@stigmer/protos 0.0.68 → 0.0.70

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/iam_permission_pb.d.ts

@@ -5,144 +5,189 @@ import type { GenEnum, GenFile } from "@bufbuild/protobuf/codegenv1";
 export declare const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_iam_permission: GenFile;
 /**
  * ApiResourceIamPermission defines the permissions and structural relations
- * used in the Stigmer authorization model. Each value maps to an FGA relation
- * name that appears either in RPC authorization annotations or in FGA tuple
- * creation logic.
+ * used in the Stigmer authorization model.
+ *
+ * Each value maps to an FGA relation name that appears either in RPC
+ * authorization annotations or in FGA tuple creation logic.
+ *
+ * @internal
+ * Removed: operator (5), platform (6), can_update_status (28).
+ * These values are reserved to prevent accidental reuse.
  *
  * @generated from enum ai.stigmer.iam.iampolicy.v1.rpcauthorization.ApiResourceIamPermission
  */
 export declare enum ApiResourceIamPermission {
     /**
+     * Default unspecified value.
+     *
      * @generated from enum value: unspecified = 0;
      */
     unspecified = 0,
     /**
-     * Basic CRUD permissions
+     * Permission to create a resource.
      *
      * @generated from enum value: create = 1;
      */
     create = 1,
     /**
+     * Permission to delete a resource.
+     *
      * @generated from enum value: can_delete = 2;
      */
     can_delete = 2,
     /**
+     * Permission to view a resource.
+     *
      * @generated from enum value: can_view = 3;
      */
     can_view = 3,
     /**
+     * Permission to edit a resource.
+     *
      * @generated from enum value: can_edit = 4;
      */
     can_edit = 4,
     /**
-     * Platform-level permissions
+     * Permission to access the back-office admin console.
      *
      * @generated from enum value: login_to_back_office = 7;
      */
     login_to_back_office = 7,
     /**
-     * IAM policy management permissions
+     * Permission to grant or revoke access on a resource.
      *
      * @generated from enum value: can_grant_access = 8;
      */
     can_grant_access = 8,
     /**
+     * Permission to view access policies on a resource.
+     *
      * @generated from enum value: can_view_access = 9;
      */
     can_view_access = 9,
     /**
-     * Resource ownership and membership
+     * Owner relation granting full control of a resource.
      *
      * @generated from enum value: owner = 10;
      */
     owner = 10,
     /**
+     * Member relation granting membership-level access to a resource.
+     *
      * @generated from enum value: member = 11;
      */
     member = 11,
     /**
+     * Viewer relation granting read-only access to a resource.
+     *
      * @generated from enum value: viewer = 26;
      */
     viewer = 26,
     /**
-     * Structural relations (parent links)
+     * Structural relation linking a resource to its owning identity account.
      *
      * @generated from enum value: identity_account = 12;
      */
     identity_account = 12,
     /**
+     * Structural relation linking a resource to its owning organization.
+     *
      * @generated from enum value: organization = 13;
      */
     organization = 13,
     /**
+     * Structural relation linking an execution to its parent session.
+     *
      * @generated from enum value: session = 14;
      */
     session = 14,
     /**
+     * Structural relation linking an instance or session to its parent agent.
+     *
      * @generated from enum value: agent = 15;
      */
     agent = 15,
     /**
-     * Resource-specific creation permissions
+     * Permission to create an agent within an organization.
      *
      * @generated from enum value: can_create_agent = 16;
      */
     can_create_agent = 16,
     /**
+     * Permission to create a workflow within an organization.
+     *
      * @generated from enum value: can_create_workflow = 17;
      */
     can_create_workflow = 17,
     /**
+     * Permission to create a session for an agent.
+     *
      * @generated from enum value: can_create_session = 18;
      */
     can_create_session = 18,
     /**
+     * Permission to create an execution within a session.
+     *
      * @generated from enum value: can_create_execution_in = 19;
      */
     can_create_execution_in = 19,
     /**
+     * Permission to create an agent instance.
+     *
      * @generated from enum value: can_create_instance = 20;
      */
     can_create_instance = 20,
     /**
+     * Permission to create a skill within an organization.
+     *
      * @generated from enum value: can_create_skill = 21;
      */
     can_create_skill = 21,
     /**
+     * Permission to create a project within an organization.
+     *
      * @generated from enum value: can_create_project = 23;
      */
     can_create_project = 23,
     /**
+     * Permission to create an identity provider within an organization.
+     *
      * @generated from enum value: can_create_idp = 24;
      */
     can_create_idp = 24,
     /**
+     * Permission to create an environment within an organization.
+     *
      * @generated from enum value: can_create_environment = 27;
      */
     can_create_environment = 27,
     /**
-     * Resource-specific operation permissions
+     * Permission to execute an agent or workflow.
      *
      * @generated from enum value: can_execute = 22;
      */
     can_execute = 22,
     /**
-     * Secret access permissions
+     * Permission to read secret values from an environment.
      *
      * @generated from enum value: can_read_secrets = 25;
      */
     can_read_secrets = 25,
     /**
-     * Platform-level operational permissions (checked against platform:stigmer)
+     * Platform-level permission to bootstrap IAM policies during resource creation.
      *
      * @generated from enum value: can_bootstrap_iam = 29;
      */
     can_bootstrap_iam = 29,
     /**
+     * Platform-level permission to manage identity accounts.
+     *
      * @generated from enum value: can_manage_identity_accounts = 30;
      */
     can_manage_identity_accounts = 30,
     /**
+     * Platform-level permission to update agent execution status.
+     *
      * @generated from enum value: can_update_execution_status = 31;
      */
     can_update_execution_status = 31

