@stigmer/protos 3.1.6 → 3.1.8

package/ai/stigmer/platform/v1/server_info_connect.d.ts

@@ -63,5 +63,45 @@ export declare const PlatformQueryController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Exchanges an embedded runner's bootstrap credential for a token scoped to
+         * one unit of dispatched work.
+         *
+         * The bootstrap token from getRunnerBootstrapConfig identifies a runner but
+         * is minted before any execution exists, so it carries no session or
+         * execution scope. Secrets are only released to runner credentials bound to
+         * the exact work they serve. At task start the runner presents its bootstrap
+         * token and names the execution it was dispatched; the control plane verifies
+         * the caller and returns a short-lived token scoped to that work, which the
+         * runner then uses for its ExecutionContext fetch. This makes a desktop
+         * runner indistinguishable, at the secret-release gate, from a
+         * server-provisioned sandbox runner.
+         *
+         * The token fields are empty when the server cannot mint (OSS, or no signing
+         * key configured) — the runner falls back to its existing credential.
+         *
+         * @internal
+         * Cloud mints via SandboxTokenService: an agent_execution_id yields a
+         * token_type=sandbox token carrying the execution's parent session_id (one
+         * session sandbox serves multi-turn executions); a workflow_execution_id
+         * yields token_type=workflow_sandbox carrying that id. Both are then bound by
+         * RunnerScopeVerifier on the getByExecutionId decrypt path exactly like
+         * cloud-sandbox-injected tokens (stigmer-cloud#155/#156).
+         *
+         * is_skip_authorization because the FGA target is derived from the input
+         * oneof, which the declarative interceptor cannot express — the handler
+         * enforces authorization itself (same pattern as getRunnerBootstrapConfig):
+         * the caller must present a runner-class token_type=embedded_runner
+         * credential AND pass the same can_view check getByExecutionId performs on
+         * the named execution.
+         *
+         * @generated from rpc ai.stigmer.platform.v1.PlatformQueryController.getRunnerScopedToken
+         */
+        readonly getRunnerScopedToken: {
+            readonly name: "getRunnerScopedToken";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
     };
 };

package/ai/stigmer/platform/v1/server_info_connect.js

@@ -2,7 +2,7 @@
 // @generated from file ai/stigmer/platform/v1/server_info.proto (package ai.stigmer.platform.v1, syntax proto3)
 /* eslint-disable */
 // @ts-nocheck
-import { GetRunnerBootstrapConfigInput, GetRunnerBootstrapConfigOutput, GetServerInfoInput, GetServerInfoOutput } from "./server_info_pbjs";
+import { GetRunnerBootstrapConfigInput, GetRunnerBootstrapConfigOutput, GetRunnerScopedTokenInput, GetRunnerScopedTokenOutput, GetServerInfoInput, GetServerInfoOutput } from "./server_info_pbjs";
 import { MethodKind } from "@bufbuild/protobuf";
 /**
  * Query service for server identity, capabilities, and runner bootstrap.
@@ -69,6 +69,46 @@ export const PlatformQueryController = {
             O: GetRunnerBootstrapConfigOutput,
             kind: MethodKind.Unary,
         },
+        /**
+         * Exchanges an embedded runner's bootstrap credential for a token scoped to
+         * one unit of dispatched work.
+         *
+         * The bootstrap token from getRunnerBootstrapConfig identifies a runner but
+         * is minted before any execution exists, so it carries no session or
+         * execution scope. Secrets are only released to runner credentials bound to
+         * the exact work they serve. At task start the runner presents its bootstrap
+         * token and names the execution it was dispatched; the control plane verifies
+         * the caller and returns a short-lived token scoped to that work, which the
+         * runner then uses for its ExecutionContext fetch. This makes a desktop
+         * runner indistinguishable, at the secret-release gate, from a
+         * server-provisioned sandbox runner.
+         *
+         * The token fields are empty when the server cannot mint (OSS, or no signing
+         * key configured) — the runner falls back to its existing credential.
+         *
+         * @internal
+         * Cloud mints via SandboxTokenService: an agent_execution_id yields a
+         * token_type=sandbox token carrying the execution's parent session_id (one
+         * session sandbox serves multi-turn executions); a workflow_execution_id
+         * yields token_type=workflow_sandbox carrying that id. Both are then bound by
+         * RunnerScopeVerifier on the getByExecutionId decrypt path exactly like
+         * cloud-sandbox-injected tokens (stigmer-cloud#155/#156).
+         *
+         * is_skip_authorization because the FGA target is derived from the input
+         * oneof, which the declarative interceptor cannot express — the handler
+         * enforces authorization itself (same pattern as getRunnerBootstrapConfig):
+         * the caller must present a runner-class token_type=embedded_runner
+         * credential AND pass the same can_view check getByExecutionId performs on
+         * the named execution.
+         *
+         * @generated from rpc ai.stigmer.platform.v1.PlatformQueryController.getRunnerScopedToken
+         */
+        getRunnerScopedToken: {
+            name: "getRunnerScopedToken",
+            I: GetRunnerScopedTokenInput,
+            O: GetRunnerScopedTokenOutput,
+            kind: MethodKind.Unary,
+        },
     }
 };
 //# sourceMappingURL=server_info_connect.js.map

