@openkaiden/opnshll-sdk 0.1.4 → 0.1.6

package/dist/gen/openshell_pb.d.ts

@@ -1,7 +1,7 @@
 import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
 import type { ObjectMeta, Provider, Workspace, WorkspaceSelector } from "./datamodel_pb.js";
 import type { Duration, Timestamp } from "@bufbuild/protobuf/wkt";
-import type { GetGatewayConfigRequestSchema, GetGatewayConfigResponseSchema, GetSandboxConfigRequestSchema, GetSandboxConfigResponseSchema, L7DenyRule, L7Rule, NetworkBinary, NetworkEndpoint, NetworkPolicyRule, PolicySource, SandboxPolicy, SettingValue } from "./sandbox_pb.js";
+import type { GetGatewayConfigRequestSchema, GetGatewayConfigResponseSchema, GetSandboxConfigRequestSchema, GetSandboxConfigResponseSchema, L7DenyRule, L7Rule, NetworkBinary, NetworkEndpoint, NetworkPolicyRule, PolicySource, SandboxConfigSnapshot, SandboxPolicy, SettingValue } from "./sandbox_pb.js";
 import type { JsonObject, Message } from "@bufbuild/protobuf";
 /**
  * Describes the file openshell.proto.
@@ -967,6 +967,14 @@ export type SandboxStatus = Message<"openshell.v1.SandboxStatus"> & {
      * @generated from field: google.protobuf.Timestamp main_process_started_time = 16;
      */
     mainProcessStartedTime?: Timestamp | undefined;
+    /**
+     * Latest refused token grant across all outbound HTTP protocols, including
+     * failures before a configured endpoint or credential could be selected.
+     * Matching grant success or a policy, provider, or supervisor reset clears it.
+     *
+     * @generated from field: openshell.v1.TokenGrantFailureObservation last_token_grant_failure = 17;
+     */
+    lastTokenGrantFailure?: TokenGrantFailureObservation | undefined;
 };
 /**
  * Describes the message openshell.v1.SandboxStatus.
@@ -1096,7 +1104,8 @@ export type CreateSandboxRequest = Message<"openshell.v1.CreateSandboxRequest">
         [key: string]: string;
     };
     /**
-     * Optional annotations for the sandbox (non-selector metadata).
+     * Optional annotations for the sandbox (non-selector metadata). Keys under
+     * the `internal.openshell.ai/` prefix are reserved for the gateway.
      *
      * @generated from field: map<string, string> annotations = 4;
      */
@@ -1652,6 +1661,57 @@ export type StartSandboxRequest = Message<"openshell.v1.StartSandboxRequest"> &
  * Use `create(StartSandboxRequestSchema)` to create a new message.
  */
 export declare const StartSandboxRequestSchema: GenMessage<StartSandboxRequest>;
+/**
+ * Suspend sandbox request.
+ *
+ * @generated from message openshell.v1.SuspendSandboxRequest
+ */
+export type SuspendSandboxRequest = Message<"openshell.v1.SuspendSandboxRequest"> & {
+    /**
+     * Workspace scope. Only a named workspace selection is accepted.
+     *
+     * @generated from field: openshell.datamodel.v1.WorkspaceSelector workspace_scope = 2;
+     */
+    workspaceScope?: WorkspaceSelector | undefined;
+    /**
+     * @generated from field: string name = 1;
+     */
+    name: string;
+};
+/**
+ * Describes the message openshell.v1.SuspendSandboxRequest.
+ * Use `create(SuspendSandboxRequestSchema)` to create a new message.
+ */
+export declare const SuspendSandboxRequestSchema: GenMessage<SuspendSandboxRequest>;
+/**
+ * Resume sandbox request.
+ *
+ * @generated from message openshell.v1.ResumeSandboxRequest
+ */
+export type ResumeSandboxRequest = Message<"openshell.v1.ResumeSandboxRequest"> & {
+    /**
+     * Workspace scope. Only a named workspace selection is accepted.
+     *
+     * @generated from field: openshell.datamodel.v1.WorkspaceSelector workspace_scope = 2;
+     */
+    workspaceScope?: WorkspaceSelector | undefined;
+    /**
+     * @generated from field: string name = 1;
+     */
+    name: string;
+    /**
+     * If true, the isolation backend may boot the workload cleanly when it
+     * cannot restore the retained memory state. If false, resume fails instead.
