@stigmer/protos 3.0.4 → 3.0.6

package/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.js

@@ -8,7 +8,7 @@ import { file_google_protobuf_descriptor } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind.proto.
  */
-export const file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind = /*@__PURE__*/ fileDesc("CkZhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2FwaV9yZXNvdXJjZV9raW5kLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIswDChNBcGlSZXNvdXJjZUtpbmRNZXRhEk8KBWdyb3VwGAEgASgOMkAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUdyb3VwElMKB3ZlcnNpb24YAiABKA4yQi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlVmVyc2lvbhIMCgRuYW1lGAMgASgJEhQKDGRpc3BsYXlfbmFtZRgEIAEoCRIRCglpZF9wcmVmaXgYBSABKAkSFAoMaXNfdmVyc2lvbmVkGAYgASgIEhoKEm5vdF9zZWFyY2hfaW5kZXhlZBgHIAEoCBJKCgR0aWVyGAggASgOMjwuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5SZXNvdXJjZVRpZXISWgoNYXV0aG9yaXphdGlvbhgJIAEoCzJDLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuQXV0aG9yaXphdGlvbkNvbmZpZypCChJBcGlSZXNvdXJjZVZlcnNpb24SJAogYXBpX3Jlc291cmNlX3ZlcnNpb25fdW5zcGVjaWZpZWQQABIGCgJ2MRABKk4KDFJlc291cmNlVGllchIdChlyZXNvdXJjZV90aWVyX3Vuc3BlY2lmaWVkEAASDwoLb3Blbl9zb3VyY2UQARIOCgpjbG91ZF9vbmx5EAIqQQoPUGxhdGZvcm1JZFZhbHVlEiEKHXBsYXRmb3JtX2lkX3ZhbHVlX3Vuc3BlY2lmaWVkEAASCwoHc3RpZ21lchABKv8NCg9BcGlSZXNvdXJjZUtpbmQSHQoZYXBpX3Jlc291cmNlX2tpbmRfdW5rbm93bhAAElsKFGFwaV9yZXNvdXJjZV92ZXJzaW9uEAEaQar/Kz0IARABGhJBcGlSZXNvdXJjZVZlcnNpb24iFEFQSSBSZXNvdXJjZSBWZXJzaW9uKgN2ZXI4AUACSgQIBRAEEj8KCmlhbV9wb2xpY3kQChovqv8rKwgCEAEaCUlhbVBvbGljeSIKSUFNIFBvbGljeSoEaWFtcDgBQAJKBAgCEAESTgoQaWRlbnRpdHlfYWNjb3VudBALGjiq/ys0CAIQARoPSWRlbnRpdHlBY2NvdW50IhBJZGVudGl0eSBBY2NvdW50KgNpZGFAAkoECAQQAxI1CgdhcGlfa2V5EAwaKKr/KyQIAhABGgZBcGlLZXkiB0FQSSBLZXkqA2tleTgBQAJKBAgEEAESPwoKaW52aXRhdGlvbhAUGi+q/ysrCAIQARoKSW52aXRhdGlvbiIKSW52aXRhdGlvbioDaW52OAFAAkoECAIQARJXChFpZGVudGl0eV9wcm92aWRlchAVGkCq/ys8CAIQARoQSWRlbnRpdHlQcm92aWRlciIRSWRlbnRpdHkgUHJvdmlkZXIqA2lkcDgBQAJKCAgCEAE6AgEEEkAKCW9hdXRoX2FwcBAWGjGq/ystCAIQARoIT0F1dGhBcHAiCU9BdXRoIEFwcCoEb2FwcDgBQAJKCAgCEAE6AgEEElEKD3BsYXRmb3JtX2NsaWVudBAXGjyq/ys4CAIQARoOUGxhdGZvcm1DbGllbnQiD1BsYXRmb3JtIENsaWVudCoDcGNsOAFAAkoICAIQAToCAQQSSQoMb3JnYW5pemF0aW9uEB4aN6r/KzMIAxABGgxPcmdhbml6YXRpb24iDE9yZ2FuaXphdGlvbioDb3JnQAFKCggEEAE6BAECAwQSOQoIcGxhdGZvcm0QHxorqv8rJwgDEAEaCFBsYXRmb3JtIghQbGF0Zm9ybSoDcGx0OAFAAkoECAUQBBI2CgVhZ2VudBAoGiuq/ysnCAEQARoFQWdlbnQiBUFnZW50KgNhZ3RAAUoMCAIQASoCCAE6AgEEEmsKD2FnZW50X2V4ZWN1dGlvbhApGlaq/ytSCAEQARoOQWdlbnRFeGVjdXRpb24iD0FnZW50IEV4ZWN1dGlvbioDYWV4QAFKJAgDEAIaHgoHc2Vzc2lvbhIHc2Vzc2lvbhoKc2Vzc2lvbl9pZBI4CgdzZXNzaW9uECoaK6r/KycIARABGgdTZXNzaW9uIgdTZXNzaW9uKgNzZXNAAUoICAIQAToCAQQSOAoFc2tpbGwQKxotqv8rKQgBEAEaBVNraWxsIgVTa2lsbCoDc2tsMAFAAUoMCAIQASoCCAE6AgEEEkQKCm1jcF9zZXJ2ZXIQLBo0qv8rMAgBEAEaCU1jcFNlcnZlciIKTUNQIFNlcnZlcioDbWNwQAFKDAgCEAEqAggBOgIBBBJqCg5hZ2VudF9pbnN0YW5jZRAtGlaq/ytSCAEQARoNQWdlbnRJbnN0YW5jZSIOQWdlbnQgSW5zdGFuY2UqA2FpbkABSiYIAhABIhgKBWFnZW50EgVhZ2VudBoIYWdlbnRfaWQqAggBOgIBBBJBCgh3b3JrZmxvdxAyGjOq/ysvCAEQARoIV29ya2Zsb3ciCFdvcmtmbG93KgN3ZmwwAUABSgwIAhABKgIIAToCAQQSeAoRd29ya2Zsb3dfaW5zdGFuY2UQMxphqv8rXQgBEAEaEFdvcmtmbG93SW5zdGFuY2UiEVdvcmtmbG93IEluc3RhbmNlKgN3aW5AAUorCAIQASIhCgh3b3JrZmxvdxIId29ya2Zsb3caC3dvcmtmbG93X2lkOgIBBBJYChJ3b3JrZmxvd19leGVjdXRpb24QNBpAqv8rPAgBEAEaEVdvcmtmbG93RXhlY3V0aW9uIhJXb3JrZmxvdyBFeGVjdXRpb24qA3dleEABSggIAhABOgIBBBJGCgtlbnZpcm9ubWVudBA1GjWq/ysxCAEQARoLRW52aXJvbm1lbnQiC0Vudmlyb25tZW50KgNlbnZAAUoKCAIQATABOgIBBBI7CghhcnRpZmFjdBA3Gi2q/yspCAEQARoIQXJ0aWZhY3QiCEFydGlmYWN0KgNhcnRAAUoICAIQAToCAQQSUgoRZXhlY3V0aW9uX2NvbnRleHQQNho7qv8rNwgBEAEaEEV4ZWN1dGlvbkNvbnRleHQiEUV4ZWN1dGlvbiBDb250ZXh0KgRlY3R4QAFKBAgEEAESOAoHcHJvamVjdBA8Giuq/ysnCAMQARoHUHJvamVjdCIHUHJvamVjdCoDcHJqQAFKCAgCEAE6AgEEOoUBCglraW5kX21ldGESIS5nb29nbGUucHJvdG9idWYuRW51bVZhbHVlT3B0aW9ucxj1vwUgASgLMkMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmRNZXRhUghraW5kTWV0YUIbQhlBcGlSZXNvdXJjZUtpbmRPdXRlckNsYXNzYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_group, file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config, file_google_protobuf_descriptor]);
+export const file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind = /*@__PURE__*/ fileDesc("CkZhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2FwaV9yZXNvdXJjZV9raW5kLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIswDChNBcGlSZXNvdXJjZUtpbmRNZXRhEk8KBWdyb3VwGAEgASgOMkAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUdyb3VwElMKB3ZlcnNpb24YAiABKA4yQi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlVmVyc2lvbhIMCgRuYW1lGAMgASgJEhQKDGRpc3BsYXlfbmFtZRgEIAEoCRIRCglpZF9wcmVmaXgYBSABKAkSFAoMaXNfdmVyc2lvbmVkGAYgASgIEhoKEm5vdF9zZWFyY2hfaW5kZXhlZBgHIAEoCBJKCgR0aWVyGAggASgOMjwuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5SZXNvdXJjZVRpZXISWgoNYXV0aG9yaXphdGlvbhgJIAEoCzJDLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuQXV0aG9yaXphdGlvbkNvbmZpZypCChJBcGlSZXNvdXJjZVZlcnNpb24SJAogYXBpX3Jlc291cmNlX3ZlcnNpb25fdW5zcGVjaWZpZWQQABIGCgJ2MRABKk4KDFJlc291cmNlVGllchIdChlyZXNvdXJjZV90aWVyX3Vuc3BlY2lmaWVkEAASDwoLb3Blbl9zb3VyY2UQARIOCgpjbG91ZF9vbmx5EAIqQQoPUGxhdGZvcm1JZFZhbHVlEiEKHXBsYXRmb3JtX2lkX3ZhbHVlX3Vuc3BlY2lmaWVkEAASCwoHc3RpZ21lchABKp8OCg9BcGlSZXNvdXJjZUtpbmQSHQoZYXBpX3Jlc291cmNlX2tpbmRfdW5rbm93bhAAElsKFGFwaV9yZXNvdXJjZV92ZXJzaW9uEAEaQar/Kz0IARABGhJBcGlSZXNvdXJjZVZlcnNpb24iFEFQSSBSZXNvdXJjZSBWZXJzaW9uKgN2ZXI4AUACSgQIBRAEEj8KCmlhbV9wb2xpY3kQChovqv8rKwgCEAEaCUlhbVBvbGljeSIKSUFNIFBvbGljeSoEaWFtcDgBQAJKBAgCEAESTgoQaWRlbnRpdHlfYWNjb3VudBALGjiq/ys0CAIQARoPSWRlbnRpdHlBY2NvdW50IhBJZGVudGl0eSBBY2NvdW50KgNpZGFAAkoECAQQAxI1CgdhcGlfa2V5EAwaKKr/KyQIAhABGgZBcGlLZXkiB0FQSSBLZXkqA2tleTgBQAJKBAgEEAESPwoKaW52aXRhdGlvbhAUGi+q/ysrCAIQARoKSW52aXRhdGlvbiIKSW52aXRhdGlvbioDaW52OAFAAkoECAIQARJXChFpZGVudGl0eV9wcm92aWRlchAVGkCq/ys8CAIQARoQSWRlbnRpdHlQcm92aWRlciIRSWRlbnRpdHkgUHJvdmlkZXIqA2lkcDgBQAJKCAgCEAE6AgEEEkAKCW9hdXRoX2FwcBAWGjGq/ystCAIQARoIT0F1dGhBcHAiCU9BdXRoIEFwcCoEb2FwcDgBQAJKCAgCEAE6AgEEElEKD3BsYXRmb3JtX2NsaWVudBAXGjyq/ys4CAIQARoOUGxhdGZvcm1DbGllbnQiD1BsYXRmb3JtIENsaWVudCoDcGNsOAFAAkoICAIQAToCAQQSSQoMb3JnYW5pemF0aW9uEB4aN6r/KzMIAxABGgxPcmdhbml6YXRpb24iDE9yZ2FuaXphdGlvbioDb3JnQAFKCggEEAE6BAECAwQSOQoIcGxhdGZvcm0QHxorqv8rJwgDEAEaCFBsYXRmb3JtIghQbGF0Zm9ybSoDcGx0OAFAAkoECAUQBBI8CgVhZ2VudBAoGjGq/ystCAEQARoFQWdlbnQiBUFnZW50KgNhZ3RAAUoSCAIQASoICAEQARgBIAE6AgEEEmsKD2FnZW50X2V4ZWN1dGlvbhApGlaq/ytSCAEQARoOQWdlbnRFeGVjdXRpb24iD0FnZW50IEV4ZWN1dGlvbioDYWV4QAFKJAgDEAIaHgoHc2Vzc2lvbhIHc2Vzc2lvbhoKc2Vzc2lvbl9pZBI4CgdzZXNzaW9uECoaK6r/KycIARABGgdTZXNzaW9uIgdTZXNzaW9uKgNzZXNAAUoICAIQAToCAQQSPgoFc2tpbGwQKxozqv8rLwgBEAEaBVNraWxsIgVTa2lsbCoDc2tsMAFAAUoSCAIQASoICAEQARgBIAE6AgEEEkoKCm1jcF9zZXJ2ZXIQLBo6qv8rNggBEAEaCU1jcFNlcnZlciIKTUNQIFNlcnZlcioDbWNwQAFKEggCEAEqCAgBEAEYASABOgIBBBJsCg5hZ2VudF9pbnN0YW5jZRAtGliq/ytUCAEQARoNQWdlbnRJbnN0YW5jZSIOQWdlbnQgSW5zdGFuY2UqA2FpbkABSigIAhABIhgKBWFnZW50EgVhZ2VudBoIYWdlbnRfaWQqBAgBGAE6AgEEEkcKCHdvcmtmbG93EDIaOar/KzUIARABGghXb3JrZmxvdyIIV29ya2Zsb3cqA3dmbDABQAFKEggCEAEqCAgBEAEYASABOgIBBBJ+ChF3b3JrZmxvd19pbnN0YW5jZRAzGmeq/ytjCAEQARoQV29ya2Zsb3dJbnN0YW5jZSIRV29ya2Zsb3cgSW5zdGFuY2UqA3dpbkABSjEIAhABIiEKCHdvcmtmbG93Egh3b3JrZmxvdxoLd29ya2Zsb3dfaWQqBAgBGAE6AgEEElgKEndvcmtmbG93X2V4ZWN1dGlvbhA0GkCq/ys8CAEQARoRV29ya2Zsb3dFeGVjdXRpb24iEldvcmtmbG93IEV4ZWN1dGlvbioDd2V4QAFKCAgCEAE6AgEEEkYKC2Vudmlyb25tZW50EDUaNar/KzEIARABGgtFbnZpcm9ubWVudCILRW52aXJvbm1lbnQqA2VudkABSgoIAhABMAE6AgEEEjsKCGFydGlmYWN0EDcaLar/KykIARABGghBcnRpZmFjdCIIQXJ0aWZhY3QqA2FydEABSggIAhABOgIBBBJSChFleGVjdXRpb25fY29udGV4dBA2Gjuq/ys3CAEQARoQRXhlY3V0aW9uQ29udGV4dCIRRXhlY3V0aW9uIENvbnRleHQqBGVjdHhAAUoECAQQARI4Cgdwcm9qZWN0EDwaK6r/KycIAxABGgdQcm9qZWN0IgdQcm9qZWN0KgNwcmpAAUoICAIQAToCAQQ6hQEKCWtpbmRfbWV0YRIhLmdvb2dsZS5wcm90b2J1Zi5FbnVtVmFsdWVPcHRpb25zGPW/BSABKAsyQy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlS2luZE1ldGFSCGtpbmRNZXRhQhtCGUFwaVJlc291cmNlS2luZE91dGVyQ2xhc3NiBnByb3RvMw", [file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_group, file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config, file_google_protobuf_descriptor]);
 /**
  * Describes the message ai.stigmer.commons.apiresource.apiresourcekind.ApiResourceKindMeta.
  * Use `create(ApiResourceKindMetaSchema)` to create a new message.

