@stigmer/protos 0.0.69 → 0.0.71

package/ai/stigmer/agentic/executioncontext/v1/query_pb.d.ts

@@ -7,8 +7,9 @@ import type { ApiResourceReferenceSchema } from "../../../commons/apiresource/io
  */
 export declare const file_ai_stigmer_agentic_executioncontext_v1_query: GenFile;
 /**
- * ExecutionContextQueryController provides read operations for ExecutionContext resources.
+ * ExecutionContextQueryController handles read operations for ExecutionContext resources.
  *
+ * @internal
  * Authorization: All RPCs use is_skip_authorization with custom handler-level derived auth.
  * ExecutionContext is ephemeral (1:1 with its parent execution) and has no dedicated
  * FGA model. Authorization is derived from the parent execution:
@@ -23,6 +24,8 @@ export declare const file_ai_stigmer_agentic_executioncontext_v1_query: GenFile;
 export declare const ExecutionContextQueryController: GenService<{
     /**
      * Get an ExecutionContext by ID.
+     *
+     * @internal
      * Handler-level derived auth: checks can_view on parent agent_execution or workflow_execution.
      *
      * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextQueryController.get
@@ -34,6 +37,8 @@ export declare const ExecutionContextQueryController: GenService<{
     };
     /**
      * Get an ExecutionContext by reference (slug-based lookup).
+     *
+     * @internal
      * Handler-level derived auth: checks can_view on parent agent_execution or workflow_execution.
      *
      * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextQueryController.getByReference
@@ -44,11 +49,12 @@ export declare const ExecutionContextQueryController: GenService<{
         output: typeof ExecutionContextSchema;
     };
     /**
-     * Get an ExecutionContext by the execution ID it belongs to.
-     * This is the primary lookup method used by runners to retrieve the merged
-     * environment variables during workflow/agent execution. The returned context
-     * contains decrypted secrets for runner consumption.
+     * Get the ExecutionContext for a given execution ID.
      *
+     * @internal
+     * Primary lookup method used by runners to retrieve the merged environment
+     * variables during workflow/agent execution. The returned context contains
+     * decrypted secrets for runner consumption.
      * Handler-level derived auth: checks can_view on parent agent_execution or workflow_execution.
      *
      * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextQueryController.getByExecutionId

package/ai/stigmer/agentic/executioncontext/v1/query_pb.js

@@ -12,8 +12,9 @@ import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from
  */
 export const file_ai_stigmer_agentic_executioncontext_v1_query = /*@__PURE__*/ fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9xdWVyeS5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEy0wMKH0V4ZWN1dGlvbkNvbnRleHRRdWVyeUNvbnRyb2xsZXISgQEKA2dldBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRJZBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiBNC4GAEShgEKDmdldEJ5UmVmZXJlbmNlEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dCIE0LgYARKcAQoQZ2V0QnlFeGVjdXRpb25JZBJILmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRFeGVjdXRpb25JZElucHV0GjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dCIE0LgYARoEoP8rNmIGcHJvdG8z", [file_ai_stigmer_agentic_executioncontext_v1_api, file_ai_stigmer_agentic_executioncontext_v1_io, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options]);
 /**
- * ExecutionContextQueryController provides read operations for ExecutionContext resources.
+ * ExecutionContextQueryController handles read operations for ExecutionContext resources.
  *
+ * @internal
  * Authorization: All RPCs use is_skip_authorization with custom handler-level derived auth.
  * ExecutionContext is ephemeral (1:1 with its parent execution) and has no dedicated
  * FGA model. Authorization is derived from the parent execution:

