# Secure Exec sidecar protocol schema, version 1.
# This schema is generator-ready: numeric ordinals are intentionally omitted
# and type blocks are ordered before first use.

type JsonUtf8 str

type ProtocolSchema struct {
  name: str
  version: u16
}

type RequestId i64

type ExtEnvelope struct {
  namespace: str
  payload: data
}

type ConnectionOwnership struct {
  connectionId: str
}

type SessionOwnership struct {
  connectionId: str
  sessionId: str
}

type VmOwnership struct {
  connectionId: str
  sessionId: str
  vmId: str
}

type OwnershipScope union {
  ConnectionOwnership |
  SessionOwnership |
  VmOwnership
}

type AuthenticateRequest struct {
  clientName: str
  authToken: str
  protocolVersion: u16
  bridgeVersion: u32
}

type SidecarPlacementShared struct {
  pool: optional<str>
}

type SidecarPlacementExplicit struct {
  sidecarId: str
}

type SidecarPlacement union {
  SidecarPlacementShared |
  SidecarPlacementExplicit
}

type OpenSessionRequest struct {
  placement: SidecarPlacement
  metadata: map<str><str>
}

type GuestRuntimeKind enum {
  JAVA_SCRIPT
  PYTHON
  WEB_ASSEMBLY
}

type RootFilesystemMode enum {
  EPHEMERAL
  READ_ONLY
}

type RootFilesystemEntryKind enum {
  FILE
  DIRECTORY
  SYMLINK
}

type RootFilesystemEntryEncoding enum {
  UTF8
  BASE64
}

type RootFilesystemEntry struct {
  path: str
  kind: RootFilesystemEntryKind
  mode: optional<u32>
  uid: optional<u32>
  gid: optional<u32>
  content: optional<str>
  encoding: optional<RootFilesystemEntryEncoding>
  target: optional<str>
  executable: bool
}

type SnapshotRootFilesystemLower struct {
  entries: list<RootFilesystemEntry>
}

type BundledBaseFilesystemLower void

type RootFilesystemLowerDescriptor union {
  SnapshotRootFilesystemLower |
  BundledBaseFilesystemLower
}

type RootFilesystemDescriptor struct {
  mode: RootFilesystemMode
  disableDefaultBaseLayer: bool
  lowers: list<RootFilesystemLowerDescriptor>
  bootstrapEntries: list<RootFilesystemEntry>
}

type PermissionMode enum {
  ALLOW
  ASK
  DENY
}

type FsPermissionRule struct {
  mode: PermissionMode
  operations: list<str>
  paths: list<str>
}

type FsPermissionRuleSet struct {
  default: optional<PermissionMode>
  rules: list<FsPermissionRule>
}

type FsPermissionScope union {
  PermissionMode |
  FsPermissionRuleSet
}

type PatternPermissionRule struct {
  mode: PermissionMode
  operations: list<str>
  patterns: list<str>
}

type PatternPermissionRuleSet struct {
  default: optional<PermissionMode>
  rules: list<PatternPermissionRule>
}

type PatternPermissionScope union {
  PermissionMode |
  PatternPermissionRuleSet
}

type PermissionsPolicy struct {
  fs: optional<FsPermissionScope>
  network: optional<PatternPermissionScope>
  childProcess: optional<PatternPermissionScope>
  process: optional<PatternPermissionScope>
  env: optional<PatternPermissionScope>
  binding: optional<PatternPermissionScope>
}

type CreateVmRequest struct {
  runtime: GuestRuntimeKind
  config: JsonUtf8
}

type DisposeReason enum {
  REQUESTED
  CONNECTION_CLOSED
  HOST_SHUTDOWN
}

type DisposeVmRequest struct {
  reason: DisposeReason
}

type BootstrapRootFilesystemRequest struct {
  entries: list<RootFilesystemEntry>
}

type MountPluginDescriptor struct {
  id: str
  config: JsonUtf8
}

type MountDescriptor struct {
  guestPath: str
  readOnly: bool
  plugin: MountPluginDescriptor
}