package/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_resource_kind_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sKAAsK;AACtK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAExF,OAAO,EAAE,sEAAsE,EAAE,MAAM,4BAA4B,CAAC;AAEpH,OAAO,EAAE,wEAAwE,EAAE,MAAM,8BAA8B,CAAC;AAExH,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAGzE;;GAEG;AACH,MAAM,CAAC,MAAM,qEAAqE,GAAY,aAAa,CACzG,QAAQ,CAAC,ymHAAymH,EAAE,CAAC,sEAAsE,EAAE,wEAAwE,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAwE3yH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAcX;AAdD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,mHAAoC,CAAA;IAEpC;;;;OAIG;IACH,uDAAM,CAAA;AACR,CAAC,EAdW,kBAAkB,KAAlB,kBAAkB,QAc7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,YAmBX;AAnBD,WAAY,YAAY;IACtB;;OAEG;IACH,yFAA6B,CAAA;IAE7B;;;;OAIG;IACH,6DAAe,CAAA;IAEf;;;;OAIG;IACH,2DAAc,CAAA;AAChB,CAAC,EAnBW,YAAY,KAAZ,YAAY,QAmBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0B,aAAa,CACpE,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eAaX;AAbD,WAAY,eAAe;IACzB;;OAEG;IACH,uGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,2DAAW,CAAA;AACb,CAAC,EAbW,eAAe,KAAf,eAAe,QAa1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAwKX;AAxKD,WAAY,eAAe;IACzB;;;;OAIG;IACH,+FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qFAAwB,CAAA;IAExB;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,8EAAqB,CAAA;IAErB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,gEAAc,CAAA;IAEd;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;OAIG;IACH,sEAAiB,CAAA;IAEjB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,0EAAmB,CAAA;IAEnB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,kFAAuB,CAAA;IAEvB;;;;OAIG;IACH,oEAAgB,CAAA;IAEhB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,4DAAY,CAAA;AACd,CAAC,EAxKW,eAAe,KAAf,eAAe,QAwK1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAwD,aAAa,CACzF,OAAO,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api_resource_kind_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sKAAsK;AACtK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAExF,OAAO,EAAE,sEAAsE,EAAE,MAAM,4BAA4B,CAAC;AAEpH,OAAO,EAAE,wEAAwE,EAAE,MAAM,8BAA8B,CAAC;AAExH,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAGzE;;GAEG;AACH,MAAM,CAAC,MAAM,qEAAqE,GAAY,aAAa,CACzG,QAAQ,CAAC,opHAAopH,EAAE,CAAC,sEAAsE,EAAE,wEAAwE,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAwEt1H;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAcX;AAdD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,mHAAoC,CAAA;IAEpC;;;;OAIG;IACH,uDAAM,CAAA;AACR,CAAC,EAdW,kBAAkB,KAAlB,kBAAkB,QAc7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,YAmBX;AAnBD,WAAY,YAAY;IACtB;;OAEG;IACH,yFAA6B,CAAA;IAE7B;;;;OAIG;IACH,6DAAe,CAAA;IAEf;;;;OAIG;IACH,2DAAc,CAAA;AAChB,CAAC,EAnBW,YAAY,KAAZ,YAAY,QAmBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0B,aAAa,CACpE,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eAaX;AAbD,WAAY,eAAe;IACzB;;OAEG;IACH,uGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,2DAAW,CAAA;AACb,CAAC,EAbW,eAAe,KAAf,eAAe,QAa1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAwKX;AAxKD,WAAY,eAAe;IACzB;;;;OAIG;IACH,+FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qFAAwB,CAAA;IAExB;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,8EAAqB,CAAA;IAErB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,gEAAc,CAAA;IAEd;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;OAIG;IACH,sEAAiB,CAAA;IAEjB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,0EAAmB,CAAA;IAEnB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,kFAAuB,CAAA;IAEvB;;;;OAIG;IACH,oEAAgB,CAAA;IAEhB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,4DAAY,CAAA;AACd,CAAC,EAxKW,eAAe,KAAf,eAAe,QAwK1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAwD,aAAa,CACzF,OAAO,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.d.ts