package/ai/stigmer/agentic/executioncontext/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,0IAA0I;AAC1I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,UAAU,CAAC;AAE3E,OAAO,EAAE,8CAA8C,EAAE,MAAM,SAAS,CAAC;AAEzE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,8DAA8D,CAAC;AAEhJ;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,0vBAA0vB,EAAE,CAAC,+CAA+C,EAAE,8CAA8C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,CAAC,CAAC,CAAC;AAE7gC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAsCvC,aAAa,CAChB,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,0IAA0I;AAC1I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,UAAU,CAAC;AAE3E,OAAO,EAAE,8CAA8C,EAAE,MAAM,SAAS,CAAC;AAEzE,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,gEAAgE,EAAE,MAAM,8DAA8D,CAAC;AAEhJ;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,0vBAA0vB,EAAE,CAAC,+CAA+C,EAAE,8CAA8C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,gEAAgE,CAAC,CAAC,CAAC;AAE7gC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GA2CvC,aAAa,CAChB,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/executioncontext/v1/spec_pb.d.ts

@@ -5,22 +5,25 @@ import type { Message } from "@bufbuild/protobuf";
  */
 export declare const file_ai_stigmer_agentic_executioncontext_v1_spec: GenFile;
 /**
- * ExecutionContextSpec defines ephemeral runtime configuration and secrets.
- * This is created during execution and deleted when execution completes.
+ * Runtime configuration and secrets for a single execution.
+ *
+ * @internal
+ * Created by the execution engine, deleted when execution completes.
  *
  * @generated from message ai.stigmer.agentic.executioncontext.v1.ExecutionContextSpec
  */
 export type ExecutionContextSpec = Message<"ai.stigmer.agentic.executioncontext.v1.ExecutionContextSpec"> & {
     /**
-     * The execution ID this context belongs to.
-     * This is typically a WorkflowExecution ID or AgentExecution ID.
+     * ID of the parent AgentExecution or WorkflowExecution.
      *
      * @generated from field: string execution_id = 1;
      */
     executionId: string;
     /**
-     * Key-value pairs containing both configuration and secrets.
-     * These are provided at runtime and only exist for the duration of the execution.
+     * Runtime key-value pairs, each marked as secret or plaintext.
+     *
+     * @internal
+     * Provided at runtime and only exist for the duration of the execution.
      * Example: {"AWS_ACCESS_KEY_ID": {value: "AKIA...", is_secret: true}}
      *
      * @generated from field: map<string, ai.stigmer.agentic.executioncontext.v1.ExecutionValue> data = 2;
@@ -35,28 +38,28 @@ export type ExecutionContextSpec = Message<"ai.stigmer.agentic.executioncontext.
  */
 export declare const ExecutionContextSpecSchema: GenMessage<ExecutionContextSpec>;
 /**
- * ExecutionValue represents a single runtime configuration or secret value.
+ * A single runtime configuration or secret value.
  *
  * @generated from message ai.stigmer.agentic.executioncontext.v1.ExecutionValue
  */
 export type ExecutionValue = Message<"ai.stigmer.agentic.executioncontext.v1.ExecutionValue"> & {
     /**
-     * The actual value.
-     * - If is_secret=true: This value is encrypted at rest and redacted in logs
-     * - If is_secret=false: This value is stored as plaintext
+     * String content of this entry.
+     *
+     * @internal
+     * If is_secret=true: encrypted at rest and redacted in logs.
+     * If is_secret=false: stored as plaintext.
      *
      * @generated from field: string value = 1;
      */
     value: string;
     /**
      * Whether this value should be treated as a secret.
-     * When true:
-     * - Value is encrypted at rest
-     * - Value is redacted in logs
-     * - Value is deleted when execution completes
-     * When false:
-     * - Value is stored as plaintext
-     * - Value is visible in audit logs
+     *
+     * @internal
+     * When true: value is encrypted at rest, redacted in logs, and deleted
+     * when execution completes.
+     * When false: value is stored as plaintext and visible in audit logs.
      *
      * @generated from field: bool is_secret = 2;
      */

package/ai/stigmer/agentic/executioncontext/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,yIAAyI;AACzI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAY,aAAa,CACpF,QAAQ,CAAC,4hBAA4hB,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AA2BvkB;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,gDAAgD,EAAE,CAAC,CAAC,CAAC;AAgCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,gDAAgD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,yIAAyI;AACzI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAY,aAAa,CACpF,QAAQ,CAAC,4hBAA4hB,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AA8BvkB;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,gDAAgD,EAAE,CAAC,CAAC,CAAC;AAgCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,gDAAgD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/api_pb.d.ts