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/iam_permission_pb.js

@@ -8,145 +8,190 @@ import { enumDesc, fileDesc } from "@bufbuild/protobuf/codegenv1";
 export const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_iam_permission = /*@__PURE__*/ fileDesc("CkFhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcnBjYXV0aG9yaXphdGlvbi9pYW1fcGVybWlzc2lvbi5wcm90bxIsYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLnJwY2F1dGhvcml6YXRpb24qoAUKGEFwaVJlc291cmNlSWFtUGVybWlzc2lvbhIPCgt1bnNwZWNpZmllZBAAEgoKBmNyZWF0ZRABEg4KCmNhbl9kZWxldGUQAhIMCghjYW5fdmlldxADEgwKCGNhbl9lZGl0EAQSGAoUbG9naW5fdG9fYmFja19vZmZpY2UQBxIUChBjYW5fZ3JhbnRfYWNjZXNzEAgSEwoPY2FuX3ZpZXdfYWNjZXNzEAkSCQoFb3duZXIQChIKCgZtZW1iZXIQCxIKCgZ2aWV3ZXIQGhIUChBpZGVudGl0eV9hY2NvdW50EAwSEAoMb3JnYW5pemF0aW9uEA0SCwoHc2Vzc2lvbhAOEgkKBWFnZW50EA8SFAoQY2FuX2NyZWF0ZV9hZ2VudBAQEhcKE2Nhbl9jcmVhdGVfd29ya2Zsb3cQERIWChJjYW5fY3JlYXRlX3Nlc3Npb24QEhIbChdjYW5fY3JlYXRlX2V4ZWN1dGlvbl9pbhATEhcKE2Nhbl9jcmVhdGVfaW5zdGFuY2UQFBIUChBjYW5fY3JlYXRlX3NraWxsEBUSFgoSY2FuX2NyZWF0ZV9wcm9qZWN0EBcSEgoOY2FuX2NyZWF0ZV9pZHAQGBIaChZjYW5fY3JlYXRlX2Vudmlyb25tZW50EBsSDwoLY2FuX2V4ZWN1dGUQFhIUChBjYW5fcmVhZF9zZWNyZXRzEBkSFQoRY2FuX2Jvb3RzdHJhcF9pYW0QHRIgChxjYW5fbWFuYWdlX2lkZW50aXR5X2FjY291bnRzEB4SHwobY2FuX3VwZGF0ZV9leGVjdXRpb25fc3RhdHVzEB8iBAgFEAUiBAgGEAYiBAgcEBwqCG9wZXJhdG9yKghwbGF0Zm9ybSoRY2FuX3VwZGF0ZV9zdGF0dXNiBnByb3RvMw");
 /**
  * ApiResourceIamPermission defines the permissions and structural relations
- * used in the Stigmer authorization model. Each value maps to an FGA relation
- * name that appears either in RPC authorization annotations or in FGA tuple
- * creation logic.
+ * used in the Stigmer authorization model.
+ *
+ * Each value maps to an FGA relation name that appears either in RPC
+ * authorization annotations or in FGA tuple creation logic.
+ *
+ * @internal
+ * Removed: operator (5), platform (6), can_update_status (28).
+ * These values are reserved to prevent accidental reuse.
  *
  * @generated from enum ai.stigmer.iam.iampolicy.v1.rpcauthorization.ApiResourceIamPermission
  */
 export var ApiResourceIamPermission;
 (function (ApiResourceIamPermission) {
     /**
+     * Default unspecified value.
+     *
      * @generated from enum value: unspecified = 0;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["unspecified"] = 0] = "unspecified";
     /**
-     * Basic CRUD permissions
+     * Permission to create a resource.
      *
      * @generated from enum value: create = 1;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["create"] = 1] = "create";
     /**
+     * Permission to delete a resource.
+     *
      * @generated from enum value: can_delete = 2;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_delete"] = 2] = "can_delete";
     /**
+     * Permission to view a resource.
+     *
      * @generated from enum value: can_view = 3;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_view"] = 3] = "can_view";
     /**
+     * Permission to edit a resource.
+     *
      * @generated from enum value: can_edit = 4;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_edit"] = 4] = "can_edit";
     /**
-     * Platform-level permissions
+     * Permission to access the back-office admin console.
      *
      * @generated from enum value: login_to_back_office = 7;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["login_to_back_office"] = 7] = "login_to_back_office";
     /**
-     * IAM policy management permissions
+     * Permission to grant or revoke access on a resource.
      *
      * @generated from enum value: can_grant_access = 8;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_grant_access"] = 8] = "can_grant_access";
     /**
+     * Permission to view access policies on a resource.
+     *
      * @generated from enum value: can_view_access = 9;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_view_access"] = 9] = "can_view_access";
     /**
-     * Resource ownership and membership
+     * Owner relation granting full control of a resource.
      *
      * @generated from enum value: owner = 10;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["owner"] = 10] = "owner";
     /**
+     * Member relation granting membership-level access to a resource.
+     *
      * @generated from enum value: member = 11;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["member"] = 11] = "member";
     /**
+     * Viewer relation granting read-only access to a resource.
+     *
      * @generated from enum value: viewer = 26;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["viewer"] = 26] = "viewer";
     /**
