@stigmer/protos 0.0.34

package/ai/stigmer/iam/identityprovider/v1/api_pb.d.ts

@@ -0,0 +1,72 @@
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { ApiResourceMetadata } from "../../../commons/apiresource/metadata_pb";
+import type { ApiResourceAuditStatus } from "../../../commons/apiresource/status_pb";
+import type { IdentityProviderSpec } from "./spec_pb";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file ai/stigmer/iam/identityprovider/v1/api.proto.
+ */
+export declare const file_ai_stigmer_iam_identityprovider_v1_api: GenFile;
+/**
+ * IdentityProvider represents an external platform's trust relationship with Stigmer.
+ *
+ * An IdentityProvider is owned by an organization (e.g., "planton") and configures
+ * how Stigmer validates signed JWT assertions from that platform. It enables the
+ * platform to create and manage organizations on behalf of its users, and to pass
+ * user identity for FGA-based authorization.
+ *
+ * Example YAML:
+ *   apiVersion: iam.stigmer.ai/v1
+ *   kind: IdentityProvider
+ *   metadata:
+ *     name: Planton Cloud
+ *     slug: planton-cloud
+ *     org: planton
+ *   spec:
+ *     display_name: "Planton Cloud"
+ *     jwks_uri: "https://api.planton.ai/.well-known/stigmer-jwks.json"
+ *     allowed_issuers: ["planton-cloud"]
+ *     expected_audience: "stigmer-api"
+ *
+ * @generated from message ai.stigmer.iam.identityprovider.v1.IdentityProvider
+ */
+export type IdentityProvider = Message<"ai.stigmer.iam.identityprovider.v1.IdentityProvider"> & {
+    /**
+     * API version for this resource type.
+     * Must be exactly "iam.stigmer.ai/v1".
+     *
+     * @generated from field: string api_version = 1;
+     */
+    apiVersion: string;
+    /**
+     * Resource kind identifier.
+     * Must be exactly "IdentityProvider".
+     *
+     * @generated from field: string kind = 2;
+     */
+    kind: string;
+    /**
+     * Standard resource metadata including name, id, org, visibility, labels, and tags.
+     * The org field identifies which organization owns this identity provider.
+     *
+     * @generated from field: ai.stigmer.commons.apiresource.ApiResourceMetadata metadata = 3;
+     */
+    metadata?: ApiResourceMetadata;
+    /**
+     * User-provided identity provider configuration (desired state).
+     *
+     * @generated from field: ai.stigmer.iam.identityprovider.v1.IdentityProviderSpec spec = 4;
+     */
+    spec?: IdentityProviderSpec;
+    /**
+     * status
+     *
+     * @generated from field: ai.stigmer.commons.apiresource.ApiResourceAuditStatus status = 5;
+     */
+    status?: ApiResourceAuditStatus;
+};
+/**
+ * Describes the message ai.stigmer.iam.identityprovider.v1.IdentityProvider.
+ * Use `create(IdentityProviderSchema)` to create a new message.
+ */
+export declare const IdentityProviderSchema: GenMessage<IdentityProvider>;

