@stigmer/protos 0.0.69 → 0.0.70

package/ai/stigmer/iam/identityaccount/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAE9H,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,0CAA0C,EAAE,MAAM,UAAU,CAAC;AAEtE,OAAO,EAAE,yCAAyC,EAAE,MAAM,SAAS,CAAC;AAEpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,4rCAA4rC,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,gEAAgE,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEr+C;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAiEtC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAE9H,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,0CAA0C,EAAE,MAAM,UAAU,CAAC;AAEtE,OAAO,EAAE,yCAAyC,EAAE,MAAM,SAAS,CAAC;AAEpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,4rCAA4rC,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,gEAAgE,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEr+C;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAuEtC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityaccount/v1/spec_pb.d.ts

@@ -9,14 +9,17 @@ export declare const file_ai_stigmer_iam_identityaccount_v1_spec: GenFile;
 /**
  * IdentityAccountSpec defines the configuration for an identity account.
  *
- * An identity account represents a user or machine principal in Stigmer's
- * authorization model. All FGA tuples use identity_account as the principal type.
+ * An identity account represents a user or machine principal in Stigmer.
+ * Accounts can be direct (signed up via Stigmer), federated (provisioned
+ * through an external identity provider), or machine (service-to-service
+ * credentials).
  *
- * Accounts are provisioned in one of three ways:
- * - direct: User signed up via Stigmer's Auth0 (idp_id is the Auth0 subject ID)
- * - federated: JIT-provisioned via an external IdentityProvider during federated auth
- *   (idp_id is a compound key: "federated:{provider_id}:{external_sub}")
- * - machine: M2M client credentials (idp_id ends with "@clients")
+ * @internal
+ * All FGA tuples use identity_account as the principal type.
+ * Provisioning details:
+ * - direct: Auth0 subject ID (e.g., "auth0|abc123")
+ * - federated: compound key "federated:{provider_id}:{external_sub}"
+ * - machine: Auth0 client ID with "@clients" suffix
  *
  * @generated from message ai.stigmer.iam.identityaccount.v1.IdentityAccountSpec
  */

package/ai/stigmer/iam/identityaccount/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAE5F,OAAO,EAAE,2CAA2C,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,kjBAAkjB,EAAE,CAAC,sCAAsC,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA4FlrB;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAE5F,OAAO,EAAE,2CAA2C,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,kjBAAkjB,EAAE,CAAC,sCAAsC,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA+FlrB;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityaccount/v1/webhook_pb.d.ts

@@ -5,40 +5,61 @@ import type { Message } from "@bufbuild/protobuf";
  */
 export declare const file_ai_stigmer_iam_identityaccount_v1_webhook: GenFile;
 /**
- * https://auth0.com/docs/customize/log-streams/custom-log-streams
+ * Auth0Webhook represents a log-stream event payload from Auth0.
+ *
+ * @internal
+ * Stigmer receives these events via a custom Auth0 log stream to trigger
+ * identity account provisioning on signup.
+ * See: https://auth0.com/docs/customize/log-streams/custom-log-streams
  *
  * @generated from message ai.stigmer.iam.identityaccount.v1.Auth0Webhook
  */
 export type Auth0Webhook = Message<"ai.stigmer.iam.identityaccount.v1.Auth0Webhook"> & {
     /**
+     * ISO 8601 timestamp of the event.
+     *
      * @generated from field: string date = 1;
      */
     date: string;
     /**
+     * Auth0 event type code (e.g., "ss" for successful signup).
+     *
      * @generated from field: string type = 2;
      */
     type: string;
     /**
+     * Human-readable description of the event.
+     *
      * @generated from field: string description = 3;
      */
     description: string;
     /**
+     * Auth0 application client ID that triggered the event.
+     *
      * @generated from field: string client_id = 4;
      */
     clientId: string;
     /**
+     * Name of the Auth0 application that triggered the event.
+     *
      * @generated from field: string client_name = 5;
      */
     clientName: string;
     /**
+     * IP address of the user who triggered the event.
+     *
      * @generated from field: string ip = 6;
      */
     ip: string;
     /**
+     * User-Agent header from the request that triggered the event.
+     *
      * @generated from field: string user_agent = 7;
      */
     userAgent: string;
     /**
+     * Auth0 user ID of the user associated with the event (e.g., "auth0|abc123").
+     *
      * @generated from field: string user_id = 8;
      */
     userId: string;

