@evalops/sdk-ts 0.1.13

package/dist/identity/v1/organizations_pb.js

@@ -0,0 +1,166 @@
+// @generated by protoc-gen-es v2.11.0 with parameter "target=ts,import_extension=.js"
+// @generated from file identity/v1/organizations.proto (package identity.v1, syntax proto3)
+/* eslint-disable */
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file identity/v1/organizations.proto.
+ */
+export const file_identity_v1_organizations = /*@__PURE__*/ fileDesc("Ch9pZGVudGl0eS92MS9vcmdhbml6YXRpb25zLnByb3RvEgtpZGVudGl0eS52MSJmCgxPcmdhbml6YXRpb24SCgoCaWQYASABKAkSDAoEbmFtZRgCIAEoCRIMCgRzbHVnGAMgASgJEi4KCmNyZWF0ZWRfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIlcKFk9yZ2FuaXphdGlvbk1lbWJlcnNoaXASLwoMb3JnYW5pemF0aW9uGAEgASgLMhkuaWRlbnRpdHkudjEuT3JnYW5pemF0aW9uEgwKBHJvbGUYAiABKAki5gEKBk1lbWJlchIPCgd1c2VyX2lkGAEgASgJEhcKD29yZ2FuaXphdGlvbl9pZBgCIAEoCRINCgVlbWFpbBgDIAEoCRIMCgRuYW1lGAQgASgJEg8KB3BpY3R1cmUYBSABKAkSDAoEcm9sZRgGIAEoCRIOCgZzdGF0dXMYByABKAkSGQoRaWRlbnRpdHlfcHJvdmlkZXIYCCABKAkSGwoTcHJvdmlzaW9uaW5nX3NvdXJjZRgJIAEoCRIuCgpjcmVhdGVkX2F0GAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCLaAQoGQVBJS2V5EgoKAmlkGAEgASgJEhcKD29yZ2FuaXphdGlvbl9pZBgCIAEoCRIMCgRuYW1lGAMgASgJEg4KBnByZWZpeBgEIAEoCRIQCghwcm92aWRlchgFIAEoCRIMCgRyb2xlGAYgASgJEg0KBWxhYmVsGAcgASgJEi4KCmNyZWF0ZWRfYXQYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCmV4cGlyZXNfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIl0KClBlcm1pc3Npb24SEAoIcmVzb3VyY2UYASABKAkSDgoGYWN0aW9uGAIgASgJEi0KBmVmZmVjdBgDIAEoDjIdLmlkZW50aXR5LnYxLlBlcm1pc3Npb25FZmZlY3QifwoEUm9sZRIMCgRuYW1lGAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRITCgtkZXNjcmlwdGlvbhgDIAEoCRIsCgtwZXJtaXNzaW9ucxgEIAMoCzIXLmlkZW50aXR5LnYxLlBlcm1pc3Npb24SEAoIYnVpbHRfaW4YBSABKAgilwIKDlJvbGVBc3NpZ25tZW50EgoKAmlkGAEgASgJEhcKD29yZ2FuaXphdGlvbl9pZBgCIAEoCRIPCgd0ZWFtX2lkGAMgASgJEjIKDnByaW5jaXBhbF90eXBlGAQgASgOMhouaWRlbnRpdHkudjEuUHJpbmNpcGFsVHlwZRIUCgxwcmluY2lwYWxfaWQYBSABKAkSEQoJcm9sZV9uYW1lGAYgASgJEhIKCmNyZWF0ZWRfYnkYByABKAkSLgoKY3JlYXRlZF9hdBgIIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKdXBkYXRlZF9hdBgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiKwoQTGlzdFJvbGVzUmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkiNQoRTGlzdFJvbGVzUmVzcG9uc2USIAoFcm9sZXMYASADKAsyES5pZGVudGl0eS52MS5Sb2xlIpoBChFBc3NpZ25Sb2xlUmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSDwoHdGVhbV9pZBgCIAEoCRIyCg5wcmluY2lwYWxfdHlwZRgDIAEoDjIaLmlkZW50aXR5LnYxLlByaW5jaXBhbFR5cGUSFAoMcHJpbmNpcGFsX2lkGAQgASgJEhEKCXJvbGVfbmFtZRgFIAEoCSJFChJBc3NpZ25Sb2xlUmVzcG9uc2USLwoKYXNzaWdubWVudBgBIAEoCzIbLmlkZW50aXR5LnYxLlJvbGVBc3NpZ25tZW50IpoBChFSZXZva2VSb2xlUmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSDwoHdGVhbV9pZBgCIAEoCRIyCg5wcmluY2lwYWxfdHlwZRgDIAEoDjIaLmlkZW50aXR5LnYxLlByaW5jaXBhbFR5cGUSFAoMcHJpbmNpcGFsX2lkGAQgASgJEhEKCXJvbGVfbmFtZRgFIAEoCSIlChJSZXZva2VSb2xlUmVzcG9uc2USDwoHcmV2b2tlZBgBIAEoCCKQAQoaTGlzdFJvbGVBc3NpZ25tZW50c1JlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEg8KB3RlYW1faWQYAiABKAkSMgoOcHJpbmNpcGFsX3R5cGUYAyABKA4yGi5pZGVudGl0eS52MS5QcmluY2lwYWxUeXBlEhQKDHByaW5jaXBhbF9pZBgEIAEoCSJPChtMaXN0Um9sZUFzc2lnbm1lbnRzUmVzcG9uc2USMAoLYXNzaWdubWVudHMYASADKAsyGy5pZGVudGl0eS52MS5Sb2xlQXNzaWdubWVudCKuAQoWQ2hlY2tQZXJtaXNzaW9uUmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSDwoHdGVhbV9pZBgCIAEoCRIyCg5wcmluY2lwYWxfdHlwZRgDIAEoDjIaLmlkZW50aXR5LnYxLlByaW5jaXBhbFR5cGUSFAoMcHJpbmNpcGFsX2lkGAQgASgJEhAKCHJlc291cmNlGAUgASgJEg4KBmFjdGlvbhgGIAEoCSKFAQoXQ2hlY2tQZXJtaXNzaW9uUmVzcG9uc2USDwoHYWxsb3dlZBgBIAEoCBIOCgZyZWFzb24YAiABKAkSFAoMbWF0Y2hlZF9yb2xlGAMgASgJEjMKEm1hdGNoZWRfcGVybWlzc2lvbhgEIAEoCzIXLmlkZW50aXR5LnYxLlBlcm1pc3Npb24qbgoQUGVybWlzc2lvbkVmZmVjdBIhCh1QRVJNSVNTSU9OX0VGRkVDVF9VTlNQRUNJRklFRBAAEhsKF1BFUk1JU1NJT05fRUZGRUNUX0FMTE9XEAESGgoWUEVSTUlTU0lPTl9FRkZFQ1RfREVOWRACKoYBCg1QcmluY2lwYWxUeXBlEh4KGlBSSU5DSVBBTF9UWVBFX1VOU1BFQ0lGSUVEEAASFwoTUFJJTkNJUEFMX1RZUEVfVVNFUhABEiIKHlBSSU5DSVBBTF9UWVBFX1NFUlZJQ0VfQUNDT1VOVBACEhgKFFBSSU5DSVBBTF9UWVBFX0FHRU5UEAMyvwMKC1JCQUNTZXJ2aWNlEkoKCUxpc3RSb2xlcxIdLmlkZW50aXR5LnYxLkxpc3RSb2xlc1JlcXVlc3QaHi5pZGVudGl0eS52MS5MaXN0Um9sZXNSZXNwb25zZRJNCgpBc3NpZ25Sb2xlEh4uaWRlbnRpdHkudjEuQXNzaWduUm9sZVJlcXVlc3QaHy5pZGVudGl0eS52MS5Bc3NpZ25Sb2xlUmVzcG9uc2USTQoKUmV2b2tlUm9sZRIeLmlkZW50aXR5LnYxLlJldm9rZVJvbGVSZXF1ZXN0Gh8uaWRlbnRpdHkudjEuUmV2b2tlUm9sZVJlc3BvbnNlEmgKE0xpc3RSb2xlQXNzaWdubWVudHMSJy5pZGVudGl0eS52MS5MaXN0Um9sZUFzc2lnbm1lbnRzUmVxdWVzdBooLmlkZW50aXR5LnYxLkxpc3RSb2xlQXNzaWdubWVudHNSZXNwb25zZRJcCg9DaGVja1Blcm1pc3Npb24SIy5pZGVudGl0eS52MS5DaGVja1Blcm1pc3Npb25SZXF1ZXN0GiQuaWRlbnRpdHkudjEuQ2hlY2tQZXJtaXNzaW9uUmVzcG9uc2VCO1o5Z2l0aHViLmNvbS9ldmFsb3BzL3BsYXRmb3JtL2dlbi9nby9pZGVudGl0eS92MTtpZGVudGl0eXYxYgZwcm90bzM", [file_google_protobuf_timestamp]);
+/**
+ * Describes the message identity.v1.Organization.
+ * Use `create(OrganizationSchema)` to create a new message.
+ */
+export const OrganizationSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 0);
+/**
+ * Describes the message identity.v1.OrganizationMembership.
+ * Use `create(OrganizationMembershipSchema)` to create a new message.
+ */
+export const OrganizationMembershipSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 1);
+/**
+ * Describes the message identity.v1.Member.
+ * Use `create(MemberSchema)` to create a new message.
+ */
+export const MemberSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 2);
+/**
+ * Describes the message identity.v1.APIKey.
+ * Use `create(APIKeySchema)` to create a new message.
+ */
+export const APIKeySchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 3);
+/**
+ * Describes the message identity.v1.Permission.