package/ai/stigmer/iam/identityprovider/v1/api_pb.js

@@ -0,0 +1,18 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityprovider/v1/api.proto (package ai.stigmer.iam.identityprovider.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_metadata } from "../../../commons/apiresource/metadata_pb";
+import { file_ai_stigmer_commons_apiresource_status } from "../../../commons/apiresource/status_pb";
+import { file_ai_stigmer_iam_identityprovider_v1_spec } from "./spec_pb";
+import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb";
+/**
+ * Describes the file ai/stigmer/iam/identityprovider/v1/api.proto.
+ */
+export const file_ai_stigmer_iam_identityprovider_v1_api = /*@__PURE__*/ fileDesc("CixhaS9zdGlnbWVyL2lhbS9pZGVudGl0eXByb3ZpZGVyL3YxL2FwaS5wcm90bxIiYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlwcm92aWRlci52MSLHAgoQSWRlbnRpdHlQcm92aWRlchItCgthcGlfdmVyc2lvbhgBIAEoCUIYukgVchMKEWlhbS5zdGlnbWVyLmFpL3YxEiUKBGtpbmQYAiABKAlCF7pIFHISChBJZGVudGl0eVByb3ZpZGVyEk0KCG1ldGFkYXRhGAMgASgLMjMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlTWV0YWRhdGFCBrpIA8gBARJGCgRzcGVjGAQgASgLMjguYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlwcm92aWRlci52MS5JZGVudGl0eVByb3ZpZGVyU3BlYxJGCgZzdGF0dXMYBSABKAsyNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdFN0YXR1c2IGcHJvdG8z", [file_ai_stigmer_commons_apiresource_metadata, file_ai_stigmer_commons_apiresource_status, file_ai_stigmer_iam_identityprovider_v1_spec, file_buf_validate_validate]);
+/**
+ * Describes the message ai.stigmer.iam.identityprovider.v1.IdentityProvider.
+ * Use `create(IdentityProviderSchema)` to create a new message.
+ */
+export const IdentityProviderSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_identityprovider_v1_api, 0);
+//# sourceMappingURL=api_pb.js.map

package/ai/stigmer/iam/identityprovider/v1/api_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/api_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,4CAA4C,EAAE,MAAM,0CAA0C,CAAC;AAExG,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAAE,4CAA4C,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,kjBAAkjB,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,EAAE,4CAA4C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAiEruB;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/command_connect.d.ts

@@ -0,0 +1,59 @@
+/**
+ * IdentityProviderCommandController provides write operations for identity providers.
+ *
+ * @generated from service ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController
+ */
+export declare const IdentityProviderCommandController: {
+    readonly typeName: "ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController";
+    readonly methods: {
+        /**
+         * Create or update an identity provider (Kubernetes-style apply).
+         * If the resource doesn't exist: creates a new identity provider.
+         * If the resource exists: updates the existing identity provider.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.apply
+         */
+        readonly apply: {
+            readonly name: "apply";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+        /**
+         * Create a new identity provider.
+         * The creator's organization owns the identity provider.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.create
+         */
+        readonly create: {
+            readonly name: "create";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+        /**
+         * Update an existing identity provider.
+         * Requires can_edit permission on the identity provider.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.update
+         */
+        readonly update: {
+            readonly name: "update";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+        /**
+         * Delete an identity provider.
+         * Deletion is blocked if any platform-managed organizations reference this identity provider.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.delete
+         */
+        readonly delete: {
+            readonly name: "delete";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+    };
+};

package/ai/stigmer/iam/identityprovider/v1/command_connect.js

@@ -0,0 +1,65 @@
+// @generated by protoc-gen-connect-es v1.6.1 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityprovider/v1/command.proto (package ai.stigmer.iam.identityprovider.v1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+import { MethodKind } from "@bufbuild/protobuf";
+/**
+ * IdentityProviderCommandController provides write operations for identity providers.
+ *
+ * @generated from service ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController
+ */
+export const IdentityProviderCommandController = {
+    typeName: "ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController",
+    methods: {
+        /**
+         * Create or update an identity provider (Kubernetes-style apply).
+         * If the resource doesn't exist: creates a new identity provider.
+         * If the resource exists: updates the existing identity provider.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.apply
+         */
+        apply: {
+            name: "apply",
+            I: IdentityProvider,
+            O: IdentityProvider,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * Create a new identity provider.
+         * The creator's organization owns the identity provider.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.create
+         */
+        create: {
+            name: "create",
+            I: IdentityProvider,
+            O: IdentityProvider,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * Update an existing identity provider.
+         * Requires can_edit permission on the identity provider.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.update
+         */
+        update: {
+            name: "update",
+            I: IdentityProvider,
+            O: IdentityProvider,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * Delete an identity provider.
+         * Deletion is blocked if any platform-managed organizations reference this identity provider.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.delete
+         */
+        delete: {
+            name: "delete",
+            I: ApiResourceDeleteInput,
+            O: IdentityProvider,
+            kind: MethodKind.Unary,
+        },
+    }
+};
+//# sourceMappingURL=command_connect.js.map

package/ai/stigmer/iam/identityprovider/v1/command_connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oIAAoI;AACpI,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,sEAAsE;IAChF,OAAO,EAAE;QACP;;;;;;WAMG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/command_pb.d.ts

