@stigmer/protos 3.0.3 → 3.0.5

package/ai/stigmer/iam/iampolicy/v1/io_pb.d.ts

@@ -419,6 +419,49 @@ export type CheckAuthorizationResult = Message<"ai.stigmer.iam.iampolicy.v1.Chec
  * Use `create(CheckAuthorizationResultSchema)` to create a new message.
  */
 export declare const CheckAuthorizationResultSchema: GenMessage<CheckAuthorizationResult>;
+/**
+ * CheckMyPermissionInput defines input for checking whether the AUTHENTICATED
+ * CALLER has a permission on a resource.
+ *
+ * Unlike CheckAuthorizationInput, there is deliberately NO principal field:
+ * the principal is always derived server-side from the authenticated token —
+ * the only trustworthy source of caller identity. Clients cannot probe another
+ * user's permissions because the API gives them no way to name a principal.
+ *
+ * This mirrors the industry-standard self-check pattern (e.g. Kubernetes
+ * SelfSubjectAccessReview): self checks and cross-principal checks are
+ * separate API surfaces with separate trust models.
+ *
+ * @generated from message ai.stigmer.iam.iampolicy.v1.CheckMyPermissionInput
+ */
+export type CheckMyPermissionInput = Message<"ai.stigmer.iam.iampolicy.v1.CheckMyPermissionInput"> & {
+    /**
+     * The resource being accessed (WHAT)
+     *
+     * @generated from field: ai.stigmer.iam.iampolicy.v1.ApiResourceRef resource = 1;
+     */
+    resource?: ApiResourceRef;
+    /**
+     * The permission to check (e.g., "can_edit", "can_grant_access").
+     *
+     * @internal
+     * This is the FGA relation checked against the resource object.
+     *
+     * @generated from field: string relation = 2;
+     */
+    relation: string;
+    /**
+     * Optional contextual policies for "what-if" scenarios
+     *
+     * @generated from field: repeated ai.stigmer.iam.iampolicy.v1.IamPolicySpec contextual_policies = 3;
+     */
+    contextualPolicies: IamPolicySpec[];
+};
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.CheckMyPermissionInput.
+ * Use `create(CheckMyPermissionInputSchema)` to create a new message.
+ */
+export declare const CheckMyPermissionInputSchema: GenMessage<CheckMyPermissionInput>;
 /**
  * ListAuthorizedResourceIdsInput defines input for listing resources a principal can access.
  *

package/ai/stigmer/iam/iampolicy/v1/io_pb.js

@@ -8,7 +8,7 @@ import { file_buf_validate_validate } from "../../../../../buf/validate/validate
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/io.proto.
  */
-export const file_ai_stigmer_iam_iampolicy_v1_io = /*@__PURE__*/ fileDesc("CiRhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MSL9AQoSQXBpUmVzb3VyY2VSZWZWaWV3EgwKBGtpbmQYASABKAkSCgoCaWQYAiABKAkSEAoIcmVsYXRpb24YAyABKAkSDAoEbmFtZRgEIAEoCRINCgVlbWFpbBgFIAEoCRIMCgRzbHVnGAYgASgJEg4KBmF2YXRhchgHIAEoCRJACgdtZW1iZXJzGAggAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldxI+CgV0ZWFtcxgJIAMoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXciJAoLSWFtUG9saWN5SWQSFQoFdmFsdWUYASABKAlCBrpIA8gBASKnAQoWUHJpbmNpcGFsUmVzb3VyY2VJbnB1dBJGCglwcmluY2lwYWwYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARJFCghyZXNvdXJjZRgCIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBIqkBChdSZXNvdXJjZVByaW5jaXBhbHNJbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkcKCnByaW5jaXBhbHMYAiADKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBASJkChRSZXZva2VPcmdBY2Nlc3NJbnB1dBInChNpZGVudGl0eV9hY2NvdW50X2lkGAEgASgJQgq6SAfIAQFyAhABEiMKD29yZ2FuaXphdGlvbl9pZBgCIAEoCUIKukgHyAEBcgIQASJKCg9JYW1Qb2xpY2llc0xpc3QSNwoHZW50cmllcxgBIAMoCzImLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3kiewoXTGlzdFJlc291cmNlQWNjZXNzSW5wdXQSRQoIcmVzb3VyY2UYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIZChFpbmNsdWRlX2luaGVyaXRlZBgCIAEoCCJeCh1SZXNvdXJjZUFjY2Vzc0J5UHJpbmNpcGFsTGlzdBI9CgdlbnRyaWVzGAEgAygLMiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbEFjY2VzcyKMAQoPUHJpbmNpcGFsQWNjZXNzEkIKCXByaW5jaXBhbBgBIAEoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXcSNQoFcm9sZXMYAiADKAsyJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUdyYW50IpsBCglSb2xlR3JhbnQSMwoEcm9sZRgBIAEoCzIlLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlSW5mbxJDCg5vd25lcl9yZXNvdXJjZRgCIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhIUCgxpc19pbmhlcml0ZWQYAyABKAgiVAoYUmVzb3VyY2VBY2Nlc3NCeVJvbGVMaXN0EjgKB2VudHJpZXMYASADKAsyJy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUFjY2VzcyKHAQoKUm9sZUFjY2VzcxI0CgRyb2xlGAEgASgLMiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJvbGVHcmFudBJDCgpwcmluY2lwYWxzGAIgAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldyJHCghSb2xlSW5mbxIKCgJpZBgBIAEoCRIMCgRjb2RlGAIgASgJEgwKBG5hbWUYAyABKAkSEwoLZGVzY3JpcHRpb24YBCABKAkiTgoWUHJpbmNpcGFsUmVzb3VyY2VSb2xlcxI0CgVyb2xlcxgBIAMoCzIlLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlSW5mbyKmAQoXQ2hlY2tBdXRob3JpemF0aW9uSW5wdXQSQgoGcG9saWN5GAEgASgLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWNCBrpIA8gBARJHChNjb250ZXh0dWFsX3BvbGljaWVzGAIgAygLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMiMQoYQ2hlY2tBdXRob3JpemF0aW9uUmVzdWx0EhUKDWlzX2F1dGhvcml6ZWQYASABKAgi8gEKHkxpc3RBdXRob3JpemVkUmVzb3VyY2VJZHNJbnB1dBJGCglwcmluY2lwYWwYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIhCg1yZXNvdXJjZV9raW5kGAIgASgJQgq6SAfIAQFyAhABEhwKCHJlbGF0aW9uGAMgASgJQgq6SAfIAQFyAhABEkcKE2NvbnRleHR1YWxfcG9saWNpZXMYBCADKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYyIxChlBdXRob3JpemVkUmVzb3VyY2VJZHNMaXN0EhQKDHJlc291cmNlX2lkcxgBIAMoCSLzAQofTGlzdEF1dGhvcml6ZWRQcmluY2lwYWxJZHNJbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEiIKDnByaW5jaXBhbF9raW5kGAIgASgJQgq6SAfIAQFyAhABEhwKCHJlbGF0aW9uGAMgASgJQgq6SAfIAQFyAhABEkcKE2NvbnRleHR1YWxfcG9saWNpZXMYBCADKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYyIzChpBdXRob3JpemVkUHJpbmNpcGFsSWRzTGlzdBIVCg1wcmluY2lwYWxfaWRzGAEgAygJIlkKF0dldFByaW5jaXBhbHNDb3VudElucHV0EhoKBm9yZ19pZBgBIAEoCUIKukgHyAEBcgIQARIiCg5wcmluY2lwYWxfa2luZBgCIAEoCUIKukgHyAEBcgIQASIgCg9QcmluY2lwYWxzQ291bnQSDQoFY291bnQYASABKAViBnByb3RvMw", [file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_spec, file_buf_validate_validate]);
+export const file_ai_stigmer_iam_iampolicy_v1_io = /*@__PURE__*/ fileDesc("CiRhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MSL9AQoSQXBpUmVzb3VyY2VSZWZWaWV3EgwKBGtpbmQYASABKAkSCgoCaWQYAiABKAkSEAoIcmVsYXRpb24YAyABKAkSDAoEbmFtZRgEIAEoCRINCgVlbWFpbBgFIAEoCRIMCgRzbHVnGAYgASgJEg4KBmF2YXRhchgHIAEoCRJACgdtZW1iZXJzGAggAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldxI+CgV0ZWFtcxgJIAMoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXciJAoLSWFtUG9saWN5SWQSFQoFdmFsdWUYASABKAlCBrpIA8gBASKnAQoWUHJpbmNpcGFsUmVzb3VyY2VJbnB1dBJGCglwcmluY2lwYWwYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARJFCghyZXNvdXJjZRgCIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBIqkBChdSZXNvdXJjZVByaW5jaXBhbHNJbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkcKCnByaW5jaXBhbHMYAiADKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBASJkChRSZXZva2VPcmdBY2Nlc3NJbnB1dBInChNpZGVudGl0eV9hY2NvdW50X2lkGAEgASgJQgq6SAfIAQFyAhABEiMKD29yZ2FuaXphdGlvbl9pZBgCIAEoCUIKukgHyAEBcgIQASJKCg9JYW1Qb2xpY2llc0xpc3QSNwoHZW50cmllcxgBIAMoCzImLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3kiewoXTGlzdFJlc291cmNlQWNjZXNzSW5wdXQSRQoIcmVzb3VyY2UYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIZChFpbmNsdWRlX2luaGVyaXRlZBgCIAEoCCJeCh1SZXNvdXJjZUFjY2Vzc0J5UHJpbmNpcGFsTGlzdBI9CgdlbnRyaWVzGAEgAygLMiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbEFjY2VzcyKMAQoPUHJpbmNpcGFsQWNjZXNzEkIKCXByaW5jaXBhbBgBIAEoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXcSNQoFcm9sZXMYAiADKAsyJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUdyYW50IpsBCglSb2xlR3JhbnQSMwoEcm9sZRgBIAEoCzIlLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlSW5mbxJDCg5vd25lcl9yZXNvdXJjZRgCIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhIUCgxpc19pbmhlcml0ZWQYAyABKAgiVAoYUmVzb3VyY2VBY2Nlc3NCeVJvbGVMaXN0EjgKB2VudHJpZXMYASADKAsyJy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUFjY2VzcyKHAQoKUm9sZUFjY2VzcxI0CgRyb2xlGAEgASgLMiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJvbGVHcmFudBJDCgpwcmluY2lwYWxzGAIgAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldyJHCghSb2xlSW5mbxIKCgJpZBgBIAEoCRIMCgRjb2RlGAIgASgJEgwKBG5hbWUYAyABKAkSEwoLZGVzY3JpcHRpb24YBCABKAkiTgoWUHJpbmNpcGFsUmVzb3VyY2VSb2xlcxI0CgVyb2xlcxgBIAMoCzIlLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlSW5mbyKmAQoXQ2hlY2tBdXRob3JpemF0aW9uSW5wdXQSQgoGcG9saWN5GAEgASgLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWNCBrpIA8gBARJHChNjb250ZXh0dWFsX3BvbGljaWVzGAIgAygLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMiMQoYQ2hlY2tBdXRob3JpemF0aW9uUmVzdWx0EhUKDWlzX2F1dGhvcml6ZWQYASABKAgiyAEKFkNoZWNrTXlQZXJtaXNzaW9uSW5wdXQSRQoIcmVzb3VyY2UYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIeCghyZWxhdGlvbhgCIAEoCUIMukgJyAEBcgQQARhAEkcKE2NvbnRleHR1YWxfcG9saWNpZXMYAyADKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYyLyAQoeTGlzdEF1dGhvcml6ZWRSZXNvdXJjZUlkc0lucHV0EkYKCXByaW5jaXBhbBgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEiEKDXJlc291cmNlX2tpbmQYAiABKAlCCrpIB8gBAXICEAESHAoIcmVsYXRpb24YAyABKAlCCrpIB8gBAXICEAESRwoTY29udGV4dHVhbF9wb2xpY2llcxgEIAMoCzIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjIjEKGUF1dGhvcml6ZWRSZXNvdXJjZUlkc0xpc3QSFAoMcmVzb3VyY2VfaWRzGAEgAygJIvMBCh9MaXN0QXV0aG9yaXplZFByaW5jaXBhbElkc0lucHV0EkUKCHJlc291cmNlGAEgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESIgoOcHJpbmNpcGFsX2tpbmQYAiABKAlCCrpIB8gBAXICEAESHAoIcmVsYXRpb24YAyABKAlCCrpIB8gBAXICEAESRwoTY29udGV4dHVhbF9wb2xpY2llcxgEIAMoCzIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjIjMKGkF1dGhvcml6ZWRQcmluY2lwYWxJZHNMaXN0EhUKDXByaW5jaXBhbF9pZHMYASADKAkiWQoXR2V0UHJpbmNpcGFsc0NvdW50SW5wdXQSGgoGb3JnX2lkGAEgASgJQgq6SAfIAQFyAhABEiIKDnByaW5jaXBhbF9raW5kGAIgASgJQgq6SAfIAQFyAhABIiAKD1ByaW5jaXBhbHNDb3VudBINCgVjb3VudBgBIAEoBWIGcHJvdG8z", [file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_spec, file_buf_validate_validate]);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.ApiResourceRefView.