package/ai/stigmer/platform/v1/server_info_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"server_info_connect.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gHAAgH;AAChH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5I,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,gDAAgD;IAC1D,OAAO,EAAE;QACP;;;;;;;;WAQG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,mBAAmB;YACtB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,wBAAwB,EAAE;YACxB,IAAI,EAAE,0BAA0B;YAChC,CAAC,EAAE,6BAA6B;YAChC,CAAC,EAAE,8BAA8B;YACjC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"server_info_connect.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gHAAgH;AAChH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnM,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,gDAAgD;IAC1D,OAAO,EAAE;QACP;;;;;;;;WAQG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,mBAAmB;YACtB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,wBAAwB,EAAE;YACxB,IAAI,EAAE,0BAA0B;YAChC,CAAC,EAAE,6BAA6B;YAChC,CAAC,EAAE,8BAA8B;YACjC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/platform/v1/server_info_pb.d.ts

@@ -111,6 +111,90 @@ export type GetRunnerBootstrapConfigOutput = Message<"ai.stigmer.platform.v1.Get
  * Use `create(GetRunnerBootstrapConfigOutputSchema)` to create a new message.
  */
 export declare const GetRunnerBootstrapConfigOutputSchema: GenMessage<GetRunnerBootstrapConfigOutput>;
+/**
+ * Names the unit of dispatched work a runner wants a scoped token for.
+ *
+ * @generated from message ai.stigmer.platform.v1.GetRunnerScopedTokenInput
+ */
+export type GetRunnerScopedTokenInput = Message<"ai.stigmer.platform.v1.GetRunnerScopedTokenInput"> & {
+    /**
+     * The dispatched work the token will serve. The runner names only the id it
+     * was dispatched; the server derives the token's scope from the resource
+     * itself (an agent execution scopes to its parent session).
+     *
+     * @generated from oneof ai.stigmer.platform.v1.GetRunnerScopedTokenInput.scope
+     */
+    scope: {
+        /**
+         * AgentExecution id — yields a token scoped to the execution's parent
+         * session, valid for every ExecutionContext in that session (multi-turn).
+         *
+         * @generated from field: string agent_execution_id = 1;
+         */
+        value: string;
+        case: "agentExecutionId";
+    } | {
+        /**
+         * WorkflowExecution id — yields a token scoped to exactly that workflow
+         * execution's ExecutionContext.
+         *
+         * @generated from field: string workflow_execution_id = 2;
+         */
+        value: string;
+        case: "workflowExecutionId";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message ai.stigmer.platform.v1.GetRunnerScopedTokenInput.
+ * Use `create(GetRunnerScopedTokenInputSchema)` to create a new message.
+ */
+export declare const GetRunnerScopedTokenInputSchema: GenMessage<GetRunnerScopedTokenInput>;
+/**
+ * A runner token scoped to one unit of work, or empty when the server cannot
+ * mint one.
+ *
+ * Mirrors the token fields of GetRunnerBootstrapConfigOutput: presence-based —
+ * an empty token means "not minted" (OSS, or no signing key), and the runner
+ * keeps using its existing credential.
+ *
+ * @generated from message ai.stigmer.platform.v1.GetRunnerScopedTokenOutput
+ */
+export type GetRunnerScopedTokenOutput = Message<"ai.stigmer.platform.v1.GetRunnerScopedTokenOutput"> & {
+    /**
+     * Stigmer-signed token scoped to the requested work. The runner presents it
+     * for ExecutionContext reads in place of its unscoped bootstrap token.
+     *
+     * @internal
+     * iss=stigmer, sub=caller identity account, token_type=sandbox (with
+     * session_id claim) or workflow_sandbox (with workflow_execution_id claim),
+     * minted by the same SandboxTokenService that provisions cloud sandboxes.
+     *
+     * @generated from field: string runner_scoped_token = 1;
+     */
+    runnerScopedToken: string;
+    /**
+     * Token type for runner_scoped_token. "Bearer" when a token is present,
+     * empty otherwise.
+     *
+     * @generated from field: string token_type = 2;
+     */
+    tokenType: string;
+    /**
+     * Lifetime of runner_scoped_token in seconds from issuance. 0 when no token
+     * is present.
+     *
+     * @generated from field: int32 expires_in_seconds = 3;
+     */
+    expiresInSeconds: number;
+};
+/**
+ * Describes the message ai.stigmer.platform.v1.GetRunnerScopedTokenOutput.
+ * Use `create(GetRunnerScopedTokenOutputSchema)` to create a new message.
+ */
+export declare const GetRunnerScopedTokenOutputSchema: GenMessage<GetRunnerScopedTokenOutput>;
 /**
  * Edition of the Stigmer server binary.
  *
@@ -206,4 +290,43 @@ export declare const PlatformQueryController: GenService<{
         input: typeof GetRunnerBootstrapConfigInputSchema;
         output: typeof GetRunnerBootstrapConfigOutputSchema;
     };
+    /**
+     * Exchanges an embedded runner's bootstrap credential for a token scoped to
+     * one unit of dispatched work.
+     *
+     * The bootstrap token from getRunnerBootstrapConfig identifies a runner but
+     * is minted before any execution exists, so it carries no session or
+     * execution scope. Secrets are only released to runner credentials bound to
+     * the exact work they serve. At task start the runner presents its bootstrap
+     * token and names the execution it was dispatched; the control plane verifies
+     * the caller and returns a short-lived token scoped to that work, which the
+     * runner then uses for its ExecutionContext fetch. This makes a desktop
+     * runner indistinguishable, at the secret-release gate, from a
+     * server-provisioned sandbox runner.
+     *
+     * The token fields are empty when the server cannot mint (OSS, or no signing
+     * key configured) — the runner falls back to its existing credential.
+     *
+     * @internal
+     * Cloud mints via SandboxTokenService: an agent_execution_id yields a
+     * token_type=sandbox token carrying the execution's parent session_id (one
+     * session sandbox serves multi-turn executions); a workflow_execution_id
+     * yields token_type=workflow_sandbox carrying that id. Both are then bound by
+     * RunnerScopeVerifier on the getByExecutionId decrypt path exactly like
+     * cloud-sandbox-injected tokens (stigmer-cloud#155/#156).
+     *
+     * is_skip_authorization because the FGA target is derived from the input
+     * oneof, which the declarative interceptor cannot express — the handler
+     * enforces authorization itself (same pattern as getRunnerBootstrapConfig):
+     * the caller must present a runner-class token_type=embedded_runner
+     * credential AND pass the same can_view check getByExecutionId performs on
+     * the named execution.
+     *
+     * @generated from rpc ai.stigmer.platform.v1.PlatformQueryController.getRunnerScopedToken
+     */
+    getRunnerScopedToken: {
+        methodKind: "unary";
+        input: typeof GetRunnerScopedTokenInputSchema;
+        output: typeof GetRunnerScopedTokenOutputSchema;
+    };
 }>;