package/ai/stigmer/iam/identityaccount/v1/webhook_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/webhook_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAY,aAAa,CAClF,QAAQ,CAAC,4UAA4U,CAAC,CAAC;AAiDzV;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"webhook_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/webhook_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAY,aAAa,CAClF,QAAQ,CAAC,4UAA4U,CAAC,CAAC;AAsEzV;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/api_pb.d.ts

@@ -59,7 +59,7 @@ export type IdentityProvider = Message<"ai.stigmer.iam.identityprovider.v1.Ident
      */
     spec?: IdentityProviderSpec;
     /**
-     * status
+     * System-managed state including audit trail.
      *
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceAuditStatus status = 5;
      */

package/ai/stigmer/iam/identityprovider/v1/command_connect.d.ts

@@ -7,9 +7,15 @@ export declare const IdentityProviderCommandController: {
     readonly typeName: "ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController";
     readonly methods: {
         /**
-         * Create or update an identity provider (Kubernetes-style apply).
-         * If the resource doesn't exist: creates a new identity provider.
-         * If the resource exists: updates the existing identity provider.
+         * Create or update an identity provider.
+         *
+         * If the resource does not exist, creates a new identity provider.
+         * If the resource exists, updates the existing identity provider.
+         *
+         * @internal
+         * The authorization and state-operation are determined depending on whether the
+         * identity provider is going to be created or updated, which is determined as
+         * part of the request execution.
          *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.apply
          */
@@ -20,9 +26,13 @@ export declare const IdentityProviderCommandController: {
             readonly kind: any;
         };
         /**
-         * Create a new identity provider.
+         * Create an identity provider.
+         *
          * The creator's organization owns the identity provider.
          *
+         * @internal
+         * Authorization: Requires can_create_idp permission in the organization.
+         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.create
          */
         readonly create: {
@@ -33,7 +43,9 @@ export declare const IdentityProviderCommandController: {
         };
         /**
          * Update an existing identity provider.
-         * Requires can_edit permission on the identity provider.
+         *
+         * @internal
+         * Authorization: Requires can_edit permission on the identity provider resource.
          *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.update
          */
@@ -45,7 +57,12 @@ export declare const IdentityProviderCommandController: {
         };
         /**
          * Delete an identity provider.
-         * Deletion is blocked if any platform-managed organizations reference this identity provider.
+         *
+         * Deletion is blocked if any platform-managed organizations reference this
+         * identity provider.
+         *
+         * @internal
+         * Authorization: Requires can_delete permission on the identity provider resource.
          *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.delete
          */

package/ai/stigmer/iam/identityprovider/v1/command_connect.js

@@ -12,9 +12,15 @@ export const IdentityProviderCommandController = {
     typeName: "ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController",
     methods: {
         /**
-         * Create or update an identity provider (Kubernetes-style apply).
-         * If the resource doesn't exist: creates a new identity provider.
-         * If the resource exists: updates the existing identity provider.
+         * Create or update an identity provider.
+         *
+         * If the resource does not exist, creates a new identity provider.
+         * If the resource exists, updates the existing identity provider.
+         *
+         * @internal
+         * The authorization and state-operation are determined depending on whether the
+         * identity provider is going to be created or updated, which is determined as
+         * part of the request execution.
          *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.apply
          */
@@ -25,9 +31,13 @@ export const IdentityProviderCommandController = {
             kind: MethodKind.Unary,
         },
         /**
-         * Create a new identity provider.
+         * Create an identity provider.
+         *
          * The creator's organization owns the identity provider.
          *
+         * @internal
+         * Authorization: Requires can_create_idp permission in the organization.
+         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.create
          */
         create: {
@@ -38,7 +48,9 @@ export const IdentityProviderCommandController = {
         },
         /**
          * Update an existing identity provider.
-         * Requires can_edit permission on the identity provider.
+         *
+         * @internal
+         * Authorization: Requires can_edit permission on the identity provider resource.
          *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.update
          */
@@ -50,7 +62,12 @@ export const IdentityProviderCommandController = {
         },
         /**
          * Delete an identity provider.
-         * Deletion is blocked if any platform-managed organizations reference this identity provider.
+         *
+         * Deletion is blocked if any platform-managed organizations reference this
+         * identity provider.
+         *
+         * @internal
+         * Authorization: Requires can_delete permission on the identity provider resource.
          *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.delete
          */

