@stigmer/protos 0.0.72 → 0.0.74

package/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.d.ts

@@ -1,4 +1,5 @@
 import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { IamRole } from "../../../iam/v1/enum_pb";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file ai/stigmer/commons/apiresource/apiresourcekind/authorization_config.proto.
@@ -112,10 +113,21 @@ export declare const ParentRelationConfigSchema: GenMessage<ParentRelationConfig
  *   scope_type: AUTHORIZATION_SCOPE_TYPE_ORGANIZATION
  *   owner_type: OWNER_ATTRIBUTION_TYPE_DIRECT
  *   requires_creator_tuple: true
+ *   grantable_roles: [owner, viewer]
  *   -> Creates: environment#organization@organization:<org_id>
  *   -> Creates: environment#owner@identity_account:<creator_id>
  *   -> Creates: environment#creator@identity_account:<creator_id>
  *
+ * Organization with three-tier role hierarchy:
+ *   scope_type: AUTHORIZATION_SCOPE_TYPE_OWNER_ONLY
+ *   owner_type: OWNER_ATTRIBUTION_TYPE_DIRECT
+ *   grantable_roles: [owner, admin, member]
+ *
+ * Owner-only resource with no role sharing (api_key, execution_context):
+ *   scope_type: AUTHORIZATION_SCOPE_TYPE_OWNER_ONLY
+ *   owner_type: OWNER_ATTRIBUTION_TYPE_DIRECT
+ *   grantable_roles: [] (empty — owner is set at creation, no sharing)
+ *
  * @generated from message ai.stigmer.commons.apiresource.apiresourcekind.AuthorizationConfig
  */
 export type AuthorizationConfig = Message<"ai.stigmer.commons.apiresource.apiresourcekind.AuthorizationConfig"> & {
@@ -167,6 +179,22 @@ export type AuthorizationConfig = Message<"ai.stigmer.commons.apiresource.apires
      * @generated from field: bool requires_creator_tuple = 6;
      */
     requiresCreatorTuple: boolean;
+    /**
+     * Roles that can be granted on this resource kind via IAM policies.
+     * Drives the web app role selector and SDK validation for IAM policy creation.
+     *
+     * Each value must correspond to a directly-assignable FGA relation
+     * (defined with [identity_account] in the FGA model). Computed roles
+     * and structural relations are excluded.
+     *
+     * Empty means no user-grantable roles: the resource is either owner-only
+     * (api_key, execution_context), inherits authorization from a parent
+     * (agent_execution), is self-owned (identity_account), or has no
+     * authorization (platform, api_resource_version).
+     *
+     * @generated from field: repeated ai.stigmer.iam.v1.IamRole grantable_roles = 7;
+     */
+    grantableRoles: IamRole[];
 };
 /**
  * Describes the message ai.stigmer.commons.apiresource.apiresourcekind.AuthorizationConfig.