package/ai/stigmer/platform/v1/server_info_pb.js

@@ -7,7 +7,7 @@ import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb
 /**
  * Describes the file ai/stigmer/platform/v1/server_info.proto.
  */
-export const file_ai_stigmer_platform_v1_server_info = /*@__PURE__*/ fileDesc("CihhaS9zdGlnbWVyL3BsYXRmb3JtL3YxL3NlcnZlcl9pbmZvLnByb3RvEhZhaS5zdGlnbWVyLnBsYXRmb3JtLnYxIhQKEkdldFNlcnZlckluZm9JbnB1dCJeChNHZXRTZXJ2ZXJJbmZvT3V0cHV0EjYKB2VkaXRpb24YASABKA4yJS5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLlNlcnZlckVkaXRpb24SDwoHdmVyc2lvbhgCIAEoCSIfCh1HZXRSdW5uZXJCb290c3RyYXBDb25maWdJbnB1dCLJAQoeR2V0UnVubmVyQm9vdHN0cmFwQ29uZmlnT3V0cHV0EiEKEHRlbXBvcmFsX2FkZHJlc3MYASABKAlCB7pIBHICEAESIwoSdGVtcG9yYWxfbmFtZXNwYWNlGAIgASgJQge6SARyAhABEhsKE3J1bm5lcl9hY2Nlc3NfdG9rZW4YAyABKAkSEgoKdG9rZW5fdHlwZRgEIAEoCRIuCiZydW5uZXJfYWNjZXNzX3Rva2VuX2V4cGlyZXNfaW5fc2Vjb25kcxgFIAEoBSpDCg1TZXJ2ZXJFZGl0aW9uEh4KGnNlcnZlcl9lZGl0aW9uX3Vuc3BlY2lmaWVkEAASBwoDb3NzEAESCQoFY2xvdWQQAjKbAgoXUGxhdGZvcm1RdWVyeUNvbnRyb2xsZXISbgoNZ2V0U2VydmVySW5mbxIqLmFpLnN0aWdtZXIucGxhdGZvcm0udjEuR2V0U2VydmVySW5mb0lucHV0GisuYWkuc3RpZ21lci5wbGF0Zm9ybS52MS5HZXRTZXJ2ZXJJbmZvT3V0cHV0IgTIuBgBEo8BChhnZXRSdW5uZXJCb290c3RyYXBDb25maWcSNS5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFJ1bm5lckJvb3RzdHJhcENvbmZpZ0lucHV0GjYuYWkuc3RpZ21lci5wbGF0Zm9ybS52MS5HZXRSdW5uZXJCb290c3RyYXBDb25maWdPdXRwdXQiBNC4GAFCEUIPU2VydmVySW5mb1Byb3RvYgZwcm90bzM", [file_ai_stigmer_commons_rpc_method_options, file_buf_validate_validate]);
+export const file_ai_stigmer_platform_v1_server_info = /*@__PURE__*/ fileDesc("CihhaS9zdGlnbWVyL3BsYXRmb3JtL3YxL3NlcnZlcl9pbmZvLnByb3RvEhZhaS5zdGlnbWVyLnBsYXRmb3JtLnYxIhQKEkdldFNlcnZlckluZm9JbnB1dCJeChNHZXRTZXJ2ZXJJbmZvT3V0cHV0EjYKB2VkaXRpb24YASABKA4yJS5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLlNlcnZlckVkaXRpb24SDwoHdmVyc2lvbhgCIAEoCSIfCh1HZXRSdW5uZXJCb290c3RyYXBDb25maWdJbnB1dCLJAQoeR2V0UnVubmVyQm9vdHN0cmFwQ29uZmlnT3V0cHV0EiEKEHRlbXBvcmFsX2FkZHJlc3MYASABKAlCB7pIBHICEAESIwoSdGVtcG9yYWxfbmFtZXNwYWNlGAIgASgJQge6SARyAhABEhsKE3J1bm5lcl9hY2Nlc3NfdG9rZW4YAyABKAkSEgoKdG9rZW5fdHlwZRgEIAEoCRIuCiZydW5uZXJfYWNjZXNzX3Rva2VuX2V4cGlyZXNfaW5fc2Vjb25kcxgFIAEoBSJqChlHZXRSdW5uZXJTY29wZWRUb2tlbklucHV0EhwKEmFnZW50X2V4ZWN1dGlvbl9pZBgBIAEoCUgAEh8KFXdvcmtmbG93X2V4ZWN1dGlvbl9pZBgCIAEoCUgAQg4KBXNjb3BlEgW6SAIIASJpChpHZXRSdW5uZXJTY29wZWRUb2tlbk91dHB1dBIbChNydW5uZXJfc2NvcGVkX3Rva2VuGAEgASgJEhIKCnRva2VuX3R5cGUYAiABKAkSGgoSZXhwaXJlc19pbl9zZWNvbmRzGAMgASgFKkMKDVNlcnZlckVkaXRpb24SHgoac2VydmVyX2VkaXRpb25fdW5zcGVjaWZpZWQQABIHCgNvc3MQARIJCgVjbG91ZBACMqEDChdQbGF0Zm9ybVF1ZXJ5Q29udHJvbGxlchJuCg1nZXRTZXJ2ZXJJbmZvEiouYWkuc3RpZ21lci5wbGF0Zm9ybS52MS5HZXRTZXJ2ZXJJbmZvSW5wdXQaKy5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFNlcnZlckluZm9PdXRwdXQiBMi4GAESjwEKGGdldFJ1bm5lckJvb3RzdHJhcENvbmZpZxI1LmFpLnN0aWdtZXIucGxhdGZvcm0udjEuR2V0UnVubmVyQm9vdHN0cmFwQ29uZmlnSW5wdXQaNi5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFJ1bm5lckJvb3RzdHJhcENvbmZpZ091dHB1dCIE0LgYARKDAQoUZ2V0UnVubmVyU2NvcGVkVG9rZW4SMS5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFJ1bm5lclNjb3BlZFRva2VuSW5wdXQaMi5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFJ1bm5lclNjb3BlZFRva2VuT3V0cHV0IgTQuBgBQhFCD1NlcnZlckluZm9Qcm90b2IGcHJvdG8z", [file_ai_stigmer_commons_rpc_method_options, file_buf_validate_validate]);
 /**
  * Describes the message ai.stigmer.platform.v1.GetServerInfoInput.
  * Use `create(GetServerInfoInputSchema)` to create a new message.
@@ -28,6 +28,16 @@ export const GetRunnerBootstrapConfigInputSchema = /*@__PURE__*/ messageDesc(fil
  * Use `create(GetRunnerBootstrapConfigOutputSchema)` to create a new message.
  */
 export const GetRunnerBootstrapConfigOutputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_platform_v1_server_info, 3);
+/**
+ * Describes the message ai.stigmer.platform.v1.GetRunnerScopedTokenInput.
+ * Use `create(GetRunnerScopedTokenInputSchema)` to create a new message.
+ */
+export const GetRunnerScopedTokenInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_platform_v1_server_info, 4);
+/**
+ * Describes the message ai.stigmer.platform.v1.GetRunnerScopedTokenOutput.
+ * Use `create(GetRunnerScopedTokenOutputSchema)` to create a new message.
+ */
+export const GetRunnerScopedTokenOutputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_platform_v1_server_info, 5);
 /**
  * Edition of the Stigmer server binary.
  *

