@stigmer/protos 3.1.12 → 3.1.14

package/ai/stigmer/agentic/agentchannel/v1/query_connect.js

@@ -0,0 +1,83 @@
+// @generated by protoc-gen-connect-es v1.6.1 with parameter "target=ts,import_extension=js"
+// @generated from file ai/stigmer/agentic/agentchannel/v1/query.proto (package ai.stigmer.agentic.agentchannel.v1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+import { AgentChannelId, AgentChannelList, GetAgentChannelsByAgentRequest, ListAgentChannelsRequest } from "./io_pbjs";
+import { AgentChannel } from "./api_pbjs";
+import { MethodKind } from "@bufbuild/protobuf";
+import { ApiResourceReference } from "../../../commons/apiresource/io_pbjs";
+/**
+ * AgentChannelQueryController handles read operations for agent channels.
+ *
+ * @internal
+ * Deliberately no anonymous/public RPC (AgentShare's getSharedProfile has
+ * no analog here): the channel's public surface is the provider webhook,
+ * which authenticates by signature — never a query endpoint.
+ *
+ * @generated from service ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController
+ */
+export const AgentChannelQueryController = {
+    typeName: "ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController",
+    methods: {
+        /**
+         * Get a single agent channel by ID.
+         *
+         * @generated from rpc ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController.get
+         */
+        get: {
+            name: "get",
+            I: AgentChannelId,
+            O: AgentChannel,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * Get an agent channel by its organization-scoped reference (org/slug).
+         *
+         * @internal
+         * Custom authorization in handler — checks both direct resource access
+         * and organization-level visibility permissions (AgentShare pattern).
+         *
+         * @generated from rpc ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController.getByReference
+         */
+        getByReference: {
+            name: "getByReference",
+            I: ApiResourceReference,
+            O: AgentChannel,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * Get all channels of a specific agent.
+         * Returns only channels the caller has access to.
+         *
+         * This is how the agent's integrations surface and CLI resolve an
+         * agent's existing channels regardless of slug.
+         *
+         * @internal
+         * Authorization in-handler: FGA-filtered in cloud, unrestricted in OSS.
+         *
+         * @generated from rpc ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController.getByAgent
+         */
+        getByAgent: {
+            name: "getByAgent",
+            I: GetAgentChannelsByAgentRequest,
+            O: AgentChannelList,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * List agent channels with optional label filtering.
+         *
+         * @internal
+         * Authorization in-handler via FGA-filtered queries (cloud) or
+         * unrestricted store queries (OSS).
+         *
+         * @generated from rpc ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController.list
+         */
+        list: {
+            name: "list",
+            I: ListAgentChannelsRequest,
+            O: AgentChannelList,
+            kind: MethodKind.Unary,
+        },
+    }
+};
+//# sourceMappingURL=query_connect.js.map

package/ai/stigmer/agentic/agentchannel/v1/query_connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentchannel/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,kIAAkI;AAClI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AACvH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,YAAY;YACf,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,YAAY;YACf,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,YAAY;YAClB,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/agentchannel/v1/query_pb.d.ts