-     * Structural relations (parent links)
+     * Structural relation linking a resource to its owning identity account.
      *
      * @generated from enum value: identity_account = 12;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["identity_account"] = 12] = "identity_account";
     /**
+     * Structural relation linking a resource to its owning organization.
+     *
      * @generated from enum value: organization = 13;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["organization"] = 13] = "organization";
     /**
+     * Structural relation linking an execution to its parent session.
+     *
      * @generated from enum value: session = 14;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["session"] = 14] = "session";
     /**
+     * Structural relation linking an instance or session to its parent agent.
+     *
      * @generated from enum value: agent = 15;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["agent"] = 15] = "agent";
     /**
-     * Resource-specific creation permissions
+     * Permission to create an agent within an organization.
      *
      * @generated from enum value: can_create_agent = 16;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_create_agent"] = 16] = "can_create_agent";
     /**
+     * Permission to create a workflow within an organization.
+     *
      * @generated from enum value: can_create_workflow = 17;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_create_workflow"] = 17] = "can_create_workflow";
     /**
+     * Permission to create a session for an agent.
+     *
      * @generated from enum value: can_create_session = 18;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_create_session"] = 18] = "can_create_session";
     /**
+     * Permission to create an execution within a session.
+     *
      * @generated from enum value: can_create_execution_in = 19;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_create_execution_in"] = 19] = "can_create_execution_in";
     /**
+     * Permission to create an agent instance.
+     *
      * @generated from enum value: can_create_instance = 20;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_create_instance"] = 20] = "can_create_instance";
     /**
+     * Permission to create a skill within an organization.
+     *
      * @generated from enum value: can_create_skill = 21;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_create_skill"] = 21] = "can_create_skill";
     /**
+     * Permission to create a project within an organization.
+     *
      * @generated from enum value: can_create_project = 23;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_create_project"] = 23] = "can_create_project";
     /**
+     * Permission to create an identity provider within an organization.
+     *
      * @generated from enum value: can_create_idp = 24;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_create_idp"] = 24] = "can_create_idp";
     /**
+     * Permission to create an environment within an organization.
+     *
      * @generated from enum value: can_create_environment = 27;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_create_environment"] = 27] = "can_create_environment";
     /**
-     * Resource-specific operation permissions
+     * Permission to execute an agent or workflow.
      *
      * @generated from enum value: can_execute = 22;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_execute"] = 22] = "can_execute";
     /**
-     * Secret access permissions
+     * Permission to read secret values from an environment.
      *
      * @generated from enum value: can_read_secrets = 25;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_read_secrets"] = 25] = "can_read_secrets";
     /**
-     * Platform-level operational permissions (checked against platform:stigmer)
+     * Platform-level permission to bootstrap IAM policies during resource creation.
      *
      * @generated from enum value: can_bootstrap_iam = 29;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_bootstrap_iam"] = 29] = "can_bootstrap_iam";
     /**
+     * Platform-level permission to manage identity accounts.
+     *
      * @generated from enum value: can_manage_identity_accounts = 30;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_manage_identity_accounts"] = 30] = "can_manage_identity_accounts";
     /**
+     * Platform-level permission to update agent execution status.
+     *
      * @generated from enum value: can_update_execution_status = 31;
      */
     ApiResourceIamPermission[ApiResourceIamPermission["can_update_execution_status"] = 31] = "can_update_execution_status";