package/ai/stigmer/platform/v1/server_info_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"server_info_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,ijCAAijC,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAUxoC;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAW1D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA8D1D;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,aAqBX;AArBD,WAAY,aAAa;IACvB;;OAEG;IACH,6FAA8B,CAAA;IAE9B;;;;;OAKG;IACH,+CAAO,CAAA;IAEP;;;;;OAKG;IACH,mDAAS,CAAA;AACX,CAAC,EArBW,aAAa,KAAb,aAAa,QAqBxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAgD/B,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server_info_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,kgDAAkgD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAUzlD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAW1D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA8D1D;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAoC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA2C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,aAqBX;AArBD,WAAY,aAAa;IACvB;;OAEG;IACH,6FAA8B,CAAA;IAE9B;;;;;OAKG;IACH,+CAAO,CAAA;IAEP;;;;;OAKG;IACH,mDAAS,CAAA;AACX,CAAC,EArBW,aAAa,KAAb,aAAa,QAqBxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAuF/B,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/tenancy/organization/v1/api_pb.d.ts

@@ -10,10 +10,16 @@ export declare const file_ai_stigmer_tenancy_organization_v1_api: GenFile;
 /**
  * Organization is the top-level container for all Stigmer resources.
  *
+ * An Organization's metadata.id equals its metadata.slug: unlike every other
+ * resource (which is assigned a generated prefixed id), the tenancy root is
+ * addressed by its slug, which is globally unique.
+ *
  * @internal
  * Similar to GitHub organizations, all agents, workflows, sessions, and other
  * resources are scoped under an organization. This enables multi-tenancy and
- * proper resource isolation.
+ * proper resource isolation. Child resources reference their owning org by slug
+ * (metadata.org), which is why the org's id is set to its slug rather than a
+ * minted org_<ulid> (see OrganizationCommandController create pipeline).
  *
  * @generated from message ai.stigmer.tenancy.organization.v1.Organization
  */

package/ai/stigmer/tenancy/organization/v1/api_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/tenancy/organization/v1/api_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAE3G,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,4CAA4C,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,wiBAAwiB,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,EAAE,4CAA4C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAiD3tB;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/tenancy/organization/v1/api_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAE3G,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,4CAA4C,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,wiBAAwiB,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,EAAE,4CAA4C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAuD3tB;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/protos",
-  "version": "3.1.6",
+  "version": "3.1.8",
   "description": "Generated TypeScript protobuf stubs for Stigmer APIs",
   "license": "Apache-2.0",
   "type": "module",