@@ -0,0 +1,75 @@
+import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
+import type { AgentChannelSchema } from "./api_pb.js";
+import type { AgentChannelIdSchema, AgentChannelListSchema, GetAgentChannelsByAgentRequestSchema, ListAgentChannelsRequestSchema } from "./io_pb.js";
+import type { ApiResourceReferenceSchema } from "../../../commons/apiresource/io_pb.js";
+/**
+ * Describes the file ai/stigmer/agentic/agentchannel/v1/query.proto.
+ */
+export declare const file_ai_stigmer_agentic_agentchannel_v1_query: GenFile;
+/**
+ * AgentChannelQueryController handles read operations for agent channels.
+ *
+ * @internal
+ * Deliberately no anonymous/public RPC (AgentShare's getSharedProfile has
+ * no analog here): the channel's public surface is the provider webhook,
+ * which authenticates by signature — never a query endpoint.
+ *
+ * @generated from service ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController
+ */
+export declare const AgentChannelQueryController: GenService<{
+    /**
+     * Get a single agent channel by ID.
+     *
+     * @generated from rpc ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController.get
+     */
+    get: {
+        methodKind: "unary";
+        input: typeof AgentChannelIdSchema;
+        output: typeof AgentChannelSchema;
+    };
+    /**
+     * Get an agent channel by its organization-scoped reference (org/slug).
+     *
+     * @internal
+     * Custom authorization in handler — checks both direct resource access
+     * and organization-level visibility permissions (AgentShare pattern).
+     *
+     * @generated from rpc ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController.getByReference
+     */
+    getByReference: {
+        methodKind: "unary";
+        input: typeof ApiResourceReferenceSchema;
+        output: typeof AgentChannelSchema;
+    };
+    /**
+     * Get all channels of a specific agent.
+     * Returns only channels the caller has access to.
+     *
+     * This is how the agent's integrations surface and CLI resolve an
+     * agent's existing channels regardless of slug.
+     *
+     * @internal
+     * Authorization in-handler: FGA-filtered in cloud, unrestricted in OSS.
+     *
+     * @generated from rpc ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController.getByAgent
+     */
+    getByAgent: {
+        methodKind: "unary";
+        input: typeof GetAgentChannelsByAgentRequestSchema;
+        output: typeof AgentChannelListSchema;
+    };
+    /**
+     * List agent channels with optional label filtering.
+     *
+     * @internal
+     * Authorization in-handler via FGA-filtered queries (cloud) or
+     * unrestricted store queries (OSS).
+     *
+     * @generated from rpc ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController.list
+     */
+    list: {
+        methodKind: "unary";
+        input: typeof ListAgentChannelsRequestSchema;
+        output: typeof AgentChannelListSchema;
+    };
+}>;

package/ai/stigmer/agentic/agentchannel/v1/query_pb.js

@@ -0,0 +1,25 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts,import_extension=js"
+// @generated from file ai/stigmer/agentic/agentchannel/v1/query.proto (package ai.stigmer.agentic.agentchannel.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_agentic_agentchannel_v1_api } from "./api_pb.js";
+import { file_ai_stigmer_agentic_agentchannel_v1_io } from "./io_pb.js";
+import { file_ai_stigmer_commons_apiresource_io } from "../../../commons/apiresource/io_pb.js";
+import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb.js";
+import { file_ai_stigmer_commons_rpc_method_options } from "../../../commons/rpc/method_options_pb.js";
+/**
+ * Describes the file ai/stigmer/agentic/agentchannel/v1/query.proto.
+ */
+export const file_ai_stigmer_agentic_agentchannel_v1_query = /*@__PURE__*/ fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxMtcEChtBZ2VudENoYW5uZWxRdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQWdlbnRDaGFubmVsSWQaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbCIywrgYLggBEC8iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gZ2V0IGFnZW50IGNoYW5uZWwSfgoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbCIE0LgYARKMAQoKZ2V0QnlBZ2VudBJCLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuR2V0QWdlbnRDaGFubmVsc0J5QWdlbnRSZXF1ZXN0GjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWxMaXN0IgTQuBgBEoABCgRsaXN0EjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5MaXN0QWdlbnRDaGFubmVsc1JlcXVlc3QaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbExpc3QiBNC4GAEaBKD/Ky9iBnByb3RvMw", [file_ai_stigmer_agentic_agentchannel_v1_api, file_ai_stigmer_agentic_agentchannel_v1_io, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options]);
+/**
+ * AgentChannelQueryController handles read operations for agent channels.
+ *
+ * @internal
+ * Deliberately no anonymous/public RPC (AgentShare's getSharedProfile has
+ * no analog here): the channel's public surface is the provider webhook,
+ * which authenticates by signature — never a query endpoint.
+ *
+ * @generated from service ai.stigmer.agentic.agentchannel.v1.AgentChannelQueryController
+ */
+export const AgentChannelQueryController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_query, 0);
+//# sourceMappingURL=query_pb.js.map

package/ai/stigmer/agentic/agentchannel/v1/query_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentchannel/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,0CAA0C,EAAE,MAAM,YAAY,CAAC;AAExE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,g6BAAg6B,EAAE,CAAC,2CAA2C,EAAE,0CAA0C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAErpC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAwDnC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agentchannel/v1/spec_pb.d.ts