+     *
+     * @generated from field: bool restart_if_restore_fails = 3;
+     */
+    restartIfRestoreFails: boolean;
+};
+/**
+ * Describes the message openshell.v1.ResumeSandboxRequest.
+ * Use `create(ResumeSandboxRequestSchema)` to create a new message.
+ */
+export declare const ResumeSandboxRequestSchema: GenMessage<ResumeSandboxRequest>;
 /**
  * Sandbox response.
  *
@@ -4713,7 +4773,9 @@ export type StaticCredentialBinding = Message<"openshell.v1.StaticCredentialBind
  */
 export declare const StaticCredentialBindingSchema: GenMessage<StaticCredentialBinding>;
 /**
- * Get sandbox provider environment response.
+ * Polling projection of ProviderEnvironmentSnapshot. The parallel maps below
+ * are keyed by the same environment variable names. Removed with the polling
+ * RPCs; new provider environment fields belong on the snapshot first.
  *
  * @generated from message openshell.v1.GetSandboxProviderEnvironmentResponse
  */
@@ -4817,6 +4879,101 @@ export type GetSandboxProviderEnvironmentResponse = Message<"openshell.v1.GetSan
  * Use `create(GetSandboxProviderEnvironmentResponseSchema)` to create a new message.
  */
 export declare const GetSandboxProviderEnvironmentResponseSchema: GenMessage<GetSandboxProviderEnvironmentResponse>;
+/**
+ * One environment value and all metadata that shares its key. Names are unique
+ * within a snapshot. static_credential_binding is present exactly when
+ * classification is STATIC_CREDENTIAL. Snapshots that violate either rule are
+ * invalid.
+ *
+ * @generated from message openshell.v1.ProviderEnvironmentValue
+ */
+export type ProviderEnvironmentValue = Message<"openshell.v1.ProviderEnvironmentValue"> & {
+    /**
+     * @generated from field: string name = 1;
+     */
+    name: string;
+    /**
+     * @generated from field: string value = 2;
+     */
+    value: string;
+    /**
+     * @generated from field: openshell.v1.ProviderEnvironmentValueClassification classification = 4;
+     */
+    classification: ProviderEnvironmentValueClassification;
+    /**
+     * @generated from field: openshell.v1.StaticCredentialBinding static_credential_binding = 5;
+     */
+    staticCredentialBinding?: StaticCredentialBinding | undefined;
+    /**
+     * Absolute expiration time. Absence means no expiry.
+     *
+     * @generated from field: google.protobuf.Timestamp expiration_time = 3;
+     */
+    expirationTime?: Timestamp | undefined;
+    /**
+     * The static credential keeps one opaque resolver handle across value-only
+     * provider revisions. Set only for STATIC_CREDENTIAL values whose binding
+     * carries a workload_credential_handle.
+     *
+     * @generated from field: bool stable_placeholder = 6;
+     */
+    stablePlaceholder: boolean;
+};
+/**
+ * Describes the message openshell.v1.ProviderEnvironmentValue.
+ * Use `create(ProviderEnvironmentValueSchema)` to create a new message.
+ */
+export declare const ProviderEnvironmentValueSchema: GenMessage<ProviderEnvironmentValue>;
+/**
+ * Complete provider environment state delivered to a supervisor. This is the
+ * canonical provider environment shape; GetSandboxProviderEnvironmentResponse
+ * is its polling projection and is removed with the polling RPCs. Dynamic
+ * credentials are endpoint selectors rather than environment values and stay
+ * in their own collection.
+ *
+ * @generated from message openshell.v1.ProviderEnvironmentSnapshot
+ */
+export type ProviderEnvironmentSnapshot = Message<"openshell.v1.ProviderEnvironmentSnapshot"> & {
+    /**
+     * @generated from field: uint64 provider_env_revision = 1;
+     */
+    providerEnvRevision: bigint;
+    /**
+     * @generated from field: repeated openshell.v1.ProviderEnvironmentValue values = 2;
+     */
+    values: ProviderEnvironmentValue[];
+    /**
+     * @generated from field: map<string, openshell.v1.ProviderProfileCredential> dynamic_credentials = 3;
+     */
+    dynamicCredentials: {
+        [key: string]: ProviderProfileCredential;
+    };
+    /**
+     * @generated from field: string provider_attachment_epoch = 4;
+     */
+    providerAttachmentEpoch: string;
+    /**
+     * @generated from field: string policy_hash = 5;
+     */
+    policyHash: string;
+    /**
+     * @generated from field: openshell.v1.ProviderReadinessReason readiness_reason = 6;
+     */
+    readinessReason: ProviderReadinessReason;
+    /**
+     * Complete desired set of non-secret managed files, keyed by absolute path.