@@ -9,8 +9,8 @@ import type { Message } from "@bufbuild/protobuf";
 export declare const file_ai_stigmer_agentic_mcpserver_v1_api: GenFile;
 /**
  * McpServer represents a reusable MCP (Model Context Protocol) server configuration.
- * MCP servers provide tools and capabilities to AI agents via a standardized protocol.
  *
+ * @internal
  * Unlike inline McpServerDefinition in AgentSpec, McpServer is a first-class resource that:
  * - Can be referenced by multiple agents (reusability)
  * - Has proper access control via FGA (authorization)
@@ -23,23 +23,6 @@ export declare const file_ai_stigmer_agentic_mcpserver_v1_api: GenFile;
  * 3. Create AgentInstance with environment_ref providing actual secrets
  * 4. Agent runner resolves McpServer, gets secrets from Environment, starts server
  *
- * Example YAML:
- *   apiVersion: agentic.stigmer.ai/v1
- *   kind: McpServer
- *   metadata:
- *     name: github
- *     scope: platform
- *   spec:
- *     description: "GitHub MCP server for repository operations"
- *     stdio:
- *       command: npx
- *       args: ["-y", "@modelcontextprotocol/server-github"]
- *     env_spec:
- *       data:
- *         GITHUB_TOKEN:
- *           is_secret: true
- *           description: "GitHub personal access token"
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.McpServer
  */
 export type McpServer = Message<"ai.stigmer.agentic.mcpserver.v1.McpServer"> & {
@@ -58,8 +41,9 @@ export type McpServer = Message<"ai.stigmer.agentic.mcpserver.v1.McpServer"> & {
      */
     kind: string;
     /**
-     * Standard resource metadata including name, id, org, visibility, labels, and tags.
+     * Resource metadata including name, organization, visibility, and labels.
      *
+     * @internal
      * Key fields:
      * - name: Human-readable name (e.g., "GitHub MCP Server")
      * - slug: URL-friendly identifier (e.g., "github")

package/ai/stigmer/agentic/mcpserver/v1/api_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/api_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,0HAA0H;AAC1H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,yCAAyC,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,EAAE,2CAA2C,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,4CAA4C,EAAE,MAAM,0CAA0C,CAAC;AACxG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,4pBAA4pB,EAAE,CAAC,yCAAyC,EAAE,2CAA2C,EAAE,4CAA4C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA2F70B;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AA+B3D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/api_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,0HAA0H;AAC1H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,yCAAyC,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,EAAE,2CAA2C,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,4CAA4C,EAAE,MAAM,0CAA0C,CAAC;AACxG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,4pBAA4pB,EAAE,CAAC,yCAAyC,EAAE,2CAA2C,EAAE,4CAA4C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA2E70B;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AA+B3D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/command_connect.d.ts