@@ -0,0 +1,102 @@
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { ApiResourceReference } from "../../../commons/apiresource/io_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file ai/stigmer/agentic/agentchannel/v1/spec.proto.
+ */
+export declare const file_ai_stigmer_agentic_agentchannel_v1_spec: GenFile;
+/**
+ * AgentChannelSpec defines the configurable properties of an agent channel.
+ *
+ * The spec is deliberately small: which agent serves the channel, whether
+ * serving is enabled, and which provider the channel targets. Workspace
+ * identity and credentials are produced by the install flow and live in
+ * status — a declarative apply can never clobber them.
+ *
+ * @internal
+ * P1: the provider arms carry only genuinely user-declarable fields. For
+ * the multi-tenant Slack app everything concrete (team_id, bot_user_id,
+ * scopes, credentials env) is OAuth-observed → status. Owner-customizable
+ * refusal copy (the AgentShareMessages analog) is deliberately deferred:
+ * platform-default copy lives in the deliverer (decision 006); adding a
+ * messages block later is a non-breaking change.
+ *
+ * @generated from message ai.stigmer.agentic.agentchannel.v1.AgentChannelSpec
+ */
+export type AgentChannelSpec = Message<"ai.stigmer.agentic.agentchannel.v1.AgentChannelSpec"> & {
+    /**
+     * Reference to the agent this channel serves.
+     *
+     * @internal
+     * Invariant (enforced in create/update/apply handlers of both editions,
+     * mirroring AgentShare's Phase A rule): agent_ref.org must equal
+     * metadata.org — the connection-owning org is the billing org and
+     * provider credentials resolve in that org (decision 004; T06 invariant).
+     *
+     * @generated from field: ai.stigmer.commons.apiresource.ApiResourceReference agent_ref = 1;
+     */
+    agentRef?: ApiResourceReference;
+    /**
+     * Whether serving traffic on this channel is enabled.
+     *
+     * Disabling is a config-preserving pause: the connection keeps its
+     * install state and credentials, but inbound events are refused until
+     * re-enabled. Delete the channel instead for a full teardown.
+     *
+     * @internal
+     * Decision 001 D-d. Pause must never drop the install: re-installing a
+     * Slack app to re-auth is painful. The per-turn gate re-reads this live
+     * (decision 003), so disabling takes effect on the next message.
+     *
+     * @generated from field: bool enabled = 2;
+     */
+    enabled: boolean;
+    /**
+     * Provider this channel connects to. Exactly one must be specified.
+     *
+     * @internal
+     * Decision 001: provider variance is config-shaped, not lifecycle-shaped
+     * — one kind, a validated oneof (McpServerSpec.server_type precedent).
+     * Adding WhatsApp (T05) extends this oneof; it touches zero kinds.
+     *
+     * @generated from oneof ai.stigmer.agentic.agentchannel.v1.AgentChannelSpec.provider_config
+     */
+    providerConfig: {
+        /**
+         * Slack workspace connection (multi-tenant Stigmer Slack app).
+         *
+         * @generated from field: ai.stigmer.agentic.agentchannel.v1.SlackChannelConfig slack = 3;
+         */
+        value: SlackChannelConfig;
+        case: "slack";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message ai.stigmer.agentic.agentchannel.v1.AgentChannelSpec.
+ * Use `create(AgentChannelSpecSchema)` to create a new message.
+ */
+export declare const AgentChannelSpecSchema: GenMessage<AgentChannelSpec>;
+/**
+ * SlackChannelConfig selects Slack as the channel provider.
+ *
+ * Empty in v1 by design: with the multi-tenant Stigmer Slack app there is
+ * nothing for the user to declare before installing — workspace identity,
+ * bot user, and granted scopes are observed during the OAuth install and
+ * recorded in status. Future user-tunable Slack behavior lands here.
+ *
+ * @internal
+ * P1. An empty message is set explicitly in manifests (`slack: {}`),
+ * satisfying the required oneof. Do not add OAuth-observed facts here —
+ * that is the spec-clobbering bug class decision 004 rejected.
+ *
+ * @generated from message ai.stigmer.agentic.agentchannel.v1.SlackChannelConfig
+ */
+export type SlackChannelConfig = Message<"ai.stigmer.agentic.agentchannel.v1.SlackChannelConfig"> & {};
+/**
+ * Describes the message ai.stigmer.agentic.agentchannel.v1.SlackChannelConfig.
+ * Use `create(SlackChannelConfigSchema)` to create a new message.
+ */
+export declare const SlackChannelConfigSchema: GenMessage<SlackChannelConfig>;