type SoftwareDescriptor struct {
  packageName: str
  root: str
}

type ProjectedModuleDescriptor struct {
  packageName: str
  entrypoint: str
}

type WasmPermissionTier enum {
  FULL
  READ_WRITE
  READ_ONLY
  ISOLATED
}

type ConfigureVmRequest struct {
  mounts: list<MountDescriptor>
  software: list<SoftwareDescriptor>
  permissions: optional<PermissionsPolicy>
  moduleAccessCwd: optional<str>
  instructions: list<str>
  projectedModules: list<ProjectedModuleDescriptor>
  commandPermissions: map<str><WasmPermissionTier>
  loopbackExemptPorts: list<u16>
}

type RegisteredHostCallbackExample struct {
  description: str
  input: JsonUtf8
}

type RegisteredHostCallbackDefinition struct {
  description: str
  inputSchema: JsonUtf8
  timeoutMs: optional<u64>
  examples: list<RegisteredHostCallbackExample>
}

type RegisterHostCallbacksRequest struct {
  name: str
  description: str
  commandAliases: list<str>
  registryCommandAliases: list<str>
  callbacks: map<str><RegisteredHostCallbackDefinition>
}

type CreateLayerRequest void

type SealLayerRequest struct {
  layerId: str
}

type ImportSnapshotRequest struct {
  entries: list<RootFilesystemEntry>
}

type ExportSnapshotRequest struct {
  layerId: str
}

type CreateOverlayRequest struct {
  mode: RootFilesystemMode
  upperLayerId: optional<str>
  lowerLayerIds: list<str>
}

type GuestFilesystemOperation enum {
  READ_FILE
  WRITE_FILE
  CREATE_DIR
  MKDIR
  EXISTS
  STAT
  LSTAT
  READ_DIR
  REMOVE_FILE
  REMOVE_DIR
  RENAME
  REALPATH
  SYMLINK
  READ_LINK
  LINK
  CHMOD
  CHOWN
  UTIMES
  TRUNCATE
  PREAD
}

type GuestFilesystemCallRequest struct {
  operation: GuestFilesystemOperation
  path: str
  destinationPath: optional<str>
  target: optional<str>
  content: optional<str>
  encoding: optional<RootFilesystemEntryEncoding>
  recursive: bool
  mode: optional<u32>
  uid: optional<u32>
  gid: optional<u32>
  atimeMs: optional<u64>
  mtimeMs: optional<u64>
  len: optional<u64>
  offset: optional<u64>
}

type SnapshotRootFilesystemRequest void

type ExecuteRequest struct {
  processId: str
  command: optional<str>
  runtime: optional<GuestRuntimeKind>
  entrypoint: optional<str>
  args: list<str>
  env: map<str><str>
  cwd: optional<str>
  wasmPermissionTier: optional<WasmPermissionTier>
}

type WriteStdinRequest struct {
  processId: str
  chunk: data
}

type CloseStdinRequest struct {
  processId: str
}

type KillProcessRequest struct {
  processId: str
  signal: str
}

type GetProcessSnapshotRequest void

type FindListenerRequest struct {
  host: optional<str>
  port: optional<u16>
  path: optional<str>
}

type FindBoundUdpRequest struct {
  host: optional<str>
  port: optional<u16>
}

type GetSignalStateRequest struct {
  processId: str
}

type GetZombieTimerCountRequest void

type FilesystemOperation enum {
  READ
  WRITE
  STAT
  READ_DIR
  MKDIR
  REMOVE
  RENAME
}

type HostFilesystemCallRequest struct {
  operation: FilesystemOperation
  path: str
  payloadSizeBytes: u64
}

type PersistenceLoadRequest struct {
  key: str
}

type PersistenceFlushRequest struct {
  key: str
  payloadSizeBytes: u64
}

type VmFetchRequest struct {
  port: u16
  method: str
  path: str
  headersJson: str
  body: optional<str>
}