+ * Use `create(PermissionSchema)` to create a new message.
+ */
+export const PermissionSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 4);
+/**
+ * Describes the message identity.v1.Role.
+ * Use `create(RoleSchema)` to create a new message.
+ */
+export const RoleSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 5);
+/**
+ * Describes the message identity.v1.RoleAssignment.
+ * Use `create(RoleAssignmentSchema)` to create a new message.
+ */
+export const RoleAssignmentSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 6);
+/**
+ * Describes the message identity.v1.ListRolesRequest.
+ * Use `create(ListRolesRequestSchema)` to create a new message.
+ */
+export const ListRolesRequestSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 7);
+/**
+ * Describes the message identity.v1.ListRolesResponse.
+ * Use `create(ListRolesResponseSchema)` to create a new message.
+ */
+export const ListRolesResponseSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 8);
+/**
+ * Describes the message identity.v1.AssignRoleRequest.
+ * Use `create(AssignRoleRequestSchema)` to create a new message.
+ */
+export const AssignRoleRequestSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 9);
+/**
+ * Describes the message identity.v1.AssignRoleResponse.
+ * Use `create(AssignRoleResponseSchema)` to create a new message.
+ */
+export const AssignRoleResponseSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 10);
+/**
+ * Describes the message identity.v1.RevokeRoleRequest.
+ * Use `create(RevokeRoleRequestSchema)` to create a new message.
+ */
+export const RevokeRoleRequestSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 11);
+/**
+ * Describes the message identity.v1.RevokeRoleResponse.
+ * Use `create(RevokeRoleResponseSchema)` to create a new message.
+ */
+export const RevokeRoleResponseSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 12);
+/**
+ * Describes the message identity.v1.ListRoleAssignmentsRequest.
+ * Use `create(ListRoleAssignmentsRequestSchema)` to create a new message.
+ */
+export const ListRoleAssignmentsRequestSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 13);
+/**
+ * Describes the message identity.v1.ListRoleAssignmentsResponse.
+ * Use `create(ListRoleAssignmentsResponseSchema)` to create a new message.
+ */
+export const ListRoleAssignmentsResponseSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 14);
+/**
+ * Describes the message identity.v1.CheckPermissionRequest.
+ * Use `create(CheckPermissionRequestSchema)` to create a new message.
+ */
+export const CheckPermissionRequestSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 15);
+/**
+ * Describes the message identity.v1.CheckPermissionResponse.
+ * Use `create(CheckPermissionResponseSchema)` to create a new message.
+ */
+export const CheckPermissionResponseSchema = /*@__PURE__*/ messageDesc(file_identity_v1_organizations, 16);
+/**
+ * PermissionEffect describes whether a permission grants or denies access.
+ *
+ * @generated from enum identity.v1.PermissionEffect
+ */
+export var PermissionEffect;
+(function (PermissionEffect) {
+    /**
+     * PERMISSION_EFFECT_UNSPECIFIED is rejected by RBAC mutation APIs.
+     *
+     * @generated from enum value: PERMISSION_EFFECT_UNSPECIFIED = 0;
+     */
+    PermissionEffect[PermissionEffect["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * PERMISSION_EFFECT_ALLOW grants access when the resource and action match.
+     *
+     * @generated from enum value: PERMISSION_EFFECT_ALLOW = 1;
+     */
+    PermissionEffect[PermissionEffect["ALLOW"] = 1] = "ALLOW";
+    /**
+     * PERMISSION_EFFECT_DENY denies access when the resource and action match.
+     *
+     * @generated from enum value: PERMISSION_EFFECT_DENY = 2;
+     */
+    PermissionEffect[PermissionEffect["DENY"] = 2] = "DENY";
+})(PermissionEffect || (PermissionEffect = {}));
+/**
+ * Describes the enum identity.v1.PermissionEffect.
+ */
+export const PermissionEffectSchema = /*@__PURE__*/ enumDesc(file_identity_v1_organizations, 0);
+/**
+ * PrincipalType identifies the kind of actor receiving a role assignment.
+ *
+ * @generated from enum identity.v1.PrincipalType
+ */
+export var PrincipalType;
+(function (PrincipalType) {
+    /**
+     * PRINCIPAL_TYPE_UNSPECIFIED is rejected by RBAC mutation APIs.
+     *
+     * @generated from enum value: PRINCIPAL_TYPE_UNSPECIFIED = 0;
+     */
+    PrincipalType[PrincipalType["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * PRINCIPAL_TYPE_USER represents a human user in an organization.
+     *
+     * @generated from enum value: PRINCIPAL_TYPE_USER = 1;
+     */
+    PrincipalType[PrincipalType["USER"] = 1] = "USER";
+    /**
+     * PRINCIPAL_TYPE_SERVICE_ACCOUNT represents a non-human service account.