+     *
+     * @generated from field: map<string, string> files = 7;
+     */
+    files: {
+        [key: string]: string;
+    };
+};
+/**
+ * Describes the message openshell.v1.ProviderEnvironmentSnapshot.
+ * Use `create(ProviderEnvironmentSnapshotSchema)` to create a new message.
+ */
+export declare const ProviderEnvironmentSnapshotSchema: GenMessage<ProviderEnvironmentSnapshot>;
 /**
  * @generated from message openshell.v1.ExchangeProviderSubjectTokenRequest
  */
@@ -4946,7 +5103,8 @@ export type UpdateConfigRequest = Message<"openshell.v1.UpdateConfigRequest"> &
      * not interpret or verify their semantics. For policy updates, the gateway
      * stores the annotations immutably with the revision and merges them into
      * sandbox metadata as a convenience projection. For setting-only updates, it
-     * only merges them into sandbox metadata.
+     * only merges them into sandbox metadata. Keys under the
+     * `internal.openshell.ai/` prefix are reserved for the gateway.
      *
      * @generated from field: map<string, string> annotations = 9;
      */
@@ -5669,6 +5827,12 @@ export type SupervisorMessage = Message<"openshell.v1.SupervisorMessage"> & {
          */
         value: RelayClose;
         case: "relayClose";
+    } | {
+        /**
+         * @generated from field: openshell.v1.ConfigUpdateResult config_update_result = 5;
+         */
+        value: ConfigUpdateResult;
+        case: "configUpdateResult";
     } | {
         case: undefined;
         value?: undefined;
@@ -5724,6 +5888,12 @@ export type GatewayMessage = Message<"openshell.v1.GatewayMessage"> & {
          */
         value: SessionRedirect;
         case: "sessionRedirect";
+    } | {
+        /**
+         * @generated from field: openshell.v1.ConfigUpdate config_update = 7;
+         */
+        value: ConfigUpdate;
+        case: "configUpdate";
     } | {
         case: undefined;
         value?: undefined;
@@ -5781,6 +5951,15 @@ export type SupervisorHello = Message<"openshell.v1.SupervisorHello"> & {
      * @generated from field: bool supports_session_redirect = 6;
      */
     supportsSessionRedirect: boolean;
+    /**
+     * The supervisor can receive its configuration over this stream instead of
+     * polling for it: it applies the bootstrap ConfigUpdate and later
+     * ConfigUpdate payloads, and answers each with its result and admission.
+     * Gateways push configuration only to supervisors that set this.
+     *
+     * @generated from field: bool supports_config_push = 7;
+     */
+    supportsConfigPush: boolean;
 };
 /**
  * Describes the message openshell.v1.SupervisorHello.
@@ -5799,6 +5978,22 @@ export type SessionAccepted = Message<"openshell.v1.SessionAccepted"> & {
      * @generated from field: string session_id = 1;
      */
     sessionId: string;
+    /**
+     * The session's first configuration update. Present exactly when
+     * config_push_enabled is set.
+     *
+     * @generated from field: openshell.v1.ConfigUpdate bootstrap = 3;
+     */
+    bootstrap?: ConfigUpdate | undefined;
+    /**
+     * The gateway pushes configuration authoritatively on this stream instead
+     * of the supervisor polling for it: the bootstrap is required, ConfigUpdate
+     * payloads are applied and acknowledged, and the supervisor stops polling.
+     * Set only for supervisors that set SupervisorHello.supports_config_push.
+     *
+     * @generated from field: bool config_push_enabled = 4;
+     */
+    configPushEnabled: boolean;
     /**
      * Recommended heartbeat interval.
      *
@@ -5811,6 +6006,131 @@ export type SessionAccepted = Message<"openshell.v1.SessionAccepted"> & {
  * Use `create(SessionAcceptedSchema)` to create a new message.
  */
 export declare const SessionAcceptedSchema: GenMessage<SessionAccepted>;
+/**
+ * Complete gateway-owned configuration for a supervisor session. Each update
+ * replaces the previous one. The supervisor applies the two parts together
+ * and answers every update with one ConfigUpdateResult before the gateway
+ * sends the next.
+ *
+ * @generated from message openshell.v1.ConfigUpdate
+ */
+export type ConfigUpdate = Message<"openshell.v1.ConfigUpdate"> & {
+    /**
+     * Opaque non-empty identifier scoped to the active supervisor session.