@@ -6,32 +6,103 @@ import type { Message } from "@bufbuild/protobuf";
  */
 export declare const file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config: GenFile;
 /**
- * Visibility configuration for public access support.
- * Controls whether this resource kind can be made publicly readable.
+ * Visibility configuration: the set of visibility levels a resource kind
+ * may be set to. The declared levels drive both request validation (an
+ * unsupported level is rejected with INVALID_ARGUMENT before persist) and
+ * FGA tuple reconciliation (each level maps to exactly one tuple shape):
  *
- * When a resource is marked PUBLIC:
- * - FGA creates a wildcard tuple: resource#viewer@identity_account:*
- * - This grants viewer access to all authenticated users via FGA
- * - Authorization remains pure FGA - no application-level fallbacks
+ * - visibility_private: no visibility tuple (owner + explicit grants only)
+ * - visibility_org:     resource#viewer@organization:<org>#member
+ * - visibility_public:  resource#viewer@identity_account:* (conditional
+ *                       wildcard gated by allow_public)
+ * - visibility_platform: resource#platform_viewer@identity_provider:<idp>#platform_user
+ *                       (the "private catalog" primitive: grants access to
+ *                       all members of all platform_managed orgs linked to
+ *                       the owning org's IdentityProvider)
  *
- * Open access resources (supports_public = true):
- *   agent, skill, workflow, mcp_server
+ * Kinds WITHOUT a visibility config accept only visibility_private (or
+ * unspecified) — they are personal or org-structural resources whose access
+ * is fully defined by their FGA model, never by per-resource visibility
+ * tuples (session, environment, executions, etc.).
  *
- * Restricted access resources (supports_public = false or not configured):
- *   session, environment, agent_instance, workflow_instance,
- *   agent_execution, workflow_execution
+ * Current classification:
+ * - Blueprint kinds (agent, skill, workflow, mcp_server):
+ *     private, org, public, platform
+ * - Instance kinds (agent_instance, workflow_instance):
+ *     private, org, public — platform is deliberately excluded to preserve
+ *     tenant isolation: each managed org instantiates shared blueprints
+ *     inside its own boundary. (System-managed DEFAULT instances opt out of
+ *     visibility entirely: their access tracks the parent blueprint
+ *     structurally via the default_of FGA relation.)
+ *
+ * Note: levels are declared as one bool per level instead of a repeated
+ * ApiResourceVisibility because that enum lives in the parent apiresource
+ * package, whose generated Go package already imports this one — a typed
+ * reference here would create a Go package import cycle.
  *
  * @generated from message ai.stigmer.commons.apiresource.apiresourcekind.VisibilityConfig
  */
 export type VisibilityConfig = Message<"ai.stigmer.commons.apiresource.apiresourcekind.VisibilityConfig"> & {
     /**
-     * Whether this resource kind supports public visibility.
-     * - true: Resources can be marked PUBLIC, creating identity_account:* tuple
-     * - false: Resources are always org-restricted, PUBLIC visibility is rejected
+     * Whether resources of this kind can be set to visibility_public.
+     * FGA tuple: resource#viewer@identity_account:* (gated by allow_public)
      *
      * @generated from field: bool supports_public = 1;
      */
     supportsPublic: boolean;
+    /**
+     * Whether resources of this kind can be set to visibility_platform.
+     * FGA tuple: resource#platform_viewer@identity_provider:<idp>#platform_user
+     *
+     * Reserved for blueprint kinds (agent, skill, workflow, mcp_server).
+     * Instance kinds are deliberately excluded to preserve tenant isolation.
+     *
+     * @generated from field: bool supports_platform = 2;
+     */
+    supportsPlatform: boolean;
+    /**
+     * Whether resources of this kind can be set to visibility_org.
+     * FGA tuple: resource#viewer@organization:<org>#member
+     *
+     * Historically org support was inferred from supports_public, which made
+     * it impossible to declare "org but not public" and silently skipped org
+     * tuples for kinds with no visibility config (the workflow_instance gap).
+     *
+     * @generated from field: bool supports_org = 3;
+     */
+    supportsOrg: boolean;
+    /**
+     * Whether resources of this kind default to visibility_org when created
+     * with unspecified visibility. When false (or when no visibility config
+     * is declared), unspecified visibility defaults to visibility_private.
+     *
+     * Set on blueprint kinds (agent, skill, workflow, mcp_server): blueprints
+     * are shared org assets, and before private visibility became real (the
+     * unconditional `viewer from organization` FGA grant was removed) every
+     * blueprint was effectively org-visible regardless of its enum value.
+     * Defaulting to org preserves that collaborative behavior — Private is an
+     * explicit opt-in, never a surprise.
+     *
+     * The flag carries a second, coupled semantic for the same kinds — the
+     * ORG FLOOR: when visibility is platform or public, the org viewer tuple
+     * is written IN ADDITION to the level's own tuple. Sharing a blueprint
+     * beyond the org must never make it less visible to the owning org's own
+     * members (org-scoped listings resolve through FGA ListObjects with the
+     * public wildcard suppressed, so the explicit org tuple is what keeps
+     * shared blueprints listable at home).
+     *
+     * Instance kinds deliberately leave this false: instances are personal
+     * resources (configuration, secrets) that must start private, and their
+     * visibility levels are exactly what the user chose — no floor.
+     *
+     * Note: a single ApiResourceVisibility-typed default field would be
+     * cleaner, but that enum lives in the parent apiresource package whose
+     * generated Go package imports this one (see the file-level note above) —
+     * hence the boolean, consistent with the supports_* flags.
+     *
+     * @generated from field: bool defaults_to_org_visibility = 4;
+     */
+    defaultsToOrgVisibility: boolean;
 };
 /**
  * Describes the message ai.stigmer.commons.apiresource.apiresourcekind.VisibilityConfig.
@@ -159,10 +230,9 @@ export type AuthorizationConfig = Message<"ai.stigmer.commons.apiresource.apires
      */
     additionalParents: ParentRelationConfig[];
     /**
-     * Visibility configuration for public access.
-     * When configured with supports_public: true, resources can be made PUBLIC,
-     * which creates an identity_account:* wildcard tuple granting viewer access
-     * to all authenticated users via FGA.
+     * Visibility configuration: which visibility levels this kind supports.
+     * Not configured means the kind accepts only visibility_private — no
+     * visibility tuples are ever written for it.
      *
      * @generated from field: ai.stigmer.commons.apiresource.apiresourcekind.VisibilityConfig visibility = 5;
      */

package/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.js

@@ -6,7 +6,7 @@ import { file_ai_stigmer_iam_v1_enum } from "../../../iam/v1/enum_pb.js";
 /**
  * Describes the file ai/stigmer/commons/apiresource/apiresourcekind/authorization_config.proto.
  */
-export const file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config = /*@__PURE__*/ fileDesc("CklhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2F1dGhvcml6YXRpb25fY29uZmlnLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIisKEFZpc2liaWxpdHlDb25maWcSFwoPc3VwcG9ydHNfcHVibGljGAEgASgIIkoKFFBhcmVudFJlbGF0aW9uQ29uZmlnEgwKBGtpbmQYASABKAkSEAoIcmVsYXRpb24YAiABKAkSEgoKc3BlY19maWVsZBgDIAEoCSKuBAoTQXV0aG9yaXphdGlvbkNvbmZpZxJaCgpzY29wZV90eXBlGAEgASgOMkYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BdXRob3JpemF0aW9uU2NvcGVUeXBlElgKCm93bmVyX3R5cGUYAiABKA4yRC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLk93bmVyQXR0cmlidXRpb25UeXBlElQKBnBhcmVudBgDIAEoCzJELmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuUGFyZW50UmVsYXRpb25Db25maWcSYAoSYWRkaXRpb25hbF9wYXJlbnRzGAQgAygLMkQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5QYXJlbnRSZWxhdGlvbkNvbmZpZxJUCgp2aXNpYmlsaXR5GAUgASgLMkAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5WaXNpYmlsaXR5Q29uZmlnEh4KFnJlcXVpcmVzX2NyZWF0b3JfdHVwbGUYBiABKAgSMwoPZ3JhbnRhYmxlX3JvbGVzGAcgAygOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZSqFAgoWQXV0aG9yaXphdGlvblNjb3BlVHlwZRIoCiRBVVRIT1JJWkFUSU9OX1NDT1BFX1RZUEVfVU5TUEVDSUZJRUQQABIlCiFBVVRIT1JJWkFUSU9OX1NDT1BFX1RZUEVfUExBVEZPUk0QARIpCiVBVVRIT1JJWkFUSU9OX1NDT1BFX1RZUEVfT1JHQU5JWkFUSU9OEAISIwofQVVUSE9SSVpBVElPTl9TQ09QRV9UWVBFX1BBUkVOVBADEicKI0FVVEhPUklaQVRJT05fU0NPUEVfVFlQRV9PV05FUl9PTkxZEAQSIQodQVVUSE9SSVpBVElPTl9TQ09QRV9UWVBFX05PTkUQBSrJAQoUT3duZXJBdHRyaWJ1dGlvblR5cGUSJgoiT1dORVJfQVRUUklCVVRJT05fVFlQRV9VTlNQRUNJRklFRBAAEiEKHU9XTkVSX0FUVFJJQlVUSU9OX1RZUEVfRElSRUNUEAESJAogT1dORVJfQVRUUklCVVRJT05fVFlQRV9JTkhFUklURUQQAhIfChtPV05FUl9BVFRSSUJVVElPTl9UWVBFX1NFTEYQAxIfChtPV05FUl9BVFRSSUJVVElPTl9UWVBFX05PTkUQBEIaQhhBdXRob3JpemF0aW9uQ29uZmlnUHJvdG9iBnByb3RvMw", [file_ai_stigmer_iam_v1_enum]);
+export const file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config = /*@__PURE__*/ fileDesc("CklhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2F1dGhvcml6YXRpb25fY29uZmlnLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIoABChBWaXNpYmlsaXR5Q29uZmlnEhcKD3N1cHBvcnRzX3B1YmxpYxgBIAEoCBIZChFzdXBwb3J0c19wbGF0Zm9ybRgCIAEoCBIUCgxzdXBwb3J0c19vcmcYAyABKAgSIgoaZGVmYXVsdHNfdG9fb3JnX3Zpc2liaWxpdHkYBCABKAgiSgoUUGFyZW50UmVsYXRpb25Db25maWcSDAoEa2luZBgBIAEoCRIQCghyZWxhdGlvbhgCIAEoCRISCgpzcGVjX2ZpZWxkGAMgASgJIq4EChNBdXRob3JpemF0aW9uQ29uZmlnEloKCnNjb3BlX3R5cGUYASABKA4yRi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkF1dGhvcml6YXRpb25TY29wZVR5cGUSWAoKb3duZXJfdHlwZRgCIAEoDjJELmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuT3duZXJBdHRyaWJ1dGlvblR5cGUSVAoGcGFyZW50GAMgASgLMkQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5QYXJlbnRSZWxhdGlvbkNvbmZpZxJgChJhZGRpdGlvbmFsX3BhcmVudHMYBCADKAsyRC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLlBhcmVudFJlbGF0aW9uQ29uZmlnElQKCnZpc2liaWxpdHkYBSABKAsyQC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLlZpc2liaWxpdHlDb25maWcSHgoWcmVxdWlyZXNfY3JlYXRvcl90dXBsZRgGIAEoCBIzCg9ncmFudGFibGVfcm9sZXMYByADKA4yGi5haS5zdGlnbWVyLmlhbS52MS5JYW1Sb2xlKoUCChZBdXRob3JpemF0aW9uU2NvcGVUeXBlEigKJEFVVEhPUklaQVRJT05fU0NPUEVfVFlQRV9VTlNQRUNJRklFRBAAEiUKIUFVVEhPUklaQVRJT05fU0NPUEVfVFlQRV9QTEFURk9STRABEikKJUFVVEhPUklaQVRJT05fU0NPUEVfVFlQRV9PUkdBTklaQVRJT04QAhIjCh9BVVRIT1JJWkFUSU9OX1NDT1BFX1RZUEVfUEFSRU5UEAMSJwojQVVUSE9SSVpBVElPTl9TQ09QRV9UWVBFX09XTkVSX09OTFkQBBIhCh1BVVRIT1JJWkFUSU9OX1NDT1BFX1RZUEVfTk9ORRAFKskBChRPd25lckF0dHJpYnV0aW9uVHlwZRImCiJPV05FUl9BVFRSSUJVVElPTl9UWVBFX1VOU1BFQ0lGSUVEEAASIQodT1dORVJfQVRUUklCVVRJT05fVFlQRV9ESVJFQ1QQARIkCiBPV05FUl9BVFRSSUJVVElPTl9UWVBFX0lOSEVSSVRFRBACEh8KG09XTkVSX0FUVFJJQlVUSU9OX1RZUEVfU0VMRhADEh8KG09XTkVSX0FUVFJJQlVUSU9OX1RZUEVfTk9ORRAEQhpCGEF1dGhvcml6YXRpb25Db25maWdQcm90b2IGcHJvdG8z", [file_ai_stigmer_iam_v1_enum]);
 /**
  * Describes the message ai.stigmer.commons.apiresource.apiresourcekind.VisibilityConfig.
  * Use `create(VisibilityConfigSchema)` to create a new message.