  * Use `create(ApiResourceRefViewSchema)` to create a new message.
@@ -89,34 +89,39 @@ export const CheckAuthorizationInputSchema = /*@__PURE__*/ messageDesc(file_ai_s
  * Use `create(CheckAuthorizationResultSchema)` to create a new message.
  */
 export const CheckAuthorizationResultSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 15);
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.CheckMyPermissionInput.
+ * Use `create(CheckMyPermissionInputSchema)` to create a new message.
+ */
+export const CheckMyPermissionInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 16);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.ListAuthorizedResourceIdsInput.
  * Use `create(ListAuthorizedResourceIdsInputSchema)` to create a new message.
  */
-export const ListAuthorizedResourceIdsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 16);
+export const ListAuthorizedResourceIdsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 17);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.AuthorizedResourceIdsList.
  * Use `create(AuthorizedResourceIdsListSchema)` to create a new message.
  */
-export const AuthorizedResourceIdsListSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 17);
+export const AuthorizedResourceIdsListSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 18);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.ListAuthorizedPrincipalIdsInput.
  * Use `create(ListAuthorizedPrincipalIdsInputSchema)` to create a new message.
  */
-export const ListAuthorizedPrincipalIdsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 18);
+export const ListAuthorizedPrincipalIdsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 19);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.AuthorizedPrincipalIdsList.
  * Use `create(AuthorizedPrincipalIdsListSchema)` to create a new message.
  */
-export const AuthorizedPrincipalIdsListSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 19);
+export const AuthorizedPrincipalIdsListSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 20);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.GetPrincipalsCountInput.
  * Use `create(GetPrincipalsCountInputSchema)` to create a new message.
  */
-export const GetPrincipalsCountInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 20);
+export const GetPrincipalsCountInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 21);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.PrincipalsCount.
  * Use `create(PrincipalsCountSchema)` to create a new message.
  */
-export const PrincipalsCountSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 21);
+export const PrincipalsCountSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 22);
 //# sourceMappingURL=io_pb.js.map

package/ai/stigmer/iam/iampolicy/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,wjHAAwjH,EAAE,CAAC,oCAAoC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA2EhrH;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAgBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAgBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA8BtD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAyB,aAAa,CAC/D,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,s0HAAs0H,EAAE,CAAC,oCAAoC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA2E97H;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAgBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAgBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA8BtD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAyB,aAAa,CAC/D,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AA2CvD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/query_connect.d.ts

@@ -22,6 +22,37 @@ export declare const IamPolicyQueryController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Check whether the AUTHENTICATED CALLER has a permission on a resource.
+         *
+         * This is the self-check RPC for clients (web console, desktop, SDKs):
+         * "Do I have permission Y on resource Z?"
+         *
+         * The principal is always derived server-side from the authenticated token.
+         * The input has no principal field by design — clients cannot name a
+         * principal, so cross-principal permission probing is structurally
+         * impossible (the Kubernetes SelfSubjectAccessReview pattern).
