@stigmer/protos 3.1.7 → 3.1.8

package/ai/stigmer/agentic/workflow/v1/serverless/validation_pb.d.ts

@@ -9,8 +9,9 @@ export declare const file_ai_stigmer_agentic_workflow_v1_serverless_validation:
  * ServerlessWorkflowValidation contains the generated Serverless Workflow YAML and its validation state.
  *
  * @internal
- * Populated asynchronously after workflow creation via a Temporal workflow
- * that validates the workflow structure.
+ * Produced synchronously by in-process workflow validation: on create/update it
+ * is persisted onto WorkflowStatus, and it is the direct response of the
+ * validateSpec RPC.
  *
  * @generated from message ai.stigmer.agentic.workflow.v1.serverless.ServerlessWorkflowValidation
  */
@@ -51,10 +52,12 @@ export type ServerlessWorkflowValidation = Message<"ai.stigmer.agentic.workflow.
      */
     validatedAt?: Timestamp;
     /**
-     * Validation process ID for tracking validation progress.
+     * Optional identifier for tracking a validation run.
      *
      * @internal
-     * Temporal workflow ID. Format: "validate-workflow-{workflow_id}".
+     * Legacy field from when validation ran as a separate async process. In-process
+     * validation is synchronous and does not populate this; retained for wire
+     * compatibility.
      *
      * @generated from field: string validation_workflow_id = 6;
      */
@@ -101,7 +104,9 @@ export declare enum ValidationState {
      * Retry validation or contact support.
      *
      * @internal
-     * Examples: Temporal workflow crashed, activity timeout, etc.
+     * Reserved for a genuine validator fault (e.g., the converter panics or an
+     * unexpected internal error prevents validation from completing) — not a
+     * user-fixable spec problem.
      *
      * @generated from enum value: FAILED = 4;
      */

package/ai/stigmer/agentic/workflow/v1/serverless/validation_pb.js

@@ -49,7 +49,9 @@ export var ValidationState;
      * Retry validation or contact support.
      *
      * @internal
-     * Examples: Temporal workflow crashed, activity timeout, etc.
+     * Reserved for a genuine validator fault (e.g., the converter panics or an
+     * unexpected internal error prevents validation from completing) — not a
+     * user-fixable spec problem.
      *
      * @generated from enum value: FAILED = 4;
      */

package/ai/stigmer/agentic/workflow/v1/serverless/validation_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/agentic/workflow/v1/serverless/validation_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,qJAAqJ;AACrJ,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAY,aAAa,CAC7F,QAAQ,CAAC,4lBAA4lB,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;AA+D3oB;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAwCX;AAxCD,WAAY,eAAe;IACzB;;;;OAIG;IACH,qGAAgC,CAAA;IAEhC;;;;OAIG;IACH,2DAAW,CAAA;IAEX;;;;OAIG;IACH,uDAAS,CAAA;IAET;;;;;OAKG;IACH,2DAAW,CAAA;IAEX;;;;;;;;OAQG;IACH,yDAAU,CAAA;AACZ,CAAC,EAxCW,eAAe,KAAf,eAAe,QAwC1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"validation_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/agentic/workflow/v1/serverless/validation_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,qJAAqJ;AACrJ,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAY,aAAa,CAC7F,QAAQ,CAAC,4lBAA4lB,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;AAkE3oB;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAN,IAAY,eA0CX;AA1CD,WAAY,eAAe;IACzB;;;;OAIG;IACH,qGAAgC,CAAA;IAEhC;;;;OAIG;IACH,2DAAW,CAAA;IAEX;;;;OAIG;IACH,uDAAS,CAAA;IAET;;;;;OAKG;IACH,2DAAW,CAAA;IAEX;;;;;;;;;;OAUG;IACH,yDAAU,CAAA;AACZ,CAAC,EA1CW,eAAe,KAAf,eAAe,QA0C1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.d.ts

@@ -209,6 +209,13 @@ export declare enum ApiResourceKind {
     /**
      * Top-level tenant that owns and manages resources.
      *
+     * Organization is the one resource whose metadata.id equals its metadata.slug
+     * (set by the create pipeline), not a minted org_<ulid>. It is the immutable,
+     * globally unique tenancy root that every child resource references by slug
+     * (metadata.org), so its slug is globally unique and doubles as its id.
+     * id_prefix below is retained deliberately: it still anchors legacy org_<ulid>
+     * records and the CLI's id-vs-slug detection — it is not used to mint new ids.
+     *
      * @generated from enum value: organization = 30;
      */
     organization = 30,