@@ -0,0 +1,59 @@
+import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
+import type { ApiResourceDeleteInputSchema } from "../../../commons/apiresource/io_pb";
+import type { IdentityProviderSchema } from "./api_pb";
+/**
+ * Describes the file ai/stigmer/iam/identityprovider/v1/command.proto.
+ */
+export declare const file_ai_stigmer_iam_identityprovider_v1_command: GenFile;
+/**
+ * IdentityProviderCommandController provides write operations for identity providers.
+ *
+ * @generated from service ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController
+ */
+export declare const IdentityProviderCommandController: GenService<{
+    /**
+     * Create or update an identity provider (Kubernetes-style apply).
+     * If the resource doesn't exist: creates a new identity provider.
+     * If the resource exists: updates the existing identity provider.
+     *
+     * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.apply
+     */
+    apply: {
+        methodKind: "unary";
+        input: typeof IdentityProviderSchema;
+        output: typeof IdentityProviderSchema;
+    };
+    /**
+     * Create a new identity provider.
+     * The creator's organization owns the identity provider.
+     *
+     * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.create
+     */
+    create: {
+        methodKind: "unary";
+        input: typeof IdentityProviderSchema;
+        output: typeof IdentityProviderSchema;
+    };
+    /**
+     * Update an existing identity provider.
+     * Requires can_edit permission on the identity provider.
+     *
+     * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.update
+     */
+    update: {
+        methodKind: "unary";
+        input: typeof IdentityProviderSchema;
+        output: typeof IdentityProviderSchema;
+    };
+    /**
+     * Delete an identity provider.
+     * Deletion is blocked if any platform-managed organizations reference this identity provider.
+     *
+     * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.delete
+     */
+    delete: {
+        methodKind: "unary";
+        input: typeof ApiResourceDeleteInputSchema;
+        output: typeof IdentityProviderSchema;
+    };
+}>;

package/ai/stigmer/iam/identityprovider/v1/command_pb.js

@@ -0,0 +1,19 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityprovider/v1/command.proto (package ai.stigmer.iam.identityprovider.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_io } from "../../../commons/apiresource/io_pb";
+import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb";
+import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from "../../iampolicy/v1/rpcauthorization/method_options_pb";
+import { file_ai_stigmer_iam_identityprovider_v1_api } from "./api_pb";
+/**
+ * Describes the file ai/stigmer/iam/identityprovider/v1/command.proto.
+ */
+export const file_ai_stigmer_iam_identityprovider_v1_command = /*@__PURE__*/ fileDesc("CjBhaS9zdGlnbWVyL2lhbS9pZGVudGl0eXByb3ZpZGVyL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIuaWFtLmlkZW50aXR5cHJvdmlkZXIudjEy3gUKIUlkZW50aXR5UHJvdmlkZXJDb21tYW5kQ29udHJvbGxlchJzCgVhcHBseRI0LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5cHJvdmlkZXIudjEuSWRlbnRpdHlQcm92aWRlcho0LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5cHJvdmlkZXIudjEuSWRlbnRpdHlQcm92aWRlchLLAQoGY3JlYXRlEjQuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlwcm92aWRlci52MS5JZGVudGl0eVByb3ZpZGVyGjQuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlwcm92aWRlci52MS5JZGVudGl0eVByb3ZpZGVyIlXCuBhRCBgQHiIMbWV0YWRhdGEub3JnKj11bmF1dGhvcml6ZWQgdG8gY3JlYXRlIGlkZW50aXR5IHByb3ZpZGVyIGluIHRoaXMgb3JnYW5pemF0aW9uErUBCgZ1cGRhdGUSNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eXByb3ZpZGVyLnYxLklkZW50aXR5UHJvdmlkZXIaNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eXByb3ZpZGVyLnYxLklkZW50aXR5UHJvdmlkZXIiP8K4GDsIBBAVIgttZXRhZGF0YS5pZCoodW5hdXRob3JpemVkIHRvIHVwZGF0ZSBpZGVudGl0eSBwcm92aWRlchK3AQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eXByb3ZpZGVyLnYxLklkZW50aXR5UHJvdmlkZXIiP8K4GDsIAhAVIgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIGRlbGV0ZSBpZGVudGl0eSBwcm92aWRlchoEoP8rFWIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, file_ai_stigmer_iam_identityprovider_v1_api]);
+/**
+ * IdentityProviderCommandController provides write operations for identity providers.
+ *
+ * @generated from service ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController
+ */
+export const IdentityProviderCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_iam_identityprovider_v1_command, 0);
+//# sourceMappingURL=command_pb.js.map