package/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization_config_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yKAAyK;AACzK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAGzE;;GAEG;AACH,MAAM,CAAC,MAAM,wEAAwE,GAAY,aAAa,CAC5G,QAAQ,CAAC,otDAAotD,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;AA+BhwD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAsC3F;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAiI3F;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAiDX;AAjDD,WAAY,sBAAsB;IAChC;;OAEG;IACH,iFAAe,CAAA;IAEf;;;;;;OAMG;IACH,2EAAY,CAAA;IAEZ;;;;;;OAMG;IACH,mFAAgB,CAAA;IAEhB;;;;;;OAMG;IACH,uEAAU,CAAA;IAEV;;;;;;OAMG;IACH,+EAAc,CAAA;IAEd;;;;;OAKG;IACH,mEAAQ,CAAA;AACV,CAAC,EAjDW,sBAAsB,KAAtB,sBAAsB,QAiDjC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAoC,aAAa,CACxF,QAAQ,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,oBAwCX;AAxCD,WAAY,oBAAoB;IAC9B;;OAEG;IACH,6EAAe,CAAA;IAEf;;;;;;OAMG;IACH,mEAAU,CAAA;IAEV;;;;;;OAMG;IACH,yEAAa,CAAA;IAEb;;;;;;OAMG;IACH,+DAAQ,CAAA;IAER;;;;;OAKG;IACH,+DAAQ,CAAA;AACV,CAAC,EAxCW,oBAAoB,KAApB,oBAAoB,QAwC/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"authorization_config_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yKAAyK;AACzK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAGzE;;GAEG;AACH,MAAM,CAAC,MAAM,wEAAwE,GAAY,aAAa,CAC5G,QAAQ,CAAC,s0DAAs0D,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;AAyGl3D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAsC3F;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAgI3F;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAiDX;AAjDD,WAAY,sBAAsB;IAChC;;OAEG;IACH,iFAAe,CAAA;IAEf;;;;;;OAMG;IACH,2EAAY,CAAA;IAEZ;;;;;;OAMG;IACH,mFAAgB,CAAA;IAEhB;;;;;;OAMG;IACH,uEAAU,CAAA;IAEV;;;;;;OAMG;IACH,+EAAc,CAAA;IAEd;;;;;OAKG;IACH,mEAAQ,CAAA;AACV,CAAC,EAjDW,sBAAsB,KAAtB,sBAAsB,QAiDjC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAoC,aAAa,CACxF,QAAQ,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,oBAwCX;AAxCD,WAAY,oBAAoB;IAC9B;;OAEG;IACH,6EAAe,CAAA;IAEf;;;;;;OAMG;IACH,mEAAU,CAAA;IAEV;;;;;;OAMG;IACH,yEAAa,CAAA;IAEb;;;;;;OAMG;IACH,+DAAQ,CAAA;IAER;;;;;OAKG;IACH,+DAAQ,CAAA;AACV,CAAC,EAxCW,oBAAoB,KAApB,oBAAoB,QAwC/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wEAAwE,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/enum_pb.d.ts

@@ -117,10 +117,13 @@ export declare const ApiResourceStateOperationTypeSchema: GenEnum<ApiResourceSta
  * All resources belong to an organization. Visibility determines whether
  * users outside that organization can access the resource.
  *
- * The three visibility levels map to FGA tuples:
+ * The visibility levels map to FGA tuples:
  * - PRIVATE: no additional viewer tuples (owner-only access)
  * - ORG: resource#viewer@organization:<org>#member tuple (all org members)
  * - PUBLIC: resource#viewer@identity_account:* with allow_public (all users)
+ * - PLATFORM: resource#platform_viewer@identity_provider:<idp>#platform_user
+ *   (all members of all organizations managed by the owning org's
+ *   IdentityProvider)
  *
  * @generated from enum ai.stigmer.commons.apiresource.ApiResourceVisibility
  */
@@ -161,7 +164,32 @@ export declare enum ApiResourceVisibility {
      *
      * @generated from enum value: visibility_org = 3;
      */
-    visibility_org = 3
+    visibility_org = 3,
+    /**
+     * All members of all organizations managed by the owning org's
+     * IdentityProvider can access (read and execute) this resource.
+     *
+     * "Platform" here means an external platform that operates Stigmer orgs
+     * on behalf of its own customers (see ManagementMode.platform_managed) —
+     * NOT the Stigmer platform singleton used by
+     * AUTHORIZATION_SCOPE_TYPE_PLATFORM.
+     *
+     * This is the "private catalog" primitive for multi-tenant consumers:
+     * a platform (e.g. Planton) authors blueprints (agents, skills, MCP
+     * servers, workflows) in its own org and shares them with every child
+     * org it manages, without exposing them publicly. Child orgs created
+     * later gain access automatically. Instances, sessions, executions and
+     * environments are never platform-visible — each child org instantiates
+     * the shared blueprint inside its own tenant boundary.
+     *
+     * Only valid for blueprint kinds with supports_platform: true, and only
+     * when the owning org owns at least one IdentityProvider.
+     *
+     * FGA tuple: resource#platform_viewer@identity_provider:<idp>#platform_user
+     *
+     * @generated from enum value: visibility_platform = 4;
+     */
+    visibility_platform = 4
 }
 /**
  * Describes the enum ai.stigmer.commons.apiresource.ApiResourceVisibility.