+     *
+     * @generated from field: string update_id = 1;
+     */
+    updateId: string;
+    /**
+     * @generated from field: openshell.sandbox.v1.SandboxConfigSnapshot sandbox_config = 2;
+     */
+    sandboxConfig?: SandboxConfigSnapshot | undefined;
+    /**
+     * The provider environment the sandbox configuration names through its
+     * provider revision, attachment epoch, and policy hash.
+     *
+     * @generated from field: openshell.v1.ProviderEnvironmentSnapshot provider_environment = 3;
+     */
+    providerEnvironment?: ProviderEnvironmentSnapshot | undefined;
+};
+/**
+ * Describes the message openshell.v1.ConfigUpdate.
+ * Use `create(ConfigUpdateSchema)` to create a new message.
+ */
+export declare const ConfigUpdateSchema: GenMessage<ConfigUpdate>;
+/**
+ * Sanitized application failure. Messages must not contain configuration
+ * payloads, credentials, or provider values.
+ *
+ * @generated from message openshell.v1.ConfigApplyFailure
+ */
+export type ConfigApplyFailure = Message<"openshell.v1.ConfigApplyFailure"> & {
+    /**
+     * @generated from field: string code = 1;
+     */
+    code: string;
+    /**
+     * @generated from field: string message = 2;
+     */
+    message: string;
+    /**
+     * @generated from field: bool retryable = 3;
+     */
+    retryable: boolean;
+};
+/**
+ * Describes the message openshell.v1.ConfigApplyFailure.
+ * Use `create(ConfigApplyFailureSchema)` to create a new message.
+ */
+export declare const ConfigApplyFailureSchema: GenMessage<ConfigApplyFailure>;
+/**
+ * Application result for one ConfigUpdate, including the bootstrap.
+ *
+ * @generated from message openshell.v1.ConfigUpdateResult
+ */
+export type ConfigUpdateResult = Message<"openshell.v1.ConfigUpdateResult"> & {
+    /**
+     * Echoes ConfigUpdate.update_id for session-local correlation.
+     *
+     * @generated from field: string update_id = 1;
+     */
+    updateId: string;
+    /**
+     * @generated from field: openshell.v1.ConfigApplyOutcome outcome = 2;
+     */
+    outcome: ConfigApplyOutcome;
+    /**
+     * Why the update did not take effect. Omitted when it did.
+     *
+     * @generated from field: openshell.v1.ConfigApplyFailure failure = 3;
+     */
+    failure?: ConfigApplyFailure | undefined;
+    /**
+     * Admission state of the delivered sandbox configuration.
+     *
+     * @generated from field: openshell.v1.SandboxConfigurationAdmission admission = 4;
+     */
+    admission?: SandboxConfigurationAdmission | undefined;
+    /**
+     * Load result of the sandbox policy revision the update changed, as a
+     * polling supervisor reports it with ReportPolicyStatus. Omitted when the
+     * update did not change the sandbox policy.
+     *
+     * @generated from field: openshell.v1.PolicyLoadResult policy_load = 5;
+     */
+    policyLoad?: PolicyLoadResult | undefined;
+};
+/**
+ * Describes the message openshell.v1.ConfigUpdateResult.
+ * Use `create(ConfigUpdateResultSchema)` to create a new message.
+ */
+export declare const ConfigUpdateResultSchema: GenMessage<ConfigUpdateResult>;
+/**
+ * Load result of one sandbox policy revision.
+ *
+ * @generated from message openshell.v1.PolicyLoadResult
+ */
+export type PolicyLoadResult = Message<"openshell.v1.PolicyLoadResult"> & {
+    /**
+     * @generated from field: uint32 version = 1;
+     */
+    version: number;
+    /**
+     * @generated from field: bool loaded = 2;
+     */
+    loaded: boolean;
+    /**
+     * Sanitized load error. Empty when loaded.
+     *
+     * @generated from field: string error = 3;
+     */
+    error: string;
+};
+/**
+ * Describes the message openshell.v1.PolicyLoadResult.
+ * Use `create(PolicyLoadResultSchema)` to create a new message.
+ */
+export declare const PolicyLoadResultSchema: GenMessage<PolicyLoadResult>;
 /**
  * Gateway rejects the supervisor session.
  *
@@ -6147,6 +6467,103 @@ export type PeerRelayFrame = Message<"openshell.v1.PeerRelayFrame"> & {
  * Use `create(PeerRelayFrameSchema)` to create a new message.