package/ai/stigmer/iam/identityprovider/v1/command_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,oIAAoI;AACpI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,2CAA2C,EAAE,MAAM,UAAU,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,slCAAslC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAErzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GA8CzC,aAAa,CAChB,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/io_pb.d.ts

@@ -0,0 +1,65 @@
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { IdentityProvider } from "./api_pb";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file ai/stigmer/iam/identityprovider/v1/io.proto.
+ */
+export declare const file_ai_stigmer_iam_identityprovider_v1_io: GenFile;
+/**
+ * Wrapper for identity provider id.
+ *
+ * @generated from message ai.stigmer.iam.identityprovider.v1.IdentityProviderId
+ */
+export type IdentityProviderId = Message<"ai.stigmer.iam.identityprovider.v1.IdentityProviderId"> & {
+    /**
+     * The unique identifier of the identity provider resource.
+     *
+     * @generated from field: string value = 1;
+     */
+    value: string;
+};
+/**
+ * Describes the message ai.stigmer.iam.identityprovider.v1.IdentityProviderId.
+ * Use `create(IdentityProviderIdSchema)` to create a new message.
+ */
+export declare const IdentityProviderIdSchema: GenMessage<IdentityProviderId>;
+/**
+ * List of identity providers (unbounded).
+ *
+ * @generated from message ai.stigmer.iam.identityprovider.v1.IdentityProviders
+ */
+export type IdentityProviders = Message<"ai.stigmer.iam.identityprovider.v1.IdentityProviders"> & {
+    /**
+     * @generated from field: repeated ai.stigmer.iam.identityprovider.v1.IdentityProvider entries = 1;
+     */
+    entries: IdentityProvider[];
+};
+/**
+ * Describes the message ai.stigmer.iam.identityprovider.v1.IdentityProviders.
+ * Use `create(IdentityProvidersSchema)` to create a new message.
+ */
+export declare const IdentityProvidersSchema: GenMessage<IdentityProviders>;
+/**
+ * Response for paginated list query.
+ *
+ * @generated from message ai.stigmer.iam.identityprovider.v1.IdentityProviderList
+ */
+export type IdentityProviderList = Message<"ai.stigmer.iam.identityprovider.v1.IdentityProviderList"> & {
+    /**
+     * Total number of pages.
+     *
+     * @generated from field: int32 total_pages = 1;
+     */
+    totalPages: number;
+    /**
+     * Identity providers in current page.
+     *
+     * @generated from field: repeated ai.stigmer.iam.identityprovider.v1.IdentityProvider entries = 2;
+     */
+    entries: IdentityProvider[];
+};
+/**
+ * Describes the message ai.stigmer.iam.identityprovider.v1.IdentityProviderList.
+ * Use `create(IdentityProviderListSchema)` to create a new message.
+ */
+export declare const IdentityProviderListSchema: GenMessage<IdentityProviderList>;