package/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.js

@@ -8,7 +8,7 @@ import { file_google_protobuf_descriptor } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind.proto.
  */
-export const file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind = /*@__PURE__*/ fileDesc("CkZhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2FwaV9yZXNvdXJjZV9raW5kLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIswDChNBcGlSZXNvdXJjZUtpbmRNZXRhEk8KBWdyb3VwGAEgASgOMkAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUdyb3VwElMKB3ZlcnNpb24YAiABKA4yQi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlVmVyc2lvbhIMCgRuYW1lGAMgASgJEhQKDGRpc3BsYXlfbmFtZRgEIAEoCRIRCglpZF9wcmVmaXgYBSABKAkSFAoMaXNfdmVyc2lvbmVkGAYgASgIEhoKEm5vdF9zZWFyY2hfaW5kZXhlZBgHIAEoCBJKCgR0aWVyGAggASgOMjwuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5SZXNvdXJjZVRpZXISWgoNYXV0aG9yaXphdGlvbhgJIAEoCzJDLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuQXV0aG9yaXphdGlvbkNvbmZpZypCChJBcGlSZXNvdXJjZVZlcnNpb24SJAogYXBpX3Jlc291cmNlX3ZlcnNpb25fdW5zcGVjaWZpZWQQABIGCgJ2MRABKk4KDFJlc291cmNlVGllchIdChlyZXNvdXJjZV90aWVyX3Vuc3BlY2lmaWVkEAASDwoLb3Blbl9zb3VyY2UQARIOCgpjbG91ZF9vbmx5EAIqQQoPUGxhdGZvcm1JZFZhbHVlEiEKHXBsYXRmb3JtX2lkX3ZhbHVlX3Vuc3BlY2lmaWVkEAASCwoHc3RpZ21lchABKt4OCg9BcGlSZXNvdXJjZUtpbmQSHQoZYXBpX3Jlc291cmNlX2tpbmRfdW5rbm93bhAAElsKFGFwaV9yZXNvdXJjZV92ZXJzaW9uEAEaQar/Kz0IARABGhJBcGlSZXNvdXJjZVZlcnNpb24iFEFQSSBSZXNvdXJjZSBWZXJzaW9uKgN2ZXI4AUACSgQIBRAEEj8KCmlhbV9wb2xpY3kQChovqv8rKwgCEAEaCUlhbVBvbGljeSIKSUFNIFBvbGljeSoEaWFtcDgBQAJKBAgCEAESTgoQaWRlbnRpdHlfYWNjb3VudBALGjiq/ys0CAIQARoPSWRlbnRpdHlBY2NvdW50IhBJZGVudGl0eSBBY2NvdW50KgNpZGFAAkoECAQQAxI1CgdhcGlfa2V5EAwaKKr/KyQIAhABGgZBcGlLZXkiB0FQSSBLZXkqA2tleTgBQAJKBAgEEAESPwoKaW52aXRhdGlvbhAUGi+q/ysrCAIQARoKSW52aXRhdGlvbiIKSW52aXRhdGlvbioDaW52OAFAAkoECAIQARJXChFpZGVudGl0eV9wcm92aWRlchAVGkCq/ys8CAIQARoQSWRlbnRpdHlQcm92aWRlciIRSWRlbnRpdHkgUHJvdmlkZXIqA2lkcDgBQAJKCAgCEAE6AgEEEkAKCW9hdXRoX2FwcBAWGjGq/ystCAIQARoIT0F1dGhBcHAiCU9BdXRoIEFwcCoEb2FwcDgBQAJKCAgCEAE6AgEEElEKD3BsYXRmb3JtX2NsaWVudBAXGjyq/ys4CAIQARoOUGxhdGZvcm1DbGllbnQiD1BsYXRmb3JtIENsaWVudCoDcGNsOAFAAkoICAIQAToCAQQSSQoMb3JnYW5pemF0aW9uEB4aN6r/KzMIAxABGgxPcmdhbml6YXRpb24iDE9yZ2FuaXphdGlvbioDb3JnQAFKCggEEAE6BAECAwQSOQoIcGxhdGZvcm0QHxorqv8rJwgDEAEaCFBsYXRmb3JtIghQbGF0Zm9ybSoDcGx0OAFAAkoECAUQBBI8CgVhZ2VudBAoGjGq/ystCAEQARoFQWdlbnQiBUFnZW50KgNhZ3RAAUoSCAIQASoICAEQARgBIAE6AgEEEmsKD2FnZW50X2V4ZWN1dGlvbhApGlaq/ytSCAEQARoOQWdlbnRFeGVjdXRpb24iD0FnZW50IEV4ZWN1dGlvbioDYWV4QAFKJAgDEAIaHgoHc2Vzc2lvbhIHc2Vzc2lvbhoKc2Vzc2lvbl9pZBI4CgdzZXNzaW9uECoaK6r/KycIARABGgdTZXNzaW9uIgdTZXNzaW9uKgNzZXNAAUoICAIQAToCAQQSPgoFc2tpbGwQKxozqv8rLwgBEAEaBVNraWxsIgVTa2lsbCoDc2tsMAFAAUoSCAIQASoICAEQARgBIAE6AgEEEkoKCm1jcF9zZXJ2ZXIQLBo6qv8rNggBEAEaCU1jcFNlcnZlciIKTUNQIFNlcnZlcioDbWNwQAFKEggCEAEqCAgBEAEYASABOgIBBBJsCg5hZ2VudF9pbnN0YW5jZRAtGliq/ytUCAEQARoNQWdlbnRJbnN0YW5jZSIOQWdlbnQgSW5zdGFuY2UqA2FpbkABSigIAhABIhgKBWFnZW50EgVhZ2VudBoIYWdlbnRfaWQqBAgBGAE6AgEEEkcKCHdvcmtmbG93EDIaOar/KzUIARABGghXb3JrZmxvdyIIV29ya2Zsb3cqA3dmbDABQAFKEggCEAEqCAgBEAEYASABOgIBBBJ+ChF3b3JrZmxvd19pbnN0YW5jZRAzGmeq/ytjCAEQARoQV29ya2Zsb3dJbnN0YW5jZSIRV29ya2Zsb3cgSW5zdGFuY2UqA3dpbkABSjEIAhABIiEKCHdvcmtmbG93Egh3b3JrZmxvdxoLd29ya2Zsb3dfaWQqBAgBGAE6AgEEEpYBChJ3b3JrZmxvd19leGVjdXRpb24QNBp+qv8reggBEAEaEVdvcmtmbG93RXhlY3V0aW9uIhJXb3JrZmxvdyBFeGVjdXRpb24qA3dleEABSkYIAhABIjwKEXdvcmtmbG93X2luc3RhbmNlEhF3b3JrZmxvd19pbnN0YW5jZRoUd29ya2Zsb3dfaW5zdGFuY2VfaWQ6AgEEEkYKC2Vudmlyb25tZW50EDUaNar/KzEIARABGgtFbnZpcm9ubWVudCILRW52aXJvbm1lbnQqA2VudkABSgoIAhABMAE6AgEEEjsKCGFydGlmYWN0EDcaLar/KykIARABGghBcnRpZmFjdCIIQXJ0aWZhY3QqA2FydEABSggIAhABOgIBBBJSChFleGVjdXRpb25fY29udGV4dBA2Gjuq/ys3CAEQARoQRXhlY3V0aW9uQ29udGV4dCIRRXhlY3V0aW9uIENvbnRleHQqBGVjdHhAAUoECAQQARI4Cgdwcm9qZWN0EDwaK6r/KycIAxABGgdQcm9qZWN0IgdQcm9qZWN0KgNwcmpAAUoICAIQAToCAQQ6hQEKCWtpbmRfbWV0YRIhLmdvb2dsZS5wcm90b2J1Zi5FbnVtVmFsdWVPcHRpb25zGPW/BSABKAsyQy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlS2luZE1ldGFSCGtpbmRNZXRhQhtCGUFwaVJlc291cmNlS2luZE91dGVyQ2xhc3NiBnByb3RvMw", [file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_group, file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config, file_google_protobuf_descriptor]);
+export const file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind = /*@__PURE__*/ fileDesc("CkZhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2FwaV9yZXNvdXJjZV9raW5kLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIswDChNBcGlSZXNvdXJjZUtpbmRNZXRhEk8KBWdyb3VwGAEgASgOMkAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUdyb3VwElMKB3ZlcnNpb24YAiABKA4yQi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlVmVyc2lvbhIMCgRuYW1lGAMgASgJEhQKDGRpc3BsYXlfbmFtZRgEIAEoCRIRCglpZF9wcmVmaXgYBSABKAkSFAoMaXNfdmVyc2lvbmVkGAYgASgIEhoKEm5vdF9zZWFyY2hfaW5kZXhlZBgHIAEoCBJKCgR0aWVyGAggASgOMjwuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5SZXNvdXJjZVRpZXISWgoNYXV0aG9yaXphdGlvbhgJIAEoCzJDLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuQXV0aG9yaXphdGlvbkNvbmZpZypCChJBcGlSZXNvdXJjZVZlcnNpb24SJAogYXBpX3Jlc291cmNlX3ZlcnNpb25fdW5zcGVjaWZpZWQQABIGCgJ2MRABKk4KDFJlc291cmNlVGllchIdChlyZXNvdXJjZV90aWVyX3Vuc3BlY2lmaWVkEAASDwoLb3Blbl9zb3VyY2UQARIOCgpjbG91ZF9vbmx5EAIqQQoPUGxhdGZvcm1JZFZhbHVlEiEKHXBsYXRmb3JtX2lkX3ZhbHVlX3Vuc3BlY2lmaWVkEAASCwoHc3RpZ21lchABKuIOCg9BcGlSZXNvdXJjZUtpbmQSHQoZYXBpX3Jlc291cmNlX2tpbmRfdW5rbm93bhAAElsKFGFwaV9yZXNvdXJjZV92ZXJzaW9uEAEaQar/Kz0IARABGhJBcGlSZXNvdXJjZVZlcnNpb24iFEFQSSBSZXNvdXJjZSBWZXJzaW9uKgN2ZXI4AUACSgQIBRAEEj8KCmlhbV9wb2xpY3kQChovqv8rKwgCEAEaCUlhbVBvbGljeSIKSUFNIFBvbGljeSoEaWFtcDgBQAJKBAgCEAESTgoQaWRlbnRpdHlfYWNjb3VudBALGjiq/ys0CAIQARoPSWRlbnRpdHlBY2NvdW50IhBJZGVudGl0eSBBY2NvdW50KgNpZGFAAkoECAQQAxI1CgdhcGlfa2V5EAwaKKr/KyQIAhABGgZBcGlLZXkiB0FQSSBLZXkqA2tleTgBQAJKBAgEEAESPwoKaW52aXRhdGlvbhAUGi+q/ysrCAIQARoKSW52aXRhdGlvbiIKSW52aXRhdGlvbioDaW52OAFAAkoECAIQARJXChFpZGVudGl0eV9wcm92aWRlchAVGkCq/ys8CAIQARoQSWRlbnRpdHlQcm92aWRlciIRSWRlbnRpdHkgUHJvdmlkZXIqA2lkcDgBQAJKCAgCEAE6AgEEEkAKCW9hdXRoX2FwcBAWGjGq/ystCAIQARoIT0F1dGhBcHAiCU9BdXRoIEFwcCoEb2FwcDgBQAJKCAgCEAE6AgEEElEKD3BsYXRmb3JtX2NsaWVudBAXGjyq/ys4CAIQARoOUGxhdGZvcm1DbGllbnQiD1BsYXRmb3JtIENsaWVudCoDcGNsOAFAAkoICAIQAToCAQQSSQoMb3JnYW5pemF0aW9uEB4aN6r/KzMIAxABGgxPcmdhbml6YXRpb24iDE9yZ2FuaXphdGlvbioDb3JnQAFKCggEEAE6BAECAwQSOQoIcGxhdGZvcm0QHxorqv8rJwgDEAEaCFBsYXRmb3JtIghQbGF0Zm9ybSoDcGx0OAFAAkoECAUQBBI8CgVhZ2VudBAoGjGq/ystCAEQARoFQWdlbnQiBUFnZW50KgNhZ3RAAUoSCAIQASoICAEQARgBIAE6AgEEEmsKD2FnZW50X2V4ZWN1dGlvbhApGlaq/ytSCAEQARoOQWdlbnRFeGVjdXRpb24iD0FnZW50IEV4ZWN1dGlvbioDYWV4QAFKJAgDEAIaHgoHc2Vzc2lvbhIHc2Vzc2lvbhoKc2Vzc2lvbl9pZBI4CgdzZXNzaW9uECoaK6r/KycIARABGgdTZXNzaW9uIgdTZXNzaW9uKgNzZXNAAUoICAIQAToCAQQSPgoFc2tpbGwQKxozqv8rLwgBEAEaBVNraWxsIgVTa2lsbCoDc2tsMAFAAUoSCAIQASoICAEQARgBIAE6AgEEEkoKCm1jcF9zZXJ2ZXIQLBo6qv8rNggBEAEaCU1jcFNlcnZlciIKTUNQIFNlcnZlcioDbWNwQAFKEggCEAEqCAgBEAEYASABOgIBBBJsCg5hZ2VudF9pbnN0YW5jZRAtGliq/ytUCAEQARoNQWdlbnRJbnN0YW5jZSIOQWdlbnQgSW5zdGFuY2UqA2FpbkABSigIAhABIhgKBWFnZW50EgVhZ2VudBoIYWdlbnRfaWQqBAgBGAE6AgEEEkcKCHdvcmtmbG93EDIaOar/KzUIARABGghXb3JrZmxvdyIIV29ya2Zsb3cqA3dmbDABQAFKEggCEAEqCAgBEAEYASABOgIBBBJ+ChF3b3JrZmxvd19pbnN0YW5jZRAzGmeq/ytjCAEQARoQV29ya2Zsb3dJbnN0YW5jZSIRV29ya2Zsb3cgSW5zdGFuY2UqA3dpbkABSjEIAhABIiEKCHdvcmtmbG93Egh3b3JrZmxvdxoLd29ya2Zsb3dfaWQqBAgBGAE6AgEEEpYBChJ3b3JrZmxvd19leGVjdXRpb24QNBp+qv8reggBEAEaEVdvcmtmbG93RXhlY3V0aW9uIhJXb3JrZmxvdyBFeGVjdXRpb24qA3dleEABSkYIAhABIjwKEXdvcmtmbG93X2luc3RhbmNlEhF3b3JrZmxvd19pbnN0YW5jZRoUd29ya2Zsb3dfaW5zdGFuY2VfaWQ6AgEEEkoKC2Vudmlyb25tZW50EDUaOar/KzUIARABGgtFbnZpcm9ubWVudCILRW52aXJvbm1lbnQqA2VudkABSg4IAhABKgIYATABOgIBBBI7CghhcnRpZmFjdBA3Gi2q/yspCAEQARoIQXJ0aWZhY3QiCEFydGlmYWN0KgNhcnRAAUoICAIQAToCAQQSUgoRZXhlY3V0aW9uX2NvbnRleHQQNho7qv8rNwgBEAEaEEV4ZWN1dGlvbkNvbnRleHQiEUV4ZWN1dGlvbiBDb250ZXh0KgRlY3R4QAFKBAgEEAESOAoHcHJvamVjdBA8Giuq/ysnCAMQARoHUHJvamVjdCIHUHJvamVjdCoDcHJqQAFKCAgCEAE6AgEEOoUBCglraW5kX21ldGESIS5nb29nbGUucHJvdG9idWYuRW51bVZhbHVlT3B0aW9ucxj1vwUgASgLMkMuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmRNZXRhUghraW5kTWV0YUIbQhlBcGlSZXNvdXJjZUtpbmRPdXRlckNsYXNzYgZwcm90bzM", [file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_group, file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config, file_google_protobuf_descriptor]);
 /**
  * Describes the message ai.stigmer.commons.apiresource.apiresourcekind.ApiResourceKindMeta.
  * Use `create(ApiResourceKindMetaSchema)` to create a new message.
@@ -154,6 +154,13 @@ export var ApiResourceKind;
     /**
      * Top-level tenant that owns and manages resources.
      *
+     * Organization is the one resource whose metadata.id equals its metadata.slug
+     * (set by the create pipeline), not a minted org_<ulid>. It is the immutable,
+     * globally unique tenancy root that every child resource references by slug
+     * (metadata.org), so its slug is globally unique and doubles as its id.
+     * id_prefix below is retained deliberately: it still anchors legacy org_<ulid>
+     * records and the CLI's id-vs-slug detection — it is not used to mint new ids.
+     *
      * @generated from enum value: organization = 30;
      */
     ApiResourceKind[ApiResourceKind["organization"] = 30] = "organization";