  */
 export declare const PeerRelayFrameSchema: GenMessage<PeerRelayFrame>;
+/**
+ * @generated from message openshell.v1.PeerConfigSandboxTarget
+ */
+export type PeerConfigSandboxTarget = Message<"openshell.v1.PeerConfigSandboxTarget"> & {
+    /**
+     * @generated from field: string sandbox_id = 1;
+     */
+    sandboxId: string;
+    /**
+     * Fences a targeted notification to the session observed by the sending replica.
+     *
+     * @generated from field: string session_id = 2;
+     */
+    sessionId: string;
+};
+/**
+ * Describes the message openshell.v1.PeerConfigSandboxTarget.
+ * Use `create(PeerConfigSandboxTargetSchema)` to create a new message.
+ */
+export declare const PeerConfigSandboxTargetSchema: GenMessage<PeerConfigSandboxTarget>;
+/**
+ * Sandboxes in a workspace that attach the named provider.
+ *
+ * @generated from message openshell.v1.PeerConfigProviderTarget
+ */
+export type PeerConfigProviderTarget = Message<"openshell.v1.PeerConfigProviderTarget"> & {
+    /**
+     * @generated from field: string workspace = 1;
+     */
+    workspace: string;
+    /**
+     * @generated from field: string name = 2;
+     */
+    name: string;
+};
+/**
+ * Describes the message openshell.v1.PeerConfigProviderTarget.
+ * Use `create(PeerConfigProviderTargetSchema)` to create a new message.
+ */
+export declare const PeerConfigProviderTargetSchema: GenMessage<PeerConfigProviderTarget>;
+/**
+ * @generated from message openshell.v1.PeerNotifyConfigUpdateRequest
+ */
+export type PeerNotifyConfigUpdateRequest = Message<"openshell.v1.PeerNotifyConfigUpdateRequest"> & {
+    /**
+     * @generated from oneof openshell.v1.PeerNotifyConfigUpdateRequest.scope
+     */
+    scope: {
+        /**
+         * @generated from field: openshell.v1.PeerConfigSandboxTarget sandbox = 1;
+         */
+        value: PeerConfigSandboxTarget;
+        case: "sandbox";
+    } | {
+        /**
+         * @generated from field: string workspace = 2;
+         */
+        value: string;
+        case: "workspace";
+    } | {
+        /**
+         * @generated from field: bool all_connected = 3;
+         */
+        value: boolean;
+        case: "allConnected";
+    } | {
+        /**
+         * @generated from field: openshell.v1.PeerConfigProviderTarget provider = 4;
+         */
+        value: PeerConfigProviderTarget;
+        case: "provider";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message openshell.v1.PeerNotifyConfigUpdateRequest.
+ * Use `create(PeerNotifyConfigUpdateRequestSchema)` to create a new message.
+ */
+export declare const PeerNotifyConfigUpdateRequestSchema: GenMessage<PeerNotifyConfigUpdateRequest>;
+/**
+ * @generated from message openshell.v1.PeerNotifyConfigUpdateResponse
+ */
+export type PeerNotifyConfigUpdateResponse = Message<"openshell.v1.PeerNotifyConfigUpdateResponse"> & {
+    /**
+     * The targeted session moved before the receiving replica accepted the notification.
+     *
+     * @generated from field: bool stale_owner = 1;
+     */
+    staleOwner: boolean;
+};
+/**
+ * Describes the message openshell.v1.PeerNotifyConfigUpdateResponse.
+ * Use `create(PeerNotifyConfigUpdateResponseSchema)` to create a new message.
+ */
+export declare const PeerNotifyConfigUpdateResponseSchema: GenMessage<PeerNotifyConfigUpdateResponse>;
 /**
  * Supervisor reports the result of a relay open request.
  *
@@ -7605,6 +8022,13 @@ export type EndpointObservation = Message<"openshell.v1.EndpointObservation"> &
      * @generated from field: openshell.v1.EndpointResult result = 2;
      */
     result: EndpointResult;
+    /**
+     * Bounded cause of result, when the supervisor classified it. Each failure
+     * domain names the results it can explain.
+     *
+     * @generated from field: openshell.v1.EndpointFailure failure = 3;
+     */
+    failure?: EndpointFailure | undefined;
 };
 /**
  * Describes the message openshell.v1.EndpointObservation.