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/iam_permission_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam_permission_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/iam/iampolicy/v1/rpcauthorization/iam_permission_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+JAA+J;AAC/J,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAY,aAAa,CACpG,QAAQ,CAAC,wiCAAwiC,CAAC,CAAC;AAErjC;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,wBAmKX;AAnKD,WAAY,wBAAwB;IAClC;;OAEG;IACH,qFAAe,CAAA;IAEf;;;;OAIG;IACH,2EAAU,CAAA;IAEV;;OAEG;IACH,mFAAc,CAAA;IAEd;;OAEG;IACH,+EAAY,CAAA;IAEZ;;OAEG;IACH,+EAAY,CAAA;IAEZ;;;;OAIG;IACH,uGAAwB,CAAA;IAExB;;;;OAIG;IACH,+FAAoB,CAAA;IAEpB;;OAEG;IACH,6FAAmB,CAAA;IAEnB;;;;OAIG;IACH,0EAAU,CAAA;IAEV;;OAEG;IACH,4EAAW,CAAA;IAEX;;OAEG;IACH,4EAAW,CAAA;IAEX;;;;OAIG;IACH,gGAAqB,CAAA;IAErB;;OAEG;IACH,wFAAiB,CAAA;IAEjB;;OAEG;IACH,8EAAY,CAAA;IAEZ;;OAEG;IACH,0EAAU,CAAA;IAEV;;;;OAIG;IACH,gGAAqB,CAAA;IAErB;;OAEG;IACH,sGAAwB,CAAA;IAExB;;OAEG;IACH,oGAAuB,CAAA;IAEvB;;OAEG;IACH,8GAA4B,CAAA;IAE5B;;OAEG;IACH,sGAAwB,CAAA;IAExB;;OAEG;IACH,gGAAqB,CAAA;IAErB;;OAEG;IACH,oGAAuB,CAAA;IAEvB;;OAEG;IACH,4FAAmB,CAAA;IAEnB;;OAEG;IACH,4GAA2B,CAAA;IAE3B;;;;OAIG;IACH,sFAAgB,CAAA;IAEhB;;;;OAIG;IACH,gGAAqB,CAAA;IAErB;;;;OAIG;IACH,kGAAsB,CAAA;IAEtB;;OAEG;IACH,wHAAiC,CAAA;IAEjC;;OAEG;IACH,sHAAgC,CAAA;AAClC,CAAC,EAnKW,wBAAwB,KAAxB,wBAAwB,QAmKnC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsC,aAAa,CAC5F,QAAQ,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"iam_permission_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/iam/iampolicy/v1/rpcauthorization/iam_permission_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+JAA+J;AAC/J,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAY,aAAa,CACpG,QAAQ,CAAC,wiCAAwiC,CAAC,CAAC;AAErjC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,wBA2MX;AA3MD,WAAY,wBAAwB;IAClC;;;;OAIG;IACH,qFAAe,CAAA;IAEf;;;;OAIG;IACH,2EAAU,CAAA;IAEV;;;;OAIG;IACH,mFAAc,CAAA;IAEd;;;;OAIG;IACH,+EAAY,CAAA;IAEZ;;;;OAIG;IACH,+EAAY,CAAA;IAEZ;;;;OAIG;IACH,uGAAwB,CAAA;IAExB;;;;OAIG;IACH,+FAAoB,CAAA;IAEpB;;;;OAIG;IACH,6FAAmB,CAAA;IAEnB;;;;OAIG;IACH,0EAAU,CAAA;IAEV;;;;OAIG;IACH,4EAAW,CAAA;IAEX;;;;OAIG;IACH,4EAAW,CAAA;IAEX;;;;OAIG;IACH,gGAAqB,CAAA;IAErB;;;;OAIG;IACH,wFAAiB,CAAA;IAEjB;;;;OAIG;IACH,8EAAY,CAAA;IAEZ;;;;OAIG;IACH,0EAAU,CAAA;IAEV;;;;OAIG;IACH,gGAAqB,CAAA;IAErB;;;;OAIG;IACH,sGAAwB,CAAA;IAExB;;;;OAIG;IACH,oGAAuB,CAAA;IAEvB;;;;OAIG;IACH,8GAA4B,CAAA;IAE5B;;;;OAIG;IACH,sGAAwB,CAAA;IAExB;;;;OAIG;IACH,gGAAqB,CAAA;IAErB;;;;OAIG;IACH,oGAAuB,CAAA;IAEvB;;;;OAIG;IACH,4FAAmB,CAAA;IAEnB;;;;OAIG;IACH,4GAA2B,CAAA;IAE3B;;;;OAIG;IACH,sFAAgB,CAAA;IAEhB;;;;OAIG;IACH,gGAAqB,CAAA;IAErB;;;;OAIG;IACH,kGAAsB,CAAA;IAEtB;;;;OAIG;IACH,wHAAiC,CAAA;IAEjC;;;;OAIG;IACH,sHAAgC,CAAA;AAClC,CAAC,EA3MW,wBAAwB,KAAxB,wBAAwB,QA2MnC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsC,aAAa,CAC5F,QAAQ,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/io_pb.d.ts

