@stigmer/protos 0.0.34

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/io_pb.d.ts

@@ -0,0 +1,58 @@
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { ApiResourceKind } from "../../../../commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceIamPermission } from "./iam_permission_pb";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file ai/stigmer/iam/iampolicy/v1/rpcauthorization/io.proto.
+ */
+export declare const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_io: GenFile;
+/**
+ * authorization config message to check before executing rpc
+ *
+ * @generated from message ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig
+ */
+export type RpcAuthorizationConfig = Message<"ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig"> & {
+    /**
+     * permission required to run the service
+     *
+     * @generated from field: ai.stigmer.iam.iampolicy.v1.rpcauthorization.ApiResourceIamPermission permission = 1;
+     */
+    permission: ApiResourceIamPermission;
+    /**
+     * api-resource-kind that the permission should be granted
+     *
+     * @generated from field: ai.stigmer.commons.apiresource.apiresourcekind.ApiResourceKind resource_kind = 2;
+     */
+    resourceKind: ApiResourceKind;
+    /**
+     * path of the field that contains the api-resource-kind on which to perform authorization.
+     * this is useful when the resource_kind is part of the input object
+     *
+     * @generated from field: string resource_kind_path = 3;
+     */
+    resourceKindPath: string;
+    /**
+     * path of the field inside the input object to be used for performing authorization.
+     *
+     * @generated from field: string field_path = 4;
+     */
+    fieldPath: string;
+    /**
+     * error message to be returned when the permission is not granted to user
+     *
+     * @generated from field: string error_msg = 5;
+     */
+    errorMsg: string;
+    /**
+     * identifier value to be configured if identifier is not part of the input
+     * this will be used in case of system internal rpc`s where the resource_id is `planton-cloud`
+     *
+     * @generated from field: string resource_id = 6;
+     */
+    resourceId: string;
+};
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig.
+ * Use `create(RpcAuthorizationConfigSchema)` to create a new message.
+ */
+export declare const RpcAuthorizationConfigSchema: GenMessage<RpcAuthorizationConfig>;

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/io_pb.js

@@ -0,0 +1,16 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/iampolicy/v1/rpcauthorization/io.proto (package ai.stigmer.iam.iampolicy.v1.rpcauthorization, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind } from "../../../../commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_iam_permission } from "./iam_permission_pb";
+/**
+ * Describes the file ai/stigmer/iam/iampolicy/v1/rpcauthorization/io.proto.
+ */
+export const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_io = /*@__PURE__*/ fileDesc("CjVhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcnBjYXV0aG9yaXphdGlvbi9pby5wcm90bxIsYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLnJwY2F1dGhvcml6YXRpb24ipAIKFlJwY0F1dGhvcml6YXRpb25Db25maWcSWgoKcGVybWlzc2lvbhgBIAEoDjJGLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5ycGNhdXRob3JpemF0aW9uLkFwaVJlc291cmNlSWFtUGVybWlzc2lvbhJWCg1yZXNvdXJjZV9raW5kGAIgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmQSGgoScmVzb3VyY2Vfa2luZF9wYXRoGAMgASgJEhIKCmZpZWxkX3BhdGgYBCABKAkSEQoJZXJyb3JfbXNnGAUgASgJEhMKC3Jlc291cmNlX2lkGAYgASgJYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_iam_permission]);
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig.
+ * Use `create(RpcAuthorizationConfigSchema)` to create a new message.
+ */
+export const RpcAuthorizationConfigSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_io, 0);
+//# sourceMappingURL=io_pb.js.map

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/io_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/iam/iampolicy/v1/rpcauthorization/io_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,mJAAmJ;AACnJ,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,qEAAqE,EAAE,MAAM,sEAAsE,CAAC;AAE7J,OAAO,EAAE,gEAAgE,EAAE,MAAM,qBAAqB,CAAC;AAGvG;;GAEG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAY,aAAa,CACxF,QAAQ,CAAC,6hBAA6hB,EAAE,CAAC,qEAAqE,EAAE,gEAAgE,CAAC,CAAC,CAAC;AAqDrrB;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,oDAAoD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options_pb.d.ts