package/ai/stigmer/agentic/agentchannel/v1/spec_pb.js

@@ -0,0 +1,22 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts,import_extension=js"
+// @generated from file ai/stigmer/agentic/agentchannel/v1/spec.proto (package ai.stigmer.agentic.agentchannel.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_field_options } from "../../../commons/apiresource/field_options_pb.js";
+import { file_ai_stigmer_commons_apiresource_io } from "../../../commons/apiresource/io_pb.js";
+import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb.js";
+/**
+ * Describes the file ai/stigmer/agentic/agentchannel/v1/spec.proto.
+ */
+export const file_ai_stigmer_agentic_agentchannel_v1_spec = /*@__PURE__*/ fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3NwZWMucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEitQIKEEFnZW50Q2hhbm5lbFNwZWMSrAEKCWFnZW50X3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUJjukhcugFWCg5hZ2VudF9yZWYua2luZBIzYWdlbnRfcmVmIG11c3QgcmVmZXJlbmNlIGEgcmVzb3VyY2Ugd2l0aCBraW5kPWFnZW50Gg90aGlzLmtpbmQgPT0gNDDIAQHghSwoEg8KB2VuYWJsZWQYAiABKAgSRwoFc2xhY2sYAyABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLlNsYWNrQ2hhbm5lbENvbmZpZ0gAQhgKD3Byb3ZpZGVyX2NvbmZpZxIFukgCCAEiFAoSU2xhY2tDaGFubmVsQ29uZmlnYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_field_options, file_ai_stigmer_commons_apiresource_io, file_buf_validate_validate]);
+/**
+ * Describes the message ai.stigmer.agentic.agentchannel.v1.AgentChannelSpec.
+ * Use `create(AgentChannelSpecSchema)` to create a new message.
+ */
+export const AgentChannelSpecSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_agentchannel_v1_spec, 0);
+/**
+ * Describes the message ai.stigmer.agentic.agentchannel.v1.SlackChannelConfig.
+ * Use `create(SlackChannelConfigSchema)` to create a new message.
+ */
+export const SlackChannelConfigSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_agentchannel_v1_spec, 1);
+//# sourceMappingURL=spec_pb.js.map

package/ai/stigmer/agentic/agentchannel/v1/spec_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentchannel/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iIAAiI;AACjI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,yjBAAyjB,EAAE,CAAC,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAuE/rB;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAoB/D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agentchannel/v1/status_pb.d.ts