+     *
+     * @generated from enum value: PRINCIPAL_TYPE_SERVICE_ACCOUNT = 2;
+     */
+    PrincipalType[PrincipalType["SERVICE_ACCOUNT"] = 2] = "SERVICE_ACCOUNT";
+    /**
+     * PRINCIPAL_TYPE_AGENT represents a registered agent identity.
+     *
+     * @generated from enum value: PRINCIPAL_TYPE_AGENT = 3;
+     */
+    PrincipalType[PrincipalType["AGENT"] = 3] = "AGENT";
+})(PrincipalType || (PrincipalType = {}));
+/**
+ * Describes the enum identity.v1.PrincipalType.
+ */
+export const PrincipalTypeSchema = /*@__PURE__*/ enumDesc(file_identity_v1_organizations, 1);
+/**
+ * RBACService manages organization-scoped roles and permission checks.
+ *
+ * @generated from service identity.v1.RBACService
+ */
+export const RBACService = /*@__PURE__*/ serviceDesc(file_identity_v1_organizations, 0);

package/dist/identity/v1/sessions_pb.d.ts

@@ -0,0 +1,78 @@
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file identity/v1/sessions.proto.
+ */
+export declare const file_identity_v1_sessions: GenFile;
+/**
+ * Session represents an authenticated user session.
+ * Derived from identity/internal/sessions.Session.
+ *
+ * @generated from message identity.v1.Session
+ */
+export type Session = Message<"identity.v1.Session"> & {
+    /**
+     * @generated from field: string id = 1;
+     */
+    id: string;
+    /**
+     * @generated from field: string identity_id = 2;
+     */
+    identityId: string;
+    /**
+     * @generated from field: string organization_id = 3;
+     */
+    organizationId: string;
+    /**
+     * @generated from field: string tenant_id = 4;
+     */
+    tenantId: string;
+    /**
+     * @generated from field: bool active = 5;
+     */
+    active: boolean;
+    /**
+     * @generated from field: identity.v1.DeviceInfo device_info = 6;
+     */
+    deviceInfo?: DeviceInfo;
+    /**
+     * @generated from field: google.protobuf.Timestamp expires_at = 7;
+     */
+    expiresAt?: Timestamp;
+    /**
+     * @generated from field: google.protobuf.Timestamp created_at = 8;
+     */
+    createdAt?: Timestamp;
+    /**
+     * @generated from field: google.protobuf.Timestamp updated_at = 9;
+     */
+    updatedAt?: Timestamp;
+};
+/**
+ * Describes the message identity.v1.Session.
+ * Use `create(SessionSchema)` to create a new message.
+ */
+export declare const SessionSchema: GenMessage<Session>;
+/**
+ * @generated from message identity.v1.DeviceInfo
+ */
+export type DeviceInfo = Message<"identity.v1.DeviceInfo"> & {
+    /**
+     * @generated from field: string ip = 1;
+     */
+    ip: string;
+    /**
+     * @generated from field: string forwarded_for = 2;
+     */
+    forwardedFor: string;
+    /**
+     * @generated from field: string user_agent = 3;
+     */
+    userAgent: string;
+};
+/**
+ * Describes the message identity.v1.DeviceInfo.
+ * Use `create(DeviceInfoSchema)` to create a new message.
+ */
+export declare const DeviceInfoSchema: GenMessage<DeviceInfo>;

package/dist/identity/v1/sessions_pb.js

@@ -0,0 +1,19 @@
+// @generated by protoc-gen-es v2.11.0 with parameter "target=ts,import_extension=.js"
+// @generated from file identity/v1/sessions.proto (package identity.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file identity/v1/sessions.proto.
+ */
+export const file_identity_v1_sessions = /*@__PURE__*/ fileDesc("ChppZGVudGl0eS92MS9zZXNzaW9ucy5wcm90bxILaWRlbnRpdHkudjEipAIKB1Nlc3Npb24SCgoCaWQYASABKAkSEwoLaWRlbnRpdHlfaWQYAiABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAMgASgJEhEKCXRlbmFudF9pZBgEIAEoCRIOCgZhY3RpdmUYBSABKAgSLAoLZGV2aWNlX2luZm8YBiABKAsyFy5pZGVudGl0eS52MS5EZXZpY2VJbmZvEi4KCmV4cGlyZXNfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCmNyZWF0ZWRfYXQYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIkMKCkRldmljZUluZm8SCgoCaXAYASABKAkSFQoNZm9yd2FyZGVkX2ZvchgCIAEoCRISCgp1c2VyX2FnZW50GAMgASgJQjtaOWdpdGh1Yi5jb20vZXZhbG9wcy9wbGF0Zm9ybS9nZW4vZ28vaWRlbnRpdHkvdjE7aWRlbnRpdHl2MWIGcHJvdG8z", [file_google_protobuf_timestamp]);
+/**
+ * Describes the message identity.v1.Session.
+ * Use `create(SessionSchema)` to create a new message.