package/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.js

@@ -2,10 +2,11 @@
 // @generated from file ai/stigmer/commons/apiresource/apiresourcekind/authorization_config.proto (package ai.stigmer.commons.apiresource.apiresourcekind, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_iam_v1_enum } from "../../../iam/v1/enum_pb";
 /**
  * Describes the file ai/stigmer/commons/apiresource/apiresourcekind/authorization_config.proto.
  */
-export const file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config = /*@__PURE__*/ fileDesc("CklhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2F1dGhvcml6YXRpb25fY29uZmlnLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIisKEFZpc2liaWxpdHlDb25maWcSFwoPc3VwcG9ydHNfcHVibGljGAEgASgIIkoKFFBhcmVudFJlbGF0aW9uQ29uZmlnEgwKBGtpbmQYASABKAkSEAoIcmVsYXRpb24YAiABKAkSEgoKc3BlY19maWVsZBgDIAEoCSL5AwoTQXV0aG9yaXphdGlvbkNvbmZpZxJaCgpzY29wZV90eXBlGAEgASgOMkYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BdXRob3JpemF0aW9uU2NvcGVUeXBlElgKCm93bmVyX3R5cGUYAiABKA4yRC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLk93bmVyQXR0cmlidXRpb25UeXBlElQKBnBhcmVudBgDIAEoCzJELmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuUGFyZW50UmVsYXRpb25Db25maWcSYAoSYWRkaXRpb25hbF9wYXJlbnRzGAQgAygLMkQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5QYXJlbnRSZWxhdGlvbkNvbmZpZxJUCgp2aXNpYmlsaXR5GAUgASgLMkAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5WaXNpYmlsaXR5Q29uZmlnEh4KFnJlcXVpcmVzX2NyZWF0b3JfdHVwbGUYBiABKAgqhQIKFkF1dGhvcml6YXRpb25TY29wZVR5cGUSKAokQVVUSE9SSVpBVElPTl9TQ09QRV9UWVBFX1VOU1BFQ0lGSUVEEAASJQohQVVUSE9SSVpBVElPTl9TQ09QRV9UWVBFX1BMQVRGT1JNEAESKQolQVVUSE9SSVpBVElPTl9TQ09QRV9UWVBFX09SR0FOSVpBVElPThACEiMKH0FVVEhPUklaQVRJT05fU0NPUEVfVFlQRV9QQVJFTlQQAxInCiNBVVRIT1JJWkFUSU9OX1NDT1BFX1RZUEVfT1dORVJfT05MWRAEEiEKHUFVVEhPUklaQVRJT05fU0NPUEVfVFlQRV9OT05FEAUqyQEKFE93bmVyQXR0cmlidXRpb25UeXBlEiYKIk9XTkVSX0FUVFJJQlVUSU9OX1RZUEVfVU5TUEVDSUZJRUQQABIhCh1PV05FUl9BVFRSSUJVVElPTl9UWVBFX0RJUkVDVBABEiQKIE9XTkVSX0FUVFJJQlVUSU9OX1RZUEVfSU5IRVJJVEVEEAISHwobT1dORVJfQVRUUklCVVRJT05fVFlQRV9TRUxGEAMSHwobT1dORVJfQVRUUklCVVRJT05fVFlQRV9OT05FEARCGkIYQXV0aG9yaXphdGlvbkNvbmZpZ1Byb3RvYgZwcm90bzM");
+export const file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config = /*@__PURE__*/ fileDesc("CklhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2F1dGhvcml6YXRpb25fY29uZmlnLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIisKEFZpc2liaWxpdHlDb25maWcSFwoPc3VwcG9ydHNfcHVibGljGAEgASgIIkoKFFBhcmVudFJlbGF0aW9uQ29uZmlnEgwKBGtpbmQYASABKAkSEAoIcmVsYXRpb24YAiABKAkSEgoKc3BlY19maWVsZBgDIAEoCSKuBAoTQXV0aG9yaXphdGlvbkNvbmZpZxJaCgpzY29wZV90eXBlGAEgASgOMkYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BdXRob3JpemF0aW9uU2NvcGVUeXBlElgKCm93bmVyX3R5cGUYAiABKA4yRC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLk93bmVyQXR0cmlidXRpb25UeXBlElQKBnBhcmVudBgDIAEoCzJELmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuUGFyZW50UmVsYXRpb25Db25maWcSYAoSYWRkaXRpb25hbF9wYXJlbnRzGAQgAygLMkQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5QYXJlbnRSZWxhdGlvbkNvbmZpZxJUCgp2aXNpYmlsaXR5GAUgASgLMkAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5WaXNpYmlsaXR5Q29uZmlnEh4KFnJlcXVpcmVzX2NyZWF0b3JfdHVwbGUYBiABKAgSMwoPZ3JhbnRhYmxlX3JvbGVzGAcgAygOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZSqFAgoWQXV0aG9yaXphdGlvblNjb3BlVHlwZRIoCiRBVVRIT1JJWkFUSU9OX1NDT1BFX1RZUEVfVU5TUEVDSUZJRUQQABIlCiFBVVRIT1JJWkFUSU9OX1NDT1BFX1RZUEVfUExBVEZPUk0QARIpCiVBVVRIT1JJWkFUSU9OX1NDT1BFX1RZUEVfT1JHQU5JWkFUSU9OEAISIwofQVVUSE9SSVpBVElPTl9TQ09QRV9UWVBFX1BBUkVOVBADEicKI0FVVEhPUklaQVRJT05fU0NPUEVfVFlQRV9PV05FUl9PTkxZEAQSIQodQVVUSE9SSVpBVElPTl9TQ09QRV9UWVBFX05PTkUQBSrJAQoUT3duZXJBdHRyaWJ1dGlvblR5cGUSJgoiT1dORVJfQVRUUklCVVRJT05fVFlQRV9VTlNQRUNJRklFRBAAEiEKHU9XTkVSX0FUVFJJQlVUSU9OX1RZUEVfRElSRUNUEAESJAogT1dORVJfQVRUUklCVVRJT05fVFlQRV9JTkhFUklURUQQAhIfChtPV05FUl9BVFRSSUJVVElPTl9UWVBFX1NFTEYQAxIfChtPV05FUl9BVFRSSUJVVElPTl9UWVBFX05PTkUQBEIaQhhBdXRob3JpemF0aW9uQ29uZmlnUHJvdG9iBnByb3RvMw", [file_ai_stigmer_iam_v1_enum]);
 /**
  * Describes the message ai.stigmer.commons.apiresource.apiresourcekind.VisibilityConfig.
  * Use `create(VisibilityConfigSchema)` to create a new message.