package/ai/stigmer/iam/identityprovider/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oIAAoI;AACpI,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,sEAAsE;IAChF,OAAO,EAAE;QACP;;;;;;WAMG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oIAAoI;AACpI,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,sEAAsE;IAChF,OAAO,EAAE;QACP;;;;;;;;;;;;WAYG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/command_pb.d.ts

@@ -12,9 +12,15 @@ export declare const file_ai_stigmer_iam_identityprovider_v1_command: GenFile;
  */
 export declare const IdentityProviderCommandController: GenService<{
     /**
-     * Create or update an identity provider (Kubernetes-style apply).
-     * If the resource doesn't exist: creates a new identity provider.
-     * If the resource exists: updates the existing identity provider.
+     * Create or update an identity provider.
+     *
+     * If the resource does not exist, creates a new identity provider.
+     * If the resource exists, updates the existing identity provider.
+     *
+     * @internal
+     * The authorization and state-operation are determined depending on whether the
+     * identity provider is going to be created or updated, which is determined as
+     * part of the request execution.
      *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.apply
      */
@@ -24,9 +30,13 @@ export declare const IdentityProviderCommandController: GenService<{
         output: typeof IdentityProviderSchema;
     };
     /**
-     * Create a new identity provider.
+     * Create an identity provider.
+     *
      * The creator's organization owns the identity provider.
      *
+     * @internal
+     * Authorization: Requires can_create_idp permission in the organization.
+     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.create
      */
     create: {
@@ -36,7 +46,9 @@ export declare const IdentityProviderCommandController: GenService<{
     };
     /**
      * Update an existing identity provider.
-     * Requires can_edit permission on the identity provider.
+     *
+     * @internal
+     * Authorization: Requires can_edit permission on the identity provider resource.
      *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.update
      */
@@ -47,7 +59,12 @@ export declare const IdentityProviderCommandController: GenService<{
     };
     /**
      * Delete an identity provider.
-     * Deletion is blocked if any platform-managed organizations reference this identity provider.
+     *
+     * Deletion is blocked if any platform-managed organizations reference this
+     * identity provider.
+     *
+     * @internal
+     * Authorization: Requires can_delete permission on the identity provider resource.
      *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.delete
      */

package/ai/stigmer/iam/identityprovider/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,oIAAoI;AACpI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,2CAA2C,EAAE,MAAM,UAAU,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,slCAAslC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAErzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GA8CzC,aAAa,CAChB,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,oIAAoI;AACpI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,2CAA2C,EAAE,MAAM,UAAU,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,slCAAslC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAErzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GA+DzC,aAAa,CAChB,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/io_pb.d.ts