@@ -1,7 +1,7 @@
 /**
  * McpServerCommandController provides write operations for MCP server resources.
- * Supports creating, updating, and deleting MCP server definitions.
  *
+ * @internal
  * Authorization model for writes:
  * - Platform-scoped: Only platform operators can create/modify
  * - Organization-scoped: Org admins can create/modify
@@ -16,19 +16,12 @@ export declare const McpServerCommandController: {
     readonly typeName: "ai.stigmer.agentic.mcpserver.v1.McpServerCommandController";
     readonly methods: {
         /**
-         * Create or update an MCP server resource (Kubernetes-style apply).
+         * Create or update an MCP server resource.
          *
-         * This is the primary interface for MCP server management.
-         * Behavior:
-         * - If the resource doesn't exist: Creates a new MCP server
-         * - If the resource exists: Updates the existing MCP server
+         * If the resource doesn't exist, creates it. If it exists, updates it.
+         * The resource is identified by its (scope, org, slug) combination.
          *
-         * The resource is identified by (scope, org, slug) combination.
-         *
-         * Input: Full McpServer resource with metadata and spec.
-         * Returns: The created/updated McpServer with system-populated fields.
-         *
-         * Authorization: Custom authorization in handler.
+         * @internal
          * The handler determines whether this is a create or update operation
          * and performs appropriate scope-aware authorization:
          * - Create: Requires permission to create in the target scope
@@ -43,14 +36,12 @@ export declare const McpServerCommandController: {
             readonly kind: any;
         };
         /**
-         * Create a new MCP server resource.
+         * Create an MCP server resource.
          *
-         * Use this when you explicitly want to create a new resource
-         * and want an error if it already exists.
-         *
-         * Input: McpServer with metadata (scope, org, name/slug) and spec.
-         * Returns: The created McpServer with system-generated ID and status.
+         * Returns an error if a resource with the same (scope, org, slug) already exists.
+         * Use `apply` for idempotent create-or-update semantics.
          *
+         * @internal
          * Authorization: Custom authorization in handler.
          * Requires permission to create MCP servers in the specified scope:
          * - Platform: Requires platform operator role
@@ -68,9 +59,7 @@ export declare const McpServerCommandController: {
         /**
          * Update an existing MCP server resource.
          *
-         * Input: McpServer with metadata.id populated and updated spec.
-         * Returns: The updated McpServer.
-         *
+         * @internal
          * Authorization: Requires can_edit permission on the mcp_server resource.
          * Only the owner (based on scope) can update:
          * - Platform: Platform operators
@@ -89,11 +78,9 @@ export declare const McpServerCommandController: {
          * Delete an MCP server resource.
          *
          * Permanently removes the MCP server definition.
-         * Agents referencing this MCP server will need to be updated.
-         *
-         * Input: ApiResourceDeleteInput with resource_id and optional version_message.
-         * Returns: The deleted McpServer (for confirmation/audit).
+         * Agents referencing this server will need to be updated.
          *
+         * @internal
          * Authorization: Requires can_delete permission on the mcp_server resource.
          * Only the owner can delete:
          * - Platform: Platform operators
@@ -111,11 +98,10 @@ export declare const McpServerCommandController: {
         /**
          * Update the visibility of an existing MCP server.
          *
-         * This is a targeted metadata update — it only modifies metadata.visibility,
-         * leaving spec, status, and other metadata fields untouched. Use this to
-         * make an MCP server publicly accessible (marketplace-style sharing) or to
-         * revoke public access without sending the entire resource.
+         * Only modifies metadata.visibility, leaving spec, status, and other
+         * metadata fields untouched.
          *
+         * @internal
          * Authorization: Requires can_edit permission on the mcp_server resource.
          *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateVisibility
@@ -129,17 +115,15 @@ export declare const McpServerCommandController: {
         /**
          * Update the discovered capabilities (tools and resource templates) for an MCP server.
          *
-         * This is a targeted status update — it only modifies status.discovered_capabilities,
-         * leaving spec, validation state, and other status fields untouched.
+         * Only modifies status.discovered_capabilities, leaving spec, validation
+         * state, and other status fields untouched.
          *
+         * @internal
          * Typical flow:
          * 1. CLI calls getByReference(org/slug) to fetch the McpServer and its ID
          * 2. CLI connects to the MCP server locally and queries tools/resources
          * 3. CLI calls this RPC with the ID and discovered capabilities
          *
-         * Input: UpdateDiscoveredCapabilitiesInput with mcp_server_id and discovered_capabilities.
-         * Returns: The updated McpServer with the new discovered capabilities.
-         *
          * Authorization: Requires can_edit permission on the mcp_server resource.
          *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateDiscoveredCapabilities
@@ -153,13 +137,12 @@ export declare const McpServerCommandController: {
         /**
          * Discover the capabilities of an MCP server by connecting to it.
          *
-         * This triggers server-side discovery: the backend resolves credentials from the
-         * authenticated user's personal environment, delegates the actual MCP connection
-         * to the agent-runner via a Temporal workflow, and stores the result.
-         *
-         * The RPC blocks until discovery completes (up to ~30 seconds) and returns the
-         * updated McpServer with populated status.discovered_capabilities.
+         * Connects to the MCP server, enumerates tools and resource templates,
+         * and stores the result. Blocks until discovery completes (up to ~30 seconds)
+         * and returns the updated McpServer with populated
+         * status.discovered_capabilities.
          *
+         * @internal
          * Typical flow:
          * 1. Web console ensures required credentials are saved in the user's personal environment
          * 2. Web console calls discoverCapabilities with the MCP server ID
@@ -167,9 +150,6 @@ export declare const McpServerCommandController: {
          * 4. Backend starts a Temporal workflow; agent-runner connects to the MCP server
          * 5. Discovered tools and resource templates are stored and returned
          *
-         * Input: DiscoverCapabilitiesInput with mcp_server_id.
-         * Returns: The updated McpServer with discovered capabilities.
-         *
          * Errors:
          * - FAILED_PRECONDITION: Required credentials missing from personal environment
          * - DEADLINE_EXCEEDED: Discovery did not complete within the timeout