package/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization_config_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,yKAAyK;AACzK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG/E;;GAEG;AACH,MAAM,CAAC,MAAM,wEAAwE,GAAY,aAAa,CAC5G,QAAQ,CAAC,6oDAA6oD,CAAC,CAAC;AA+B1pD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAsC3F;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAqG3F;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAiDX;AAjDD,WAAY,sBAAsB;IAChC;;OAEG;IACH,iFAAe,CAAA;IAEf;;;;;;OAMG;IACH,2EAAY,CAAA;IAEZ;;;;;;OAMG;IACH,mFAAgB,CAAA;IAEhB;;;;;;OAMG;IACH,uEAAU,CAAA;IAEV;;;;;;OAMG;IACH,+EAAc,CAAA;IAEd;;;;;OAKG;IACH,mEAAQ,CAAA;AACV,CAAC,EAjDW,sBAAsB,KAAtB,sBAAsB,QAiDjC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAoC,aAAa,CACxF,QAAQ,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,oBAwCX;AAxCD,WAAY,oBAAoB;IAC9B;;OAEG;IACH,6EAAe,CAAA;IAEf;;;;;;OAMG;IACH,mEAAU,CAAA;IAEV;;;;;;OAMG;IACH,yEAAa,CAAA;IAEb;;;;;;OAMG;IACH,+DAAQ,CAAA;IAER;;;;;OAKG;IACH,+DAAQ,CAAA;AACV,CAAC,EAxCW,oBAAoB,KAApB,oBAAoB,QAwC/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"authorization_config_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,yKAAyK;AACzK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAGtE;;GAEG;AACH,MAAM,CAAC,MAAM,wEAAwE,GAAY,aAAa,CAC5G,QAAQ,CAAC,otDAAotD,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;AA+BhwD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAsC3F;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAiI3F;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAiDX;AAjDD,WAAY,sBAAsB;IAChC;;OAEG;IACH,iFAAe,CAAA;IAEf;;;;;;OAMG;IACH,2EAAY,CAAA;IAEZ;;;;;;OAMG;IACH,mFAAgB,CAAA;IAEhB;;;;;;OAMG;IACH,uEAAU,CAAA;IAEV;;;;;;OAMG;IACH,+EAAc,CAAA;IAEd;;;;;OAKG;IACH,mEAAQ,CAAA;AACV,CAAC,EAjDW,sBAAsB,KAAtB,sBAAsB,QAiDjC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAoC,aAAa,CACxF,QAAQ,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,oBAwCX;AAxCD,WAAY,oBAAoB;IAC9B;;OAEG;IACH,6EAAe,CAAA;IAEf;;;;;;OAMG;IACH,mEAAU,CAAA;IAEV;;;;;;OAMG;IACH,yEAAa,CAAA;IAEb;;;;;;OAMG;IACH,+DAAQ,CAAA;IAER;;;;;OAKG;IACH,+DAAQ,CAAA;AACV,CAAC,EAxCW,oBAAoB,KAApB,oBAAoB,QAwC/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/{iam/iampolicy/v1/rpcauthorization/io_pb.d.ts → commons/rpc/authorization_config_pb.d.ts}

@@ -1,11 +1,11 @@
 import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
-import type { ApiResourceKind } from "../../../../commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import type { ApiResourceIamPermission } from "./iam_permission_pb";
+import type { ApiResourceKind } from "../apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IamPermission } from "../../iam/v1/enum_pb";
 import type { Message } from "@bufbuild/protobuf";
 /**
- * Describes the file ai/stigmer/iam/iampolicy/v1/rpcauthorization/io.proto.
+ * Describes the file ai/stigmer/commons/rpc/authorization_config.proto.
  */
-export declare const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_io: GenFile;
+export declare const file_ai_stigmer_commons_rpc_authorization_config: GenFile;
 /**
  * RpcAuthorizationConfig defines the authorization check performed before an RPC executes.
  *
@@ -14,15 +14,15 @@ export declare const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_io: GenFi
  * and performs an FGA check: does the caller have `permission` on
  * `resource_kind:<resolved_id>`?
  *
- * @generated from message ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig
+ * @generated from message ai.stigmer.commons.rpc.RpcAuthorizationConfig
  */
-export type RpcAuthorizationConfig = Message<"ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig"> & {
+export type RpcAuthorizationConfig = Message<"ai.stigmer.commons.rpc.RpcAuthorizationConfig"> & {
     /**
      * Permission required to invoke the RPC.
      *
-     * @generated from field: ai.stigmer.iam.iampolicy.v1.rpcauthorization.ApiResourceIamPermission permission = 1;
+     * @generated from field: ai.stigmer.iam.v1.IamPermission permission = 1;
      */
-    permission: ApiResourceIamPermission;
+    permission: IamPermission;
     /**
      * Resource kind that the permission is checked against.
      *
@@ -59,7 +59,7 @@ export type RpcAuthorizationConfig = Message<"ai.stigmer.iam.iampolicy.v1.rpcaut
     resourceId: string;
 };
 /**
- * Describes the message ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig.
+ * Describes the message ai.stigmer.commons.rpc.RpcAuthorizationConfig.
  * Use `create(RpcAuthorizationConfigSchema)` to create a new message.
  */
 export declare const RpcAuthorizationConfigSchema: GenMessage<RpcAuthorizationConfig>;