+ */
+export const SessionSchema = /*@__PURE__*/ messageDesc(file_identity_v1_sessions, 0);
+/**
+ * Describes the message identity.v1.DeviceInfo.
+ * Use `create(DeviceInfoSchema)` to create a new message.
+ */
+export const DeviceInfoSchema = /*@__PURE__*/ messageDesc(file_identity_v1_sessions, 1);

package/dist/identity/v1/tokens_pb.d.ts

@@ -0,0 +1,332 @@
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file identity/v1/tokens.proto.
+ */
+export declare const file_identity_v1_tokens: GenFile;
+/**
+ * @generated from message identity.v1.IntrospectRequest
+ */
+export type IntrospectRequest = Message<"identity.v1.IntrospectRequest"> & {
+    /**
+     * @generated from field: string token = 1;
+     */
+    token: string;
+};
+/**
+ * Describes the message identity.v1.IntrospectRequest.
+ * Use `create(IntrospectRequestSchema)` to create a new message.
+ */
+export declare const IntrospectRequestSchema: GenMessage<IntrospectRequest>;
+/**
+ * IntrospectResponse is the canonical introspection result.
+ * Superset of service-runtime/identityclient.IntrospectionResult and
+ * llm-gateway/internal/auth.IntrospectionResult — callers should import
+ * this type instead of maintaining their own structs.
+ *
+ * @generated from message identity.v1.IntrospectResponse
+ */
+export type IntrospectResponse = Message<"identity.v1.IntrospectResponse"> & {
+    /**
+     * @generated from field: bool active = 1;
+     */
+    active: boolean;
+    /**
+     * @generated from field: string subject = 2;
+     */
+    subject: string;
+    /**
+     * @generated from field: string token_type = 3;
+     */
+    tokenType: string;
+    /**
+     * @generated from field: string service = 4;
+     */
+    service: string;
+    /**
+     * @generated from field: string organization_id = 5;
+     */
+    organizationId: string;
+    /**
+     * @generated from field: repeated string scopes = 6;
+     */
+    scopes: string[];
+    /**
+     * @generated from field: string agent_type = 7;
+     */
+    agentType: string;
+    /**
+     * @generated from field: repeated string capabilities = 8;
+     */
+    capabilities: string[];
+    /**
+     * @generated from field: string run_id = 9;
+     */
+    runId: string;
+    /**
+     * @generated from field: string surface = 10;
+     */
+    surface: string;
+    /**
+     * @generated from field: string user_subject = 11;
+     */
+    userSubject: string;
+    /**
+     * @generated from field: string email = 12;
+     */
+    email: string;
+    /**
+     * @generated from field: string name = 13;
+     */
+    name: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp expires_at = 14;
+     */
+    expiresAt?: Timestamp;
+    /**
+     * @generated from field: google.protobuf.Timestamp issued_at = 15;
+     */
+    issuedAt?: Timestamp;
+    /**
+     * @generated from field: repeated string delegation_chain = 16;
+     */
+    delegationChain: string[];
+    /**
+     * @generated from field: string delegator_subject = 17;
+     */
+    delegatorSubject: string;
+    /**
+     * @generated from field: string delegator_token_type = 18;
+     */
+    delegatorTokenType: string;
+};
+/**
+ * Describes the message identity.v1.IntrospectResponse.
+ * Use `create(IntrospectResponseSchema)` to create a new message.
+ */
+export declare const IntrospectResponseSchema: GenMessage<IntrospectResponse>;
+/**
+ * @generated from message identity.v1.IssueServiceTokenRequest
+ */
+export type IssueServiceTokenRequest = Message<"identity.v1.IssueServiceTokenRequest"> & {
+    /**
+     * @generated from field: string service = 1;
+     */
+    service: string;
+    /**
+     * @generated from field: string organization_id = 2;
+     */
+    organizationId: string;
+    /**
+     * @generated from field: repeated string scopes = 3;
+     */
+    scopes: string[];
+    /**
+     * @generated from field: int32 ttl_seconds = 4;
+     */
+    ttlSeconds: number;
+};
+/**
+ * Describes the message identity.v1.IssueServiceTokenRequest.
+ * Use `create(IssueServiceTokenRequestSchema)` to create a new message.
+ */
+export declare const IssueServiceTokenRequestSchema: GenMessage<IssueServiceTokenRequest>;
+/**
+ * @generated from message identity.v1.IssueServiceTokenResponse
+ */
+export type IssueServiceTokenResponse = Message<"identity.v1.IssueServiceTokenResponse"> & {
+    /**
+     * @generated from field: string token = 1;
+     */
+    token: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp expires_at = 2;
+     */
+    expiresAt?: Timestamp;
+};
+/**
+ * Describes the message identity.v1.IssueServiceTokenResponse.
+ * Use `create(IssueServiceTokenResponseSchema)` to create a new message.