@@ -6,13 +6,13 @@ import type { Message } from "@bufbuild/protobuf";
  */
 export declare const file_ai_stigmer_iam_identityprovider_v1_io: GenFile;
 /**
- * Wrapper for identity provider id.
+ * IdentityProviderId identifies an identity provider by its unique identifier.
  *
  * @generated from message ai.stigmer.iam.identityprovider.v1.IdentityProviderId
  */
 export type IdentityProviderId = Message<"ai.stigmer.iam.identityprovider.v1.IdentityProviderId"> & {
     /**
-     * The unique identifier of the identity provider resource.
+     * Unique identifier of the identity provider resource.
      *
      * @generated from field: string value = 1;
      */
@@ -24,12 +24,14 @@ export type IdentityProviderId = Message<"ai.stigmer.iam.identityprovider.v1.Ide
  */
 export declare const IdentityProviderIdSchema: GenMessage<IdentityProviderId>;
 /**
- * List of identity providers (unbounded).
+ * IdentityProviders contains a list of identity provider resources.
  *
  * @generated from message ai.stigmer.iam.identityprovider.v1.IdentityProviders
  */
 export type IdentityProviders = Message<"ai.stigmer.iam.identityprovider.v1.IdentityProviders"> & {
     /**
+     * Identity provider entries.
+     *
      * @generated from field: repeated ai.stigmer.iam.identityprovider.v1.IdentityProvider entries = 1;
      */
     entries: IdentityProvider[];
@@ -40,19 +42,19 @@ export type IdentityProviders = Message<"ai.stigmer.iam.identityprovider.v1.Iden
  */
 export declare const IdentityProvidersSchema: GenMessage<IdentityProviders>;
 /**
- * Response for paginated list query.
+ * IdentityProviderList is a paginated response containing identity providers.
  *
  * @generated from message ai.stigmer.iam.identityprovider.v1.IdentityProviderList
  */
 export type IdentityProviderList = Message<"ai.stigmer.iam.identityprovider.v1.IdentityProviderList"> & {
     /**
-     * Total number of pages.
+     * Total number of pages available.
      *
      * @generated from field: int32 total_pages = 1;
      */
     totalPages: number;
     /**
-     * Identity providers in current page.
+     * Identity providers in the current page.
      *
      * @generated from field: repeated ai.stigmer.iam.identityprovider.v1.IdentityProvider entries = 2;
      */

package/ai/stigmer/iam/identityprovider/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/io_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,8cAA8c,EAAE,CAAC,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAgBtiB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAc7D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAuB7D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/io_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,8cAA8c,EAAE,CAAC,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAgBtiB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAgB7D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAuB7D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/query_connect.d.ts

@@ -9,6 +9,9 @@ export declare const IdentityProviderQueryController: {
         /**
          * Get an identity provider by its unique identifier.
          *
+         * @internal
+         * Authorization: Requires can_view permission on the identity provider resource.
+         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.get
          */
         readonly get: {
@@ -18,8 +21,14 @@ export declare const IdentityProviderQueryController: {
             readonly kind: any;
         };
         /**
-         * Get an identity provider by reference (org + slug).
-         * Custom authorization in handler.
+         * Get an identity provider by its organization-scoped reference (org/slug).
+         *
+         * Resolves a human-readable reference like "acme/planton-cloud" to the full
+         * IdentityProvider resource.
+         *
+         * @internal
+         * Custom authorization in handler — checks both direct resource access
+         * and organization-level visibility permissions.
          *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getByReference
          */

package/ai/stigmer/iam/identityprovider/v1/query_connect.js

@@ -14,6 +14,9 @@ export const IdentityProviderQueryController = {
         /**
          * Get an identity provider by its unique identifier.
          *
+         * @internal
+         * Authorization: Requires can_view permission on the identity provider resource.
+         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.get
          */
         get: {
@@ -23,8 +26,14 @@ export const IdentityProviderQueryController = {
             kind: MethodKind.Unary,
         },
         /**
-         * Get an identity provider by reference (org + slug).
-         * Custom authorization in handler.
+         * Get an identity provider by its organization-scoped reference (org/slug).
+         *
+         * Resolves a human-readable reference like "acme/planton-cloud" to the full
+         * IdentityProvider resource.
+         *
+         * @internal
+         * Custom authorization in handler — checks both direct resource access
+         * and organization-level visibility permissions.
          *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getByReference
          */

package/ai/stigmer/iam/identityprovider/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,kIAAkI;AAClI,oBAAoB;AACpB,cAAc;AAId,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,kIAAkI;AAClI,oBAAoB;AACpB,cAAc;AAId,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/query_pb.d.ts