package/ai/stigmer/agentic/mcpserver/v1/command_connect.js

@@ -5,8 +5,8 @@
 import { MethodKind } from "@bufbuild/protobuf";
 /**
  * McpServerCommandController provides write operations for MCP server resources.
- * Supports creating, updating, and deleting MCP server definitions.
  *
+ * @internal
  * Authorization model for writes:
  * - Platform-scoped: Only platform operators can create/modify
  * - Organization-scoped: Org admins can create/modify
@@ -21,19 +21,12 @@ export const McpServerCommandController = {
     typeName: "ai.stigmer.agentic.mcpserver.v1.McpServerCommandController",
     methods: {
         /**
-         * Create or update an MCP server resource (Kubernetes-style apply).
+         * Create or update an MCP server resource.
          *
-         * This is the primary interface for MCP server management.
-         * Behavior:
-         * - If the resource doesn't exist: Creates a new MCP server
-         * - If the resource exists: Updates the existing MCP server
+         * If the resource doesn't exist, creates it. If it exists, updates it.
+         * The resource is identified by its (scope, org, slug) combination.
          *
-         * The resource is identified by (scope, org, slug) combination.
-         *
-         * Input: Full McpServer resource with metadata and spec.
-         * Returns: The created/updated McpServer with system-populated fields.
-         *
-         * Authorization: Custom authorization in handler.
+         * @internal
          * The handler determines whether this is a create or update operation
          * and performs appropriate scope-aware authorization:
          * - Create: Requires permission to create in the target scope
@@ -48,14 +41,12 @@ export const McpServerCommandController = {
             kind: MethodKind.Unary,
         },
         /**
-         * Create a new MCP server resource.
+         * Create an MCP server resource.
          *
-         * Use this when you explicitly want to create a new resource
-         * and want an error if it already exists.
-         *
-         * Input: McpServer with metadata (scope, org, name/slug) and spec.
-         * Returns: The created McpServer with system-generated ID and status.
+         * Returns an error if a resource with the same (scope, org, slug) already exists.
+         * Use `apply` for idempotent create-or-update semantics.
          *
+         * @internal
          * Authorization: Custom authorization in handler.
          * Requires permission to create MCP servers in the specified scope:
          * - Platform: Requires platform operator role
@@ -73,9 +64,7 @@ export const McpServerCommandController = {
         /**
          * Update an existing MCP server resource.
          *
-         * Input: McpServer with metadata.id populated and updated spec.
-         * Returns: The updated McpServer.
-         *
+         * @internal
          * Authorization: Requires can_edit permission on the mcp_server resource.
          * Only the owner (based on scope) can update:
          * - Platform: Platform operators
@@ -94,11 +83,9 @@ export const McpServerCommandController = {
          * Delete an MCP server resource.
          *
          * Permanently removes the MCP server definition.
-         * Agents referencing this MCP server will need to be updated.
-         *
-         * Input: ApiResourceDeleteInput with resource_id and optional version_message.
-         * Returns: The deleted McpServer (for confirmation/audit).
+         * Agents referencing this server will need to be updated.
          *
+         * @internal
          * Authorization: Requires can_delete permission on the mcp_server resource.
          * Only the owner can delete:
          * - Platform: Platform operators
@@ -116,11 +103,10 @@ export const McpServerCommandController = {
         /**
          * Update the visibility of an existing MCP server.
          *
-         * This is a targeted metadata update — it only modifies metadata.visibility,
-         * leaving spec, status, and other metadata fields untouched. Use this to