@@ -0,0 +1,19 @@
+import type { GenExtension, GenFile } from "@bufbuild/protobuf/codegenv1";
+import type { RpcAuthorizationConfig } from "./io_pb";
+import type { MethodOptions } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options.proto.
+ */
+export declare const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options: GenFile;
+/**
+ * @generated from extension: ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig config = 50056;
+ */
+export declare const config: GenExtension<MethodOptions, RpcAuthorizationConfig>;
+/**
+ * @generated from extension: bool is_public = 50057;
+ */
+export declare const is_public: GenExtension<MethodOptions, boolean>;
+/**
+ * @generated from extension: bool is_skip_authorization = 50058;
+ */
+export declare const is_skip_authorization: GenExtension<MethodOptions, boolean>;

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options_pb.js

@@ -0,0 +1,23 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options.proto (package ai.stigmer.iam.iampolicy.v1.rpcauthorization, syntax proto3)
+/* eslint-disable */
+import { extDesc, fileDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_io } from "./io_pb";
+import { file_google_protobuf_descriptor } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options.proto.
+ */
+export const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options = /*@__PURE__*/ fileDesc("CkFhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcnBjYXV0aG9yaXphdGlvbi9tZXRob2Rfb3B0aW9ucy5wcm90bxIsYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLnJwY2F1dGhvcml6YXRpb246fgoGY29uZmlnEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYiIcDIAEoCzJELmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5ycGNhdXRob3JpemF0aW9uLlJwY0F1dGhvcml6YXRpb25Db25maWdSBmNvbmZpZzo9Cglpc19wdWJsaWMSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxiJhwMgASgIUghpc1B1YmxpYzpUChVpc19za2lwX2F1dGhvcml6YXRpb24SHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxiKhwMgASgIUhNpc1NraXBBdXRob3JpemF0aW9uYgZwcm90bzM", [file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_io, file_google_protobuf_descriptor]);
+/**
+ * @generated from extension: ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig config = 50056;
+ */
+export const config = /*@__PURE__*/ extDesc(file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, 0);
+/**
+ * @generated from extension: bool is_public = 50057;
+ */
+export const is_public = /*@__PURE__*/ extDesc(file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, 1);
+/**
+ * @generated from extension: bool is_skip_authorization = 50058;
+ */
+export const is_skip_authorization = /*@__PURE__*/ extDesc(file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, 2);
+//# sourceMappingURL=method_options_pb.js.map

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"method_options_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+JAA+J;AAC/J,oBAAoB;AAGpB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,oDAAoD,EAAE,MAAM,SAAS,CAAC;AAE/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;GAEG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAY,aAAa,CACpG,QAAQ,CAAC,qhBAAqhB,EAAE,CAAC,oDAAoD,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAE3nB;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAwD,aAAa,CACtF,OAAO,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAyC,aAAa,CAC1E,OAAO,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAyC,aAAa,CACtF,OAAO,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/spec_pb.d.ts