package/ai/stigmer/commons/apiresource/enum_pb.js

@@ -5,7 +5,7 @@ import { enumDesc, fileDesc } from "@bufbuild/protobuf/codegenv1";
 /**
  * Describes the file ai/stigmer/commons/apiresource/enum.proto.
  */
-export const file_ai_stigmer_commons_apiresource_enum = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvZW51bS5wcm90bxIeYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlKnYKFEFwaVJlc291cmNlRXZlbnRUeXBlEg8KC3Vuc3BlY2lmaWVkEAASCwoHY3JlYXRlZBABEgsKB3VwZGF0ZWQQAhILCgdkZWxldGVkEAMSCwoHcmVuYW1lZBAEEhkKFXN0YWNrX291dHB1dHNfdXBkYXRlZBAFKowBCh1BcGlSZXNvdXJjZVN0YXRlT3BlcmF0aW9uVHlwZRIxCi1hcGlfcmVzb3VyY2Vfc3RhdGVfb3BlcmF0aW9uX3R5cGVfdW5zcGVjaWZpZWQQABIKCgZjcmVhdGUQARIKCgZ1cGRhdGUQAhIKCgZkZWxldGUQAxIICgRyZWFkEAQSCgoGc3RyZWFtEAUqgwEKFUFwaVJlc291cmNlVmlzaWJpbGl0eRInCiNhcGlfcmVzb3VyY2VfdmlzaWJpbGl0eV91bnNwZWNpZmllZBAAEhYKEnZpc2liaWxpdHlfcHJpdmF0ZRABEhUKEXZpc2liaWxpdHlfcHVibGljEAISEgoOdmlzaWJpbGl0eV9vcmcQA2IGcHJvdG8z");
+export const file_ai_stigmer_commons_apiresource_enum = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvZW51bS5wcm90bxIeYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlKnYKFEFwaVJlc291cmNlRXZlbnRUeXBlEg8KC3Vuc3BlY2lmaWVkEAASCwoHY3JlYXRlZBABEgsKB3VwZGF0ZWQQAhILCgdkZWxldGVkEAMSCwoHcmVuYW1lZBAEEhkKFXN0YWNrX291dHB1dHNfdXBkYXRlZBAFKowBCh1BcGlSZXNvdXJjZVN0YXRlT3BlcmF0aW9uVHlwZRIxCi1hcGlfcmVzb3VyY2Vfc3RhdGVfb3BlcmF0aW9uX3R5cGVfdW5zcGVjaWZpZWQQABIKCgZjcmVhdGUQARIKCgZ1cGRhdGUQAhIKCgZkZWxldGUQAxIICgRyZWFkEAQSCgoGc3RyZWFtEAUqnAEKFUFwaVJlc291cmNlVmlzaWJpbGl0eRInCiNhcGlfcmVzb3VyY2VfdmlzaWJpbGl0eV91bnNwZWNpZmllZBAAEhYKEnZpc2liaWxpdHlfcHJpdmF0ZRABEhUKEXZpc2liaWxpdHlfcHVibGljEAISEgoOdmlzaWJpbGl0eV9vcmcQAxIXChN2aXNpYmlsaXR5X3BsYXRmb3JtEARiBnByb3RvMw");
 /**
  * Event types produced by command controller RPCs across all API resources.
  *
@@ -122,10 +122,13 @@ export const ApiResourceStateOperationTypeSchema = /*@__PURE__*/ enumDesc(file_a
  * All resources belong to an organization. Visibility determines whether
  * users outside that organization can access the resource.
  *
- * The three visibility levels map to FGA tuples:
+ * The visibility levels map to FGA tuples:
  * - PRIVATE: no additional viewer tuples (owner-only access)
  * - ORG: resource#viewer@organization:<org>#member tuple (all org members)
  * - PUBLIC: resource#viewer@identity_account:* with allow_public (all users)
+ * - PLATFORM: resource#platform_viewer@identity_provider:<idp>#platform_user
+ *   (all members of all organizations managed by the owning org's
+ *   IdentityProvider)
  *
  * @generated from enum ai.stigmer.commons.apiresource.ApiResourceVisibility
  */
@@ -168,6 +171,31 @@ export var ApiResourceVisibility;
      * @generated from enum value: visibility_org = 3;
      */
     ApiResourceVisibility[ApiResourceVisibility["visibility_org"] = 3] = "visibility_org";
+    /**
+     * All members of all organizations managed by the owning org's
+     * IdentityProvider can access (read and execute) this resource.
+     *
+     * "Platform" here means an external platform that operates Stigmer orgs
+     * on behalf of its own customers (see ManagementMode.platform_managed) —
+     * NOT the Stigmer platform singleton used by
+     * AUTHORIZATION_SCOPE_TYPE_PLATFORM.
+     *
+     * This is the "private catalog" primitive for multi-tenant consumers:
+     * a platform (e.g. Planton) authors blueprints (agents, skills, MCP
+     * servers, workflows) in its own org and shares them with every child
+     * org it manages, without exposing them publicly. Child orgs created
+     * later gain access automatically. Instances, sessions, executions and
+     * environments are never platform-visible — each child org instantiates
+     * the shared blueprint inside its own tenant boundary.
+     *
+     * Only valid for blueprint kinds with supports_platform: true, and only
+     * when the owning org owns at least one IdentityProvider.
+     *
+     * FGA tuple: resource#platform_viewer@identity_provider:<idp>#platform_user
+     *
+     * @generated from enum value: visibility_platform = 4;
+     */
+    ApiResourceVisibility[ApiResourceVisibility["visibility_platform"] = 4] = "visibility_platform";
 })(ApiResourceVisibility || (ApiResourceVisibility = {}));
 /**
  * Describes the enum ai.stigmer.commons.apiresource.ApiResourceVisibility.

package/ai/stigmer/commons/apiresource/enum_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,koBAAkoB,CAAC,CAAC;AAE/oB;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,qBAyCX;AAzCD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,+HAAuC,CAAA;IAEvC;;;;;;OAMG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;OAOG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;OAWG;IACH,qFAAkB,CAAA;AACpB,CAAC,EAzCW,qBAAqB,KAArB,qBAAqB,QAyChC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,oqBAAoqB,CAAC,CAAC;AAEjrB;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,qBAmEX;AAnED,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,+HAAuC,CAAA;IAEvC;;;;;;OAMG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;OAOG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;OAWG;IACH,qFAAkB,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,+FAAuB,CAAA;AACzB,CAAC,EAnEW,qBAAqB,KAArB,qBAAqB,QAmEhC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/io_pb.d.ts

@@ -127,17 +127,24 @@ export declare const FindApiResourcesRequestSchema: GenMessage<FindApiResourcesR
  * Each controller's updateVisibility RPC accepts this shared input
  * and returns the full updated resource.
  *
- * Visibility transitions trigger FGA tuple management in Cloud mode:
- * - PRIVATE → PUBLIC: creates resource#viewer@identity_account:* tuple
- * - PUBLIC → PRIVATE: deletes the wildcard viewer tuple
- * - PRIVATE → ORG: creates resource#viewer@organization:<org>#member tuple
- * - ORG → PRIVATE: deletes the org member viewer tuple
- * - ORG → PUBLIC: deletes org tuple, creates wildcard tuple
- * - PUBLIC → ORG: deletes wildcard tuple, creates org tuple
+ * Visibility transitions trigger FGA tuple management in Cloud mode. Each
+ * level maps to exactly one tuple shape; on a transition the tuple for the
+ * old level is removed and the tuple for the new level is created:
+ * - PRIVATE:  no visibility tuple (owner + explicit grants only)
+ * - ORG:      resource#viewer@organization:<org>#member
+ * - PUBLIC:   resource#viewer@identity_account:* (gated by allow_public)
+ * - PLATFORM: resource#platform_viewer@identity_provider:<idp>#platform_user
  *
- * Not all resources support all visibility levels:
- * - Blueprints (agent, workflow, skill, mcp_server): PRIVATE or PUBLIC only
- * - Instances (agent_instance, workflow_instance): PRIVATE, ORG, or PUBLIC
+ * Not all resources support all visibility levels — the supported set is
+ * declared per kind via VisibilityConfig in kind_meta:
+ * - Blueprints (agent, workflow, skill, mcp_server):
+ *     PRIVATE, ORG, PUBLIC, or PLATFORM
+ * - Instances (agent_instance, workflow_instance):
+ *     PRIVATE, ORG, or PUBLIC (never PLATFORM — tenant isolation)
+ *
+ * System-managed DEFAULT instances reject visibility updates entirely:
+ * their access structurally tracks the parent blueprint via the
+ * default_of FGA relation.
  *
  * @generated from message ai.stigmer.commons.apiresource.UpdateVisibilityInput
  */
@@ -150,9 +157,8 @@ export type UpdateVisibilityInput = Message<"ai.stigmer.commons.apiresource.Upda
     resourceId: string;
     /**
      * The new visibility setting for the resource.
-     * Must not be unspecified (0). Valid values depend on resource kind:
-     * - Blueprints: visibility_private (1) or visibility_public (2)
-     * - Instances: visibility_private (1), visibility_public (2), or visibility_org (3)
+     * Must not be unspecified (0). Valid values depend on resource kind —
+     * see the VisibilityConfig in the kind's kind_meta.
      *
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceVisibility visibility = 2;
      */

package/ai/stigmer/commons/apiresource/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uHAAuH;AACvH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,qEAAqE,EAAE,MAAM,2CAA2C,CAAC;AAElI,OAAO,EAAE,wCAAwC,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,EAAE,sCAAsC,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,qoCAAqoC,EAAE,CAAC,qEAAqE,EAAE,wCAAwC,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAcz0C;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AA+BzD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AAuBzD;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AA4CzD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AA0CzD;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AAkEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uHAAuH;AACvH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,qEAAqE,EAAE,MAAM,2CAA2C,CAAC;AAElI,OAAO,EAAE,wCAAwC,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,EAAE,sCAAsC,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,qoCAAqoC,EAAE,CAAC,qEAAqE,EAAE,wCAAwC,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAcz0C;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AA+BzD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AAuBzD;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AA4CzD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AAgDzD;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;AAkEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/io_pb.d.ts

@@ -419,6 +419,49 @@ export type CheckAuthorizationResult = Message<"ai.stigmer.iam.iampolicy.v1.Chec
  * Use `create(CheckAuthorizationResultSchema)` to create a new message.
  */
 export declare const CheckAuthorizationResultSchema: GenMessage<CheckAuthorizationResult>;
+/**
+ * CheckMyPermissionInput defines input for checking whether the AUTHENTICATED
+ * CALLER has a permission on a resource.
+ *
+ * Unlike CheckAuthorizationInput, there is deliberately NO principal field:
+ * the principal is always derived server-side from the authenticated token —
+ * the only trustworthy source of caller identity. Clients cannot probe another
+ * user's permissions because the API gives them no way to name a principal.
+ *
+ * This mirrors the industry-standard self-check pattern (e.g. Kubernetes
+ * SelfSubjectAccessReview): self checks and cross-principal checks are
+ * separate API surfaces with separate trust models.
+ *
+ * @generated from message ai.stigmer.iam.iampolicy.v1.CheckMyPermissionInput
+ */
+export type CheckMyPermissionInput = Message<"ai.stigmer.iam.iampolicy.v1.CheckMyPermissionInput"> & {
+    /**
+     * The resource being accessed (WHAT)
+     *
+     * @generated from field: ai.stigmer.iam.iampolicy.v1.ApiResourceRef resource = 1;
+     */
+    resource?: ApiResourceRef;
+    /**
+     * The permission to check (e.g., "can_edit", "can_grant_access").
+     *
+     * @internal
+     * This is the FGA relation checked against the resource object.
+     *
+     * @generated from field: string relation = 2;
+     */
+    relation: string;
+    /**
+     * Optional contextual policies for "what-if" scenarios
+     *
+     * @generated from field: repeated ai.stigmer.iam.iampolicy.v1.IamPolicySpec contextual_policies = 3;
+     */
+    contextualPolicies: IamPolicySpec[];
+};
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.CheckMyPermissionInput.
+ * Use `create(CheckMyPermissionInputSchema)` to create a new message.
+ */
+export declare const CheckMyPermissionInputSchema: GenMessage<CheckMyPermissionInput>;
 /**
  * ListAuthorizedResourceIdsInput defines input for listing resources a principal can access.
  *