package/ai/stigmer/iam/identityprovider/v1/io_pb.js

@@ -0,0 +1,26 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityprovider/v1/io.proto (package ai.stigmer.iam.identityprovider.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_iam_identityprovider_v1_api } from "./api_pb";
+import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb";
+/**
+ * Describes the file ai/stigmer/iam/identityprovider/v1/io.proto.
+ */
+export const file_ai_stigmer_iam_identityprovider_v1_io = /*@__PURE__*/ fileDesc("CithaS9zdGlnbWVyL2lhbS9pZGVudGl0eXByb3ZpZGVyL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLmlhbS5pZGVudGl0eXByb3ZpZGVyLnYxIi4KEklkZW50aXR5UHJvdmlkZXJJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIloKEUlkZW50aXR5UHJvdmlkZXJzEkUKB2VudHJpZXMYASADKAsyNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eXByb3ZpZGVyLnYxLklkZW50aXR5UHJvdmlkZXIicgoUSWRlbnRpdHlQcm92aWRlckxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSRQoHZW50cmllcxgCIAMoCzI0LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5cHJvdmlkZXIudjEuSWRlbnRpdHlQcm92aWRlcmIGcHJvdG8z", [file_ai_stigmer_iam_identityprovider_v1_api, file_buf_validate_validate]);
+/**
+ * Describes the message ai.stigmer.iam.identityprovider.v1.IdentityProviderId.
+ * Use `create(IdentityProviderIdSchema)` to create a new message.
+ */
+export const IdentityProviderIdSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_identityprovider_v1_io, 0);
+/**
+ * Describes the message ai.stigmer.iam.identityprovider.v1.IdentityProviders.
+ * Use `create(IdentityProvidersSchema)` to create a new message.
+ */
+export const IdentityProvidersSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_identityprovider_v1_io, 1);
+/**
+ * Describes the message ai.stigmer.iam.identityprovider.v1.IdentityProviderList.
+ * Use `create(IdentityProviderListSchema)` to create a new message.
+ */
+export const IdentityProviderListSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_identityprovider_v1_io, 2);
+//# sourceMappingURL=io_pb.js.map

package/ai/stigmer/iam/identityprovider/v1/io_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/io_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,8cAA8c,EAAE,CAAC,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAgBtiB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAc7D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAuB7D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/query_connect.d.ts

@@ -0,0 +1,32 @@
+/**
+ * IdentityProviderQueryController provides read operations for identity providers.
+ *
+ * @generated from service ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController
+ */
+export declare const IdentityProviderQueryController: {
+    readonly typeName: "ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController";
+    readonly methods: {
+        /**
+         * Get an identity provider by its unique identifier.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.get
+         */
+        readonly get: {
+            readonly name: "get";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+        /**
+         * Get an identity provider by reference (org + slug).
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getByReference
+         */
+        readonly getByReference: {
+            readonly name: "getByReference";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+    };
+};

package/ai/stigmer/iam/identityprovider/v1/query_connect.js

@@ -0,0 +1,38 @@
+// @generated by protoc-gen-connect-es v1.6.1 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityprovider/v1/query.proto (package ai.stigmer.iam.identityprovider.v1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+import { MethodKind } from "@bufbuild/protobuf";
+/**
+ * IdentityProviderQueryController provides read operations for identity providers.
+ *
+ * @generated from service ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController
+ */
+export const IdentityProviderQueryController = {
+    typeName: "ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController",
+    methods: {
+        /**
+         * Get an identity provider by its unique identifier.
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.get
+         */
+        get: {
+            name: "get",
+            I: ApiResourceId,
+            O: IdentityProvider,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * Get an identity provider by reference (org + slug).
+         *
+         * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getByReference
+         */
+        getByReference: {
+            name: "getByReference",
+            I: ApiResourceReference,
+            O: IdentityProvider,
+            kind: MethodKind.Unary,
+        },
+    }
+};
+//# sourceMappingURL=query_connect.js.map

package/ai/stigmer/iam/identityprovider/v1/query_connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,kIAAkI;AAClI,oBAAoB;AACpB,cAAc;AAId,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/query_pb.d.ts