-         * make an MCP server publicly accessible (marketplace-style sharing) or to
-         * revoke public access without sending the entire resource.
+         * Only modifies metadata.visibility, leaving spec, status, and other
+         * metadata fields untouched.
          *
+         * @internal
          * Authorization: Requires can_edit permission on the mcp_server resource.
          *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateVisibility
@@ -134,17 +120,15 @@ export const McpServerCommandController = {
         /**
          * Update the discovered capabilities (tools and resource templates) for an MCP server.
          *
-         * This is a targeted status update — it only modifies status.discovered_capabilities,
-         * leaving spec, validation state, and other status fields untouched.
+         * Only modifies status.discovered_capabilities, leaving spec, validation
+         * state, and other status fields untouched.
          *
+         * @internal
          * Typical flow:
          * 1. CLI calls getByReference(org/slug) to fetch the McpServer and its ID
          * 2. CLI connects to the MCP server locally and queries tools/resources
          * 3. CLI calls this RPC with the ID and discovered capabilities
          *
-         * Input: UpdateDiscoveredCapabilitiesInput with mcp_server_id and discovered_capabilities.
-         * Returns: The updated McpServer with the new discovered capabilities.
-         *
          * Authorization: Requires can_edit permission on the mcp_server resource.
          *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateDiscoveredCapabilities
@@ -158,13 +142,12 @@ export const McpServerCommandController = {
         /**
          * Discover the capabilities of an MCP server by connecting to it.
          *
-         * This triggers server-side discovery: the backend resolves credentials from the
-         * authenticated user's personal environment, delegates the actual MCP connection
-         * to the agent-runner via a Temporal workflow, and stores the result.
-         *
-         * The RPC blocks until discovery completes (up to ~30 seconds) and returns the
-         * updated McpServer with populated status.discovered_capabilities.
+         * Connects to the MCP server, enumerates tools and resource templates,
+         * and stores the result. Blocks until discovery completes (up to ~30 seconds)
+         * and returns the updated McpServer with populated
+         * status.discovered_capabilities.
          *
+         * @internal
          * Typical flow:
          * 1. Web console ensures required credentials are saved in the user's personal environment
          * 2. Web console calls discoverCapabilities with the MCP server ID
@@ -172,9 +155,6 @@ export const McpServerCommandController = {
          * 4. Backend starts a Temporal workflow; agent-runner connects to the MCP server
          * 5. Discovered tools and resource templates are stored and returned
          *
-         * Input: DiscoverCapabilitiesInput with mcp_server_id.
-         * Returns: The updated McpServer with discovered capabilities.
-         *
          * Errors:
          * - FAILED_PRECONDITION: Required credentials missing from personal environment
          * - DEADLINE_EXCEEDED: Discovery did not complete within the timeout

package/ai/stigmer/agentic/mcpserver/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIhD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,4DAA4D;IACtE,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,4BAA4B,EAAE;YAC5B,IAAI,EAAE,8BAA8B;YACpC,CAAC,EAAE,iCAAiC;YACpC,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAGd,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIhD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,4DAA4D;IACtE,OAAO,EAAE;QACP;;;;;;;;;;;;;WAaG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,4BAA4B,EAAE;YAC5B,IAAI,EAAE,8BAA8B;YACpC,CAAC,EAAE,iCAAiC;YACpC,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/command_pb.d.ts