package/ai/stigmer/commons/rpc/authorization_config_pb.js

@@ -0,0 +1,16 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/commons/rpc/authorization_config.proto (package ai.stigmer.commons.rpc, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind } from "../apiresource/apiresourcekind/api_resource_kind_pb";
+import { file_ai_stigmer_iam_v1_enum } from "../../iam/v1/enum_pb";
+/**
+ * Describes the file ai/stigmer/commons/rpc/authorization_config.proto.
+ */
+export const file_ai_stigmer_commons_rpc_authorization_config = /*@__PURE__*/ fileDesc("CjFhaS9zdGlnbWVyL2NvbW1vbnMvcnBjL2F1dGhvcml6YXRpb25fY29uZmlnLnByb3RvEhZhaS5zdGlnbWVyLmNvbW1vbnMucnBjIv4BChZScGNBdXRob3JpemF0aW9uQ29uZmlnEjQKCnBlcm1pc3Npb24YASABKA4yIC5haS5zdGlnbWVyLmlhbS52MS5JYW1QZXJtaXNzaW9uElYKDXJlc291cmNlX2tpbmQYAiABKA4yPy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlS2luZBIaChJyZXNvdXJjZV9raW5kX3BhdGgYAyABKAkSEgoKZmllbGRfcGF0aBgEIAEoCRIRCgllcnJvcl9tc2cYBSABKAkSEwoLcmVzb3VyY2VfaWQYBiABKAliBnByb3RvMw", [file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind, file_ai_stigmer_iam_v1_enum]);
+/**
+ * Describes the message ai.stigmer.commons.rpc.RpcAuthorizationConfig.
+ * Use `create(RpcAuthorizationConfigSchema)` to create a new message.
+ */
+export const RpcAuthorizationConfigSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_commons_rpc_authorization_config, 0);
+//# sourceMappingURL=authorization_config_pb.js.map

package/ai/stigmer/commons/rpc/authorization_config_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization_config_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/rpc/authorization_config_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,qEAAqE,EAAE,MAAM,qDAAqD,CAAC;AAE5I,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAGnE;;GAEG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAY,aAAa,CACpF,QAAQ,CAAC,wcAAwc,EAAE,CAAC,qEAAqE,EAAE,2BAA2B,CAAC,CAAC,CAAC;AA4D3jB;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,gDAAgD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/{iam/iampolicy/v1/rpcauthorization → commons/rpc}/method_options_pb.d.ts

@@ -1,14 +1,14 @@
 import type { GenExtension, GenFile } from "@bufbuild/protobuf/codegenv1";
-import type { RpcAuthorizationConfig } from "./io_pb";
+import type { RpcAuthorizationConfig } from "./authorization_config_pb";
 import type { MethodOptions } from "@bufbuild/protobuf/wkt";
 /**
- * Describes the file ai/stigmer/iam/iampolicy/v1/rpcauthorization/method_options.proto.
+ * Describes the file ai/stigmer/commons/rpc/method_options.proto.
  */
-export declare const file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options: GenFile;
+export declare const file_ai_stigmer_commons_rpc_method_options: GenFile;
 /**
  * Full authorization configuration: permission, resource kind, field path, and error message.
  *
- * @generated from extension: ai.stigmer.iam.iampolicy.v1.rpcauthorization.RpcAuthorizationConfig config = 50056;
+ * @generated from extension: ai.stigmer.commons.rpc.RpcAuthorizationConfig config = 50056;
  */
 export declare const config: GenExtension<MethodOptions, RpcAuthorizationConfig>;
 /**

package/ai/stigmer/commons/rpc/method_options_pb.js

@@ -0,0 +1,29 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/commons/rpc/method_options.proto (package ai.stigmer.commons.rpc, syntax proto3)
+/* eslint-disable */
+import { extDesc, fileDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_rpc_authorization_config } from "./authorization_config_pb";
+import { file_google_protobuf_descriptor } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file ai/stigmer/commons/rpc/method_options.proto.
+ */
+export const file_ai_stigmer_commons_rpc_method_options = /*@__PURE__*/ fileDesc("CithaS9zdGlnbWVyL2NvbW1vbnMvcnBjL21ldGhvZF9vcHRpb25zLnByb3RvEhZhaS5zdGlnbWVyLmNvbW1vbnMucnBjOmgKBmNvbmZpZxIeLmdvb2dsZS5wcm90b2J1Zi5NZXRob2RPcHRpb25zGIiHAyABKAsyLi5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlJwY0F1dGhvcml6YXRpb25Db25maWdSBmNvbmZpZzo9Cglpc19wdWJsaWMSHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxiJhwMgASgIUghpc1B1YmxpYzpUChVpc19za2lwX2F1dGhvcml6YXRpb24SHi5nb29nbGUucHJvdG9idWYuTWV0aG9kT3B0aW9ucxiKhwMgASgIUhNpc1NraXBBdXRob3JpemF0aW9uYgZwcm90bzM", [file_ai_stigmer_commons_rpc_authorization_config, file_google_protobuf_descriptor]);
+/**
+ * Full authorization configuration: permission, resource kind, field path, and error message.
+ *
+ * @generated from extension: ai.stigmer.commons.rpc.RpcAuthorizationConfig config = 50056;
+ */
+export const config = /*@__PURE__*/ extDesc(file_ai_stigmer_commons_rpc_method_options, 0);
+/**
+ * When true, the RPC is publicly accessible without any authentication.
+ *
+ * @generated from extension: bool is_public = 50057;
+ */
+export const is_public = /*@__PURE__*/ extDesc(file_ai_stigmer_commons_rpc_method_options, 1);
+/**
+ * When true, the RPC requires authentication but skips FGA authorization checks.
+ *
+ * @generated from extension: bool is_skip_authorization = 50058;
+ */
+export const is_skip_authorization = /*@__PURE__*/ extDesc(file_ai_stigmer_commons_rpc_method_options, 2);
+//# sourceMappingURL=method_options_pb.js.map