@@ -7662,12 +8086,67 @@ export type ReportEndpointStatusRequest = Message<"openshell.v1.ReportEndpointSt
      * @generated from field: uint64 report_sequence = 7;
      */
     reportSequence: bigint;
+    /**
+     * Complete latest grant state. Omission retains legacy compatibility;
+     * a present message with no last_failure explicitly clears the prior cause.
+     *
+     * @generated from field: openshell.v1.TokenGrantStatus token_grant_status = 8;
+     */
+    tokenGrantStatus?: TokenGrantStatus | undefined;
 };
 /**
  * Describes the message openshell.v1.ReportEndpointStatusRequest.
  * Use `create(ReportEndpointStatusRequestSchema)` to create a new message.
  */
 export declare const ReportEndpointStatusRequestSchema: GenMessage<ReportEndpointStatusRequest>;
+/**
+ * Latest token-grant state sent by the authenticated supervisor.
+ *
+ * @generated from message openshell.v1.TokenGrantStatus
+ */
+export type TokenGrantStatus = Message<"openshell.v1.TokenGrantStatus"> & {
+    /**
+     * @generated from field: openshell.v1.TokenGrantFailureObservation last_failure = 1;
+     */
+    lastFailure?: TokenGrantFailureObservation | undefined;
+};
+/**
+ * Describes the message openshell.v1.TokenGrantStatus.
+ * Use `create(TokenGrantStatusSchema)` to create a new message.
+ */
+export declare const TokenGrantStatusSchema: GenMessage<TokenGrantStatus>;
+/**
+ * A refused grant and its destination, without request paths or remote text.
+ * This describes the failed attempt, not the destination's current health.
+ *
+ * @generated from message openshell.v1.TokenGrantFailureObservation
+ */
+export type TokenGrantFailureObservation = Message<"openshell.v1.TokenGrantFailureObservation"> & {
+    /**
+     * Canonical observed host or IP address, bounded to 253 ASCII bytes.
+     *
+     * @generated from field: string destination_host = 1;
+     */
+    destinationHost: string;
+    /**
+     * Observed destination port in the range 1 through 65535.
+     *
+     * @generated from field: uint32 destination_port = 2;
+     */
+    destinationPort: number;
+    /**
+     * Bounded token_grant cause. Provider and credential may be absent when
+     * selection failed; the request ID still identifies the refused exchange.
+     *
+     * @generated from field: openshell.v1.EndpointFailure failure = 3;
+     */
+    failure?: EndpointFailure | undefined;
+};
+/**
+ * Describes the message openshell.v1.TokenGrantFailureObservation.
+ * Use `create(TokenGrantFailureObservationSchema)` to create a new message.
+ */
+export declare const TokenGrantFailureObservationSchema: GenMessage<TokenGrantFailureObservation>;
 /**
  * Empty acknowledgement for a persisted endpoint status report.
  *
@@ -7726,6 +8205,15 @@ export type EndpointStatus = Message<"openshell.v1.EndpointStatus"> & {
      * @generated from field: google.protobuf.Timestamp last_reported_time = 106;
      */
     lastReportedTime?: Timestamp | undefined;
+    /**
+     * Bounded cause of last_result, when the supervisor classified it. Each
+     * failure domain names the results it can explain. Replaced or cleared by
+     * every later observation, and cleared by the same resets that clear
+     * last_result.
+     *
+     * @generated from field: openshell.v1.EndpointFailure last_failure = 7;
+     */
+    lastFailure?: EndpointFailure | undefined;
 };
 /**
  * Describes the message openshell.v1.EndpointStatus.
@@ -7862,6 +8350,70 @@ export type SandboxServiceExposure = Message<"openshell.v1.SandboxServiceExposur
  * Use `create(SandboxServiceExposureSchema)` to create a new message.
  */
 export declare const SandboxServiceExposureSchema: GenMessage<SandboxServiceExposure>;
+/**
+ * Bounded cause of a failed endpoint observation, including failures before
+ * any request reaches the endpoint. No field carries remote
+ * text: code and stage come from the domain's closed sets, provider and
+ * credential_key are configured names, and request_id is an opaque random ID.
+ *
+ * @generated from message openshell.v1.EndpointFailure
+ */
+export type EndpointFailure = Message<"openshell.v1.EndpointFailure"> & {
+    /**
+     * @generated from field: openshell.v1.EndpointFailureDomain domain = 1;
+     */
+    domain: EndpointFailureDomain;
+    /**
+     * Stable lower_snake_case code from the domain's closed set, such as
+     * provider_authorization_required.