@@ -0,0 +1,105 @@
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file ai/stigmer/iam/iampolicy/v1/spec.proto.
+ */
+export declare const file_ai_stigmer_iam_iampolicy_v1_spec: GenFile;
+/**
+ * IamPolicySpec defines the desired state of an IAM policy binding.
+ * It specifies WHO (principal) gets WHAT permission (relation) on WHICH resource.
+ *
+ * @generated from message ai.stigmer.iam.iampolicy.v1.IamPolicySpec
+ */
+export type IamPolicySpec = Message<"ai.stigmer.iam.iampolicy.v1.IamPolicySpec"> & {
+    /**
+     * Principal: WHO is being granted access
+     * This can be any API resource that acts as an identity:
+     * - identity_account (individual user)
+     * - team (group of users)
+     * - organization (for cross-org grants)
+     * - Any other resource that can be a subject in authorization
+     *
+     * @generated from field: ai.stigmer.iam.iampolicy.v1.ApiResourceRef principal = 1;
+     */
+    principal?: ApiResourceRef;
+    /**
+     * Resource: WHAT is being accessed
+     * This can be any API resource that is being protected:
+     * - organization
+     * - environment
+     * - cloud_resource (VPC, S3 bucket, etc.)
+     * - service
+     * - Any other resource that requires access control
+     *
+     * @generated from field: ai.stigmer.iam.iampolicy.v1.ApiResourceRef resource = 2;
+     */
+    resource?: ApiResourceRef;
+    /**
+     * Relation: HOW/what permission is being granted
+     * This is the FGA relation/permission being granted (e.g., "admin", "viewer", "owner")
+     * The relation value maps to the role_code from IamRole.
+     * Examples: "admin", "editor", "viewer", "owner", "member"
+     *
+     * When this policy is synced to OpenFGA, this becomes the relation in the tuple:
+     * principal.kind:principal.id#principal.relation@resource.kind:resource.id#relation
+     *
+     * @generated from field: string relation = 3;
+     */
+    relation: string;
+};
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.IamPolicySpec.
+ * Use `create(IamPolicySpecSchema)` to create a new message.
+ */
+export declare const IamPolicySpecSchema: GenMessage<IamPolicySpec>;
+/**
+ * ApiResourceRef represents a reference to ANY API resource in the system.
+ * It is intentionally generic and reusable for both principals and resources
+ * to maintain symmetry and flexibility in the authorization model.
+ *
+ * This message contains ONLY identification fields (kind, id, relation).
+ * For view/query responses that need display information, use ApiResourceRefView in io.proto.
+ *
+ * @generated from message ai.stigmer.iam.iampolicy.v1.ApiResourceRef
+ */
+export type ApiResourceRef = Message<"ai.stigmer.iam.iampolicy.v1.ApiResourceRef"> & {
+    /**
+     * Type of the API resource being referenced
+     * This should be the resource kind as defined in ApiResourceKind enum.
+     * Examples: "identity_account", "team", "organization", "environment",
+     * "cloud_resource", "service", etc.
+     *
+     * @generated from field: string kind = 1;
+     */
+    kind: string;
+    /**
+     * Unique identifier of the resource
+     * This is the resource's ID field (e.g., ia-01HQUSER123, tm-01HQTEAM456)
+     *
+     * @generated from field: string id = 2;
+     */
+    id: string;
+    /**
+     * Optional relation qualifier for the resource reference
+     * Used when the reference needs additional context about the relationship.
+     *
+     * Primary use case: For team principals, this specifies the relation of the
+     * user to the team (e.g., "member", "admin").
+     * Example: principal { kind: "team", id: "tm-123", relation: "member" }
+     * means "members of team tm-123"
+     *
+     * In OpenFGA tuple notation, this becomes:
+     * team:tm-123#member (as the subject of the tuple)
+     *
+     * This field qualifies HOW the principal relates to this resource reference,
+     * NOT the permission being granted (that's IamPolicySpec.relation).
+     *
+     * @generated from field: string relation = 3;
+     */
+    relation: string;
+};
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.ApiResourceRef.
+ * Use `create(ApiResourceRefSchema)` to create a new message.
+ */
+export declare const ApiResourceRefSchema: GenMessage<ApiResourceRef>;

package/ai/stigmer/iam/iampolicy/v1/spec_pb.js

@@ -0,0 +1,20 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/iampolicy/v1/spec.proto (package ai.stigmer.iam.iampolicy.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb";
+/**
+ * Describes the file ai/stigmer/iam/iampolicy/v1/spec.proto.
+ */
+export const file_ai_stigmer_iam_iampolicy_v1_spec = /*@__PURE__*/ fileDesc("CiZhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvc3BlYy5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxIr4BCg1JYW1Qb2xpY3lTcGVjEkYKCXByaW5jaXBhbBgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkUKCHJlc291cmNlGAIgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESHgoIcmVsYXRpb24YAyABKAlCDLpICcgBAXIEEAEYQCJkCg5BcGlSZXNvdXJjZVJlZhIbCgRraW5kGAEgASgJQg26SArIAQFyBRABGIACEhkKAmlkGAIgASgJQg26SArIAQFyBRABGIACEhoKCHJlbGF0aW9uGAMgASgJQgi6SAVyAxiAAmIGcHJvdG8z", [file_buf_validate_validate]);
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.IamPolicySpec.
+ * Use `create(IamPolicySpecSchema)` to create a new message.
+ */
+export const IamPolicySpecSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_spec, 0);
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.ApiResourceRef.
+ * Use `create(ApiResourceRefSchema)` to create a new message.
+ */
+export const ApiResourceRefSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_spec, 1);
+//# sourceMappingURL=spec_pb.js.map

package/ai/stigmer/iam/iampolicy/v1/spec_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,mHAAmH;AACnH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAY,aAAa,CACzE,QAAQ,CAAC,kfAAkf,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAgD7hB;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAmDxD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityaccount/v1/api_pb.d.ts