package/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_resource_kind_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sKAAsK;AACtK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAExF,OAAO,EAAE,sEAAsE,EAAE,MAAM,4BAA4B,CAAC;AAEpH,OAAO,EAAE,wEAAwE,EAAE,MAAM,8BAA8B,CAAC;AAExH,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAGzE;;GAEG;AACH,MAAM,CAAC,MAAM,qEAAqE,GAAY,aAAa,CACzG,QAAQ,CAAC,wuHAAwuH,EAAE,CAAC,sEAAsE,EAAE,wEAAwE,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAwE16H;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAcX;AAdD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,mHAAoC,CAAA;IAEpC;;;;OAIG;IACH,uDAAM,CAAA;AACR,CAAC,EAdW,kBAAkB,KAAlB,kBAAkB,QAc7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,YAmBX;AAnBD,WAAY,YAAY;IACtB;;OAEG;IACH,yFAA6B,CAAA;IAE7B;;;;OAIG;IACH,6DAAe,CAAA;IAEf;;;;OAIG;IACH,2DAAc,CAAA;AAChB,CAAC,EAnBW,YAAY,KAAZ,YAAY,QAmBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0B,aAAa,CACpE,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eAaX;AAbD,WAAY,eAAe;IACzB;;OAEG;IACH,uGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,2DAAW,CAAA;AACb,CAAC,EAbW,eAAe,KAAf,eAAe,QAa1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAwKX;AAxKD,WAAY,eAAe;IACzB;;;;OAIG;IACH,+FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qFAAwB,CAAA;IAExB;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,8EAAqB,CAAA;IAErB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,gEAAc,CAAA;IAEd;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;OAIG;IACH,sEAAiB,CAAA;IAEjB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,0EAAmB,CAAA;IAEnB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,kFAAuB,CAAA;IAEvB;;;;OAIG;IACH,oEAAgB,CAAA;IAEhB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,4DAAY,CAAA;AACd,CAAC,EAxKW,eAAe,KAAf,eAAe,QAwK1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAwD,aAAa,CACzF,OAAO,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api_resource_kind_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sKAAsK;AACtK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAExF,OAAO,EAAE,sEAAsE,EAAE,MAAM,4BAA4B,CAAC;AAEpH,OAAO,EAAE,wEAAwE,EAAE,MAAM,8BAA8B,CAAC;AAExH,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAGzE;;GAEG;AACH,MAAM,CAAC,MAAM,qEAAqE,GAAY,aAAa,CACzG,QAAQ,CAAC,6uHAA6uH,EAAE,CAAC,sEAAsE,EAAE,wEAAwE,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAwE/6H;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAcX;AAdD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,mHAAoC,CAAA;IAEpC;;;;OAIG;IACH,uDAAM,CAAA;AACR,CAAC,EAdW,kBAAkB,KAAlB,kBAAkB,QAc7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,YAmBX;AAnBD,WAAY,YAAY;IACtB;;OAEG;IACH,yFAA6B,CAAA;IAE7B;;;;OAIG;IACH,6DAAe,CAAA;IAEf;;;;OAIG;IACH,2DAAc,CAAA;AAChB,CAAC,EAnBW,YAAY,KAAZ,YAAY,QAmBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0B,aAAa,CACpE,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eAaX;AAbD,WAAY,eAAe;IACzB;;OAEG;IACH,uGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,2DAAW,CAAA;AACb,CAAC,EAbW,eAAe,KAAf,eAAe,QAa1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,eA+KX;AA/KD,WAAY,eAAe;IACzB;;;;OAIG;IACH,+FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qFAAwB,CAAA;IAExB;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,8EAAqB,CAAA;IAErB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,gEAAc,CAAA;IAEd;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;;;;;;;;OAWG;IACH,sEAAiB,CAAA;IAEjB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,0EAAmB,CAAA;IAEnB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,kFAAuB,CAAA;IAEvB;;;;OAIG;IACH,oEAAgB,CAAA;IAEhB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,4DAAY,CAAA;AACd,CAAC,EA/KW,eAAe,KAAf,eAAe,QA+K1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAwD,aAAa,CACzF,OAAO,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/enum_pb.d.ts