@@ -0,0 +1,34 @@
+import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
+import type { ApiResourceIdSchema, ApiResourceReferenceSchema } from "../../../commons/apiresource/io_pb";
+import type { IdentityProviderSchema } from "./api_pb";
+/**
+ * Describes the file ai/stigmer/iam/identityprovider/v1/query.proto.
+ */
+export declare const file_ai_stigmer_iam_identityprovider_v1_query: GenFile;
+/**
+ * IdentityProviderQueryController provides read operations for identity providers.
+ *
+ * @generated from service ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController
+ */
+export declare const IdentityProviderQueryController: GenService<{
+    /**
+     * Get an identity provider by its unique identifier.
+     *
+     * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.get
+     */
+    get: {
+        methodKind: "unary";
+        input: typeof ApiResourceIdSchema;
+        output: typeof IdentityProviderSchema;
+    };
+    /**
+     * Get an identity provider by reference (org + slug).
+     *
+     * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getByReference
+     */
+    getByReference: {
+        methodKind: "unary";
+        input: typeof ApiResourceReferenceSchema;
+        output: typeof IdentityProviderSchema;
+    };
+}>;

package/ai/stigmer/iam/identityprovider/v1/query_pb.js

@@ -0,0 +1,19 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/identityprovider/v1/query.proto (package ai.stigmer.iam.identityprovider.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_io } from "../../../commons/apiresource/io_pb";
+import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb";
+import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from "../../iampolicy/v1/rpcauthorization/method_options_pb";
+import { file_ai_stigmer_iam_identityprovider_v1_api } from "./api_pb";
+/**
+ * Describes the file ai/stigmer/iam/identityprovider/v1/query.proto.
+ */
+export const file_ai_stigmer_iam_identityprovider_v1_query = /*@__PURE__*/ fileDesc("Ci5haS9zdGlnbWVyL2lhbS9pZGVudGl0eXByb3ZpZGVyL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLmlhbS5pZGVudGl0eXByb3ZpZGVyLnYxMssCCh9JZGVudGl0eVByb3ZpZGVyUXVlcnlDb250cm9sbGVyEqMBCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBo0LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5cHJvdmlkZXIudjEuSWRlbnRpdHlQcm92aWRlciI3wrgYMwgDEBUiBXZhbHVlKiZ1bmF1dGhvcml6ZWQgdG8gdmlldyBpZGVudGl0eSBwcm92aWRlchJ8Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRo0LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5cHJvdmlkZXIudjEuSWRlbnRpdHlQcm92aWRlchoEoP8rFWIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, file_ai_stigmer_iam_identityprovider_v1_api]);
+/**
+ * IdentityProviderQueryController provides read operations for identity providers.
+ *
+ * @generated from service ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController
+ */
+export const IdentityProviderQueryController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_iam_identityprovider_v1_query, 0);
+//# sourceMappingURL=query_pb.js.map

package/ai/stigmer/iam/identityprovider/v1/query_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,2CAA2C,EAAE,MAAM,UAAU,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,0jBAA0jB,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAEzxB;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAqBvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/spec_pb.d.ts