package/ai/stigmer/commons/rpc/method_options_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"method_options_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/rpc/method_options_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,mHAAmH;AACnH,oBAAoB;AAGpB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,gDAAgD,EAAE,MAAM,2BAA2B,CAAC;AAE7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,6bAA6b,EAAE,CAAC,gDAAgD,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAE/hB;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAwD,aAAa,CACtF,OAAO,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAyC,aAAa,CAC1E,OAAO,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAyC,aAAa,CACtF,OAAO,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/apikey/v1/command_pb.js

@@ -3,13 +3,13 @@
 /* eslint-disable */
 import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
 import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb";
+import { file_ai_stigmer_commons_rpc_method_options } from "../../../commons/rpc/method_options_pb";
 import { file_ai_stigmer_iam_apikey_v1_api } from "./api_pb";
 import { file_ai_stigmer_iam_apikey_v1_io } from "./io_pb";
-import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from "../../iampolicy/v1/rpcauthorization/method_options_pb";
 /**
  * Describes the file ai/stigmer/iam/apikey/v1/command.proto.
  */
-export const file_ai_stigmer_iam_apikey_v1_command = /*@__PURE__*/ fileDesc("CiZhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvY29tbWFuZC5wcm90bxIYYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxMvoCChdBcGlLZXlDb21tYW5kQ29udHJvbGxlchJSCgZjcmVhdGUSIC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5GiAuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleSIE0LgYARKDAQoGdXBkYXRlEiAuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleRogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiNcK4GDEIBBAMIgttZXRhZGF0YS5pZCoedW5hdXRob3JpemVkIHRvIHVwZGF0ZSBhcGkga2V5En8KBmRlbGV0ZRIiLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlJZBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiL8K4GCsIAhAMIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhcGkga2V5GgSg/ysMYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_apikey_v1_api, file_ai_stigmer_iam_apikey_v1_io, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options]);
+export const file_ai_stigmer_iam_apikey_v1_command = /*@__PURE__*/ fileDesc("CiZhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvY29tbWFuZC5wcm90bxIYYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxMvoCChdBcGlLZXlDb21tYW5kQ29udHJvbGxlchJSCgZjcmVhdGUSIC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5GiAuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleSIE0LgYARKDAQoGdXBkYXRlEiAuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleRogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiNcK4GDEIAhAMIgttZXRhZGF0YS5pZCoedW5hdXRob3JpemVkIHRvIHVwZGF0ZSBhcGkga2V5En8KBmRlbGV0ZRIiLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlJZBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiL8K4GCsIAxAMIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhcGkga2V5GgSg/ysMYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_apikey_v1_api, file_ai_stigmer_iam_apikey_v1_io]);
 /**
  * ApiKeyCommandController handles write operations for API keys.
  *

package/ai/stigmer/iam/apikey/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAE9H,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAY,aAAa,CACzE,QAAQ,CAAC,imBAAimB,EAAE,CAAC,uDAAuD,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,gEAAgE,CAAC,CAAC,CAAC;AAEhzB;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GA2C/B,aAAa,CAChB,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,SAAS,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAY,aAAa,CACzE,QAAQ,CAAC,imBAAimB,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,iCAAiC,EAAE,gCAAgC,CAAC,CAAC,CAAC;AAE1xB;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GA2C/B,aAAa,CAChB,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/apikey/v1/query_pb.js