+         *
+         * Use Cases:
+         * - Pre-flight UI checks before showing buttons/actions
+         * - Permission-gated rendering (PermissionGate components)
+         *
+         * Input: CheckMyPermissionInput with resource, relation, and optional contextual policies
+         * Output: CheckAuthorizationResult with is_authorized boolean
+         *
+         * @internal
+         * Skips standard authorization because authorizing this RPC via IAM would
+         * recurse into IAM. Authentication is still required; the handler anchors
+         * the FGA check to the caller's identity account.
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkMyPermission
+         */
+        readonly checkMyPermission: {
+            readonly name: "checkMyPermission";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
         /**
          * Check if a principal is authorized to perform a relation on a resource
          *
@@ -31,8 +62,11 @@ export declare const IamPolicyQueryController: {
          * It provides a simple boolean answer based on the complete authorization state,
          * including existing IAM policies, inherited permissions, and group memberships.
          *
+         * This RPC is an INTERNAL-FACING contract for the platform's own
+         * authorization pipeline (service-to-service and in-process checks).
+         * Client-facing self checks must use checkMyPermission instead.
+         *
          * Use Cases:
-         * - Pre-flight UI checks before showing buttons/actions
          * - API request authorization before processing operations
          * - Service-to-service authorization
          * - Team-based access checks
@@ -40,6 +74,11 @@ export declare const IamPolicyQueryController: {
          * Input: CheckAuthorizationInput with policy spec and optional contextual policies
          * Output: CheckAuthorizationResult with is_authorized boolean
          *
+         * @internal
+         * Skips standard authorization to avoid IAM-authorizing-IAM recursion.
+         * The handler enforces principal trust instead: the caller must either BE
+         * the principal being checked, or be a machine (system) account.
+         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkAuthorization
          */
         readonly checkAuthorization: {

package/ai/stigmer/iam/iampolicy/v1/query_connect.js

@@ -2,7 +2,7 @@
 // @generated from file ai/stigmer/iam/iampolicy/v1/query.proto (package ai.stigmer.iam.iampolicy.v1, syntax proto3)
 /* eslint-disable */
 // @ts-nocheck
-import { AuthorizedPrincipalIdsList, AuthorizedResourceIdsList, CheckAuthorizationInput, CheckAuthorizationResult, GetPrincipalsCountInput, IamPolicyId, ListAuthorizedPrincipalIdsInput, ListAuthorizedResourceIdsInput, ListResourceAccessInput, PrincipalResourceInput, PrincipalResourceRoles, PrincipalsCount, ResourceAccessByPrincipalList } from "./io_pbjs";
+import { AuthorizedPrincipalIdsList, AuthorizedResourceIdsList, CheckAuthorizationInput, CheckAuthorizationResult, CheckMyPermissionInput, GetPrincipalsCountInput, IamPolicyId, ListAuthorizedPrincipalIdsInput, ListAuthorizedResourceIdsInput, ListResourceAccessInput, PrincipalResourceInput, PrincipalResourceRoles, PrincipalsCount, ResourceAccessByPrincipalList } from "./io_pbjs";
 import { IamPolicy } from "./api_pbjs";
 import { MethodKind } from "@bufbuild/protobuf";
 /**
@@ -29,6 +29,37 @@ export const IamPolicyQueryController = {
             O: IamPolicy,
             kind: MethodKind.Unary,
         },
+        /**
+         * Check whether the AUTHENTICATED CALLER has a permission on a resource.
+         *
+         * This is the self-check RPC for clients (web console, desktop, SDKs):
+         * "Do I have permission Y on resource Z?"
+         *
+         * The principal is always derived server-side from the authenticated token.
+         * The input has no principal field by design — clients cannot name a
+         * principal, so cross-principal permission probing is structurally
+         * impossible (the Kubernetes SelfSubjectAccessReview pattern).
+         *
+         * Use Cases:
+         * - Pre-flight UI checks before showing buttons/actions
+         * - Permission-gated rendering (PermissionGate components)
+         *
+         * Input: CheckMyPermissionInput with resource, relation, and optional contextual policies
+         * Output: CheckAuthorizationResult with is_authorized boolean
+         *
+         * @internal
+         * Skips standard authorization because authorizing this RPC via IAM would
+         * recurse into IAM. Authentication is still required; the handler anchors
+         * the FGA check to the caller's identity account.