+ */
+export declare const IssueServiceTokenResponseSchema: GenMessage<IssueServiceTokenResponse>;
+/**
+ * @generated from message identity.v1.IssueAgentTokenRequest
+ */
+export type IssueAgentTokenRequest = Message<"identity.v1.IssueAgentTokenRequest"> & {
+    /**
+     * Deprecated: use agent_id instead. Ignored when agent_id is set.
+     * Accepted for backward compatibility when agent_id is empty.
+     *
+     * @generated from field: string agent_type = 1 [deprecated = true];
+     * @deprecated
+     */
+    agentType: string;
+    /**
+     * Deprecated: use agent_id instead. Ignored when agent_id is set.
+     * Accepted for backward compatibility when agent_id is empty.
+     *
+     * @generated from field: repeated string capabilities = 2 [deprecated = true];
+     * @deprecated
+     */
+    capabilities: string[];
+    /**
+     * @generated from field: repeated string scopes = 3;
+     */
+    scopes: string[];
+    /**
+     * @generated from field: string surface = 4;
+     */
+    surface: string;
+    /**
+     * @generated from field: int32 ttl_seconds = 5;
+     */
+    ttlSeconds: number;
+    /**
+     * When set, the identity service looks up the agent record in registry
+     * and derives agent_type and capabilities from it. Takes precedence over
+     * the deprecated agent_type and capabilities fields. Must reference an
+     * existing agents/v1 Agent record.
+     *
+     * @generated from field: string agent_id = 6;
+     */
+    agentId: string;
+};
+/**
+ * Describes the message identity.v1.IssueAgentTokenRequest.
+ * Use `create(IssueAgentTokenRequestSchema)` to create a new message.
+ */
+export declare const IssueAgentTokenRequestSchema: GenMessage<IssueAgentTokenRequest>;
+/**
+ * @generated from message identity.v1.IssueAgentTokenResponse
+ */
+export type IssueAgentTokenResponse = Message<"identity.v1.IssueAgentTokenResponse"> & {
+    /**
+     * @generated from field: string token = 1;
+     */
+    token: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp expires_at = 2;
+     */
+    expiresAt?: Timestamp;
+};
+/**
+ * Describes the message identity.v1.IssueAgentTokenResponse.
+ * Use `create(IssueAgentTokenResponseSchema)` to create a new message.
+ */
+export declare const IssueAgentTokenResponseSchema: GenMessage<IssueAgentTokenResponse>;
+/**
+ * @generated from message identity.v1.IssueDelegationTokenRequest
+ */
+export type IssueDelegationTokenRequest = Message<"identity.v1.IssueDelegationTokenRequest"> & {
+    /**
+     * @generated from field: string agent_id = 1;
+     */
+    agentId: string;
+    /**
+     * @generated from field: string agent_type = 2;
+     */
+    agentType: string;
+    /**
+     * @generated from field: repeated string capabilities = 3;
+     */
+    capabilities: string[];
+    /**
+     * @generated from field: repeated string scopes = 4;
+     */
+    scopes: string[];
+    /**
+     * @generated from field: string surface = 5;
+     */
+    surface: string;
+    /**
+     * @generated from field: string run_id = 6;
+     */
+    runId: string;
+    /**
+     * @generated from field: int32 ttl_seconds = 7;
+     */
+    ttlSeconds: number;
+};
+/**
+ * Describes the message identity.v1.IssueDelegationTokenRequest.
+ * Use `create(IssueDelegationTokenRequestSchema)` to create a new message.
+ */
+export declare const IssueDelegationTokenRequestSchema: GenMessage<IssueDelegationTokenRequest>;
+/**
+ * @generated from message identity.v1.IssueDelegationTokenResponse
+ */
+export type IssueDelegationTokenResponse = Message<"identity.v1.IssueDelegationTokenResponse"> & {
+    /**
+     * @generated from field: string token = 1;
+     */
+    token: string;
+    /**
+     * @generated from field: google.protobuf.Timestamp expires_at = 2;
+     */
+    expiresAt?: Timestamp;
+    /**
+     * @generated from field: repeated string scopes_requested = 3;
+     */
+    scopesRequested: string[];
+    /**
+     * @generated from field: repeated string scopes_granted = 4;
+     */
+    scopesGranted: string[];
+    /**
+     * @generated from field: repeated string scopes_denied = 5;
+     */
+    scopesDenied: string[];
+};
+/**
+ * Describes the message identity.v1.IssueDelegationTokenResponse.
+ * Use `create(IssueDelegationTokenResponseSchema)` to create a new message.
+ */
+export declare const IssueDelegationTokenResponseSchema: GenMessage<IssueDelegationTokenResponse>;
+/**
+ * TokenService handles token introspection and issuance for cross-service auth.
+ *
+ * @generated from service identity.v1.TokenService
+ */
+export declare const TokenService: GenService<{
+    /**
+     * Introspect validates a bearer token and returns the resolved claims.