@@ -7,45 +7,52 @@ import type { Message } from "@bufbuild/protobuf";
  */
 export declare const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_io: GenFile;
 /**
- * authorization config message to check before executing rpc
+ * RpcAuthorizationConfig defines the authorization check performed before an RPC executes.
+ *
+ * @internal
+ * The authorization interceptor reads these fields from the method option annotation
+ * and performs an FGA check: does the caller have `permission` on
+ * `resource_kind:<resolved_id>`?
  *
  * @generated from message ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig
  */
 export type RpcAuthorizationConfig = Message<"ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig"> & {
     /**
-     * permission required to run the service
+     * Permission required to invoke the RPC.
      *
      * @generated from field: ai.stigmer.iam.iampolicy.v1.rpcauthorization.ApiResourceIamPermission permission = 1;
      */
     permission: ApiResourceIamPermission;
     /**
-     * api-resource-kind that the permission should be granted
+     * Resource kind that the permission is checked against.
      *
      * @generated from field: ai.stigmer.commons.apiresource.apiresourcekind.ApiResourceKind resource_kind = 2;
      */
     resourceKind: ApiResourceKind;
     /**
-     * path of the field that contains the api-resource-kind on which to perform authorization.
-     * this is useful when the resource_kind is part of the input object
+     * Dot-path to the field in the request that contains the resource kind value.
+     * Used when resource_kind varies per request rather than being statically configured.
      *
      * @generated from field: string resource_kind_path = 3;
      */
     resourceKindPath: string;
     /**
-     * path of the field inside the input object to be used for performing authorization.
+     * Dot-path to the field in the request that contains the resource identifier for the authorization check.
      *
      * @generated from field: string field_path = 4;
      */
     fieldPath: string;
     /**
-     * error message to be returned when the permission is not granted to user
+     * Error message returned when the caller lacks the required permission.
      *
      * @generated from field: string error_msg = 5;
      */
     errorMsg: string;
     /**
-     * identifier value to be configured if identifier is not part of the input
-     * this will be used in case of system internal rpc`s where the resource_id is `planton-cloud`
+     * Static resource identifier used when the ID is not part of the request.
+     *
+     * @internal
+     * Used for platform-level RPCs where the resource is always "stigmer".
      *
      * @generated from field: string resource_id = 6;
      */