@@ -130,7 +130,9 @@ export declare const ApiResourceStateOperationTypeSchema: GenEnum<ApiResourceSta
 export declare enum ApiResourceVisibility {
     /**
      * Default/unspecified - backend infers from context.
-     * For new resources: defaults to visibility_private.
+     * For new resources the default is config-driven per kind: blueprint kinds
+     * marked defaults_to_org_visibility default to visibility_org; all other
+     * kinds default to visibility_private.
      *
      * @generated from enum value: api_resource_visibility_unspecified = 0;
      */

package/ai/stigmer/commons/apiresource/enum_pb.js

@@ -136,7 +136,9 @@ export var ApiResourceVisibility;
 (function (ApiResourceVisibility) {
     /**
      * Default/unspecified - backend infers from context.
-     * For new resources: defaults to visibility_private.
+     * For new resources the default is config-driven per kind: blueprint kinds
+     * marked defaults_to_org_visibility default to visibility_org; all other
+     * kinds default to visibility_private.
      *
      * @generated from enum value: api_resource_visibility_unspecified = 0;
      */

package/ai/stigmer/commons/apiresource/enum_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,oqBAAoqB,CAAC,CAAC;AAEjrB;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,qBAmEX;AAnED,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,+HAAuC,CAAA;IAEvC;;;;;;OAMG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;OAOG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;OAWG;IACH,qFAAkB,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,+FAAuB,CAAA;AACzB,CAAC,EAnEW,qBAAqB,KAArB,qBAAqB,QAmEhC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,oqBAAoqB,CAAC,CAAC;AAEjrB;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,qBAqEX;AArED,WAAY,qBAAqB;IAC/B;;;;;;;OAOG;IACH,+HAAuC,CAAA;IAEvC;;;;;;OAMG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;OAOG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;OAWG;IACH,qFAAkB,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,+FAAuB,CAAA;AACzB,CAAC,EArEW,qBAAqB,KAArB,qBAAqB,QAqEhC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/metadata_pb.d.ts

@@ -33,6 +33,10 @@ export type ApiResourceMetadata = Message<"ai.stigmer.commons.apiresource.ApiRes
     /**
      * System-generated unique identifier.
      *
+     * For every kind this is a generated, prefixed id (e.g. agt_<ulid>). The one
+     * exception is Organization: its id equals its slug (the globally unique
+     * tenancy root is addressed by slug, not a minted id).
+     *
      * @generated from field: string id = 3;
      */
     id: string;
@@ -49,7 +53,8 @@ export type ApiResourceMetadata = Message<"ai.stigmer.commons.apiresource.ApiRes
      * Visibility controls who can access this resource.
      * - PRIVATE: Only members of the owning organization can access.
      * - PUBLIC: Anyone can access (read). Write access still requires org membership.
-     * Default: PRIVATE for new resources.
+     * Default: config-driven per kind — blueprint kinds (marked
+     * defaults_to_org_visibility) default to ORG; all other kinds default to PRIVATE.
      *
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceVisibility visibility = 5;
      */

package/ai/stigmer/commons/apiresource/metadata_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/metadata_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,s/BAAs/B,EAAE,CAAC,wCAAwC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAqF3kC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAkD/D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"metadata_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/metadata_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,s/BAAs/B,EAAE,CAAC,wCAAwC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA0F3kC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAkD/D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_connect.d.ts