@@ -0,0 +1,174 @@
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { ApiResourceAudit } from "../../../commons/apiresource/status_pb.js";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file ai/stigmer/agentic/agentchannel/v1/status.proto.
+ */
+export declare const file_ai_stigmer_agentic_agentchannel_v1_status: GenFile;
+/**
+ * AgentChannelStatus contains system-managed state for an agent channel.
+ *
+ * @internal
+ * Server-owned per decision 001 D-e / decision 004: install facts and the
+ * credentials reference survive every apply/update verbatim (the
+ * share_link_token precedent), so a routine manifest apply can never
+ * clobber an install or leak a secret. Secrets themselves NEVER appear
+ * here — the bot token lives encrypted in the referenced managed
+ * Environment; status is readable by anyone with can_view.
+ *
+ * @generated from message ai.stigmer.agentic.agentchannel.v1.AgentChannelStatus
+ */
+export type AgentChannelStatus = Message<"ai.stigmer.agentic.agentchannel.v1.AgentChannelStatus"> & {
+    /**
+     * Install lifecycle of the provider connection.
+     *
+     * @generated from field: ai.stigmer.agentic.agentchannel.v1.AgentChannelInstallState install_state = 1;
+     */
+    installState: AgentChannelInstallState;
+    /**
+     * Provider-specific install facts observed during the install flow.
+     *
+     * @internal
+     * Populated by the install completion path (sole writer). The arm always
+     * matches spec.provider_config's case.
+     *
+     * @generated from oneof ai.stigmer.agentic.agentchannel.v1.AgentChannelStatus.provider_status
+     */
+    providerStatus: {
+        /**
+         * Slack workspace install facts.
+         *
+         * @generated from field: ai.stigmer.agentic.agentchannel.v1.SlackInstallStatus slack = 2;
+         */
+        value: SlackInstallStatus;
+        case: "slack";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+    /**
+     * ID of the system-managed Environment holding this connection's
+     * provider credentials (e.g. the Slack bot token).
+     *
+     * @internal
+     * Decision 004: created via ManagedEnvironmentService in the
+     * connection's org (stigmer.ai/managed=true), non-secret grant metadata
+     * in the resource-agnostic OAuthGrant document. The webhook receiver and
+     * delivery worker resolve the token through this reference — never from
+     * the channel resource itself.
+     *
+     * @generated from field: string credentials_environment_id = 3;
+     */
+    credentialsEnvironmentId: string;
+    /**
+     * Standard audit information (created_at, updated_at, created_by, etc.)
+     *
+     * @generated from field: ai.stigmer.commons.apiresource.ApiResourceAudit audit = 99;
+     */
+    audit?: ApiResourceAudit;
+};
+/**
+ * Describes the message ai.stigmer.agentic.agentchannel.v1.AgentChannelStatus.
+ * Use `create(AgentChannelStatusSchema)` to create a new message.
+ */
+export declare const AgentChannelStatusSchema: GenMessage<AgentChannelStatus>;
+/**
+ * SlackInstallStatus holds the facts observed when the Stigmer Slack app
+ * was installed into a workspace.
+ *
+ * @generated from message ai.stigmer.agentic.agentchannel.v1.SlackInstallStatus
+ */
+export type SlackInstallStatus = Message<"ai.stigmer.agentic.agentchannel.v1.SlackInstallStatus"> & {
+    /**
+     * Slack workspace (team) ID, e.g. "T0123ABCD".
+     *
+     * @internal
+     * The inbound routing key: the webhook receiver resolves the
+     * AgentChannel from the event payload's team_id. One INSTALLED channel
+     * per workspace, enforced by a partial-unique index on installed rows
+     * (decision 007).
+     *
+     * @generated from field: string team_id = 1;
+     */
+    teamId: string;
+    /**
+     * Human-readable workspace name at install time.
+     *
+     * @generated from field: string team_name = 2;
+     */
+    teamName: string;
+    /**
+     * Bot user ID minted by the install, e.g. "U0456EFGH".
+     * The identity the agent posts as; also how @mentions are recognized.
+     *
+     * @generated from field: string bot_user_id = 3;
+     */
+    botUserId: string;
+    /**
+     * OAuth scopes granted to the installation.
+     *
+     * @generated from field: repeated string granted_scopes = 4;
+     */
+    grantedScopes: string[];
+    /**
+     * Slack user ID of the person who performed the install.
+     *
+     * @generated from field: string installer_slack_user_id = 5;
+     */
+    installerSlackUserId: string;
+    /**
+     * When the install completed.
+     *
+     * @generated from field: google.protobuf.Timestamp installed_at = 6;
+     */
+    installedAt?: Timestamp;
+};
+/**
+ * Describes the message ai.stigmer.agentic.agentchannel.v1.SlackInstallStatus.
+ * Use `create(SlackInstallStatusSchema)` to create a new message.
+ */
+export declare const SlackInstallStatusSchema: GenMessage<SlackInstallStatus>;
+/**
+ * AgentChannelInstallState tracks the provider install lifecycle.
+ *
+ * This is deliberately distinct from spec.enabled: enabled is the owner's
+ * serving switch; install_state is the observed state of the provider
+ * connection. Traffic is served only when installed AND enabled.
+ *
+ * @generated from enum ai.stigmer.agentic.agentchannel.v1.AgentChannelInstallState
+ */
+export declare enum AgentChannelInstallState {
+    /**
+     * Default value when no state is set.
+     *
+     * @generated from enum value: agent_channel_install_state_unspecified = 0;
+     */
+    agent_channel_install_state_unspecified = 0,
+    /**
+     * The channel exists but the provider install has not completed.
+     * No traffic is served in this state regardless of spec.enabled.
+     *
+     * @generated from enum value: pending_install = 1;
+     */
+    pending_install = 1,
+    /**
+     * The provider install completed; credentials are stored and the
+     * channel serves traffic while spec.enabled is true.
+     *
+     * @generated from enum value: installed = 2;
+     */
+    installed = 2,
+    /**
+     * The provider revoked the installation (e.g. the Slack app was
+     * uninstalled from the workspace or tokens were revoked). The channel
+     * configuration survives; re-installing returns it to installed.
+     *
+     * @generated from enum value: revoked = 3;
+     */
+    revoked = 3
+}
+/**
+ * Describes the enum ai.stigmer.agentic.agentchannel.v1.AgentChannelInstallState.
+ */
+export declare const AgentChannelInstallStateSchema: GenEnum<AgentChannelInstallState>;