@@ -8,8 +8,8 @@ import type { ApiResourceDeleteInputSchema, UpdateVisibilityInputSchema } from "
 export declare const file_ai_stigmer_agentic_mcpserver_v1_command: GenFile;
 /**
  * McpServerCommandController provides write operations for MCP server resources.
- * Supports creating, updating, and deleting MCP server definitions.
  *
+ * @internal
  * Authorization model for writes:
  * - Platform-scoped: Only platform operators can create/modify
  * - Organization-scoped: Org admins can create/modify
@@ -22,19 +22,12 @@ export declare const file_ai_stigmer_agentic_mcpserver_v1_command: GenFile;
  */
 export declare const McpServerCommandController: GenService<{
     /**
-     * Create or update an MCP server resource (Kubernetes-style apply).
+     * Create or update an MCP server resource.
      *
-     * This is the primary interface for MCP server management.
-     * Behavior:
-     * - If the resource doesn't exist: Creates a new MCP server
-     * - If the resource exists: Updates the existing MCP server
+     * If the resource doesn't exist, creates it. If it exists, updates it.
+     * The resource is identified by its (scope, org, slug) combination.
      *
-     * The resource is identified by (scope, org, slug) combination.
-     *
-     * Input: Full McpServer resource with metadata and spec.
-     * Returns: The created/updated McpServer with system-populated fields.
-     *
-     * Authorization: Custom authorization in handler.
+     * @internal
      * The handler determines whether this is a create or update operation
      * and performs appropriate scope-aware authorization:
      * - Create: Requires permission to create in the target scope
@@ -48,14 +41,12 @@ export declare const McpServerCommandController: GenService<{
         output: typeof McpServerSchema;
     };
     /**
-     * Create a new MCP server resource.
+     * Create an MCP server resource.
      *
-     * Use this when you explicitly want to create a new resource
-     * and want an error if it already exists.
-     *
-     * Input: McpServer with metadata (scope, org, name/slug) and spec.
-     * Returns: The created McpServer with system-generated ID and status.
+     * Returns an error if a resource with the same (scope, org, slug) already exists.
+     * Use `apply` for idempotent create-or-update semantics.
      *
+     * @internal
      * Authorization: Custom authorization in handler.
      * Requires permission to create MCP servers in the specified scope:
      * - Platform: Requires platform operator role
@@ -72,9 +63,7 @@ export declare const McpServerCommandController: GenService<{
     /**
      * Update an existing MCP server resource.
      *
-     * Input: McpServer with metadata.id populated and updated spec.
-     * Returns: The updated McpServer.
-     *
+     * @internal
      * Authorization: Requires can_edit permission on the mcp_server resource.
      * Only the owner (based on scope) can update:
      * - Platform: Platform operators
@@ -92,11 +81,9 @@ export declare const McpServerCommandController: GenService<{
      * Delete an MCP server resource.
      *
      * Permanently removes the MCP server definition.
-     * Agents referencing this MCP server will need to be updated.
-     *
-     * Input: ApiResourceDeleteInput with resource_id and optional version_message.
-     * Returns: The deleted McpServer (for confirmation/audit).
+     * Agents referencing this server will need to be updated.
      *
+     * @internal
      * Authorization: Requires can_delete permission on the mcp_server resource.
      * Only the owner can delete:
      * - Platform: Platform operators
@@ -113,11 +100,10 @@ export declare const McpServerCommandController: GenService<{
     /**
      * Update the visibility of an existing MCP server.
      *
-     * This is a targeted metadata update — it only modifies metadata.visibility,
-     * leaving spec, status, and other metadata fields untouched. Use this to
-     * make an MCP server publicly accessible (marketplace-style sharing) or to
-     * revoke public access without sending the entire resource.
+     * Only modifies metadata.visibility, leaving spec, status, and other
+     * metadata fields untouched.
      *
+     * @internal
      * Authorization: Requires can_edit permission on the mcp_server resource.
      *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateVisibility
@@ -130,17 +116,15 @@ export declare const McpServerCommandController: GenService<{
     /**
      * Update the discovered capabilities (tools and resource templates) for an MCP server.
      *
-     * This is a targeted status update — it only modifies status.discovered_capabilities,
-     * leaving spec, validation state, and other status fields untouched.
+     * Only modifies status.discovered_capabilities, leaving spec, validation
+     * state, and other status fields untouched.
      *
+     * @internal
      * Typical flow:
      * 1. CLI calls getByReference(org/slug) to fetch the McpServer and its ID
      * 2. CLI connects to the MCP server locally and queries tools/resources
      * 3. CLI calls this RPC with the ID and discovered capabilities
      *
-     * Input: UpdateDiscoveredCapabilitiesInput with mcp_server_id and discovered_capabilities.
-     * Returns: The updated McpServer with the new discovered capabilities.
-     *
      * Authorization: Requires can_edit permission on the mcp_server resource.
      *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateDiscoveredCapabilities
@@ -153,13 +137,12 @@ export declare const McpServerCommandController: GenService<{
     /**
      * Discover the capabilities of an MCP server by connecting to it.
      *
-     * This triggers server-side discovery: the backend resolves credentials from the
-     * authenticated user's personal environment, delegates the actual MCP connection
-     * to the agent-runner via a Temporal workflow, and stores the result.
-     *
-     * The RPC blocks until discovery completes (up to ~30 seconds) and returns the
-     * updated McpServer with populated status.discovered_capabilities.
+     * Connects to the MCP server, enumerates tools and resource templates,
+     * and stores the result. Blocks until discovery completes (up to ~30 seconds)
+     * and returns the updated McpServer with populated
+     * status.discovered_capabilities.
      *
+     * @internal
      * Typical flow:
      * 1. Web console ensures required credentials are saved in the user's personal environment
      * 2. Web console calls discoverCapabilities with the MCP server ID
@@ -167,9 +150,6 @@ export declare const McpServerCommandController: GenService<{
      * 4. Backend starts a Temporal workflow; agent-runner connects to the MCP server
      * 5. Discovered tools and resource templates are stored and returned
      *
-     * Input: DiscoverCapabilitiesInput with mcp_server_id.
-     * Returns: The updated McpServer with discovered capabilities.
-     *
      * Errors:
      * - FAILED_PRECONDITION: Required credentials missing from personal environment
      * - DEADLINE_EXCEEDED: Discovery did not complete within the timeout