package/ai/stigmer/iam/iampolicy/v1/io_pb.js

@@ -8,7 +8,7 @@ import { file_buf_validate_validate } from "../../../../../buf/validate/validate
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/io.proto.
  */
-export const file_ai_stigmer_iam_iampolicy_v1_io = /*@__PURE__*/ fileDesc("CiRhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MSL9AQoSQXBpUmVzb3VyY2VSZWZWaWV3EgwKBGtpbmQYASABKAkSCgoCaWQYAiABKAkSEAoIcmVsYXRpb24YAyABKAkSDAoEbmFtZRgEIAEoCRINCgVlbWFpbBgFIAEoCRIMCgRzbHVnGAYgASgJEg4KBmF2YXRhchgHIAEoCRJACgdtZW1iZXJzGAggAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldxI+CgV0ZWFtcxgJIAMoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXciJAoLSWFtUG9saWN5SWQSFQoFdmFsdWUYASABKAlCBrpIA8gBASKnAQoWUHJpbmNpcGFsUmVzb3VyY2VJbnB1dBJGCglwcmluY2lwYWwYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARJFCghyZXNvdXJjZRgCIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBIqkBChdSZXNvdXJjZVByaW5jaXBhbHNJbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkcKCnByaW5jaXBhbHMYAiADKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBASJkChRSZXZva2VPcmdBY2Nlc3NJbnB1dBInChNpZGVudGl0eV9hY2NvdW50X2lkGAEgASgJQgq6SAfIAQFyAhABEiMKD29yZ2FuaXphdGlvbl9pZBgCIAEoCUIKukgHyAEBcgIQASJKCg9JYW1Qb2xpY2llc0xpc3QSNwoHZW50cmllcxgBIAMoCzImLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3kiewoXTGlzdFJlc291cmNlQWNjZXNzSW5wdXQSRQoIcmVzb3VyY2UYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIZChFpbmNsdWRlX2luaGVyaXRlZBgCIAEoCCJeCh1SZXNvdXJjZUFjY2Vzc0J5UHJpbmNpcGFsTGlzdBI9CgdlbnRyaWVzGAEgAygLMiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbEFjY2VzcyKMAQoPUHJpbmNpcGFsQWNjZXNzEkIKCXByaW5jaXBhbBgBIAEoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXcSNQoFcm9sZXMYAiADKAsyJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUdyYW50IpsBCglSb2xlR3JhbnQSMwoEcm9sZRgBIAEoCzIlLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlSW5mbxJDCg5vd25lcl9yZXNvdXJjZRgCIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhIUCgxpc19pbmhlcml0ZWQYAyABKAgiVAoYUmVzb3VyY2VBY2Nlc3NCeVJvbGVMaXN0EjgKB2VudHJpZXMYASADKAsyJy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUFjY2VzcyKHAQoKUm9sZUFjY2VzcxI0CgRyb2xlGAEgASgLMiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJvbGVHcmFudBJDCgpwcmluY2lwYWxzGAIgAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldyJHCghSb2xlSW5mbxIKCgJpZBgBIAEoCRIMCgRjb2RlGAIgASgJEgwKBG5hbWUYAyABKAkSEwoLZGVzY3JpcHRpb24YBCABKAkiTgoWUHJpbmNpcGFsUmVzb3VyY2VSb2xlcxI0CgVyb2xlcxgBIAMoCzIlLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlSW5mbyKmAQoXQ2hlY2tBdXRob3JpemF0aW9uSW5wdXQSQgoGcG9saWN5GAEgASgLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWNCBrpIA8gBARJHChNjb250ZXh0dWFsX3BvbGljaWVzGAIgAygLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMiMQoYQ2hlY2tBdXRob3JpemF0aW9uUmVzdWx0EhUKDWlzX2F1dGhvcml6ZWQYASABKAgi8gEKHkxpc3RBdXRob3JpemVkUmVzb3VyY2VJZHNJbnB1dBJGCglwcmluY2lwYWwYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIhCg1yZXNvdXJjZV9raW5kGAIgASgJQgq6SAfIAQFyAhABEhwKCHJlbGF0aW9uGAMgASgJQgq6SAfIAQFyAhABEkcKE2NvbnRleHR1YWxfcG9saWNpZXMYBCADKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYyIxChlBdXRob3JpemVkUmVzb3VyY2VJZHNMaXN0EhQKDHJlc291cmNlX2lkcxgBIAMoCSLzAQofTGlzdEF1dGhvcml6ZWRQcmluY2lwYWxJZHNJbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEiIKDnByaW5jaXBhbF9raW5kGAIgASgJQgq6SAfIAQFyAhABEhwKCHJlbGF0aW9uGAMgASgJQgq6SAfIAQFyAhABEkcKE2NvbnRleHR1YWxfcG9saWNpZXMYBCADKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYyIzChpBdXRob3JpemVkUHJpbmNpcGFsSWRzTGlzdBIVCg1wcmluY2lwYWxfaWRzGAEgAygJIlkKF0dldFByaW5jaXBhbHNDb3VudElucHV0EhoKBm9yZ19pZBgBIAEoCUIKukgHyAEBcgIQARIiCg5wcmluY2lwYWxfa2luZBgCIAEoCUIKukgHyAEBcgIQASIgCg9QcmluY2lwYWxzQ291bnQSDQoFY291bnQYASABKAViBnByb3RvMw", [file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_spec, file_buf_validate_validate]);
+export const file_ai_stigmer_iam_iampolicy_v1_io = /*@__PURE__*/ fileDesc("CiRhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MSL9AQoSQXBpUmVzb3VyY2VSZWZWaWV3EgwKBGtpbmQYASABKAkSCgoCaWQYAiABKAkSEAoIcmVsYXRpb24YAyABKAkSDAoEbmFtZRgEIAEoCRINCgVlbWFpbBgFIAEoCRIMCgRzbHVnGAYgASgJEg4KBmF2YXRhchgHIAEoCRJACgdtZW1iZXJzGAggAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldxI+CgV0ZWFtcxgJIAMoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXciJAoLSWFtUG9saWN5SWQSFQoFdmFsdWUYASABKAlCBrpIA8gBASKnAQoWUHJpbmNpcGFsUmVzb3VyY2VJbnB1dBJGCglwcmluY2lwYWwYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARJFCghyZXNvdXJjZRgCIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBIqkBChdSZXNvdXJjZVByaW5jaXBhbHNJbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkcKCnByaW5jaXBhbHMYAiADKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBASJkChRSZXZva2VPcmdBY2Nlc3NJbnB1dBInChNpZGVudGl0eV9hY2NvdW50X2lkGAEgASgJQgq6SAfIAQFyAhABEiMKD29yZ2FuaXphdGlvbl9pZBgCIAEoCUIKukgHyAEBcgIQASJKCg9JYW1Qb2xpY2llc0xpc3QSNwoHZW50cmllcxgBIAMoCzImLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3kiewoXTGlzdFJlc291cmNlQWNjZXNzSW5wdXQSRQoIcmVzb3VyY2UYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIZChFpbmNsdWRlX2luaGVyaXRlZBgCIAEoCCJeCh1SZXNvdXJjZUFjY2Vzc0J5UHJpbmNpcGFsTGlzdBI9CgdlbnRyaWVzGAEgAygLMiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbEFjY2VzcyKMAQoPUHJpbmNpcGFsQWNjZXNzEkIKCXByaW5jaXBhbBgBIAEoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXcSNQoFcm9sZXMYAiADKAsyJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUdyYW50IpsBCglSb2xlR3JhbnQSMwoEcm9sZRgBIAEoCzIlLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlSW5mbxJDCg5vd25lcl9yZXNvdXJjZRgCIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhIUCgxpc19pbmhlcml0ZWQYAyABKAgiVAoYUmVzb3VyY2VBY2Nlc3NCeVJvbGVMaXN0EjgKB2VudHJpZXMYASADKAsyJy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUFjY2VzcyKHAQoKUm9sZUFjY2VzcxI0CgRyb2xlGAEgASgLMiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJvbGVHcmFudBJDCgpwcmluY2lwYWxzGAIgAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldyJHCghSb2xlSW5mbxIKCgJpZBgBIAEoCRIMCgRjb2RlGAIgASgJEgwKBG5hbWUYAyABKAkSEwoLZGVzY3JpcHRpb24YBCABKAkiTgoWUHJpbmNpcGFsUmVzb3VyY2VSb2xlcxI0CgVyb2xlcxgBIAMoCzIlLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlSW5mbyKmAQoXQ2hlY2tBdXRob3JpemF0aW9uSW5wdXQSQgoGcG9saWN5GAEgASgLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWNCBrpIA8gBARJHChNjb250ZXh0dWFsX3BvbGljaWVzGAIgAygLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMiMQoYQ2hlY2tBdXRob3JpemF0aW9uUmVzdWx0EhUKDWlzX2F1dGhvcml6ZWQYASABKAgiyAEKFkNoZWNrTXlQZXJtaXNzaW9uSW5wdXQSRQoIcmVzb3VyY2UYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIeCghyZWxhdGlvbhgCIAEoCUIMukgJyAEBcgQQARhAEkcKE2NvbnRleHR1YWxfcG9saWNpZXMYAyADKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYyLyAQoeTGlzdEF1dGhvcml6ZWRSZXNvdXJjZUlkc0lucHV0EkYKCXByaW5jaXBhbBgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEiEKDXJlc291cmNlX2tpbmQYAiABKAlCCrpIB8gBAXICEAESHAoIcmVsYXRpb24YAyABKAlCCrpIB8gBAXICEAESRwoTY29udGV4dHVhbF9wb2xpY2llcxgEIAMoCzIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjIjEKGUF1dGhvcml6ZWRSZXNvdXJjZUlkc0xpc3QSFAoMcmVzb3VyY2VfaWRzGAEgAygJIvMBCh9MaXN0QXV0aG9yaXplZFByaW5jaXBhbElkc0lucHV0EkUKCHJlc291cmNlGAEgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESIgoOcHJpbmNpcGFsX2tpbmQYAiABKAlCCrpIB8gBAXICEAESHAoIcmVsYXRpb24YAyABKAlCCrpIB8gBAXICEAESRwoTY29udGV4dHVhbF9wb2xpY2llcxgEIAMoCzIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjIjMKGkF1dGhvcml6ZWRQcmluY2lwYWxJZHNMaXN0EhUKDXByaW5jaXBhbF9pZHMYASADKAkiWQoXR2V0UHJpbmNpcGFsc0NvdW50SW5wdXQSGgoGb3JnX2lkGAEgASgJQgq6SAfIAQFyAhABEiIKDnByaW5jaXBhbF9raW5kGAIgASgJQgq6SAfIAQFyAhABIiAKD1ByaW5jaXBhbHNDb3VudBINCgVjb3VudBgBIAEoBWIGcHJvdG8z", [file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_spec, file_buf_validate_validate]);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.ApiResourceRefView.
  * Use `create(ApiResourceRefViewSchema)` to create a new message.
@@ -89,34 +89,39 @@ export const CheckAuthorizationInputSchema = /*@__PURE__*/ messageDesc(file_ai_s
  * Use `create(CheckAuthorizationResultSchema)` to create a new message.
  */
 export const CheckAuthorizationResultSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 15);
+/**
+ * Describes the message ai.stigmer.iam.iampolicy.v1.CheckMyPermissionInput.
+ * Use `create(CheckMyPermissionInputSchema)` to create a new message.
+ */
+export const CheckMyPermissionInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 16);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.ListAuthorizedResourceIdsInput.
  * Use `create(ListAuthorizedResourceIdsInputSchema)` to create a new message.
  */
-export const ListAuthorizedResourceIdsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 16);
+export const ListAuthorizedResourceIdsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 17);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.AuthorizedResourceIdsList.
  * Use `create(AuthorizedResourceIdsListSchema)` to create a new message.
  */
-export const AuthorizedResourceIdsListSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 17);
+export const AuthorizedResourceIdsListSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 18);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.ListAuthorizedPrincipalIdsInput.
  * Use `create(ListAuthorizedPrincipalIdsInputSchema)` to create a new message.
  */
-export const ListAuthorizedPrincipalIdsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 18);
+export const ListAuthorizedPrincipalIdsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 19);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.AuthorizedPrincipalIdsList.
  * Use `create(AuthorizedPrincipalIdsListSchema)` to create a new message.
  */
-export const AuthorizedPrincipalIdsListSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 19);
+export const AuthorizedPrincipalIdsListSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 20);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.GetPrincipalsCountInput.
  * Use `create(GetPrincipalsCountInputSchema)` to create a new message.
  */
-export const GetPrincipalsCountInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 20);
+export const GetPrincipalsCountInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 21);
 /**
  * Describes the message ai.stigmer.iam.iampolicy.v1.PrincipalsCount.
  * Use `create(PrincipalsCountSchema)` to create a new message.
  */
-export const PrincipalsCountSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 21);
+export const PrincipalsCountSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_iampolicy_v1_io, 22);
 //# sourceMappingURL=io_pb.js.map