package/ai/stigmer/agentic/agentchannel/v1/status_pb.js

@@ -0,0 +1,65 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts,import_extension=js"
+// @generated from file ai/stigmer/agentic/agentchannel/v1/status.proto (package ai.stigmer.agentic.agentchannel.v1, syntax proto3)
+/* eslint-disable */
+import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_status } from "../../../commons/apiresource/status_pb.js";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file ai/stigmer/agentic/agentchannel/v1/status.proto.
+ */
+export const file_ai_stigmer_agentic_agentchannel_v1_status = /*@__PURE__*/ fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3N0YXR1cy5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSKqAgoSQWdlbnRDaGFubmVsU3RhdHVzElMKDWluc3RhbGxfc3RhdGUYASABKA4yPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbEluc3RhbGxTdGF0ZRJHCgVzbGFjaxgCIAEoCzI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuU2xhY2tJbnN0YWxsU3RhdHVzSAASIgoaY3JlZGVudGlhbHNfZW52aXJvbm1lbnRfaWQYAyABKAkSPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdEIRCg9wcm92aWRlcl9zdGF0dXMiuAEKElNsYWNrSW5zdGFsbFN0YXR1cxIPCgd0ZWFtX2lkGAEgASgJEhEKCXRlYW1fbmFtZRgCIAEoCRITCgtib3RfdXNlcl9pZBgDIAEoCRIWCg5ncmFudGVkX3Njb3BlcxgEIAMoCRIfChdpbnN0YWxsZXJfc2xhY2tfdXNlcl9pZBgFIAEoCRIwCgxpbnN0YWxsZWRfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wKngKGEFnZW50Q2hhbm5lbEluc3RhbGxTdGF0ZRIrCidhZ2VudF9jaGFubmVsX2luc3RhbGxfc3RhdGVfdW5zcGVjaWZpZWQQABITCg9wZW5kaW5nX2luc3RhbGwQARINCglpbnN0YWxsZWQQAhILCgdyZXZva2VkEANiBnByb3RvMw", [file_ai_stigmer_commons_apiresource_status, file_google_protobuf_timestamp]);
+/**
+ * Describes the message ai.stigmer.agentic.agentchannel.v1.AgentChannelStatus.
+ * Use `create(AgentChannelStatusSchema)` to create a new message.
+ */
+export const AgentChannelStatusSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_agentchannel_v1_status, 0);
+/**
+ * Describes the message ai.stigmer.agentic.agentchannel.v1.SlackInstallStatus.
+ * Use `create(SlackInstallStatusSchema)` to create a new message.
+ */
+export const SlackInstallStatusSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_agentchannel_v1_status, 1);
+/**
+ * AgentChannelInstallState tracks the provider install lifecycle.
+ *
+ * This is deliberately distinct from spec.enabled: enabled is the owner's
+ * serving switch; install_state is the observed state of the provider
+ * connection. Traffic is served only when installed AND enabled.
+ *
+ * @generated from enum ai.stigmer.agentic.agentchannel.v1.AgentChannelInstallState
+ */
+export var AgentChannelInstallState;
+(function (AgentChannelInstallState) {
+    /**
+     * Default value when no state is set.
+     *
+     * @generated from enum value: agent_channel_install_state_unspecified = 0;
+     */
+    AgentChannelInstallState[AgentChannelInstallState["agent_channel_install_state_unspecified"] = 0] = "agent_channel_install_state_unspecified";
+    /**
+     * The channel exists but the provider install has not completed.
+     * No traffic is served in this state regardless of spec.enabled.
+     *
+     * @generated from enum value: pending_install = 1;
+     */
+    AgentChannelInstallState[AgentChannelInstallState["pending_install"] = 1] = "pending_install";
+    /**
+     * The provider install completed; credentials are stored and the
+     * channel serves traffic while spec.enabled is true.
+     *
+     * @generated from enum value: installed = 2;
+     */
+    AgentChannelInstallState[AgentChannelInstallState["installed"] = 2] = "installed";
+    /**
+     * The provider revoked the installation (e.g. the Slack app was
+     * uninstalled from the workspace or tokens were revoked). The channel
+     * configuration survives; re-installing returns it to installed.
+     *
+     * @generated from enum value: revoked = 3;
+     */
+    AgentChannelInstallState[AgentChannelInstallState["revoked"] = 3] = "revoked";
+})(AgentChannelInstallState || (AgentChannelInstallState = {}));
+/**
+ * Describes the enum ai.stigmer.agentic.agentchannel.v1.AgentChannelInstallState.
+ */
+export const AgentChannelInstallStateSchema = /*@__PURE__*/ enumDesc(file_ai_stigmer_agentic_agentchannel_v1_status, 0);
+//# sourceMappingURL=status_pb.js.map