@@ -14,6 +14,9 @@ export declare const IdentityProviderQueryController: GenService<{
     /**
      * Get an identity provider by its unique identifier.
      *
+     * @internal
+     * Authorization: Requires can_view permission on the identity provider resource.
+     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.get
      */
     get: {
@@ -22,8 +25,14 @@ export declare const IdentityProviderQueryController: GenService<{
         output: typeof IdentityProviderSchema;
     };
     /**
-     * Get an identity provider by reference (org + slug).
-     * Custom authorization in handler.
+     * Get an identity provider by its organization-scoped reference (org/slug).
+     *
+     * Resolves a human-readable reference like "acme/planton-cloud" to the full
+     * IdentityProvider resource.
+     *
+     * @internal
+     * Custom authorization in handler — checks both direct resource access
+     * and organization-level visibility permissions.
      *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getByReference
      */

package/ai/stigmer/iam/identityprovider/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,2CAA2C,EAAE,MAAM,UAAU,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,okBAAokB,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAEnyB;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAsBvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,2CAA2C,EAAE,MAAM,UAAU,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,okBAAokB,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAEnyB;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GA+BvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/platform/github/v1/service_connect.d.ts

@@ -1,17 +1,17 @@
 /**
  * GitHubService provides OAuth integration with GitHub.
  *
- * This is a platform utility service — not a domain resource.
- * It enables the web console (and SDK consumers) to connect a user's
- * GitHub account via OAuth, then browse and select repositories
- * for workspace configuration.
- *
- * The service handles the server-side OAuth code exchange (protecting
- * the client_secret) and provides the authorize URL so the frontend
- * does not need to know the client_id or redirect_uri.
+ * Use this service to connect a GitHub account via OAuth and obtain
+ * an access token for GitHub API calls. The service manages the
+ * authorize URL construction and the authorization-code-for-token
+ * exchange so callers do not handle OAuth details directly.
  *
- * Tokens are ephemeral — they are returned to the caller and never
- * persisted by the backend.
+ * @internal
+ * This is a platform utility service — not a domain resource.
+ * The backend protects the client_secret during the token exchange
+ * and constructs the authorize URL with the registered client_id and
+ * redirect_uri so the frontend never needs those values.
+ * Tokens are ephemeral — returned to the caller and never persisted.
  *
  * @generated from service ai.stigmer.platform.github.v1.GitHubService
  */
@@ -19,12 +19,16 @@ export declare const GitHubService: {
     readonly typeName: "ai.stigmer.platform.github.v1.GitHubService";
     readonly methods: {
         /**
-         * Returns the GitHub OAuth authorize URL for initiating the OAuth flow.
+         * Get the GitHub OAuth authorize URL for initiating the OAuth flow.
+         *
+         * Returns a URL to redirect the user to and a random state value for
+         * CSRF protection. After the user authorizes, GitHub redirects back
+         * to your redirect_uri with an authorization code.
          *
+         * @internal
          * The backend constructs the URL with the registered client_id, requested
-         * scopes, and a random state parameter for CSRF protection. The frontend
-         * redirects the user to this URL, and GitHub redirects back to the
-         * provided redirect_uri with an authorization code.
+         * scopes, and the state parameter. Authorization is skipped because this
+         * is a pre-authentication step.
          *
          * @generated from rpc ai.stigmer.platform.github.v1.GitHubService.getOAuthAuthorizeUrl
          */
@@ -35,16 +39,17 @@ export declare const GitHubService: {
             readonly kind: any;
         };
         /**
-         * Exchanges a GitHub OAuth authorization code for an access token.
+         * Exchange a GitHub OAuth authorization code for an access token.
          *
-         * The frontend calls this after receiving the authorization code from
-         * GitHub's OAuth redirect. The backend makes the token exchange request
-         * to GitHub using the client_secret (which must never be exposed to
-         * the frontend).
+         * Call this after receiving the authorization code from GitHub's OAuth
+         * redirect. Pass the code, the state from the original authorize request,
+         * and the same redirect_uri. Returns an access token for GitHub API calls.
          *
-         * The returned access_token is NOT stored by the backend. The frontend
-         * is responsible for persisting it (e.g., in localStorage) and including
-         * it in subsequent requests that need GitHub access.
+         * @internal
+         * The backend performs the token exchange using the client_secret, which
+         * must never be exposed to the frontend. The returned access_token is NOT
+         * stored by the backend — the caller is responsible for persisting it and
+         * including it in subsequent requests that need GitHub access.
          *
          * @generated from rpc ai.stigmer.platform.github.v1.GitHubService.exchangeOAuthCode
          */