@@ -11,6 +11,10 @@
  * chain validates these tokens via a dedicated PlatformClientTokenAuthenticationProvider
  * that checks the Stigmer-issued signature and resolves the identity account.
  *
+ * mintGuestToken is the credential-free exception: no client_id/client_secret.
+ * It mints a guest-scoped JWT for anonymous visitors of a shared agent's
+ * hosted page, gated on spec.sharing.enabled.
+ *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientTokenController
  */
 export declare const PlatformClientTokenController: {
@@ -52,5 +56,24 @@ export declare const PlatformClientTokenController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Mint a guest-scoped JWT for an anonymous visitor of a shared agent's hosted page.
+         *
+         * Resolves org+slug to a shared agent, provisions the org's system-managed
+         * PlatformClient and guest identity account lazily, and returns a short-lived
+         * Stigmer-signed JWT scoped to that org.
+         *
+         * @internal
+         * Public — no Bearer token. No PlatformClient credentials. The handler gates
+         * on agent.spec.sharing.enabled (NOT_FOUND when unshared or missing).
+         *
+         * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintGuestToken
+         */
+        readonly mintGuestToken: {
+            readonly name: "mintGuestToken";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
     };
 };

package/ai/stigmer/iam/platformclient/v1/token_connect.js

@@ -2,7 +2,7 @@
 // @generated from file ai/stigmer/iam/platformclient/v1/token.proto (package ai.stigmer.iam.platformclient.v1, syntax proto3)
 /* eslint-disable */
 // @ts-nocheck
-import { MintUserTokenRequest, MintUserTokenResponse } from "./token_pbjs";
+import { MintGuestTokenRequest, MintGuestTokenResponse, MintUserTokenRequest, MintUserTokenResponse } from "./token_pbjs";
 import { MethodKind } from "@bufbuild/protobuf";
 /**
  * PlatformClientTokenController provides token-minting operations for
@@ -17,6 +17,10 @@ import { MethodKind } from "@bufbuild/protobuf";
  * chain validates these tokens via a dedicated PlatformClientTokenAuthenticationProvider
  * that checks the Stigmer-issued signature and resolves the identity account.
  *
+ * mintGuestToken is the credential-free exception: no client_id/client_secret.
+ * It mints a guest-scoped JWT for anonymous visitors of a shared agent's
+ * hosted page, gated on spec.sharing.enabled.
+ *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientTokenController
  */
 export const PlatformClientTokenController = {
@@ -58,6 +62,25 @@ export const PlatformClientTokenController = {
             O: MintUserTokenResponse,
             kind: MethodKind.Unary,
         },
+        /**
+         * Mint a guest-scoped JWT for an anonymous visitor of a shared agent's hosted page.
+         *
+         * Resolves org+slug to a shared agent, provisions the org's system-managed
+         * PlatformClient and guest identity account lazily, and returns a short-lived
+         * Stigmer-signed JWT scoped to that org.
+         *
+         * @internal
+         * Public — no Bearer token. No PlatformClient credentials. The handler gates
+         * on agent.spec.sharing.enabled (NOT_FOUND when unshared or missing).
+         *
+         * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintGuestToken
+         */
+        mintGuestToken: {
+            name: "mintGuestToken",
+            I: MintGuestTokenRequest,
+            O: MintGuestTokenResponse,
+            kind: MethodKind.Unary,
+        },
     }
 };
 //# sourceMappingURL=token_connect.js.map

package/ai/stigmer/iam/platformclient/v1/token_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_pb.d.ts

@@ -101,6 +101,121 @@ export type MintUserTokenResponse = Message<"ai.stigmer.iam.platformclient.v1.Mi
  * Use `create(MintUserTokenResponseSchema)` to create a new message.
  */
 export declare const MintUserTokenResponseSchema: GenMessage<MintUserTokenResponse>;
+/**
+ * MintGuestTokenRequest identifies a shared agent and optional visitor cookie id.
+ *
+ * @generated from message ai.stigmer.iam.platformclient.v1.MintGuestTokenRequest
+ */
+export type MintGuestTokenRequest = Message<"ai.stigmer.iam.platformclient.v1.MintGuestTokenRequest"> & {
+    /**
+     * Organization slug from the share URL (required).
+     *
+     * @generated from field: string org = 1;
+     */
+    org: string;
+    /**
+     * Agent slug from the share URL (required).
+     *
+     * @generated from field: string slug = 2;
+     */
+    slug: string;
+    /**
+     * Per-browser visitor cookie id from a prior mint (optional).
+     *
+     * When empty, the server generates a high-entropy id and returns it so the
+     * hosted page can persist it in an httpOnly cookie. When supplied, it must
+     * be the value previously returned by this RPC for the same visitor.
+     *
+     * @generated from field: string guest_cookie_id = 3;
+     */
+    guestCookieId: string;
+    /**
+     * Web origin of the page embedding the shared agent (optional).
+     *
+     * Set by the hosted chat page when it runs inside an iframe (the embedding
+     * page's origin, e.g. "https://docs.example.com") and by direct SDK embeds
+     * (their own page origin). Leave empty on the unframed hosted page. The
+     * literal value "null" reports a framed page whose parent origin could not
+     * be determined (opaque origin).
+     *
+     * @internal
+     * Validated at mint against the agent's spec.sharing.allowed_origins:
+     * empty list admits any origin; a non-empty list refuses PERMISSION_DENIED
+     * for unlisted origins and for "null". An empty field always passes (the
+     * anyone-with-link hosted page). The validated value is stamped into the
+     * guest JWT as the embed_origin claim and re-validated against the live
+     * list by the guest create-time gate. Self-reported by design: the widget
+     * code inside the iframe derives it from browser-authentic sources the
+     * embedder cannot alter; non-browser callers gain nothing by omitting it
+     * since the hosted link is anyone-with-link (decision 001) — rate limits
+     * and the billing gate remain the API guards.
+     *
+     * @generated from field: string embed_origin = 4;
+     */
+    embedOrigin: string;
+    /**
+     * Link token from the share URL's `?k=` parameter (optional).
+     *
+     * Required when the agent's share link has been locked with
+     * rotateShareLink; ignored for plain share links.
+     *
+     * @internal
+     * Validated at mint against the agent's live status.share_link_token
+     * (mismatch or absence answers the same NOT_FOUND as an unshared agent,
+     * so a killed link is indistinguishable from a nonexistent one). The
+     * validated value is stamped into the guest JWT as the link_token claim
+     * and re-validated against the live value by the guest create-time gate
+     * on every session/execution create — rotation therefore revokes live
+     * guest tokens on their next message, exactly like disabling sharing.
+     *
+     * @generated from field: string link_token = 5;
+     */
+    linkToken: string;
+};
+/**
+ * Describes the message ai.stigmer.iam.platformclient.v1.MintGuestTokenRequest.
+ * Use `create(MintGuestTokenRequestSchema)` to create a new message.
+ */
+export declare const MintGuestTokenRequestSchema: GenMessage<MintGuestTokenRequest>;
+/**
+ * MintGuestTokenResponse contains the guest JWT and the visitor cookie id.
+ *
+ * @generated from message ai.stigmer.iam.platformclient.v1.MintGuestTokenResponse
+ */
+export type MintGuestTokenResponse = Message<"ai.stigmer.iam.platformclient.v1.MintGuestTokenResponse"> & {
+    /**
+     * Stigmer-signed JWT for authenticating shared-agent chat API calls.
+     *
+     * @generated from field: string access_token = 1;
+     */
+    accessToken: string;
+    /**
+     * Token type. Always "Bearer".
+     *
+     * @generated from field: string token_type = 2;
+     */
+    tokenType: string;
+    /**
+     * Token lifetime in seconds from the time of issuance.
+     *
+     * @generated from field: int32 expires_in = 3;
+     */
+    expiresIn: number;
+    /**
+     * Visitor cookie id to persist client-side (httpOnly cookie in item 3).
+     *
+     * Echoes guest_cookie_id from the request when provided; otherwise a newly
+     * generated high-entropy value.
+     *
+     * @generated from field: string guest_cookie_id = 4;
+     */
+    guestCookieId: string;
+};
+/**
+ * Describes the message ai.stigmer.iam.platformclient.v1.MintGuestTokenResponse.
+ * Use `create(MintGuestTokenResponseSchema)` to create a new message.
+ */
+export declare const MintGuestTokenResponseSchema: GenMessage<MintGuestTokenResponse>;
 /**
  * PlatformClientTokenController provides token-minting operations for
  * platform builders embedding Stigmer into their products.
@@ -114,6 +229,10 @@ export declare const MintUserTokenResponseSchema: GenMessage<MintUserTokenRespon
  * chain validates these tokens via a dedicated PlatformClientTokenAuthenticationProvider
  * that checks the Stigmer-issued signature and resolves the identity account.
  *
+ * mintGuestToken is the credential-free exception: no client_id/client_secret.
+ * It mints a guest-scoped JWT for anonymous visitors of a shared agent's
+ * hosted page, gated on spec.sharing.enabled.
+ *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientTokenController
  */
 export declare const PlatformClientTokenController: GenService<{
@@ -152,4 +271,22 @@ export declare const PlatformClientTokenController: GenService<{
         input: typeof MintUserTokenRequestSchema;
         output: typeof MintUserTokenResponseSchema;
     };
+    /**
+     * Mint a guest-scoped JWT for an anonymous visitor of a shared agent's hosted page.
+     *
+     * Resolves org+slug to a shared agent, provisions the org's system-managed
+     * PlatformClient and guest identity account lazily, and returns a short-lived
+     * Stigmer-signed JWT scoped to that org.
+     *
+     * @internal
+     * Public — no Bearer token. No PlatformClient credentials. The handler gates
+     * on agent.spec.sharing.enabled (NOT_FOUND when unshared or missing).
+     *
+     * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintGuestToken
+     */
+    mintGuestToken: {
+        methodKind: "unary";
+        input: typeof MintGuestTokenRequestSchema;
+        output: typeof MintGuestTokenResponseSchema;
+    };
 }>;

