OpenShell/crates/openshell-core/src/lib.rs

// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

//! `OpenShell` Core - shared library for `OpenShell` components.
//!
//! This crate provides:
//! - Protocol buffer definitions and generated code
//! - Configuration management
//! - Common error types
//! - Build version metadata

pub mod activity;
pub mod auth;
pub mod compute;
pub mod config;
pub mod container_paths;
pub mod denial;
pub mod driver_mounts;
pub mod driver_utils;
pub mod dynamic_credential_key;
pub mod dynamic_string_allowlist;
#[cfg(unix)]
pub mod e2fsprogs;
pub mod endpoint_failure;
pub mod endpoint_path;
pub mod endpoint_status;
pub mod error;
pub mod extension_protocol;
#[cfg(unix)]
pub mod external_driver_socket;
pub mod forward;
pub mod google_cloud;
pub mod gpu;
pub mod grpc_client;
pub mod host_pattern;
pub mod image;
pub mod isolation_registration;
pub mod jwt;
pub mod local_api_socket;
pub mod mcp;
pub mod metadata;
pub mod middleware;
pub mod net;
pub mod network_trust;
#[cfg(feature = "oauth")]
pub mod oauth;
pub mod paths;
pub mod policy;
pub use openshell_policy_schema::yaml;
pub mod policy_identity;
pub mod progress;
pub mod proposals;
pub mod proto;
pub mod proto_struct;
pub mod provider_credentials;
pub mod replica_routing;
pub mod resource_admission;
pub mod rpc_error;
pub mod sandbox_env;
pub mod sandbox_generation;
pub mod sandbox_session;
pub mod sandbox_update;
pub mod secrets;
pub mod settings;
pub mod shell;
pub mod spiffe;
pub mod telemetry;
pub mod time;
pub mod token_grant_failure;
pub mod transport_errors;
pub mod upload;

pub use config::{
    AppArmorProfile, Config, ExtensionBindingPolicy, GatewayAuthConfig,
    GatewayInterceptorBindingOverride, GatewayInterceptorBindingPolicy, GatewayInterceptorConfig,
    GatewayInterceptorFailurePolicy, GatewayInterceptorPhaseConfig, GatewayJwtConfig,
    GatewayProviderProfileSourceConfig, ImagePullPolicy, MtlsAuthConfig, OidcConfig,
    PolicyValidationFailureMode, TlsConfig, UpstreamProxyConfig,
};
pub use dynamic_string_allowlist::DynamicStringAllowlist;
pub use error::{ComputeDriverError, Error, Result};
pub use metadata::{
    GetResourceVersion, ObjectId, ObjectLabels, ObjectName, ObjectWorkspace, SetResourceVersion,
};
pub use network_trust::NetworkSupervisorTrustBundle;
pub use sandbox_session::{SandboxSessionId, SandboxSessionIdError};

/// Build version string derived from git metadata.
///
/// For local builds this is computed by `build.rs` from the exact release tag
/// or the latest merged stable tag using the guess-next-dev scheme (e.g.
/// `0.0.4-dev.6+g2bf9969ab`). In Docker/CI builds where `.git` is absent, it
/// falls back to `CARGO_PKG_VERSION`, which the build pipeline already stamps.
pub const VERSION: &str = match option_env!("OPENSHELL_GIT_VERSION") {
    Some(v) => v,
    None => env!("CARGO_PKG_VERSION"),
};

#[cfg(test)]
#[path = "../build_version.rs"]
mod build_version;

/// Encoded protobuf `FileDescriptorSet` for every proto in `proto/`.
///
/// Emitted by `build.rs` via `tonic_build::configure().file_descriptor_set_path(...)`.
/// Used by tests in `openshell-server` to enumerate every RPC and verify that
/// each one declares the `openshell.options.v1.authorization` proto option.
pub const FILE_DESCRIPTOR_SET: &[u8] = include_bytes!(env!("OPENSHELL_DESCRIPTOR_PATH"));

#[cfg(test)]
#[path = "../../../tests/support/environment.rs"]
mod test_environment;