From b72f8c2ee929d92f391fd760be9fc468f0939168 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 14:13:11 +0000
Subject: [PATCH] chore(deps): update vendored OpenAPI specs

---
 .../policy/attributes/attributes.openapi.yaml | 73 ++++++++++++++++
 .../keymanagement/key_management.openapi.yaml | 28 ++++++-
 specs/policy/unsafe/unsafe.openapi.yaml       | 83 ++++++++++++++++++-
 3 files changed, 181 insertions(+), 3 deletions(-)

diff --git a/specs/policy/attributes/attributes.openapi.yaml b/specs/policy/attributes/attributes.openapi.yaml
index 19415e3c..3588e95d 100644
--- a/specs/policy/attributes/attributes.openapi.yaml
+++ b/specs/policy/attributes/attributes.openapi.yaml
@@ -1880,6 +1880,52 @@ components:
         - obligationValue
         - action
       additionalProperties: false
+    policy.attributes.AttributeValueSubjectMappingRequest:
+      type: object
+      properties:
+        actions:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Action'
+          title: actions
+          minItems: 1
+          description: |+
+            Required. The actions permitted by subjects in this mapping.
+            Action name or ID must not be empty if provided:
+            ```
+            this.all(item, item.name != '' || item.id != '')
+            ```
+
+        existingSubjectConditionSetId:
+          type: string
+          title: existing_subject_condition_set_id
+          format: uuid
+          description: Reuse an existing SubjectConditionSet.
+        newSubjectConditionSet:
+          title: new_subject_condition_set
+          description: Create a new SubjectConditionSet.
+          $ref: '#/components/schemas/policy.subjectmapping.SubjectConditionSetCreate'
+        namespaceId:
+          type: string
+          title: namespace_id
+          format: uuid
+        namespaceFqn:
+          type: string
+          title: namespace_fqn
+          minLength: 1
+          format: uri
+        metadata:
+          title: metadata
+          description: Optional. Common metadata for the subject mapping.
+          $ref: '#/components/schemas/common.MetadataMutable'
+      title: AttributeValueSubjectMappingRequest
+      additionalProperties: false
+      description: |+
+        Exactly one of existing_subject_condition_set_id or new_subject_condition_set must be provided:
+        ```
+        (this.existing_subject_condition_set_id != '') != has(this.new_subject_condition_set)
+        ```
+
     policy.attributes.AttributesSort:
       type: object
       properties:
@@ -1981,6 +2027,15 @@ components:
           description: |-
             Optional
              Existing obligation values to trigger for the newly created attribute value.
+        subjectMappings:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.attributes.AttributeValueSubjectMappingRequest'
+          title: subject_mappings
+          maxItems: 250
+          description: |-
+            Optional
+             Subject mappings to associate with the newly created attribute value.
         metadata:
           title: metadata
           description: |-
@@ -2632,6 +2687,24 @@ components:
           description: Required
       title: ValueKeyAccessServer
       additionalProperties: false
+    policy.subjectmapping.SubjectConditionSetCreate:
+      type: object
+      properties:
+        subjectSets:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.SubjectSet'
+          title: subject_sets
+          minItems: 1
+          description: Required
+        metadata:
+          title: metadata
+          description: |-
+            Optional
+             Common metadata
+          $ref: '#/components/schemas/common.MetadataMutable'
+      title: SubjectConditionSetCreate
+      additionalProperties: false
     connect-protocol-version:
       type: number
       title: Connect-Protocol-Version
diff --git a/specs/policy/keymanagement/key_management.openapi.yaml b/specs/policy/keymanagement/key_management.openapi.yaml
index 61a3e433..b76124e8 100644
--- a/specs/policy/keymanagement/key_management.openapi.yaml
+++ b/specs/policy/keymanagement/key_management.openapi.yaml
@@ -480,16 +480,42 @@ components:
               type: string
               title: name
               minLength: 1
+              description: DEPRECATED, please use the NameManager and specify manager + name together.
+              deprecated: true
           title: name
           required:
             - name
+        - properties:
+            nameManager:
+              title: name_manager
+              description: Search by name and manager.
+              $ref: '#/components/schemas/policy.keymanagement.GetProviderConfigRequest.NameManager'
+          title: name_manager
+          required:
+            - nameManager
       properties:
         manager:
           type: string
           title: manager
-          description: Optional - filter by manager type when searching by name
+          description: DEPRECATED, please use the NameManager and specify manager + name together.
+          deprecated: true
       title: GetProviderConfigRequest
       additionalProperties: false
+    policy.keymanagement.GetProviderConfigRequest.NameManager:
+      type: object
+      properties:
+        name:
+          type: string
+          title: name
+          minLength: 1
+          description: The name of the key provider
+        manager:
+          type: string
+          title: manager
+          minLength: 1
+          description: The type of key manager.
+      title: NameManager
+      additionalProperties: false
     policy.keymanagement.GetProviderConfigResponse:
       type: object
       properties:
diff --git a/specs/policy/unsafe/unsafe.openapi.yaml b/specs/policy/unsafe/unsafe.openapi.yaml
index 0fd9822b..383144f9 100644
--- a/specs/policy/unsafe/unsafe.openapi.yaml
+++ b/specs/policy/unsafe/unsafe.openapi.yaml
@@ -329,15 +329,50 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeValueResponse'
-  /policy.unsafe.UnsafeService/UnsafeDeleteKasKey:
+  /policy.unsafe.UnsafeService/UnsafeUpdateKey:
     post:
       tags:
         - policy.unsafe.UnsafeService
-      summary: UnsafeDeleteKasKey
+      summary: UnsafeUpdateKey
       description: |-
         --------------------------------------*
          Kas Key RPCs
         ---------------------------------------
+      operationId: policy.unsafe.UnsafeService.UnsafeUpdateKey
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateKeyRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateKeyResponse'
+  /policy.unsafe.UnsafeService/UnsafeDeleteKasKey:
+    post:
+      tags:
+        - policy.unsafe.UnsafeService
+      summary: UnsafeDeleteKasKey
       operationId: policy.unsafe.UnsafeService.UnsafeDeleteKasKey
       parameters:
         - name: Connect-Protocol-Version
@@ -1617,6 +1652,50 @@ components:
           $ref: '#/components/schemas/policy.Value'
       title: UnsafeUpdateAttributeValueResponse
       additionalProperties: false
+    policy.unsafe.UnsafeUpdateKeyRequest:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+          format: uuid
+          description: |-
+            Required
+             UUID of the Key
+        targetKeyMode:
+          title: target_key_mode
+          enum:
+            - 0
+            - 3
+            - 4
+          description: |-
+            Optional
+             Target key mode. Only KEY_MODE_REMOTE and KEY_MODE_PUBLIC_KEY_ONLY mode changes are supported.
+             KEY_MODE_UNSPECIFIED with provider_config_id updates only the provider configuration for an existing REMOTE key.
+          $ref: '#/components/schemas/policy.KeyMode'
+        providerConfigId:
+          type: string
+          title: provider_config_id
+          format: uuid
+          description: |-
+            Conditionally Required
+             Configuration ID for the key provider. Required for KEY_MODE_REMOTE and KEY_MODE_UNSPECIFIED; empty for KEY_MODE_PUBLIC_KEY_ONLY.
+      title: UnsafeUpdateKeyRequest
+      additionalProperties: false
+      description: |-
+        WARNING!!
+         Updating a key in place can retroactively alter decryptability for existing TDFs.
+         This support-only operation is limited to switching between REMOTE and PUBLIC_KEY_ONLY
+         key modes, or updating the provider configuration for an existing REMOTE key, while
+         preserving the existing KID, KAS URI, and public key.
+    policy.unsafe.UnsafeUpdateKeyResponse:
+      type: object
+      properties:
+        key:
+          title: key
+          $ref: '#/components/schemas/policy.KasKey'
+      title: UnsafeUpdateKeyResponse
+      additionalProperties: false
     policy.unsafe.UnsafeUpdateNamespaceRequest:
       type: object
       properties:
