_UNAVAILABLE.
+     *
+     * @generated from enum value: ENDPOINT_FAILURE_DOMAIN_TOKEN_GRANT = 1;
+     */
+    TOKEN_GRANT = 1
+}
+/**
+ * Describes the enum openshell.v1.EndpointFailureDomain.
+ */
+export declare const EndpointFailureDomainSchema: GenEnum<EndpointFailureDomain>;
 /**
  * OpenShell service provides sandbox, provider, and runtime management capabilities.
  *
@@ -8808,6 +9483,17 @@ export declare const OpenShell: GenService<{
         input: typeof GetProviderRequestSchema;
         output: typeof ProviderResponseSchema;
     };
+    /**
+     * Export selected usable runtime credentials. Only directly authenticated
+     * mTLS operators may call this method; refresh material is never returned.
+     *
+     * @generated from rpc openshell.v1.OpenShell.GetProviderCredentials
+     */
+    getProviderCredentials: {
+        methodKind: "unary";
+        input: typeof GetProviderCredentialsRequestSchema;
+        output: typeof GetProviderCredentialsResponseSchema;
+    };
     /**
      * List providers.
      *
@@ -8939,7 +9625,9 @@ export declare const OpenShell: GenService<{
         output: typeof DeleteProviderProfileResponseSchema;
     };
     /**
-     * Get sandbox settings by id (called by sandbox entrypoint and poll loop).
+     * Get sandbox settings by id (called by users, and by supervisors at startup
+     * and in their poll loop). A supervisor whose session pushes configuration
+     * receives later updates over ConnectSupervisor and stops polling.
      *
      * @generated from rpc openshell.v1.OpenShell.GetSandboxConfig
      */
@@ -9036,7 +9724,9 @@ export declare const OpenShell: GenService<{
         output: typeof ReportSandboxConfigurationResponseSchema;
     };
     /**
-     * Get provider environment for a sandbox (called by sandbox supervisor at startup).
+     * Get provider environment for a sandbox (called by the sandbox supervisor at
+     * startup and by its poll loop). Polling projection of the provider
+     * environment delivered over ConnectSupervisor; removed with the polling RPCs.
      *
      * @generated from rpc openshell.v1.OpenShell.GetSandboxProviderEnvironment
      */
@@ -9081,9 +9771,11 @@ export declare const OpenShell: GenService<{
      *
      * The supervisor opens this stream at startup and keeps it alive for the
      * sandbox lifetime. The gateway uses it to coordinate relay channels for
-     * SSH connect, ExecSandbox, and targetable sandbox services. Raw service
-     * bytes flow over RelayStream calls (separate HTTP/2 streams on the same
-     * connection), not over this stream.
+     * SSH connect, ExecSandbox, targetable sandbox services, and configuration
+     * delivery. Supervisors advertise optional stream features in
+     * SupervisorHello, and the gateway sends only payloads the supervisor
+     * advertises. Raw service bytes flow over RelayStream calls (separate HTTP/2
+     * streams on the same connection), not over this stream.
      *
      * @generated from rpc openshell.v1.OpenShell.ConnectSupervisor
      */
@@ -9174,6 +9866,17 @@ export declare const OpenShell: GenService<{
         input: typeof GetSandboxProviderStatusRequestSchema;
         output: typeof GetSandboxProviderStatusResponseSchema;
     };
+    /**
+     * Best-effort notification to the replica that owns a supervisor session.
+     * The receiver rebuilds snapshots from authoritative state.
+     *
+     * @generated from rpc openshell.v1.OpenShell.PeerNotifyConfigUpdate
+     */
+    peerNotifyConfigUpdate: {
+        methodKind: "unary";
+        input: typeof PeerNotifyConfigUpdateRequestSchema;
+        output: typeof PeerNotifyConfigUpdateResponseSchema;
+    };
     /**
      * Watch a sandbox and stream updates.
      *