+     *
+     * @generated from field: string code = 2;
+     */
+    code: string;
+    /**
+     * Who can resolve the failure; always the action documented for the code.
+     *
+     * @generated from field: openshell.v1.ProviderCredentialRefreshRecoveryAction recovery_action = 3;
+     */
+    recoveryAction: ProviderCredentialRefreshRecoveryAction;
+    /**
+     * Provider whose credential failed. Empty when the failure happened before
+     * a credential was selected.
+     *
+     * @generated from field: string provider = 4;
+     */
+    provider: string;
+    /**
+     * Credential name within the provider. Never a credential value.
+     *
+     * @generated from field: string credential_key = 5;
+     */
+    credentialKey: string;
+    /**
+     * Step that observed the failure, from the domain's closed set.
+     *
+     * @generated from field: string stage = 6;
+     */
+    stage: string;
+    /**
+     * HTTP status a token service returned, when one was received.
+     *
+     * @generated from field: optional uint32 upstream_http_status = 7;
+     */
+    upstreamHttpStatus?: number | undefined;
+    /**
+     * Supervisor-minted UUID of the refused exchange. The workload receives the
+     * same value in the x-openshell-request-id response header.
+     *
+     * @generated from field: string request_id = 8;
+     */
+    requestId: string;
+};
+/**
+ * Describes the message openshell.v1.EndpointFailure.
+ * Use `create(EndpointFailureSchema)` to create a new message.
+ */
+export declare const EndpointFailureSchema: GenMessage<EndpointFailure>;
 /**
  * @generated from enum openshell.v1.ExtensionKind
  */
@@ -7941,7 +8493,20 @@ export declare enum SandboxPhase {
      *
      * @generated from enum value: SANDBOX_PHASE_COMPLETED = 9;
      */
-    COMPLETED = 9
+    COMPLETED = 9,
+    /**
+     * The gateway requested suspension and the driver has not confirmed it.
+     *
+     * @generated from enum value: SANDBOX_PHASE_SUSPENDING = 11;
+     */
+    SUSPENDING = 11,
+    /**
+     * The workload is frozen and its memory state is retained by the isolation
+     * backend. ResumeSandbox restores it; StartSandbox discards it.
+     *
+     * @generated from enum value: SANDBOX_PHASE_SUSPENDED = 12;
+     */
+    SUSPENDED = 12
 }
 /**
  * Describes the enum openshell.v1.SandboxPhase.
@@ -8312,6 +8877,29 @@ export declare enum ProviderProfileCategory {
  * Describes the enum openshell.v1.ProviderProfileCategory.
  */
 export declare const ProviderProfileCategorySchema: GenEnum<ProviderProfileCategory>;
+/**
+ * Receivers treat UNSPECIFIED and unknown values as secret.
+ *
+ * @generated from enum openshell.v1.ProviderEnvironmentValueClassification
+ */
+export declare enum ProviderEnvironmentValueClassification {
+    /**
+     * @generated from enum value: PROVIDER_ENVIRONMENT_VALUE_CLASSIFICATION_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: PROVIDER_ENVIRONMENT_VALUE_CLASSIFICATION_NON_SECRET = 1;
+     */
+    NON_SECRET = 1,
+    /**
+     * @generated from enum value: PROVIDER_ENVIRONMENT_VALUE_CLASSIFICATION_STATIC_CREDENTIAL = 2;
+     */
+    STATIC_CREDENTIAL = 2
+}
+/**
+ * Describes the enum openshell.v1.ProviderEnvironmentValueClassification.
+ */
+export declare const ProviderEnvironmentValueClassificationSchema: GenEnum<ProviderEnvironmentValueClassification>;
 /**
  * @generated from enum openshell.v1.ConfigurationAdmissionState
  */
@@ -8621,6 +9209,32 @@ export declare enum ServiceAuthorizationMode {
  * Describes the enum openshell.v1.ServiceAuthorizationMode.
  */
 export declare const ServiceAuthorizationModeSchema: GenEnum<ServiceAuthorizationMode>;
+/**
+ * Subsystem whose closed code set explains an endpoint failure. Each domain
+ * defines its codes, stages, recovery actions, and the endpoint results it
+ * can explain. Kept at the end of the file so adding it does not renumber
+ * existing generated descriptors.