@@ -0,0 +1,51 @@
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { ApiResourceMetadata } from "../../../commons/apiresource/metadata_pb";
+import type { ApiResourceAuditStatus } from "../../../commons/apiresource/status_pb";
+import type { IdentityAccountSpec } from "./spec_pb";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file ai/stigmer/iam/identityaccount/v1/api.proto.
+ */
+export declare const file_ai_stigmer_iam_identityaccount_v1_api: GenFile;
+/**
+ * identity-account for user accounts
+ *
+ * @generated from message ai.stigmer.iam.identityaccount.v1.IdentityAccount
+ */
+export type IdentityAccount = Message<"ai.stigmer.iam.identityaccount.v1.IdentityAccount"> & {
+    /**
+     * api-version
+     *
+     * @generated from field: string api_version = 1;
+     */
+    apiVersion: string;
+    /**
+     * resource-kind
+     *
+     * @generated from field: string kind = 2;
+     */
+    kind: string;
+    /**
+     * metadata
+     *
+     * @generated from field: ai.stigmer.commons.apiresource.ApiResourceMetadata metadata = 3;
+     */
+    metadata?: ApiResourceMetadata;
+    /**
+     * spec
+     *
+     * @generated from field: ai.stigmer.iam.identityaccount.v1.IdentityAccountSpec spec = 4;
+     */
+    spec?: IdentityAccountSpec;
+    /**
+     * status
+     *
+     * @generated from field: ai.stigmer.commons.apiresource.ApiResourceAuditStatus status = 5;
+     */
+    status?: ApiResourceAuditStatus;
+};
+/**
+ * Describes the message ai.stigmer.iam.identityaccount.v1.IdentityAccount.
+ * Use `create(IdentityAccountSchema)` to create a new message.
+ */
+export declare const IdentityAccountSchema: GenMessage<IdentityAccount>;

package/ai/stigmer/iam/identityaccount/v1/api_pb.js

@@ -0,0 +1,18 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityaccount/v1/api.proto (package ai.stigmer.iam.identityaccount.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_metadata } from "../../../commons/apiresource/metadata_pb";
+import { file_ai_stigmer_commons_apiresource_status } from "../../../commons/apiresource/status_pb";
+import { file_ai_stigmer_iam_identityaccount_v1_spec } from "./spec_pb";
+import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb";
+/**
+ * Describes the file ai/stigmer/iam/identityaccount/v1/api.proto.
+ */
+export const file_ai_stigmer_iam_identityaccount_v1_api = /*@__PURE__*/ fileDesc("CithaS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvYXBpLnByb3RvEiFhaS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEiuwIKD0lkZW50aXR5QWNjb3VudBItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEiQKBGtpbmQYAiABKAlCFrpIE3IRCg9JZGVudGl0eUFjY291bnQSRQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YRJECgRzcGVjGAQgASgLMjYuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudFNwZWMSRgoGc3RhdHVzGAUgASgLMjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlQXVkaXRTdGF0dXNiBnByb3RvMw", [file_ai_stigmer_commons_apiresource_metadata, file_ai_stigmer_commons_apiresource_status, file_ai_stigmer_iam_identityaccount_v1_spec, file_buf_validate_validate]);
+/**
+ * Describes the message ai.stigmer.iam.identityaccount.v1.IdentityAccount.
+ * Use `create(IdentityAccountSchema)` to create a new message.
+ */
+export const IdentityAccountSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_identityaccount_v1_api, 0);
+//# sourceMappingURL=api_pb.js.map

package/ai/stigmer/iam/identityaccount/v1/api_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/api_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,4CAA4C,EAAE,MAAM,0CAA0C,CAAC;AAExG,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAAE,2CAA2C,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,giBAAgiB,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA4CltB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityaccount/v1/command_connect.d.ts