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/iam/iampolicy/v1/rpcauthorization/io_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,mJAAmJ;AACnJ,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,qEAAqE,EAAE,MAAM,sEAAsE,CAAC;AAE7J,OAAO,EAAE,gEAAgE,EAAE,MAAM,qBAAqB,CAAC;AAGvG;;GAEG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAY,aAAa,CACxF,QAAQ,CAAC,6hBAA6hB,EAAE,CAAC,qEAAqE,EAAE,gEAAgE,CAAC,CAAC,CAAC;AAqDrrB;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,oDAAoD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/iam/iampolicy/v1/rpcauthorization/io_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,mJAAmJ;AACnJ,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,qEAAqE,EAAE,MAAM,sEAAsE,CAAC;AAE7J,OAAO,EAAE,gEAAgE,EAAE,MAAM,qBAAqB,CAAC;AAGvG;;GAEG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAY,aAAa,CACxF,QAAQ,CAAC,6hBAA6hB,EAAE,CAAC,qEAAqE,EAAE,gEAAgE,CAAC,CAAC,CAAC;AA4DrrB;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,oDAAoD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options_pb.d.ts

@@ -6,14 +6,20 @@ import type { MethodOptions } from "@bufbuild/protobuf/wkt";
  */
 export declare const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options: GenFile;
 /**
+ * Full authorization configuration: permission, resource kind, field path, and error message.
+ *
  * @generated from extension: ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig config = 50056;
  */
 export declare const config: GenExtension<MethodOptions, RpcAuthorizationConfig>;
 /**
+ * When true, the RPC is publicly accessible without any authentication.
+ *
  * @generated from extension: bool is_public = 50057;
  */
 export declare const is_public: GenExtension<MethodOptions, boolean>;
 /**
+ * When true, the RPC requires authentication but skips FGA authorization checks.
+ *
  * @generated from extension: bool is_skip_authorization = 50058;
  */
 export declare const is_skip_authorization: GenExtension<MethodOptions, boolean>;

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options_pb.js

@@ -9,14 +9,20 @@ import { file_google_protobuf_descriptor } from "@bufbuild/protobuf/wkt";
  */
 export const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options = /*@__PURE__*/ fileDesc("CkFhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcnBjYXV0aG9yaXphdGlvbi9tZXRob2Rfb3B0aW9ucy5wcm90bxIsYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLnJwY2F1dGhvcml6YXRpb246fgoGY29uZmlnEh4uZ29vZ2xlLnByb3RvYnVmLk1ldGhvZE9wdGlvbnMYiIcDIAEoCzJELmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5ycGNhdXRob3JpemF0aW9uLlJwY0F1dGhvcml6YXRpb25Db25maWdSBmNvbmZpZzo9Cglpc19wdWJsaWMSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxiJhwMgASgIUghpc1B1YmxpYzpUChVpc19za2lwX2F1dGhvcml6YXRpb24SHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxiKhwMgASgIUhNpc1NraXBBdXRob3JpemF0aW9uYgZwcm90bzM", [file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_io, file_google_protobuf_descriptor]);
 /**
+ * Full authorization configuration: permission, resource kind, field path, and error message.
+ *
  * @generated from extension: ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig config = 50056;
  */
 export const config = /*@__PURE__*/ extDesc(file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, 0);
 /**
+ * When true, the RPC is publicly accessible without any authentication.
+ *
  * @generated from extension: bool is_public = 50057;
  */
 export const is_public = /*@__PURE__*/ extDesc(file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, 1);
 /**
+ * When true, the RPC requires authentication but skips FGA authorization checks.
+ *
  * @generated from extension: bool is_skip_authorization = 50058;
  */
 export const is_skip_authorization = /*@__PURE__*/ extDesc(file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, 2);

package/ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"method_options_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+JAA+J;AAC/J,oBAAoB;AAGpB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,oDAAoD,EAAE,MAAM,SAAS,CAAC;AAE/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;GAEG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAY,aAAa,CACpG,QAAQ,CAAC,qhBAAqhB,EAAE,CAAC,oDAAoD,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAE3nB;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAwD,aAAa,CACtF,OAAO,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAyC,aAAa,CAC1E,OAAO,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAyC,aAAa,CACtF,OAAO,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"method_options_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+JAA+J;AAC/J,oBAAoB;AAGpB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,oDAAoD,EAAE,MAAM,SAAS,CAAC;AAE/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;GAEG;AACH,MAAM,CAAC,MAAM,gEAAgE,GAAY,aAAa,CACpG,QAAQ,CAAC,qhBAAqhB,EAAE,CAAC,oDAAoD,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAE3nB;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAwD,aAAa,CACtF,OAAO,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAyC,aAAa,CAC1E,OAAO,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAyC,aAAa,CACtF,OAAO,CAAC,gEAAgE,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/spec_pb.d.ts