package/ai/stigmer/iam/iampolicy/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,wjHAAwjH,EAAE,CAAC,oCAAoC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA2EhrH;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAgBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAgBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA8BtD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAyB,aAAa,CAC/D,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,s0HAAs0H,EAAE,CAAC,oCAAoC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA2E97H;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAgBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAgBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA8BtD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAyB,aAAa,CAC/D,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AA2CvD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAqCvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAuBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;AAgBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/query_connect.d.ts

@@ -22,6 +22,37 @@ export declare const IamPolicyQueryController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Check whether the AUTHENTICATED CALLER has a permission on a resource.
+         *
+         * This is the self-check RPC for clients (web console, desktop, SDKs):
+         * "Do I have permission Y on resource Z?"
+         *
+         * The principal is always derived server-side from the authenticated token.
+         * The input has no principal field by design — clients cannot name a
+         * principal, so cross-principal permission probing is structurally
+         * impossible (the Kubernetes SelfSubjectAccessReview pattern).
+         *
+         * Use Cases:
+         * - Pre-flight UI checks before showing buttons/actions
+         * - Permission-gated rendering (PermissionGate components)
+         *
+         * Input: CheckMyPermissionInput with resource, relation, and optional contextual policies
+         * Output: CheckAuthorizationResult with is_authorized boolean
+         *
+         * @internal
+         * Skips standard authorization because authorizing this RPC via IAM would
+         * recurse into IAM. Authentication is still required; the handler anchors
+         * the FGA check to the caller's identity account.
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkMyPermission
+         */
+        readonly checkMyPermission: {
+            readonly name: "checkMyPermission";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
         /**
          * Check if a principal is authorized to perform a relation on a resource
          *
@@ -31,8 +62,11 @@ export declare const IamPolicyQueryController: {
          * It provides a simple boolean answer based on the complete authorization state,
          * including existing IAM policies, inherited permissions, and group memberships.
          *
+         * This RPC is an INTERNAL-FACING contract for the platform's own
+         * authorization pipeline (service-to-service and in-process checks).
+         * Client-facing self checks must use checkMyPermission instead.
+         *
          * Use Cases:
-         * - Pre-flight UI checks before showing buttons/actions
          * - API request authorization before processing operations
          * - Service-to-service authorization
          * - Team-based access checks
@@ -40,6 +74,11 @@ export declare const IamPolicyQueryController: {
          * Input: CheckAuthorizationInput with policy spec and optional contextual policies
          * Output: CheckAuthorizationResult with is_authorized boolean
          *
+         * @internal
+         * Skips standard authorization to avoid IAM-authorizing-IAM recursion.
+         * The handler enforces principal trust instead: the caller must either BE
+         * the principal being checked, or be a machine (system) account.
+         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkAuthorization
          */
         readonly checkAuthorization: {

package/ai/stigmer/iam/iampolicy/v1/query_connect.js

@@ -2,7 +2,7 @@
 // @generated from file ai/stigmer/iam/iampolicy/v1/query.proto (package ai.stigmer.iam.iampolicy.v1, syntax proto3)
 /* eslint-disable */
 // @ts-nocheck
-import { AuthorizedPrincipalIdsList, AuthorizedResourceIdsList, CheckAuthorizationInput, CheckAuthorizationResult, GetPrincipalsCountInput, IamPolicyId, ListAuthorizedPrincipalIdsInput, ListAuthorizedResourceIdsInput, ListResourceAccessInput, PrincipalResourceInput, PrincipalResourceRoles, PrincipalsCount, ResourceAccessByPrincipalList } from "./io_pbjs";
+import { AuthorizedPrincipalIdsList, AuthorizedResourceIdsList, CheckAuthorizationInput, CheckAuthorizationResult, CheckMyPermissionInput, GetPrincipalsCountInput, IamPolicyId, ListAuthorizedPrincipalIdsInput, ListAuthorizedResourceIdsInput, ListResourceAccessInput, PrincipalResourceInput, PrincipalResourceRoles, PrincipalsCount, ResourceAccessByPrincipalList } from "./io_pbjs";
 import { IamPolicy } from "./api_pbjs";
 import { MethodKind } from "@bufbuild/protobuf";
 /**
@@ -29,6 +29,37 @@ export const IamPolicyQueryController = {
             O: IamPolicy,
             kind: MethodKind.Unary,
         },
+        /**
+         * Check whether the AUTHENTICATED CALLER has a permission on a resource.
+         *
+         * This is the self-check RPC for clients (web console, desktop, SDKs):
+         * "Do I have permission Y on resource Z?"
+         *
+         * The principal is always derived server-side from the authenticated token.
+         * The input has no principal field by design — clients cannot name a
+         * principal, so cross-principal permission probing is structurally
+         * impossible (the Kubernetes SelfSubjectAccessReview pattern).
+         *
+         * Use Cases:
+         * - Pre-flight UI checks before showing buttons/actions
+         * - Permission-gated rendering (PermissionGate components)
+         *
+         * Input: CheckMyPermissionInput with resource, relation, and optional contextual policies
+         * Output: CheckAuthorizationResult with is_authorized boolean
+         *
+         * @internal
+         * Skips standard authorization because authorizing this RPC via IAM would
+         * recurse into IAM. Authentication is still required; the handler anchors
+         * the FGA check to the caller's identity account.
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkMyPermission
+         */
+        checkMyPermission: {
+            name: "checkMyPermission",
+            I: CheckMyPermissionInput,
+            O: CheckAuthorizationResult,
+            kind: MethodKind.Unary,
+        },
         /**
          * Check if a principal is authorized to perform a relation on a resource
          *
@@ -38,8 +69,11 @@ export const IamPolicyQueryController = {
          * It provides a simple boolean answer based on the complete authorization state,
          * including existing IAM policies, inherited permissions, and group memberships.
          *
+         * This RPC is an INTERNAL-FACING contract for the platform's own
+         * authorization pipeline (service-to-service and in-process checks).
+         * Client-facing self checks must use checkMyPermission instead.
+         *
          * Use Cases:
-         * - Pre-flight UI checks before showing buttons/actions
          * - API request authorization before processing operations
          * - Service-to-service authorization
          * - Team-based access checks
@@ -47,6 +81,11 @@ export const IamPolicyQueryController = {
          * Input: CheckAuthorizationInput with policy spec and optional contextual policies
          * Output: CheckAuthorizationResult with is_authorized boolean
          *
+         * @internal
+         * Skips standard authorization to avoid IAM-authorizing-IAM recursion.
+         * The handler enforces principal trust instead: the caller must either BE
+         * the principal being checked, or be a machine (system) account.
+         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkAuthorization
          */
         checkAuthorization: {

package/ai/stigmer/iam/iampolicy/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,WAAW,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AACrW,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE;QACP;;;;;;;;;WASG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,wBAAwB;YAC3B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,0BAA0B,EAAE;YAC1B,IAAI,EAAE,4BAA4B;YAClC,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,6BAA6B,EAAE;YAC7B,IAAI,EAAE,+BAA+B;YACrC,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,6BAA6B;YAChC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,WAAW,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAC7X,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE;QACP;;;;;;;;;WASG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,wBAAwB;YAC3B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,wBAAwB;YAC3B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,0BAA0B,EAAE;YAC1B,IAAI,EAAE,4BAA4B;YAClC,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,6BAA6B,EAAE;YAC7B,IAAI,EAAE,+BAA+B;YACrC,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,6BAA6B;YAChC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/query_pb.d.ts