package/ai/stigmer/agentic/mcpserver/v1/command_pb.js

@@ -13,8 +13,8 @@ import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from
 export const file_ai_stigmer_agentic_mcpserver_v1_command = /*@__PURE__*/ fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEylAkKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchJmCgZjcmVhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAQQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgCECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IBBAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkS1wEKHHVwZGF0ZURpc2NvdmVyZWRDYXBhYmlsaXRpZXMSQi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLlVwZGF0ZURpc2NvdmVyZWRDYXBhYmlsaXRpZXNJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIkfCuBhDCAQQLCINbWNwX3NlcnZlcl9pZCoudW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIGNhcGFiaWxpdGllcxLJAQoUZGlzY292ZXJDYXBhYmlsaXRpZXMSOi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRpc2NvdmVyQ2FwYWJpbGl0aWVzSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciJJwrgYRQgEECwiDW1jcF9zZXJ2ZXJfaWQqMHVuYXV0aG9yaXplZCB0byBkaXNjb3ZlciBtY3Agc2VydmVyIGNhcGFiaWxpdGllcxoEoP8rLGIGcHJvdG8z", [file_ai_stigmer_agentic_mcpserver_v1_api, file_ai_stigmer_agentic_mcpserver_v1_io, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options]);
 /**
  * McpServerCommandController provides write operations for MCP server resources.
- * Supports creating, updating, and deleting MCP server definitions.
  *
+ * @internal
  * Authorization model for writes:
  * - Platform-scoped: Only platform operators can create/modify
  * - Organization-scoped: Org admins can create/modify