+     *
+     * @generated from rpc identity.v1.TokenService.Introspect
+     */
+    introspect: {
+        methodKind: "unary";
+        input: typeof IntrospectRequestSchema;
+        output: typeof IntrospectResponseSchema;
+    };
+    /**
+     * IssueServiceToken mints a short-lived token for service-to-service calls.
+     *
+     * @generated from rpc identity.v1.TokenService.IssueServiceToken
+     */
+    issueServiceToken: {
+        methodKind: "unary";
+        input: typeof IssueServiceTokenRequestSchema;
+        output: typeof IssueServiceTokenResponseSchema;
+    };
+    /**
+     * IssueAgentToken mints a token scoped to an agent identity.
+     *
+     * @generated from rpc identity.v1.TokenService.IssueAgentToken
+     */
+    issueAgentToken: {
+        methodKind: "unary";
+        input: typeof IssueAgentTokenRequestSchema;
+        output: typeof IssueAgentTokenResponseSchema;
+    };
+    /**
+     * IssueDelegationToken mints a short-lived token narrowed at delegation time.
+     *
+     * @generated from rpc identity.v1.TokenService.IssueDelegationToken
+     */
+    issueDelegationToken: {
+        methodKind: "unary";
+        input: typeof IssueDelegationTokenRequestSchema;
+        output: typeof IssueDelegationTokenResponseSchema;
+    };
+}>;

package/dist/identity/v1/tokens_pb.js

@@ -0,0 +1,56 @@
+// @generated by protoc-gen-es v2.11.0 with parameter "target=ts,import_extension=.js"
+// @generated from file identity/v1/tokens.proto (package identity.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_buf_validate_validate } from "../../buf/validate/validate_pb.js";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file identity/v1/tokens.proto.
+ */
+export const file_identity_v1_tokens = /*@__PURE__*/ fileDesc("ChhpZGVudGl0eS92MS90b2tlbnMucHJvdG8SC2lkZW50aXR5LnYxIisKEUludHJvc3BlY3RSZXF1ZXN0EhYKBXRva2VuGAEgASgJQge6SARyAhABIrMDChJJbnRyb3NwZWN0UmVzcG9uc2USDgoGYWN0aXZlGAEgASgIEg8KB3N1YmplY3QYAiABKAkSEgoKdG9rZW5fdHlwZRgDIAEoCRIPCgdzZXJ2aWNlGAQgASgJEhcKD29yZ2FuaXphdGlvbl9pZBgFIAEoCRIOCgZzY29wZXMYBiADKAkSEgoKYWdlbnRfdHlwZRgHIAEoCRIUCgxjYXBhYmlsaXRpZXMYCCADKAkSDgoGcnVuX2lkGAkgASgJEg8KB3N1cmZhY2UYCiABKAkSFAoMdXNlcl9zdWJqZWN0GAsgASgJEg0KBWVtYWlsGAwgASgJEgwKBG5hbWUYDSABKAkSLgoKZXhwaXJlc19hdBgOIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLQoJaXNzdWVkX2F0GA8gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIYChBkZWxlZ2F0aW9uX2NoYWluGBAgAygJEhkKEWRlbGVnYXRvcl9zdWJqZWN0GBEgASgJEhwKFGRlbGVnYXRvcl90b2tlbl90eXBlGBIgASgJInsKGElzc3VlU2VydmljZVRva2VuUmVxdWVzdBIYCgdzZXJ2aWNlGAEgASgJQge6SARyAhABEhcKD29yZ2FuaXphdGlvbl9pZBgCIAEoCRIOCgZzY29wZXMYAyADKAkSHAoLdHRsX3NlY29uZHMYBCABKAVCB7pIBBoCKAAiWgoZSXNzdWVTZXJ2aWNlVG9rZW5SZXNwb25zZRINCgV0b2tlbhgBIAEoCRIuCgpleHBpcmVzX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKtAQoWSXNzdWVBZ2VudFRva2VuUmVxdWVzdBIWCgphZ2VudF90eXBlGAEgASgJQgIYARIYCgxjYXBhYmlsaXRpZXMYAiADKAlCAhgBEg4KBnNjb3BlcxgDIAMoCRIYCgdzdXJmYWNlGAQgASgJQge6SARyAhABEhwKC3R0bF9zZWNvbmRzGAUgASgFQge6SAQaAigAEhkKCGFnZW50X2lkGAYgASgJQge6SARyAhABIlgKF0lzc3VlQWdlbnRUb2tlblJlc3BvbnNlEg0KBXRva2VuGAEgASgJEi4KCmV4cGlyZXNfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIswBChtJc3N1ZURlbGVnYXRpb25Ub2tlblJlcXVlc3QSGQoIYWdlbnRfaWQYASABKAlCB7pIBHICEAESGwoKYWdlbnRfdHlwZRgCIAEoCUIHukgEcgIQARIUCgxjYXBhYmlsaXRpZXMYAyADKAkSDgoGc2NvcGVzGAQgAygJEhgKB3N1cmZhY2UYBSABKAlCB7pIBHICEAESFwoGcnVuX2lkGAYgASgJQge6SARyAhABEhwKC3R0bF9zZWNvbmRzGAcgASgFQge6SAQaAigAIqYBChxJc3N1ZURlbGVnYXRpb25Ub2tlblJlc3BvbnNlEg0KBXRva2VuGAEgASgJEi4KCmV4cGlyZXNfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhgKEHNjb3Blc19yZXF1ZXN0ZWQYAyADKAkSFgoOc2NvcGVzX2dyYW50ZWQYBCADKAkSFQoNc2NvcGVzX2RlbmllZBgFIAMoCTKMAwoMVG9rZW5TZXJ2aWNlEk0KCkludHJvc3BlY3QSHi5pZGVudGl0eS52MS5JbnRyb3NwZWN0UmVxdWVzdBofLmlkZW50aXR5LnYxLkludHJvc3BlY3RSZXNwb25zZRJiChFJc3N1ZVNlcnZpY2VUb2tlbhIlLmlkZW50aXR5LnYxLklzc3VlU2VydmljZVRva2VuUmVxdWVzdBomLmlkZW50aXR5LnYxLklzc3VlU2VydmljZVRva2VuUmVzcG9uc2USXAoPSXNzdWVBZ2VudFRva2VuEiMuaWRlbnRpdHkudjEuSXNzdWVBZ2VudFRva2VuUmVxdWVzdBokLmlkZW50aXR5LnYxLklzc3VlQWdlbnRUb2tlblJlc3BvbnNlEmsKFElzc3VlRGVsZWdhdGlvblRva2VuEiguaWRlbnRpdHkudjEuSXNzdWVEZWxlZ2F0aW9uVG9rZW5SZXF1ZXN0GikuaWRlbnRpdHkudjEuSXNzdWVEZWxlZ2F0aW9uVG9rZW5SZXNwb25zZUI7WjlnaXRodWIuY29tL2V2YWxvcHMvcGxhdGZvcm0vZ2VuL2dvL2lkZW50aXR5L3YxO2lkZW50aXR5djFiBnByb3RvMw", [file_buf_validate_validate, file_google_protobuf_timestamp]);
+/**
+ * Describes the message identity.v1.IntrospectRequest.
+ * Use `create(IntrospectRequestSchema)` to create a new message.
+ */
+export const IntrospectRequestSchema = /*@__PURE__*/ messageDesc(file_identity_v1_tokens, 0);
+/**
+ * Describes the message identity.v1.IntrospectResponse.
+ * Use `create(IntrospectResponseSchema)` to create a new message.
+ */
+export const IntrospectResponseSchema = /*@__PURE__*/ messageDesc(file_identity_v1_tokens, 1);
+/**
+ * Describes the message identity.v1.IssueServiceTokenRequest.
+ * Use `create(IssueServiceTokenRequestSchema)` to create a new message.
+ */
+export const IssueServiceTokenRequestSchema = /*@__PURE__*/ messageDesc(file_identity_v1_tokens, 2);
+/**
+ * Describes the message identity.v1.IssueServiceTokenResponse.
+ * Use `create(IssueServiceTokenResponseSchema)` to create a new message.
+ */
+export const IssueServiceTokenResponseSchema = /*@__PURE__*/ messageDesc(file_identity_v1_tokens, 3);
+/**
+ * Describes the message identity.v1.IssueAgentTokenRequest.
+ * Use `create(IssueAgentTokenRequestSchema)` to create a new message.
+ */
+export const IssueAgentTokenRequestSchema = /*@__PURE__*/ messageDesc(file_identity_v1_tokens, 4);
+/**
+ * Describes the message identity.v1.IssueAgentTokenResponse.
+ * Use `create(IssueAgentTokenResponseSchema)` to create a new message.
+ */
+export const IssueAgentTokenResponseSchema = /*@__PURE__*/ messageDesc(file_identity_v1_tokens, 5);
+/**
+ * Describes the message identity.v1.IssueDelegationTokenRequest.
+ * Use `create(IssueDelegationTokenRequestSchema)` to create a new message.
+ */
+export const IssueDelegationTokenRequestSchema = /*@__PURE__*/ messageDesc(file_identity_v1_tokens, 6);
+/**
+ * Describes the message identity.v1.IssueDelegationTokenResponse.
+ * Use `create(IssueDelegationTokenResponseSchema)` to create a new message.
+ */
+export const IssueDelegationTokenResponseSchema = /*@__PURE__*/ messageDesc(file_identity_v1_tokens, 7);
+/**
+ * TokenService handles token introspection and issuance for cross-service auth.
+ *
+ * @generated from service identity.v1.TokenService
+ */
+export const TokenService = /*@__PURE__*/ serviceDesc(file_identity_v1_tokens, 0);