type RequestPayload union {
  AuthenticateRequest |
  OpenSessionRequest |
  CreateVmRequest |
  DisposeVmRequest |
  BootstrapRootFilesystemRequest |
  ConfigureVmRequest |
  RegisterHostCallbacksRequest |
  CreateLayerRequest |
  SealLayerRequest |
  ImportSnapshotRequest |
  ExportSnapshotRequest |
  CreateOverlayRequest |
  GuestFilesystemCallRequest |
  SnapshotRootFilesystemRequest |
  ExecuteRequest |
  WriteStdinRequest |
  CloseStdinRequest |
  KillProcessRequest |
  GetProcessSnapshotRequest |
  FindListenerRequest |
  FindBoundUdpRequest |
  GetSignalStateRequest |
  GetZombieTimerCountRequest |
  HostFilesystemCallRequest |
  PersistenceLoadRequest |
  PersistenceFlushRequest |
  VmFetchRequest |
  ExtEnvelope
}

type RequestFrame struct {
  schema: ProtocolSchema
  requestId: RequestId
  ownership: OwnershipScope
  payload: RequestPayload
}

type AuthenticatedResponse struct {
  sidecarId: str
  connectionId: str
  maxFrameBytes: u32
}

type SessionOpenedResponse struct {
  sessionId: str
  ownerConnectionId: str
}

type VmCreatedResponse struct {
  vmId: str
}

type VmDisposedResponse struct {
  vmId: str
}

type RootFilesystemBootstrappedResponse struct {
  entryCount: u32
}

type VmConfiguredResponse struct {
  appliedMounts: u32
  appliedSoftware: u32
}

type HostCallbacksRegisteredResponse struct {
  registration: str
  commandCount: u32
}

type LayerCreatedResponse struct {
  layerId: str
}

type LayerSealedResponse struct {
  layerId: str
}

type SnapshotImportedResponse struct {
  layerId: str
}

type SnapshotExportedResponse struct {
  layerId: str
  entries: list<RootFilesystemEntry>
}

type OverlayCreatedResponse struct {
  layerId: str
}

type GuestFilesystemStat struct {
  mode: u32
  size: u64
  blocks: u64
  dev: u64
  rdev: u64
  isDirectory: bool
  isSymbolicLink: bool
  atimeMs: u64
  mtimeMs: u64
  ctimeMs: u64
  birthtimeMs: u64
  ino: u64
  nlink: u64
  uid: u32
  gid: u32
}

type GuestFilesystemResultResponse struct {
  operation: GuestFilesystemOperation
  path: str
  content: optional<str>
  encoding: optional<RootFilesystemEntryEncoding>
  entries: optional<list<str>>
  stat: optional<GuestFilesystemStat>
  exists: optional<bool>
  target: optional<str>
}

type RootFilesystemSnapshotResponse struct {
  entries: list<RootFilesystemEntry>
}

type ProcessStartedResponse struct {
  processId: str
  pid: optional<u32>
}

type StdinWrittenResponse struct {
  processId: str
  acceptedBytes: u64
}

type StdinClosedResponse struct {
  processId: str
}

type ProcessKilledResponse struct {
  processId: str
}

type ProcessSnapshotStatus enum {
  RUNNING
  EXITED
  STOPPED
}

type ProcessSnapshotEntry struct {
  processId: str
  pid: u32
  ppid: u32
  pgid: u32
  sid: u32
  driver: str
  command: str
  args: list<str>
  cwd: str
  status: ProcessSnapshotStatus
  exitCode: optional<i32>
}

type ProcessSnapshotResponse struct {
  processes: list<ProcessSnapshotEntry>
}

type SocketStateEntry struct {
  processId: str
  host: optional<str>
  port: optional<u16>
  path: optional<str>
}

type ListenerSnapshotResponse struct {
  listener: optional<SocketStateEntry>
}

type BoundUdpSnapshotResponse struct {
  socket: optional<SocketStateEntry>
}

type SignalDispositionAction enum {
  DEFAULT
  IGNORE
  USER
}

type SignalHandlerRegistration struct {
  action: SignalDispositionAction
  mask: list<u32>
  flags: u32
}