@@ -35,12 +35,12 @@ export type IamPolicySpec = Message<"ai.stigmer.iam.iampolicy.v1.IamPolicySpec">
      */
     resource?: ApiResourceRef;
     /**
-     * Relation: HOW/what permission is being granted
-     * This is the FGA relation/permission being granted (e.g., "admin", "viewer", "owner")
-     * The relation value maps to the role_code from IamRole.
+     * The permission being granted (e.g., "admin", "viewer", "owner").
+     * Maps to the role_code from IamRole.
      * Examples: "admin", "editor", "viewer", "owner", "member"
      *
-     * When this policy is synced to OpenFGA, this becomes the relation in the tuple:
+     * @internal
+     * This is the FGA relation in the authorization tuple:
      * principal.kind:principal.id#principal.relation@resource.kind:resource.id#relation
      *
      * @generated from field: string relation = 3;
@@ -80,7 +80,7 @@ export type ApiResourceRef = Message<"ai.stigmer.iam.iampolicy.v1.ApiResourceRef
      */
     id: string;
     /**
-     * Optional relation qualifier for the resource reference
+     * Optional relation qualifier for the resource reference.
      * Used when the reference needs additional context about the relationship.
      *
      * Primary use case: For team principals, this specifies the relation of the
@@ -88,12 +88,12 @@ export type ApiResourceRef = Message<"ai.stigmer.iam.iampolicy.v1.ApiResourceRef
      * Example: principal { kind: "team", id: "tm-123", relation: "member" }
      * means "members of team tm-123"
      *
-     * In OpenFGA tuple notation, this becomes:
-     * team:tm-123#member (as the subject of the tuple)
-     *
      * This field qualifies HOW the principal relates to this resource reference,
      * NOT the permission being granted (that's IamPolicySpec.relation).
      *
+     * @internal
+     * In OpenFGA tuple notation: team:tm-123#member (as the subject of the tuple)
+     *
      * @generated from field: string relation = 3;
      */
     relation: string;

package/ai/stigmer/iam/identityaccount/v1/api_pb.d.ts

@@ -8,37 +8,42 @@ import type { Message } from "@bufbuild/protobuf";
  */
 export declare const file_ai_stigmer_iam_identityaccount_v1_api: GenFile;
 /**
- * identity-account for user accounts
+ * IdentityAccount represents a user or machine principal in Stigmer.
+ *
+ * An identity account is the core identity primitive for authentication and
+ * authorization. Accounts can be direct (signed up via Stigmer), federated
+ * (provisioned through an external identity provider), or machine
+ * (service-to-service credentials).
  *
  * @generated from message ai.stigmer.iam.identityaccount.v1.IdentityAccount
  */
 export type IdentityAccount = Message<"ai.stigmer.iam.identityaccount.v1.IdentityAccount"> & {
     /**
-     * api-version
+     * API version for this resource type.
      *
      * @generated from field: string api_version = 1;
      */
     apiVersion: string;
     /**
-     * resource-kind
+     * Resource kind identifier.
      *
      * @generated from field: string kind = 2;
      */
     kind: string;
     /**
-     * metadata
+     * Resource metadata including name, organization, and labels.
      *
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceMetadata metadata = 3;
      */
     metadata?: ApiResourceMetadata;
     /**
-     * spec
+     * Configurable properties: identity provider ID, email, name, and provisioning mode.
      *
      * @generated from field: ai.stigmer.iam.identityaccount.v1.IdentityAccountSpec spec = 4;
      */
     spec?: IdentityAccountSpec;
     /**
-     * status
+     * System-managed state including audit trail.
      *
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceAuditStatus status = 5;
      */

package/ai/stigmer/iam/identityaccount/v1/api_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/api_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,4CAA4C,EAAE,MAAM,0CAA0C,CAAC;AAExG,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAAE,2CAA2C,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,giBAAgiB,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA4CltB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/api_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,4CAA4C,EAAE,MAAM,0CAA0C,CAAC;AAExG,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAAE,2CAA2C,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,giBAAgiB,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAiDltB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}