@@ -0,0 +1,59 @@
+/**
+ * identity-account command controller
+ *
+ * @generated from service ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController
+ */
+export declare const IdentityAccountCommandController: {
+    readonly typeName: "ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController";
+    readonly methods: {
+        /**
+         * create a new identity-account.
+         * system-level RPC used by federated JIT provisioning and Auth0 webhook flow.
+         * no FGA authorization — called via inProcessChannelAsSystem (machine account).
+         * the handler's createAuthorizationTuples step writes the self-ownership tuple after creation.
+         *
+         * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.create
+         */
+        readonly create: {
+            readonly name: "create";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+        /**
+         * update an existing identity-account
+         *
+         * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.update
+         */
+        readonly update: {
+            readonly name: "update";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+        /**
+         * delete an existing identity-account
+         *
+         * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.delete
+         */
+        readonly delete: {
+            readonly name: "delete";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+        /**
+         * simulate signup webhook to add a user who created account on auth0 but is not created on stigmer.
+         * this rpc will take the email, look it up on auth0,
+         * if there is a user with this email on auth0 and post a webhook to stigmer with auth0 payload format.
+         *
+         * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.simulateSignupWebhook
+         */
+        readonly simulateSignupWebhook: {
+            readonly name: "simulateSignupWebhook";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+    };
+};

package/ai/stigmer/iam/identityaccount/v1/command_connect.js

@@ -0,0 +1,65 @@
+// @generated by protoc-gen-connect-es v1.6.1 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityaccount/v1/command.proto (package ai.stigmer.iam.identityaccount.v1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+import { Empty, MethodKind } from "@bufbuild/protobuf";
+/**
+ * identity-account command controller
+ *
+ * @generated from service ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController
+ */
+export const IdentityAccountCommandController = {
+    typeName: "ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController",
+    methods: {
+        /**
+         * create a new identity-account.
+         * system-level RPC used by federated JIT provisioning and Auth0 webhook flow.
+         * no FGA authorization — called via inProcessChannelAsSystem (machine account).
+         * the handler's createAuthorizationTuples step writes the self-ownership tuple after creation.
+         *
+         * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.create
+         */
+        create: {
+            name: "create",
+            I: IdentityAccount,
+            O: IdentityAccount,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * update an existing identity-account
+         *
+         * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.update
+         */
+        update: {
+            name: "update",
+            I: IdentityAccount,
+            O: IdentityAccount,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * delete an existing identity-account
+         *
+         * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.delete
+         */
+        delete: {
+            name: "delete",
+            I: IdentityAccountId,
+            O: IdentityAccount,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * simulate signup webhook to add a user who created account on auth0 but is not created on stigmer.
+         * this rpc will take the email, look it up on auth0,
+         * if there is a user with this email on auth0 and post a webhook to stigmer with auth0 payload format.
+         *
+         * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.simulateSignupWebhook
+         */
+        simulateSignupWebhook: {
+            name: "simulateSignupWebhook",
+            I: IdentityAccountEmail,
+            O: Empty,
+            kind: MethodKind.Unary,
+        },
+    }
+};
+//# sourceMappingURL=command_connect.js.map

package/ai/stigmer/iam/identityaccount/v1/command_connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,kIAAkI;AAClI,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,eAAe;YAClB,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,eAAe;YAClB,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,iBAAiB;YACpB,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,qBAAqB,EAAE;YACrB,IAAI,EAAE,uBAAuB;YAC7B,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/identityaccount/v1/command_pb.d.ts

@@ -0,0 +1,60 @@
+import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
+import type { IdentityAccountSchema } from "./api_pb";
+import type { IdentityAccountEmailSchema, IdentityAccountIdSchema } from "./io_pb";
+import type { EmptySchema } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file ai/stigmer/iam/identityaccount/v1/command.proto.
+ */
+export declare const file_ai_stigmer_iam_identityaccount_v1_command: GenFile;
+/**
+ * identity-account command controller
+ *
+ * @generated from service ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController
+ */
+export declare const IdentityAccountCommandController: GenService<{
+    /**
+     * create a new identity-account.
+     * system-level RPC used by federated JIT provisioning and Auth0 webhook flow.
+     * no FGA authorization — called via inProcessChannelAsSystem (machine account).
+     * the handler's createAuthorizationTuples step writes the self-ownership tuple after creation.
+     *
+     * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.create
+     */
+    create: {
+        methodKind: "unary";
+        input: typeof IdentityAccountSchema;
+        output: typeof IdentityAccountSchema;
+    };
+    /**
+     * update an existing identity-account
+     *
+     * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.update
+     */
+    update: {
+        methodKind: "unary";
+        input: typeof IdentityAccountSchema;
+        output: typeof IdentityAccountSchema;
+    };
+    /**
+     * delete an existing identity-account
+     *
+     * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.delete
+     */
+    delete: {
+        methodKind: "unary";
+        input: typeof IdentityAccountIdSchema;
+        output: typeof IdentityAccountSchema;
+    };
+    /**
+     * simulate signup webhook to add a user who created account on auth0 but is not created on stigmer.
+     * this rpc will take the email, look it up on auth0,
+     * if there is a user with this email on auth0 and post a webhook to stigmer with auth0 payload format.
+     *
+     * @generated from rpc ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController.simulateSignupWebhook
+     */
+    simulateSignupWebhook: {
+        methodKind: "unary";
+        input: typeof IdentityAccountEmailSchema;
+        output: typeof EmptySchema;
+    };
+}>;