type SignalStateResponse struct {
  processId: str
  handlers: map<u32><SignalHandlerRegistration>
}

type ZombieTimerCountResponse struct {
  count: u64
}

type FilesystemResultResponse struct {
  operation: FilesystemOperation
  status: str
  payloadSizeBytes: u64
}

type PermissionDecisionResponse struct {
  capability: str
  decision: PermissionMode
}

type PersistenceStateResponse struct {
  key: str
  found: bool
  payloadSizeBytes: u64
}

type PersistenceFlushedResponse struct {
  key: str
  committedBytes: u64
}

type RejectedResponse struct {
  code: str
  message: str
}

type VmFetchResponse struct {
  responseJson: str
}

type ResponsePayload union {
  AuthenticatedResponse |
  SessionOpenedResponse |
  VmCreatedResponse |
  VmDisposedResponse |
  RootFilesystemBootstrappedResponse |
  VmConfiguredResponse |
  HostCallbacksRegisteredResponse |
  LayerCreatedResponse |
  LayerSealedResponse |
  SnapshotImportedResponse |
  SnapshotExportedResponse |
  OverlayCreatedResponse |
  GuestFilesystemResultResponse |
  RootFilesystemSnapshotResponse |
  ProcessStartedResponse |
  StdinWrittenResponse |
  StdinClosedResponse |
  ProcessKilledResponse |
  ProcessSnapshotResponse |
  ListenerSnapshotResponse |
  BoundUdpSnapshotResponse |
  SignalStateResponse |
  ZombieTimerCountResponse |
  FilesystemResultResponse |
  PermissionDecisionResponse |
  PersistenceStateResponse |
  PersistenceFlushedResponse |
  RejectedResponse |
  VmFetchResponse |
  ExtEnvelope
}

type ResponseFrame struct {
  schema: ProtocolSchema
  requestId: RequestId
  ownership: OwnershipScope
  payload: ResponsePayload
}

type VmLifecycleState enum {
  CREATING
  READY
  DISPOSING
  DISPOSED
  FAILED
}

type VmLifecycleEvent struct {
  state: VmLifecycleState
}

type StreamChannel enum {
  STDOUT
  STDERR
}

type ProcessOutputEvent struct {
  processId: str
  channel: StreamChannel
  chunk: data
}

type ProcessExitedEvent struct {
  processId: str
  exitCode: i32
}

type StructuredEvent struct {
  name: str
  detail: map<str><str>
}

type EventPayload union {
  VmLifecycleEvent |
  ProcessOutputEvent |
  ProcessExitedEvent |
  StructuredEvent |
  ExtEnvelope
}

type EventFrame struct {
  schema: ProtocolSchema
  ownership: OwnershipScope
  payload: EventPayload
}

type HostCallbackRequest struct {
  invocationId: str
  callbackKey: str
  input: JsonUtf8
  timeoutMs: u64
}

type JsBridgeCallRequest struct {
  callId: str
  mountId: str
  operation: str
  args: JsonUtf8
}

type SidecarRequestPayload union {
  HostCallbackRequest |
  JsBridgeCallRequest |
  ExtEnvelope
}

type SidecarRequestFrame struct {
  schema: ProtocolSchema
  requestId: RequestId
  ownership: OwnershipScope
  payload: SidecarRequestPayload
}

type HostCallbackResultResponse struct {
  invocationId: str
  result: optional<JsonUtf8>
  error: optional<str>
}

type JsBridgeResultResponse struct {
  callId: str
  result: optional<JsonUtf8>
  error: optional<str>
}

type SidecarResponsePayload union {
  HostCallbackResultResponse |
  JsBridgeResultResponse |
  ExtEnvelope
}

type SidecarResponseFrame struct {
  schema: ProtocolSchema
  requestId: RequestId
  ownership: OwnershipScope
  payload: SidecarResponsePayload
}

type ProtocolFrame union {
  RequestFrame |
  ResponseFrame |
  EventFrame |
  SidecarRequestFrame |
  SidecarResponseFrame
}