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkMyPermission
+         */
+        checkMyPermission: {
+            name: "checkMyPermission",
+            I: CheckMyPermissionInput,
+            O: CheckAuthorizationResult,
+            kind: MethodKind.Unary,
+        },
         /**
          * Check if a principal is authorized to perform a relation on a resource
          *
@@ -38,8 +69,11 @@ export const IamPolicyQueryController = {
          * It provides a simple boolean answer based on the complete authorization state,
          * including existing IAM policies, inherited permissions, and group memberships.
          *
+         * This RPC is an INTERNAL-FACING contract for the platform's own
+         * authorization pipeline (service-to-service and in-process checks).
+         * Client-facing self checks must use checkMyPermission instead.
+         *
          * Use Cases:
-         * - Pre-flight UI checks before showing buttons/actions
          * - API request authorization before processing operations
          * - Service-to-service authorization
          * - Team-based access checks
@@ -47,6 +81,11 @@ export const IamPolicyQueryController = {
          * Input: CheckAuthorizationInput with policy spec and optional contextual policies
          * Output: CheckAuthorizationResult with is_authorized boolean
          *
+         * @internal
+         * Skips standard authorization to avoid IAM-authorizing-IAM recursion.
+         * The handler enforces principal trust instead: the caller must either BE
+         * the principal being checked, or be a machine (system) account.
+         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkAuthorization
          */
         checkAuthorization: {

package/ai/stigmer/iam/iampolicy/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,WAAW,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AACrW,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE;QACP;;;;;;;;;WASG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,wBAAwB;YAC3B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,0BAA0B,EAAE;YAC1B,IAAI,EAAE,4BAA4B;YAClC,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,6BAA6B,EAAE;YAC7B,IAAI,EAAE,+BAA+B;YACrC,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,6BAA6B;YAChC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,WAAW,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAC7X,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE;QACP;;;;;;;;;WASG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,wBAAwB;YAC3B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,wBAAwB;YAC3B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,0BAA0B,EAAE;YAC1B,IAAI,EAAE,4BAA4B;YAClC,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,6BAA6B,EAAE;YAC7B,IAAI,EAAE,+BAA+B;YACrC,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,6BAA6B;YAChC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/query_pb.d.ts

@@ -1,6 +1,6 @@
 import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
 import type { IamPolicySchema } from "./api_pb.js";
-import type { AuthorizedPrincipalIdsListSchema, AuthorizedResourceIdsListSchema, CheckAuthorizationInputSchema, CheckAuthorizationResultSchema, GetPrincipalsCountInputSchema, IamPolicyIdSchema, ListAuthorizedPrincipalIdsInputSchema, ListAuthorizedResourceIdsInputSchema, ListResourceAccessInputSchema, PrincipalResourceInputSchema, PrincipalResourceRolesSchema, PrincipalsCountSchema, ResourceAccessByPrincipalListSchema } from "./io_pb.js";
+import type { AuthorizedPrincipalIdsListSchema, AuthorizedResourceIdsListSchema, CheckAuthorizationInputSchema, CheckAuthorizationResultSchema, CheckMyPermissionInputSchema, GetPrincipalsCountInputSchema, IamPolicyIdSchema, ListAuthorizedPrincipalIdsInputSchema, ListAuthorizedResourceIdsInputSchema, ListResourceAccessInputSchema, PrincipalResourceInputSchema, PrincipalResourceRolesSchema, PrincipalsCountSchema, ResourceAccessByPrincipalListSchema } from "./io_pb.js";
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/query.proto.
  */
@@ -26,6 +26,36 @@ export declare const IamPolicyQueryController: GenService<{
         input: typeof IamPolicyIdSchema;
         output: typeof IamPolicySchema;
     };
+    /**
+     * Check whether the AUTHENTICATED CALLER has a permission on a resource.
+     *
+     * This is the self-check RPC for clients (web console, desktop, SDKs):
+     * "Do I have permission Y on resource Z?"