+ *
+ * @generated from enum openshell.v1.EndpointFailureDomain
+ */
+export declare enum EndpointFailureDomain {
+    /**
+     * @generated from enum value: ENDPOINT_FAILURE_DOMAIN_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * A dynamic token grant for a provider credential failed, so OpenShell
+     * refused the request before any of it reached the endpoint. Explains
+     * ENDPOINT_RESULT_CREDENTIAL_UNAVAILABLE.
+     *
+     * @generated from enum value: ENDPOINT_FAILURE_DOMAIN_TOKEN_GRANT = 1;
+     */
+    TOKEN_GRANT = 1
+}
+/**
+ * Describes the enum openshell.v1.EndpointFailureDomain.
+ */
+export declare const EndpointFailureDomainSchema: GenEnum<EndpointFailureDomain>;
 /**
  * OpenShell service provides sandbox, provider, and runtime management capabilities.
  *
@@ -8821,6 +9435,28 @@ export declare const OpenShell: GenService<{
         input: typeof StartSandboxRequestSchema;
         output: typeof SandboxResponseSchema;
     };
+    /**
+     * Freeze a ready sandbox and retain its memory state for a later resume.
+     * Requires a compute driver and isolation backend that support state
+     * retention.
+     *
+     * @generated from rpc openshell.v1.OpenShell.SuspendSandbox
+     */
+    suspendSandbox: {
+        methodKind: "unary";
+        input: typeof SuspendSandboxRequestSchema;
+        output: typeof SandboxResponseSchema;
+    };
+    /**
+     * Restore a suspended sandbox in a new runtime generation.
+     *
+     * @generated from rpc openshell.v1.OpenShell.ResumeSandbox
+     */
+    resumeSandbox: {
+        methodKind: "unary";
+        input: typeof ResumeSandboxRequestSchema;
+        output: typeof SandboxResponseSchema;
+    };
     /**
      * Create a short-lived SSH session for a sandbox.
      *
@@ -9075,7 +9711,9 @@ export declare const OpenShell: GenService<{
         output: typeof DeleteProviderProfileResponseSchema;
     };
     /**
-     * Get sandbox settings by id (called by sandbox entrypoint and poll loop).
+     * Get sandbox settings by id (called by users, and by supervisors at startup
+     * and in their poll loop). A supervisor whose session pushes configuration
+     * receives later updates over ConnectSupervisor and stops polling.
      *
      * @generated from rpc openshell.v1.OpenShell.GetSandboxConfig
      */
@@ -9172,7 +9810,9 @@ export declare const OpenShell: GenService<{
         output: typeof ReportSandboxConfigurationResponseSchema;
     };
     /**
-     * Get provider environment for a sandbox (called by sandbox supervisor at startup).
+     * Get provider environment for a sandbox (called by the sandbox supervisor at
+     * startup and by its poll loop). Polling projection of the provider
+     * environment delivered over ConnectSupervisor; removed with the polling RPCs.
      *
      * @generated from rpc openshell.v1.OpenShell.GetSandboxProviderEnvironment
      */
@@ -9217,9 +9857,11 @@ export declare const OpenShell: GenService<{
      *
      * The supervisor opens this stream at startup and keeps it alive for the
      * sandbox lifetime. The gateway uses it to coordinate relay channels for
-     * SSH connect, ExecSandbox, and targetable sandbox services. Raw service
-     * bytes flow over RelayStream calls (separate HTTP/2 streams on the same
-     * connection), not over this stream.
+     * SSH connect, ExecSandbox, targetable sandbox services, and configuration
+     * delivery. Supervisors advertise optional stream features in
+     * SupervisorHello, and the gateway sends only payloads the supervisor
+     * advertises. Raw service bytes flow over RelayStream calls (separate HTTP/2
+     * streams on the same connection), not over this stream.
      *
      * @generated from rpc openshell.v1.OpenShell.ConnectSupervisor
      */
@@ -9310,6 +9952,17 @@ export declare const OpenShell: GenService<{
         input: typeof GetSandboxProviderStatusRequestSchema;
         output: typeof GetSandboxProviderStatusResponseSchema;
     };
+    /**
+     * Best-effort notification to the replica that owns a supervisor session.
+     * The receiver rebuilds snapshots from authoritative state.
+     *
+     * @generated from rpc openshell.v1.OpenShell.PeerNotifyConfigUpdate
+     */
+    peerNotifyConfigUpdate: {
+        methodKind: "unary";
+        input: typeof PeerNotifyConfigUpdateRequestSchema;
+        output: typeof PeerNotifyConfigUpdateResponseSchema;
+    };
     /**
      * Watch a sandbox and stream updates.
      *