package/ai/stigmer/iam/identityaccount/v1/command_pb.js

@@ -0,0 +1,20 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityaccount/v1/command.proto (package ai.stigmer.iam.identityaccount.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb";
+import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from "../../iampolicy/v1/rpcauthorization/method_options_pb";
+import { file_ai_stigmer_iam_identityaccount_v1_api } from "./api_pb";
+import { file_ai_stigmer_iam_identityaccount_v1_io } from "./io_pb";
+import { file_google_protobuf_empty } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file ai/stigmer/iam/identityaccount/v1/command.proto.
+ */
+export const file_ai_stigmer_iam_identityaccount_v1_command = /*@__PURE__*/ fileDesc("Ci9haS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxMuYECiBJZGVudGl0eUFjY291bnRDb21tYW5kQ29udHJvbGxlchJwCgZjcmVhdGUSMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50GjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudBKwAQoGdXBkYXRlEjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudBoyLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnQiPsK4GDoIBBALIgttZXRhZGF0YS5pZCondW5hdXRob3JpemVkIHRvIHVwZGF0ZSBpZGVudGl0eSBhY2NvdW50EqwBCgZkZWxldGUSNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50SWQaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IjjCuBg0CAIQCyIFdmFsdWUqJ3VuYXV0aG9yaXplZCB0byBkZWxldGUgaWRlbnRpdHkgYWNjb3VudBJoChVzaW11bGF0ZVNpZ251cFdlYmhvb2sSNy5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50RW1haWwaFi5nb29nbGUucHJvdG9idWYuRW1wdHkaBKD/KwtiBnByb3RvMw", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, file_ai_stigmer_iam_identityaccount_v1_api, file_ai_stigmer_iam_identityaccount_v1_io, file_google_protobuf_empty]);
+/**
+ * identity-account command controller
+ *
+ * @generated from service ai.stigmer.iam.identityaccount.v1.IdentityAccountCommandController
+ */
+export const IdentityAccountCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_iam_identityaccount_v1_command, 0);
+//# sourceMappingURL=command_pb.js.map

package/ai/stigmer/iam/identityaccount/v1/command_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,0CAA0C,EAAE,MAAM,UAAU,CAAC;AAEtE,OAAO,EAAE,yCAAyC,EAAE,MAAM,SAAS,CAAC;AAEpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAY,aAAa,CAClF,QAAQ,CAAC,o7BAAo7B,EAAE,CAAC,uDAAuD,EAAE,gEAAgE,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEjrC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GA8CxC,aAAa,CAChB,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityaccount/v1/enum_pb.d.ts

@@ -0,0 +1,40 @@
+import type { GenEnum, GenFile } from "@bufbuild/protobuf/codegenv1";
+/**
+ * Describes the file ai/stigmer/iam/identityaccount/v1/enum.proto.
+ */
+export declare const file_ai_stigmer_iam_identityaccount_v1_enum: GenFile;
+/**
+ * IdentityAccountProvisioningMode defines how an identity account was created.
+ *
+ * - direct: User signed up via Stigmer's own Auth0 tenant (existing behavior).
+ * - federated: JIT-provisioned during federated authentication via an IdentityProvider.
+ *   The account has no credentials in Stigmer's Auth0 — it participates in FGA
+ *   authorization but cannot log into Stigmer directly.
+ * - machine: M2M client credentials account used for inter-service communication.
+ *
+ * Unspecified is the default for legacy accounts created before this enum was introduced.
+ *
+ * @generated from enum ai.stigmer.iam.identityaccount.v1.IdentityAccountProvisioningMode
+ */
+export declare enum IdentityAccountProvisioningMode {
+    /**
+     * @generated from enum value: identity_account_provisioning_mode_unspecified = 0;
+     */
+    identity_account_provisioning_mode_unspecified = 0,
+    /**
+     * @generated from enum value: direct = 1;
+     */
+    direct = 1,
+    /**
+     * @generated from enum value: federated = 2;
+     */
+    federated = 2,
+    /**
+     * @generated from enum value: machine = 3;
+     */
+    machine = 3
+}
+/**
+ * Describes the enum ai.stigmer.iam.identityaccount.v1.IdentityAccountProvisioningMode.
+ */
+export declare const IdentityAccountProvisioningModeSchema: GenEnum<IdentityAccountProvisioningMode>;