@@ -1,6 +1,6 @@
 import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
 import type { IamPolicySchema } from "./api_pb.js";
-import type { AuthorizedPrincipalIdsListSchema, AuthorizedResourceIdsListSchema, CheckAuthorizationInputSchema, CheckAuthorizationResultSchema, GetPrincipalsCountInputSchema, IamPolicyIdSchema, ListAuthorizedPrincipalIdsInputSchema, ListAuthorizedResourceIdsInputSchema, ListResourceAccessInputSchema, PrincipalResourceInputSchema, PrincipalResourceRolesSchema, PrincipalsCountSchema, ResourceAccessByPrincipalListSchema } from "./io_pb.js";
+import type { AuthorizedPrincipalIdsListSchema, AuthorizedResourceIdsListSchema, CheckAuthorizationInputSchema, CheckAuthorizationResultSchema, CheckMyPermissionInputSchema, GetPrincipalsCountInputSchema, IamPolicyIdSchema, ListAuthorizedPrincipalIdsInputSchema, ListAuthorizedResourceIdsInputSchema, ListResourceAccessInputSchema, PrincipalResourceInputSchema, PrincipalResourceRolesSchema, PrincipalsCountSchema, ResourceAccessByPrincipalListSchema } from "./io_pb.js";
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/query.proto.
  */
@@ -26,6 +26,36 @@ export declare const IamPolicyQueryController: GenService<{
         input: typeof IamPolicyIdSchema;
         output: typeof IamPolicySchema;
     };
+    /**
+     * Check whether the AUTHENTICATED CALLER has a permission on a resource.
+     *
+     * This is the self-check RPC for clients (web console, desktop, SDKs):
+     * "Do I have permission Y on resource Z?"
+     *
+     * The principal is always derived server-side from the authenticated token.
+     * The input has no principal field by design — clients cannot name a
+     * principal, so cross-principal permission probing is structurally
+     * impossible (the Kubernetes SelfSubjectAccessReview pattern).
+     *
+     * Use Cases:
+     * - Pre-flight UI checks before showing buttons/actions
+     * - Permission-gated rendering (PermissionGate components)
+     *
+     * Input: CheckMyPermissionInput with resource, relation, and optional contextual policies
+     * Output: CheckAuthorizationResult with is_authorized boolean
+     *
+     * @internal
+     * Skips standard authorization because authorizing this RPC via IAM would
+     * recurse into IAM. Authentication is still required; the handler anchors
+     * the FGA check to the caller's identity account.
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkMyPermission
+     */
+    checkMyPermission: {
+        methodKind: "unary";
+        input: typeof CheckMyPermissionInputSchema;
+        output: typeof CheckAuthorizationResultSchema;
+    };
     /**
      * Check if a principal is authorized to perform a relation on a resource
      *
@@ -35,8 +65,11 @@ export declare const IamPolicyQueryController: GenService<{
      * It provides a simple boolean answer based on the complete authorization state,
      * including existing IAM policies, inherited permissions, and group memberships.
      *
+     * This RPC is an INTERNAL-FACING contract for the platform's own
+     * authorization pipeline (service-to-service and in-process checks).
+     * Client-facing self checks must use checkMyPermission instead.
+     *
      * Use Cases:
-     * - Pre-flight UI checks before showing buttons/actions
      * - API request authorization before processing operations
      * - Service-to-service authorization
      * - Team-based access checks
@@ -44,6 +77,11 @@ export declare const IamPolicyQueryController: GenService<{
      * Input: CheckAuthorizationInput with policy spec and optional contextual policies
      * Output: CheckAuthorizationResult with is_authorized boolean
      *
+     * @internal
+     * Skips standard authorization to avoid IAM-authorizing-IAM recursion.
+     * The handler enforces principal trust instead: the caller must either BE
+     * the principal being checked, or be a machine (system) account.
+     *
      * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyQueryController.checkAuthorization
      */
     checkAuthorization: {

package/ai/stigmer/iam/iampolicy/v1/query_pb.js

@@ -9,7 +9,7 @@ import { file_ai_stigmer_iam_iampolicy_v1_io } from "./io_pb.js";
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/query.proto.
  */
-export const file_ai_stigmer_iam_iampolicy_v1_query = /*@__PURE__*/ fileDesc("CidhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MTLqCQoYSWFtUG9saWN5UXVlcnlDb250cm9sbGVyEoUBCgNnZXQSKC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5SWQaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IGFjY2VzcyBwb2xpY2llcxKHAQoSY2hlY2tBdXRob3JpemF0aW9uEjQuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkNoZWNrQXV0aG9yaXphdGlvbklucHV0GjUuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkNoZWNrQXV0aG9yaXphdGlvblJlc3VsdCIE0LgYARLGAQoZbGlzdEF1dGhvcml6ZWRSZXNvdXJjZUlkcxI7LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5MaXN0QXV0aG9yaXplZFJlc291cmNlSWRzSW5wdXQaNi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXV0aG9yaXplZFJlc291cmNlSWRzTGlzdCI0wrgYMAgFKix1bmF1dGhvcml6ZWQgdG8gdmlldyBhdXRob3JpemVkIHJlc291cmNlIGlkcxLKAQoabGlzdEF1dGhvcml6ZWRQcmluY2lwYWxJZHMSPC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuTGlzdEF1dGhvcml6ZWRQcmluY2lwYWxJZHNJbnB1dBo3LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BdXRob3JpemVkUHJpbmNpcGFsSWRzTGlzdCI1wrgYMQgFKi11bmF1dGhvcml6ZWQgdG8gdmlldyBhdXRob3JpemVkIHByaW5jaXBhbCBpZHMSvwEKHWxpc3RSZXNvdXJjZUFjY2Vzc0J5UHJpbmNpcGFsEjQuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkxpc3RSZXNvdXJjZUFjY2Vzc0lucHV0GjouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJlc291cmNlQWNjZXNzQnlQcmluY2lwYWxMaXN0IizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IHJlc291cmNlIGFjY2VzcxKzAQoZZ2V0UHJpbmNpcGFsUmVzb3VyY2VSb2xlcxIzLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5QcmluY2lwYWxSZXNvdXJjZUlucHV0GjMuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbFJlc291cmNlUm9sZXMiLMK4GCgIBSokdW5hdXRob3JpemVkIHRvIHZpZXcgcHJpbmNpcGFsIHJvbGVzEqcBChJnZXRQcmluY2lwYWxzQ291bnQSNC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuR2V0UHJpbmNpcGFsc0NvdW50SW5wdXQaLC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUHJpbmNpcGFsc0NvdW50Ii3CuBgpCAUqJXVuYXV0aG9yaXplZCB0byB2aWV3IHByaW5jaXBhbHMgY291bnQaBKD/KwpiBnByb3RvMw", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io]);
+export const file_ai_stigmer_iam_iampolicy_v1_query = /*@__PURE__*/ fileDesc("CidhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MTLyCgoYSWFtUG9saWN5UXVlcnlDb250cm9sbGVyEoUBCgNnZXQSKC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5SWQaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IGFjY2VzcyBwb2xpY2llcxKFAQoRY2hlY2tNeVBlcm1pc3Npb24SMy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQ2hlY2tNeVBlcm1pc3Npb25JbnB1dBo1LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25SZXN1bHQiBNC4GAEShwEKEmNoZWNrQXV0aG9yaXphdGlvbhI0LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25JbnB1dBo1LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25SZXN1bHQiBNC4GAESxgEKGWxpc3RBdXRob3JpemVkUmVzb3VyY2VJZHMSOy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuTGlzdEF1dGhvcml6ZWRSZXNvdXJjZUlkc0lucHV0GjYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkF1dGhvcml6ZWRSZXNvdXJjZUlkc0xpc3QiNMK4GDAIBSosdW5hdXRob3JpemVkIHRvIHZpZXcgYXV0aG9yaXplZCByZXNvdXJjZSBpZHMSygEKGmxpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzEjwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkxpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzSW5wdXQaNy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXV0aG9yaXplZFByaW5jaXBhbElkc0xpc3QiNcK4GDEIBSotdW5hdXRob3JpemVkIHRvIHZpZXcgYXV0aG9yaXplZCBwcmluY2lwYWwgaWRzEr8BCh1saXN0UmVzb3VyY2VBY2Nlc3NCeVByaW5jaXBhbBI0LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5MaXN0UmVzb3VyY2VBY2Nlc3NJbnB1dBo6LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5SZXNvdXJjZUFjY2Vzc0J5UHJpbmNpcGFsTGlzdCIswrgYKAgFKiR1bmF1dGhvcml6ZWQgdG8gdmlldyByZXNvdXJjZSBhY2Nlc3MSswEKGWdldFByaW5jaXBhbFJlc291cmNlUm9sZXMSMy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUHJpbmNpcGFsUmVzb3VyY2VJbnB1dBozLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5QcmluY2lwYWxSZXNvdXJjZVJvbGVzIizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IHByaW5jaXBhbCByb2xlcxKnAQoSZ2V0UHJpbmNpcGFsc0NvdW50EjQuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkdldFByaW5jaXBhbHNDb3VudElucHV0GiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbHNDb3VudCItwrgYKQgFKiV1bmF1dGhvcml6ZWQgdG8gdmlldyBwcmluY2lwYWxzIGNvdW50GgSg/ysKYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io]);
 /**
  * IamPolicyQueryController handles read operations for IAM policies.
  *

package/ai/stigmer/iam/iampolicy/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,4vDAA4vD,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,CAAC,CAAC,CAAC;AAE37D;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAkJhC,aAAa,CAChB,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,i7DAAi7D,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,CAAC,CAAC,CAAC;AAEhnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAwLhC,aAAa,CAChB,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/protos",
-  "version": "3.0.4",
+  "version": "3.0.6",
   "description": "Generated TypeScript protobuf stubs for Stigmer APIs",
   "license": "Apache-2.0",
   "type": "module",