+     *
+     * The principal is always derived server-side from the authenticated token.
+     * The input has no principal field by design — clients cannot name a
+     * principal, so cross-principal permission probing is structurally
+     * impossible (the Kubernetes SelfSubjectAccessReview pattern).
+     *
+     * Use Cases:
+     * - Pre-flight UI checks before showing buttons/actions
+     * - Permission-gated rendering (PermissionGate components)
+     *
+     * Input: CheckMyPermissionInput with resource, relation, and optional contextual policies
+     * Output: CheckAuthorizationResult with is_authorized boolean
+     *
+     * @internal
+     * Skips standard authorization because authorizing this RPC via IAM would
+     * recurse into IAM. Authentication is still required; the handler anchors
+     * the FGA check to the caller's identity account.
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkMyPermission
+     */
+    checkMyPermission: {
+        methodKind: "unary";
+        input: typeof CheckMyPermissionInputSchema;
+        output: typeof CheckAuthorizationResultSchema;
+    };
     /**
      * Check if a principal is authorized to perform a relation on a resource
      *
@@ -35,8 +65,11 @@ export declare const IamPolicyQueryController: GenService<{
      * It provides a simple boolean answer based on the complete authorization state,
      * including existing IAM policies, inherited permissions, and group memberships.
      *
+     * This RPC is an INTERNAL-FACING contract for the platform's own
+     * authorization pipeline (service-to-service and in-process checks).
+     * Client-facing self checks must use checkMyPermission instead.
+     *
      * Use Cases:
-     * - Pre-flight UI checks before showing buttons/actions
      * - API request authorization before processing operations
      * - Service-to-service authorization
      * - Team-based access checks
@@ -44,6 +77,11 @@ export declare const IamPolicyQueryController: GenService<{
      * Input: CheckAuthorizationInput with policy spec and optional contextual policies
      * Output: CheckAuthorizationResult with is_authorized boolean
      *
+     * @internal
+     * Skips standard authorization to avoid IAM-authorizing-IAM recursion.
+     * The handler enforces principal trust instead: the caller must either BE
+     * the principal being checked, or be a machine (system) account.
+     *
      * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkAuthorization
      */
     checkAuthorization: {

package/ai/stigmer/iam/iampolicy/v1/query_pb.js

@@ -9,7 +9,7 @@ import { file_ai_stigmer_iam_iampolicy_v1_io } from "./io_pb.js";
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/query.proto.
  */
-export const file_ai_stigmer_iam_iampolicy_v1_query = /*@__PURE__*/ fileDesc("CidhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MTLqCQoYSWFtUG9saWN5UXVlcnlDb250cm9sbGVyEoUBCgNnZXQSKC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5SWQaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IGFjY2VzcyBwb2xpY2llcxKHAQoSY2hlY2tBdXRob3JpemF0aW9uEjQuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkNoZWNrQXV0aG9yaXphdGlvbklucHV0GjUuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkNoZWNrQXV0aG9yaXphdGlvblJlc3VsdCIE0LgYARLGAQoZbGlzdEF1dGhvcml6ZWRSZXNvdXJjZUlkcxI7LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5MaXN0QXV0aG9yaXplZFJlc291cmNlSWRzSW5wdXQaNi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXV0aG9yaXplZFJlc291cmNlSWRzTGlzdCI0wrgYMAgFKix1bmF1dGhvcml6ZWQgdG8gdmlldyBhdXRob3JpemVkIHJlc291cmNlIGlkcxLKAQoabGlzdEF1dGhvcml6ZWRQcmluY2lwYWxJZHMSPC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuTGlzdEF1dGhvcml6ZWRQcmluY2lwYWxJZHNJbnB1dBo3LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BdXRob3JpemVkUHJpbmNpcGFsSWRzTGlzdCI1wrgYMQgFKi11bmF1dGhvcml6ZWQgdG8gdmlldyBhdXRob3JpemVkIHByaW5jaXBhbCBpZHMSvwEKHWxpc3RSZXNvdXJjZUFjY2Vzc0J5UHJpbmNpcGFsEjQuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkxpc3RSZXNvdXJjZUFjY2Vzc0lucHV0GjouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJlc291cmNlQWNjZXNzQnlQcmluY2lwYWxMaXN0IizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IHJlc291cmNlIGFjY2VzcxKzAQoZZ2V0UHJpbmNpcGFsUmVzb3VyY2VSb2xlcxIzLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5QcmluY2lwYWxSZXNvdXJjZUlucHV0GjMuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbFJlc291cmNlUm9sZXMiLMK4GCgIBSokdW5hdXRob3JpemVkIHRvIHZpZXcgcHJpbmNpcGFsIHJvbGVzEqcBChJnZXRQcmluY2lwYWxzQ291bnQSNC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuR2V0UHJpbmNpcGFsc0NvdW50SW5wdXQaLC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUHJpbmNpcGFsc0NvdW50Ii3CuBgpCAUqJXVuYXV0aG9yaXplZCB0byB2aWV3IHByaW5jaXBhbHMgY291bnQaBKD/KwpiBnByb3RvMw", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io]);
+export const file_ai_stigmer_iam_iampolicy_v1_query = /*@__PURE__*/ fileDesc("CidhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MTLyCgoYSWFtUG9saWN5UXVlcnlDb250cm9sbGVyEoUBCgNnZXQSKC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5SWQaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IGFjY2VzcyBwb2xpY2llcxKFAQoRY2hlY2tNeVBlcm1pc3Npb24SMy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQ2hlY2tNeVBlcm1pc3Npb25JbnB1dBo1LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25SZXN1bHQiBNC4GAEShwEKEmNoZWNrQXV0aG9yaXphdGlvbhI0LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25JbnB1dBo1LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25SZXN1bHQiBNC4GAESxgEKGWxpc3RBdXRob3JpemVkUmVzb3VyY2VJZHMSOy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuTGlzdEF1dGhvcml6ZWRSZXNvdXJjZUlkc0lucHV0GjYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkF1dGhvcml6ZWRSZXNvdXJjZUlkc0xpc3QiNMK4GDAIBSosdW5hdXRob3JpemVkIHRvIHZpZXcgYXV0aG9yaXplZCByZXNvdXJjZSBpZHMSygEKGmxpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzEjwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkxpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzSW5wdXQaNy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXV0aG9yaXplZFByaW5jaXBhbElkc0xpc3QiNcK4GDEIBSotdW5hdXRob3JpemVkIHRvIHZpZXcgYXV0aG9yaXplZCBwcmluY2lwYWwgaWRzEr8BCh1saXN0UmVzb3VyY2VBY2Nlc3NCeVByaW5jaXBhbBI0LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5MaXN0UmVzb3VyY2VBY2Nlc3NJbnB1dBo6LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5SZXNvdXJjZUFjY2Vzc0J5UHJpbmNpcGFsTGlzdCIswrgYKAgFKiR1bmF1dGhvcml6ZWQgdG8gdmlldyByZXNvdXJjZSBhY2Nlc3MSswEKGWdldFByaW5jaXBhbFJlc291cmNlUm9sZXMSMy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUHJpbmNpcGFsUmVzb3VyY2VJbnB1dBozLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5QcmluY2lwYWxSZXNvdXJjZVJvbGVzIizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IHByaW5jaXBhbCByb2xlcxKnAQoSZ2V0UHJpbmNpcGFsc0NvdW50EjQuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkdldFByaW5jaXBhbHNDb3VudElucHV0GiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbHNDb3VudCItwrgYKQgFKiV1bmF1dGhvcml6ZWQgdG8gdmlldyBwcmluY2lwYWxzIGNvdW50GgSg/ysKYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io]);
 /**
  * IamPolicyQueryController handles read operations for IAM policies.
  *

package/ai/stigmer/iam/iampolicy/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,4vDAA4vD,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,CAAC,CAAC,CAAC;AAE37D;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAkJhC,aAAa,CAChB,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,i7DAAi7D,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,CAAC,CAAC,CAAC;AAEhnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAwLhC,aAAa,CAChB,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/protos",
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "Generated TypeScript protobuf stubs for Stigmer APIs",
   "license": "Apache-2.0",
   "type": "module",