package/ai/stigmer/platform/github/v1/service_connect.js

@@ -6,17 +6,17 @@ import { MethodKind } from "@bufbuild/protobuf";
 /**
  * GitHubService provides OAuth integration with GitHub.
  *
- * This is a platform utility service — not a domain resource.
- * It enables the web console (and SDK consumers) to connect a user's
- * GitHub account via OAuth, then browse and select repositories
- * for workspace configuration.
- *
- * The service handles the server-side OAuth code exchange (protecting
- * the client_secret) and provides the authorize URL so the frontend
- * does not need to know the client_id or redirect_uri.
+ * Use this service to connect a GitHub account via OAuth and obtain
+ * an access token for GitHub API calls. The service manages the
+ * authorize URL construction and the authorization-code-for-token
+ * exchange so callers do not handle OAuth details directly.
  *
- * Tokens are ephemeral — they are returned to the caller and never
- * persisted by the backend.
+ * @internal
+ * This is a platform utility service — not a domain resource.
+ * The backend protects the client_secret during the token exchange
+ * and constructs the authorize URL with the registered client_id and
+ * redirect_uri so the frontend never needs those values.
+ * Tokens are ephemeral — returned to the caller and never persisted.
  *
  * @generated from service ai.stigmer.platform.github.v1.GitHubService
  */
@@ -24,12 +24,16 @@ export const GitHubService = {
     typeName: "ai.stigmer.platform.github.v1.GitHubService",
     methods: {
         /**
-         * Returns the GitHub OAuth authorize URL for initiating the OAuth flow.
+         * Get the GitHub OAuth authorize URL for initiating the OAuth flow.
+         *
+         * Returns a URL to redirect the user to and a random state value for
+         * CSRF protection. After the user authorizes, GitHub redirects back
+         * to your redirect_uri with an authorization code.
          *
+         * @internal
          * The backend constructs the URL with the registered client_id, requested
-         * scopes, and a random state parameter for CSRF protection. The frontend
-         * redirects the user to this URL, and GitHub redirects back to the
-         * provided redirect_uri with an authorization code.
+         * scopes, and the state parameter. Authorization is skipped because this
+         * is a pre-authentication step.
          *
          * @generated from rpc ai.stigmer.platform.github.v1.GitHubService.getOAuthAuthorizeUrl
          */
@@ -40,16 +44,17 @@ export const GitHubService = {
             kind: MethodKind.Unary,
         },
         /**
-         * Exchanges a GitHub OAuth authorization code for an access token.
+         * Exchange a GitHub OAuth authorization code for an access token.
          *
-         * The frontend calls this after receiving the authorization code from
-         * GitHub's OAuth redirect. The backend makes the token exchange request
-         * to GitHub using the client_secret (which must never be exposed to
-         * the frontend).
+         * Call this after receiving the authorization code from GitHub's OAuth
+         * redirect. Pass the code, the state from the original authorize request,
+         * and the same redirect_uri. Returns an access token for GitHub API calls.
          *
-         * The returned access_token is NOT stored by the backend. The frontend
-         * is responsible for persisting it (e.g., in localStorage) and including
-         * it in subsequent requests that need GitHub access.
+         * @internal
+         * The backend performs the token exchange using the client_secret, which
+         * must never be exposed to the frontend. The returned access_token is NOT
+         * stored by the backend — the caller is responsible for persisting it and
+         * including it in subsequent requests that need GitHub access.
          *
          * @generated from rpc ai.stigmer.platform.github.v1.GitHubService.exchangeOAuthCode
          */

package/ai/stigmer/platform/github/v1/service_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"service_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/platform/github/v1/service_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,0HAA0H;AAC1H,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE,6CAA6C;IACvD,OAAO,EAAE;QACP;;;;;;;;;WASG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,2BAA2B;YAC9B,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"service_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/platform/github/v1/service_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,0HAA0H;AAC1H,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE,6CAA6C;IACvD,OAAO,EAAE;QACP;;;;;;;;;;;;;WAaG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,2BAA2B;YAC9B,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}