package/ai/stigmer/agentic/agentchannel/v1/status_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentchannel/v1/status_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mIAAmI;AACnI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAY,aAAa,CAClF,QAAQ,CAAC,46BAA46B,EAAE,CAAC,0CAA0C,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAiEvgC;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AA2DjE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,wBAgCX;AAhCD,WAAY,wBAAwB;IAClC;;;;OAIG;IACH,6IAA2C,CAAA;IAE3C;;;;;OAKG;IACH,6FAAmB,CAAA;IAEnB;;;;;OAKG;IACH,iFAAa,CAAA;IAEb;;;;;;OAMG;IACH,6EAAW,CAAA;AACb,CAAC,EAhCW,wBAAwB,KAAxB,wBAAwB,QAgCnC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsC,aAAa,CAC5F,QAAQ,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agentshare/v1/spec_pb.d.ts

@@ -29,12 +29,26 @@ export type AgentShareSpec = Message<"ai.stigmer.agentic.agentshare.v1.AgentShar
     /**
      * Reference to the agent this share distributes.
      *
+     * The referenced agent may live in another organization when it is
+     * marketplace-public: the share then offers that agent from this share's
+     * org, billed to this share's org, with tool credentials bound from this
+     * share's org. Cross-org shares must have a public audience.
+     *
      * @internal
-     * Phase A invariant: agent_ref.org must equal metadata.org — the sharing
-     * org is the billing org (decision 001 generalized), and guest tool
-     * credentials resolve in the share's org (secrets never cross orgs).
-     * Enforced in the create/update/apply handlers of both editions;
-     * cross-org shares are Phase B (decision 012).
+     * Cross-org contract (decision 013): making an agent visibility_public
+     * IS the origin org's consent to external shares — enforced app-level in
+     * both editions' defaults resolvers (spec-level CEL cannot see
+     * metadata.org), together with the public-audience-only rule and the
+     * dependency-publicness sweep (every skill/MCP the agent declares must be
+     * visibility_public, refused loudly naming blockers). The sharing org is
+     * always the billing org (decision 001 generalized) and guest tool
+     * credentials resolve in the share's org (secrets never cross orgs —
+     * org A's environments are structurally unreachable from org B's
+     * executions via OrgSharedEnvironmentPolicy). The agent's public
+     * visibility is re-verified on every guest turn, at the shared profile,
+     * and at guest mint, so revoking visibility kills external channels on
+     * the visitor's next message. status.agent_id pins the resolved agent
+     * against slug-reuse rebind.
      *
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceReference agent_ref = 1;
      */