@@ -3,14 +3,14 @@
 /* eslint-disable */
 import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
 import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb";
+import { file_ai_stigmer_commons_rpc_method_options } from "../../../commons/rpc/method_options_pb";
 import { file_ai_stigmer_iam_apikey_v1_api } from "./api_pb";
 import { file_ai_stigmer_iam_apikey_v1_io } from "./io_pb";
-import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from "../../iampolicy/v1/rpcauthorization/method_options_pb";
 import { file_google_protobuf_empty } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/iam/apikey/v1/query.proto.
  */
-export const file_ai_stigmer_iam_apikey_v1_query = /*@__PURE__*/ fileDesc("CiRhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvcXVlcnkucHJvdG8SGGFpLnN0aWdtZXIuaWFtLmFwaWtleS52MTLDAgoVQXBpS2V5UXVlcnlDb250cm9sbGVyEnoKA2dldBIiLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlJZBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiLcK4GCkIAxAMIgV2YWx1ZSocdW5hdXRob3JpemVkIHRvIHZpZXcgYXBpIGtleRJcCgxnZXRCeUtleUhhc2gSJC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5SGFzaBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiBNC4GAESSgoHZmluZEFsbBIWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eRohLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlzIgTQuBgBGgSg/ysMYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_apikey_v1_api, file_ai_stigmer_iam_apikey_v1_io, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, file_google_protobuf_empty]);
+export const file_ai_stigmer_iam_apikey_v1_query = /*@__PURE__*/ fileDesc("CiRhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvcXVlcnkucHJvdG8SGGFpLnN0aWdtZXIuaWFtLmFwaWtleS52MTLDAgoVQXBpS2V5UXVlcnlDb250cm9sbGVyEnoKA2dldBIiLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlJZBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiLcK4GCkIARAMIgV2YWx1ZSocdW5hdXRob3JpemVkIHRvIHZpZXcgYXBpIGtleRJcCgxnZXRCeUtleUhhc2gSJC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5SGFzaBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiBNC4GAESSgoHZmluZEFsbBIWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eRohLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlzIgTQuBgBGgSg/ysMYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_apikey_v1_api, file_ai_stigmer_iam_apikey_v1_io, file_google_protobuf_empty]);
 /**
  * ApiKeyQueryController handles read operations for API keys.
  *

package/ai/stigmer/iam/apikey/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,8GAA8G;AAC9G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAE9H,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,gEAAgE,EAAE,MAAM,uDAAuD,CAAC;AAEzI,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,qhBAAqhB,EAAE,CAAC,uDAAuD,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,gEAAgE,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEhwB;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAwC7B,aAAa,CAChB,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/query_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,8GAA8G;AAC9G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,qhBAAqhB,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAE1uB;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAwC7B,aAAa,CAChB,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/command_connect.d.ts

@@ -186,5 +186,38 @@ export declare const IamPolicyCommandController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Revoke all of a user's access to an organization.
+         *
+         * Removes every IAM policy that grants the specified identity account access to
+         * resources within the given organization, including policies on the organization
+         * itself and on child resources (environments, agents, etc.).
+         *
+         * @internal
+         * The operation:
+         * 1. Validates the input (identity_account_id and organization_id are present)
+         * 2. Authorizes caller (can_grant_access on the organization)
+         * 3. Loads all policies where the user is principal within the org scope
+         * 4. Deletes all matching policies from MongoDB
+         * 5. Removes all corresponding tuples from OpenFGA
+         *
+         * Authorization:
+         * - Caller must have 'can_grant_access' permission on the organization
+         *
+         * Use Cases:
+         * - Removing a member from an organization
+         * - Offboarding a user from all org resources in one operation
+         *
+         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+         * Output: Empty (google.protobuf.Empty)
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.revokeOrgAccess
+         */
+        readonly revokeOrgAccess: {
+            readonly name: "revokeOrgAccess";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
     };
 };

package/ai/stigmer/iam/iampolicy/v1/command_connect.js

@@ -191,6 +191,39 @@ export const IamPolicyCommandController = {
             O: Empty,
             kind: MethodKind.Unary,
         },
+        /**
+         * Revoke all of a user's access to an organization.
+         *
+         * Removes every IAM policy that grants the specified identity account access to
+         * resources within the given organization, including policies on the organization
+         * itself and on child resources (environments, agents, etc.).
+         *
+         * @internal
+         * The operation:
+         * 1. Validates the input (identity_account_id and organization_id are present)
+         * 2. Authorizes caller (can_grant_access on the organization)
+         * 3. Loads all policies where the user is principal within the org scope
+         * 4. Deletes all matching policies from MongoDB
+         * 5. Removes all corresponding tuples from OpenFGA
+         *
+         * Authorization:
+         * - Caller must have 'can_grant_access' permission on the organization
+         *
+         * Use Cases:
+         * - Removing a member from an organization
+         * - Offboarding a user from all org resources in one operation
+         *
+         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+         * Output: Empty (google.protobuf.Empty)
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.revokeOrgAccess
+         */
+        revokeOrgAccess: {
+            name: "revokeOrgAccess",
+            I: RevokeOrgAccessInput,
+            O: Empty,
+            kind: MethodKind.Unary,
+        },
     }
 };
 //# sourceMappingURL=command_connect.js.map

package/ai/stigmer/iam/iampolicy/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAId,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAgCG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0CG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAId,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAgCG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0CG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/command_pb.d.ts