@@ -0,0 +1,106 @@
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file ai/stigmer/iam/identityprovider/v1/spec.proto.
+ */
+export declare const file_ai_stigmer_iam_identityprovider_v1_spec: GenFile;
+/**
+ * IdentityProviderSpec defines the configuration for an external identity provider.
+ *
+ * An IdentityProvider represents an external platform's trust relationship with Stigmer.
+ * It is owned by an organization (e.g., "planton") and configures how Stigmer validates
+ * tokens from that platform during token exchange. The platform forwards its OIDC
+ * provider's access tokens to Stigmer's token exchange endpoint, which:
+ * - Validates the token signature against the configured JWKS
+ * - Fetches user profile data from the OIDC UserInfo endpoint
+ * - JIT-provisions a federated identity account with email, name, and picture
+ * - Issues a Stigmer-native token for subsequent API access
+ *
+ * The spec contains only public validation configuration — no secrets are stored.
+ * For OIDC-based integrators (e.g., Auth0), the jwks_uri and userinfo_endpoint
+ * point to the OIDC provider's standard endpoints.
+ *
+ * Example YAML:
+ *   apiVersion: iam.stigmer.ai/v1
+ *   kind: IdentityProvider
+ *   metadata:
+ *     name: Planton Cloud
+ *     slug: planton-cloud
+ *     org: planton
+ *   spec:
+ *     display_name: "Planton Cloud"
+ *     jwks_uri: "https://planton-prod.us.auth0.com/.well-known/jwks.json"
+ *     allowed_issuers: ["https://planton-prod.us.auth0.com/"]
+ *     expected_audience: "https://api.planton.ai/"
+ *     userinfo_endpoint: "https://planton-prod.us.auth0.com/userinfo"
+ *
+ * @generated from message ai.stigmer.iam.identityprovider.v1.IdentityProviderSpec
+ */
+export type IdentityProviderSpec = Message<"ai.stigmer.iam.identityprovider.v1.IdentityProviderSpec"> & {
+    /**
+     * Human-readable display name for this identity provider.
+     * Used in UI and audit logs to identify the integrating platform.
+     *
+     * @generated from field: string display_name = 1;
+     */
+    displayName: string;
+    /**
+     * JWKS endpoint URL for validating tokens presented during token exchange.
+     * For OIDC-based integrators, this points to the provider's standard JWKS endpoint
+     * (e.g., Auth0's /.well-known/jwks.json). Stigmer fetches and caches signing keys
+     * from this URL for JWT signature verification.
+     *
+     * This is the standard "jwks_uri" metadata field defined in
+     * OpenID Connect Discovery 1.0 (Section 3) and RFC 7517 (JSON Web Key Set).
+     *
+     * @generated from field: string jwks_uri = 2;
+     */
+    jwksUri: string;
+    /**
+     * JWT issuer values that Stigmer will accept from this platform.
+     * Each JWT's `iss` claim must match one of these values.
+     * For Auth0-based integrators, this is the Auth0 tenant URL
+     * (e.g., "https://planton-prod.us.auth0.com/").
+     * Supports multiple values for key rotation or multi-environment scenarios.
+     *
+     * @generated from field: repeated string allowed_issuers = 3;
+     */
+    allowedIssuers: string[];
+    /**
+     * Expected JWT audience value.
+     * Every JWT from this platform must include this as the `aud` claim.
+     * For Auth0-based integrators, this is the API identifier configured in Auth0
+     * (e.g., "https://api.planton.ai/").
+     * Prevents tokens intended for other services from being accepted by Stigmer.
+     *
+     * @generated from field: string expected_audience = 4;
+     */
+    expectedAudience: string;
+    /**
+     * Shared rate limit budget across all organizations managed via this identity provider.
+     * Expressed as requests per minute. 0 means no limit.
+     *
+     * @generated from field: int32 rate_limit_budget = 5;
+     */
+    rateLimitBudget: number;
+    /**
+     * OIDC UserInfo endpoint URL for fetching user profile data during token exchange.
+     * Stigmer calls this endpoint with the platform's access token (as a Bearer token)
+     * to retrieve the user's email, name, and picture for the federated identity account.
+     * Profile data is updated on every token exchange to keep it fresh.
+     *
+     * This is the standard "userinfo_endpoint" metadata field defined in
+     * OpenID Connect Discovery 1.0 (Section 3). The endpoint itself is specified in
+     * OpenID Connect Core 1.0 (Section 5.3).
+     *
+     * For Auth0-based integrators: https://{tenant}.auth0.com/userinfo
+     *
+     * @generated from field: string userinfo_endpoint = 6;
+     */
+    userinfoEndpoint: string;
+};
+/**
+ * Describes the message ai.stigmer.iam.identityprovider.v1.IdentityProviderSpec.
+ * Use `create(IdentityProviderSpecSchema)` to create a new message.
+ */
+export declare const IdentityProviderSpecSchema: GenMessage<IdentityProviderSpec>;