package/ai/stigmer/agentic/agentshare/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentshare/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,iyDAAiyD,EAAE,CAAC,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAoIv6D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAmC7D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kBA0BX;AA1BD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,yEAAe,CAAA;IAEf;;;;;;OAMG;IACH,+DAAU,CAAA;IAEV;;;;;;;OAOG;IACH,yDAAO,CAAA;AACT,CAAC,EA1BW,kBAAkB,KAAlB,kBAAkB,QA0B7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentshare/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,iyDAAiyD,EAAE,CAAC,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAkJv6D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAmC7D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kBA0BX;AA1BD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,yEAAe,CAAA;IAEf;;;;;;OAMG;IACH,+DAAU,CAAA;IAEV;;;;;;;OAOG;IACH,yDAAO,CAAA;AACT,CAAC,EA1BW,kBAAkB,KAAlB,kBAAkB,QA0B7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agentshare/v1/status_pb.d.ts

@@ -42,6 +42,31 @@ export type AgentShareStatus = Message<"ai.stigmer.agentic.agentshare.v1.AgentSh
      * @generated from field: string share_link_token = 1;
      */
     shareLinkToken: string;
+    /**
+     * ID of the agent this share was created against.
+     *
+     * Pins the share to the exact agent (by immutable ID) that spec.agent_ref
+     * resolved to at creation. If that agent is deleted and a different one
+     * is later created at the same org/slug, the share stops resolving
+     * instead of silently attaching to the new agent.
+     *
+     * @internal
+     * Server-owned rebind guard (decision 013): agent_ref is org+slug, and
+     * slugs are reusable after delete — without the pin, a stale share's
+     * audience, link token, and bound credentials would transfer to whatever
+     * agent later claims the slug. Stamped once at create (the defaults
+     * resolver already loads the referenced agent); immutable like agent_ref
+     * itself; in status so no apply can wipe or forge it (the
+     * share_link_token posture). Every share-resolution gate (shared
+     * profile, guest mint, create-time gate, runner elevation) verifies it
+     * WHEN PRESENT; shares created before this field exists carry an empty
+     * pin and are tolerated — the same-org delete cascade already guarantees
+     * a same-org share never outlives its agent, so no backfill is needed.
+     * Cross-org shares (Phase B) always carry the pin.
+     *
+     * @generated from field: string agent_id = 2;
+     */
+    agentId: string;
 };
 /**
  * Describes the message ai.stigmer.agentic.agentshare.v1.AgentShareStatus.

package/ai/stigmer/agentic/agentshare/v1/status_pb.js

@@ -6,7 +6,7 @@ import { file_ai_stigmer_commons_apiresource_status } from "../../../commons/api
 /**
  * Describes the file ai/stigmer/agentic/agentshare/v1/status.proto.
  */
-export const file_ai_stigmer_agentic_agentshare_v1_status = /*@__PURE__*/ fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zdGF0dXMucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIm0KEEFnZW50U2hhcmVTdGF0dXMSPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdBIYChBzaGFyZV9saW5rX3Rva2VuGAEgASgJYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_status]);
+export const file_ai_stigmer_agentic_agentshare_v1_status = /*@__PURE__*/ fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9zdGF0dXMucHJvdG8SIGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxIn8KEEFnZW50U2hhcmVTdGF0dXMSPwoFYXVkaXQYYyABKAsyMC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdBIYChBzaGFyZV9saW5rX3Rva2VuGAEgASgJEhAKCGFnZW50X2lkGAIgASgJYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_status]);
 /**
  * Describes the message ai.stigmer.agentic.agentshare.v1.AgentShareStatus.
  * Use `create(AgentShareStatusSchema)` to create a new message.