@@ -1,5 +1,6 @@
 import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
 import type { IamPolicySchema } from "./api_pb";
+import type { RevokeOrgAccessInputSchema } from "./io_pb";
 import type { ApiResourceRefSchema, IamPolicySpecSchema } from "./spec_pb";
 import type { EmptySchema } from "@bufbuild/protobuf/wkt";
 /**
@@ -188,4 +189,36 @@ export declare const IamPolicyCommandController: GenService<{
         input: typeof ApiResourceRefSchema;
         output: typeof EmptySchema;
     };
+    /**
+     * Revoke all of a user's access to an organization.
+     *
+     * Removes every IAM policy that grants the specified identity account access to
+     * resources within the given organization, including policies on the organization
+     * itself and on child resources (environments, agents, etc.).
+     *
+     * @internal
+     * The operation:
+     * 1. Validates the input (identity_account_id and organization_id are present)
+     * 2. Authorizes caller (can_grant_access on the organization)
+     * 3. Loads all policies where the user is principal within the org scope
+     * 4. Deletes all matching policies from MongoDB
+     * 5. Removes all corresponding tuples from OpenFGA
+     *
+     * Authorization:
+     * - Caller must have 'can_grant_access' permission on the organization
+     *
+     * Use Cases:
+     * - Removing a member from an organization
+     * - Offboarding a user from all org resources in one operation
+     *
+     * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+     * Output: Empty (google.protobuf.Empty)
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.revokeOrgAccess
+     */
+    revokeOrgAccess: {
+        methodKind: "unary";
+        input: typeof RevokeOrgAccessInputSchema;
+        output: typeof EmptySchema;
+    };
 }>;

package/ai/stigmer/iam/iampolicy/v1/command_pb.js

@@ -3,14 +3,15 @@
 /* eslint-disable */
 import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
 import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb";
+import { file_ai_stigmer_commons_rpc_method_options } from "../../../commons/rpc/method_options_pb";
 import { file_ai_stigmer_iam_iampolicy_v1_api } from "./api_pb";
-import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from "./rpcauthorization/method_options_pb";
+import { file_ai_stigmer_iam_iampolicy_v1_io } from "./io_pb";
 import { file_ai_stigmer_iam_iampolicy_v1_spec } from "./spec_pb";
 import { file_google_protobuf_empty } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/command.proto.
  */
-export const file_ai_stigmer_iam_iampolicy_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMrkFChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKCAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IiTCuBggCAgqHHVuYXV0aG9yaXplZCB0byBncmFudCBhY2Nlc3MSgwEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjGiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSIlwrgYIQgIKh11bmF1dGhvcml6ZWQgdG8gcmV2b2tlIGFjY2VzcxLCAQoPYm9vdHN0cmFwUG9saWN5EiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlvCuBhXCB0QHypIdW5hdXRob3JpemVkIHRvIGJvb3RzdHJhcCBwb2xpY3kgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEsQBChdjbGVhbnVwUmVzb3VyY2VQb2xpY2llcxIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSJkwrgYYAgdEB8qUXVuYXV0aG9yaXplZCB0byBjbGVhbnVwIHJlc291cmNlIHBvbGljaWVzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchoEoP8rCmIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, file_ai_stigmer_iam_iampolicy_v1_spec, file_google_protobuf_empty]);
+export const file_ai_stigmer_iam_iampolicy_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMswGChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKCAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IiTCuBggCAQqHHVuYXV0aG9yaXplZCB0byBncmFudCBhY2Nlc3MSgwEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjGiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSIlwrgYIQgEKh11bmF1dGhvcml6ZWQgdG8gcmV2b2tlIGFjY2VzcxLCAQoPYm9vdHN0cmFwUG9saWN5EiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlvCuBhXCBEQHypIdW5hdXRob3JpemVkIHRvIGJvb3RzdHJhcCBwb2xpY3kgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEsQBChdjbGVhbnVwUmVzb3VyY2VQb2xpY2llcxIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSJkwrgYYAgREB8qUXVuYXV0aG9yaXplZCB0byBjbGVhbnVwIHJlc291cmNlIHBvbGljaWVzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchKQAQoPcmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IjLCuBguCAQqKnVuYXV0aG9yaXplZCB0byByZXZva2Ugb3JnYW5pemF0aW9uIGFjY2VzcxoEoP8rCmIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io, file_ai_stigmer_iam_iampolicy_v1_spec, file_google_protobuf_empty]);
 /**
  * IAM Policy Command Controller
  *

package/ai/stigmer/iam/iampolicy/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAE9H,OAAO,EAAE,oCAAoC,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,gEAAgE,EAAE,MAAM,sCAAsC,CAAC;AAExH,OAAO,EAAE,qCAAqC,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,khCAAkhC,EAAE,CAAC,uDAAuD,EAAE,oCAAoC,EAAE,gEAAgE,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAErwC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAmKlC,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAC9H,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,UAAU,CAAC;AAEhE,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,EAAE,qCAAqC,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,stCAAstC,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEx9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAmMlC,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/query_connect.d.ts