package/ai/stigmer/iam/identityaccount/v1/enum_pb.js

@@ -0,0 +1,45 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityaccount/v1/enum.proto (package ai.stigmer.iam.identityaccount.v1, syntax proto3)
+/* eslint-disable */
+import { enumDesc, fileDesc } from "@bufbuild/protobuf/codegenv1";
+/**
+ * Describes the file ai/stigmer/iam/identityaccount/v1/enum.proto.
+ */
+export const file_ai_stigmer_iam_identityaccount_v1_enum = /*@__PURE__*/ fileDesc("CixhaS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvZW51bS5wcm90bxIhYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxKn0KH0lkZW50aXR5QWNjb3VudFByb3Zpc2lvbmluZ01vZGUSMgouaWRlbnRpdHlfYWNjb3VudF9wcm92aXNpb25pbmdfbW9kZV91bnNwZWNpZmllZBAAEgoKBmRpcmVjdBABEg0KCWZlZGVyYXRlZBACEgsKB21hY2hpbmUQA2IGcHJvdG8z");
+/**
+ * IdentityAccountProvisioningMode defines how an identity account was created.
+ *
+ * - direct: User signed up via Stigmer's own Auth0 tenant (existing behavior).
+ * - federated: JIT-provisioned during federated authentication via an IdentityProvider.
+ *   The account has no credentials in Stigmer's Auth0 — it participates in FGA
+ *   authorization but cannot log into Stigmer directly.
+ * - machine: M2M client credentials account used for inter-service communication.
+ *
+ * Unspecified is the default for legacy accounts created before this enum was introduced.
+ *
+ * @generated from enum ai.stigmer.iam.identityaccount.v1.IdentityAccountProvisioningMode
+ */
+export var IdentityAccountProvisioningMode;
+(function (IdentityAccountProvisioningMode) {
+    /**
+     * @generated from enum value: identity_account_provisioning_mode_unspecified = 0;
+     */
+    IdentityAccountProvisioningMode[IdentityAccountProvisioningMode["identity_account_provisioning_mode_unspecified"] = 0] = "identity_account_provisioning_mode_unspecified";
+    /**
+     * @generated from enum value: direct = 1;
+     */
+    IdentityAccountProvisioningMode[IdentityAccountProvisioningMode["direct"] = 1] = "direct";
+    /**
+     * @generated from enum value: federated = 2;
+     */
+    IdentityAccountProvisioningMode[IdentityAccountProvisioningMode["federated"] = 2] = "federated";
+    /**
+     * @generated from enum value: machine = 3;
+     */
+    IdentityAccountProvisioningMode[IdentityAccountProvisioningMode["machine"] = 3] = "machine";
+})(IdentityAccountProvisioningMode || (IdentityAccountProvisioningMode = {}));
+/**
+ * Describes the enum ai.stigmer.iam.identityaccount.v1.IdentityAccountProvisioningMode.
+ */
+export const IdentityAccountProvisioningModeSchema = /*@__PURE__*/ enumDesc(file_ai_stigmer_iam_identityaccount_v1_enum, 0);
+//# sourceMappingURL=enum_pb.js.map

package/ai/stigmer/iam/identityaccount/v1/enum_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/enum_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,kSAAkS,CAAC,CAAC;AAE/S;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,+BAoBX;AApBD,WAAY,+BAA+B;IACzC;;OAEG;IACH,yKAAkD,CAAA;IAElD;;OAEG;IACH,yFAAU,CAAA;IAEV;;OAEG;IACH,+FAAa,CAAA;IAEb;;OAEG;IACH,2FAAW,CAAA;AACb,CAAC,EApBW,+BAA+B,KAA/B,+BAA+B,QAoB1C;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAA6C,aAAa,CAC1G,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}