@@ -92,5 +92,71 @@ export declare const IamPolicyQueryController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * List all principals and their roles on a resource, grouped by principal.
+         *
+         * This RPC answers: "Who has access to this resource, and what roles do they have?"
+         * Returns each principal with full display information and all their role grants,
+         * optionally including roles inherited from parent resources.
+         *
+         * Use Cases:
+         * - Organization members page (show all users and their roles)
+         * - Resource "Share" dialog (show who already has access)
+         * - Access audit views
+         *
+         * Input: ListResourceAccessInput with resource ref and include_inherited flag
+         * Output: ResourceAccessByPrincipalList with PrincipalAccess entries
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.listResourceAccessByPrincipal
+         */
+        readonly listResourceAccessByPrincipal: {
+            readonly name: "listResourceAccessByPrincipal";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+        /**
+         * Get all roles a specific principal has on a specific resource.
+         *
+         * This RPC answers: "What roles does [principal] have on [resource]?"
+         * Returns role metadata (code, display name, description) for each assigned role.
+         *
+         * Use Cases:
+         * - Displaying a user's current role in a resource detail view
+         * - Pre-populating role selectors when editing access
+         * - Permission summary for a specific user-resource pair
+         *
+         * Input: PrincipalResourceInput with principal and resource refs
+         * Output: PrincipalResourceRoles with list of RoleInfo entries
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.getPrincipalResourceRoles
+         */
+        readonly getPrincipalResourceRoles: {
+            readonly name: "getPrincipalResourceRoles";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
+        /**
+         * Count distinct principals that have access to a resource.
+         *
+         * This RPC answers: "How many [principal-kind] have access to this organization?"
+         * Used for member count badges and summary statistics.
+         *
+         * Use Cases:
+         * - Organization members count badge in navigation
+         * - Settings page member summary
+         *
+         * Input: GetPrincipalsCountInput with org_id and principal_kind
+         * Output: PrincipalsCount with integer count
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.getPrincipalsCount
+         */
+        readonly getPrincipalsCount: {
+            readonly name: "getPrincipalsCount";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
     };
 };

package/ai/stigmer/iam/iampolicy/v1/query_connect.js

@@ -97,6 +97,72 @@ export const IamPolicyQueryController = {
             O: AuthorizedPrincipalIdsList,
             kind: MethodKind.Unary,
         },
+        /**
+         * List all principals and their roles on a resource, grouped by principal.
+         *
+         * This RPC answers: "Who has access to this resource, and what roles do they have?"
+         * Returns each principal with full display information and all their role grants,
+         * optionally including roles inherited from parent resources.
+         *
+         * Use Cases:
+         * - Organization members page (show all users and their roles)
+         * - Resource "Share" dialog (show who already has access)
+         * - Access audit views
+         *
+         * Input: ListResourceAccessInput with resource ref and include_inherited flag
+         * Output: ResourceAccessByPrincipalList with PrincipalAccess entries
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.listResourceAccessByPrincipal
+         */
+        listResourceAccessByPrincipal: {
+            name: "listResourceAccessByPrincipal",
+            I: ListResourceAccessInput,
+            O: ResourceAccessByPrincipalList,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * Get all roles a specific principal has on a specific resource.
+         *
+         * This RPC answers: "What roles does [principal] have on [resource]?"
+         * Returns role metadata (code, display name, description) for each assigned role.
+         *
+         * Use Cases:
+         * - Displaying a user's current role in a resource detail view
+         * - Pre-populating role selectors when editing access
+         * - Permission summary for a specific user-resource pair
+         *
+         * Input: PrincipalResourceInput with principal and resource refs
+         * Output: PrincipalResourceRoles with list of RoleInfo entries
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.getPrincipalResourceRoles
+         */
+        getPrincipalResourceRoles: {
+            name: "getPrincipalResourceRoles",
+            I: PrincipalResourceInput,
+            O: PrincipalResourceRoles,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * Count distinct principals that have access to a resource.
+         *
+         * This RPC answers: "How many [principal-kind] have access to this organization?"
+         * Used for member count badges and summary statistics.
+         *
+         * Use Cases:
+         * - Organization members count badge in navigation
+         * - Settings page member summary
+         *
+         * Input: GetPrincipalsCountInput with org_id and principal_kind
+         * Output: PrincipalsCount with integer count
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.getPrincipalsCount
+         */
+        getPrincipalsCount: {
+            name: "getPrincipalsCount",
+            I: GetPrincipalsCountInput,
+            O: PrincipalsCount,
+            kind: MethodKind.Unary,
+        },
     }
 };
 //# sourceMappingURL=query_connect.js.map

package/ai/stigmer/iam/iampolicy/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAId,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE;QACP;;;;;;;;;WASG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,wBAAwB;YAC3B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,0BAA0B,EAAE;YAC1B,IAAI,EAAE,4BAA4B;YAClC,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_connect.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAId,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE;QACP;;;;;;;;;WASG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,wBAAwB;YAC3B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,0BAA0B,EAAE;YAC1B,IAAI,EAAE,4BAA4B;YAClC,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,6BAA6B,EAAE;YAC7B,IAAI,EAAE,+BAA+B;YACrC,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,6BAA6B;YAChC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}