package/ai/stigmer/iam/platformclient/v1/token_pb.js

@@ -7,7 +7,7 @@ import { file_buf_validate_validate } from "../../../../../buf/validate/validate
 /**
  * Describes the file ai/stigmer/iam/platformclient/v1/token.proto.
  */
-export const file_ai_stigmer_iam_platformclient_v1_token = /*@__PURE__*/ fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS90b2tlbi5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiowEKFE1pbnRVc2VyVG9rZW5SZXF1ZXN0EhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEhgKB3VzZXJfaWQYAyABKAlCB7pIBHICEAESEgoKdXNlcl9lbWFpbBgEIAEoCRIRCgl1c2VyX25hbWUYBSABKAkSDgoGb3JnX2lkGAYgASgJIlUKFU1pbnRVc2VyVG9rZW5SZXNwb25zZRIUCgxhY2Nlc3NfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRISCgpleHBpcmVzX2luGAMgASgFMqgBCh1QbGF0Zm9ybUNsaWVudFRva2VuQ29udHJvbGxlchKGAQoNbWludFVzZXJUb2tlbhI2LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLk1pbnRVc2VyVG9rZW5SZXF1ZXN0GjcuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludFVzZXJUb2tlblJlc3BvbnNlIgTIuBgBYgZwcm90bzM", [file_ai_stigmer_commons_rpc_method_options, file_buf_validate_validate]);
+export const file_ai_stigmer_iam_platformclient_v1_token = /*@__PURE__*/ fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS90b2tlbi5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiowEKFE1pbnRVc2VyVG9rZW5SZXF1ZXN0EhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEhgKB3VzZXJfaWQYAyABKAlCB7pIBHICEAESEgoKdXNlcl9lbWFpbBgEIAEoCRIRCgl1c2VyX25hbWUYBSABKAkSDgoGb3JnX2lkGAYgASgJIlUKFU1pbnRVc2VyVG9rZW5SZXNwb25zZRIUCgxhY2Nlc3NfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRISCgpleHBpcmVzX2luGAMgASgFIskDChVNaW50R3Vlc3RUb2tlblJlcXVlc3QSFAoDb3JnGAEgASgJQge6SARyAhABEhUKBHNsdWcYAiABKAlCB7pIBHICEAESFwoPZ3Vlc3RfY29va2llX2lkGAMgASgJEssCCgxlbWJlZF9vcmlnaW4YBCABKAlCtAK6SLACugGsAgoTZW1iZWRfb3JpZ2luLmZvcm1hdBJ3ZW1iZWRfb3JpZ2luIG11c3QgYmUgZW1wdHksICJudWxsIiwgb3IgYW4gZXhhY3Qgd2ViIG9yaWdpbiBsaWtlIGh0dHBzOi8vZXhhbXBsZS5jb20gKG5vIHBhdGgsIHF1ZXJ5LCBvciB0cmFpbGluZyBzbGFzaCkamwF0aGlzID09ICcnIHx8IHRoaXMgPT0gJ251bGwnIHx8IHRoaXMubWF0Y2hlcygnXmh0dHBzPzovL1tBLVphLXowLTldKFtBLVphLXowLTktXSpbQS1aYS16MC05XSk/KFxcLltBLVphLXowLTldKFtBLVphLXowLTktXSpbQS1aYS16MC05XSk/KSooOlswLTldezEsNX0pPyQnKRIcCgpsaW5rX3Rva2VuGAUgASgJQgi6SAVyAxiAASJvChZNaW50R3Vlc3RUb2tlblJlc3BvbnNlEhQKDGFjY2Vzc190b2tlbhgBIAEoCRISCgp0b2tlbl90eXBlGAIgASgJEhIKCmV4cGlyZXNfaW4YAyABKAUSFwoPZ3Vlc3RfY29va2llX2lkGAQgASgJMrQCCh1QbGF0Zm9ybUNsaWVudFRva2VuQ29udHJvbGxlchKGAQoNbWludFVzZXJUb2tlbhI2LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLk1pbnRVc2VyVG9rZW5SZXF1ZXN0GjcuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludFVzZXJUb2tlblJlc3BvbnNlIgTIuBgBEokBCg5taW50R3Vlc3RUb2tlbhI3LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLk1pbnRHdWVzdFRva2VuUmVxdWVzdBo4LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLk1pbnRHdWVzdFRva2VuUmVzcG9uc2UiBMi4GAFiBnByb3RvMw", [file_ai_stigmer_commons_rpc_method_options, file_buf_validate_validate]);
 /**
  * Describes the message ai.stigmer.iam.platformclient.v1.MintUserTokenRequest.
  * Use `create(MintUserTokenRequestSchema)` to create a new message.
@@ -18,6 +18,16 @@ export const MintUserTokenRequestSchema = /*@__PURE__*/ messageDesc(file_ai_stig
  * Use `create(MintUserTokenResponseSchema)` to create a new message.
  */
 export const MintUserTokenResponseSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_platformclient_v1_token, 1);
+/**
+ * Describes the message ai.stigmer.iam.platformclient.v1.MintGuestTokenRequest.
+ * Use `create(MintGuestTokenRequestSchema)` to create a new message.
+ */
+export const MintGuestTokenRequestSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_platformclient_v1_token, 2);
+/**
+ * Describes the message ai.stigmer.iam.platformclient.v1.MintGuestTokenResponse.
+ * Use `create(MintGuestTokenResponseSchema)` to create a new message.
+ */
+export const MintGuestTokenResponseSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_platformclient_v1_token, 3);
 /**
  * PlatformClientTokenController provides token-minting operations for
  * platform builders embedding Stigmer into their products.
@@ -31,6 +41,10 @@ export const MintUserTokenResponseSchema = /*@__PURE__*/ messageDesc(file_ai_sti
  * chain validates these tokens via a dedicated PlatformClientTokenAuthenticationProvider
  * that checks the Stigmer-issued signature and resolves the identity account.
  *
+ * mintGuestToken is the credential-free exception: no client_id/client_secret.
+ * It mints a guest-scoped JWT for anonymous visitors of a shared agent's
+ * hosted page, gated on spec.sharing.enabled.
+ *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientTokenController
  */
 export const PlatformClientTokenController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_iam_platformclient_v1_token, 0);

package/ai/stigmer/iam/platformclient/v1/token_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,6qBAA6qB,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAqEpwB;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAoCrC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,omDAAomD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAqE3rD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8E9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAwC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAsDrC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/v1/enum_pb.d.ts

@@ -139,10 +139,13 @@ export declare enum IamPermission {
      */
     can_create_runner = 25,
     /**
-     * Platform-level permission to delete sessions.
-     * Session deletion is restricted to operators to preserve billing audit trail.
+     * Deprecated: session deletion is authorized via can_delete on the
+     * session itself (owner-only). This platform-level permission is no
+     * longer referenced by any RPC or FGA relation; the value is retained
+     * because enum value removal is a breaking change.
      *
-     * @generated from enum value: can_delete_session = 26;
+     * @generated from enum value: can_delete_session = 26 [deprecated = true];
+     * @deprecated
      */
     can_delete_session = 26,
     /**

package/ai/stigmer/iam/v1/enum_pb.js

@@ -5,7 +5,7 @@ import { enumDesc, fileDesc } from "@bufbuild/protobuf/codegenv1";
 /**
  * Describes the file ai/stigmer/iam/v1/enum.proto.
  */
-export const file_ai_stigmer_iam_v1_enum = /*@__PURE__*/ fileDesc("ChxhaS9zdGlnbWVyL2lhbS92MS9lbnVtLnByb3RvEhFhaS5zdGlnbWVyLmlhbS52MSqyBQoNSWFtUGVybWlzc2lvbhIPCgt1bnNwZWNpZmllZBAAEgwKCGNhbl92aWV3EAESDAoIY2FuX2VkaXQQAhIOCgpjYW5fZGVsZXRlEAMSFAoQY2FuX2dyYW50X2FjY2VzcxAEEhMKD2Nhbl92aWV3X2FjY2VzcxAFEhQKEGNhbl9jcmVhdGVfYWdlbnQQBhIXChNjYW5fY3JlYXRlX3dvcmtmbG93EAcSFgoSY2FuX2NyZWF0ZV9zZXNzaW9uEAgSFAoQY2FuX2NyZWF0ZV9za2lsbBAJEhYKEmNhbl9jcmVhdGVfcHJvamVjdBAKEhIKDmNhbl9jcmVhdGVfaWRwEAsSGgoWY2FuX2NyZWF0ZV9lbnZpcm9ubWVudBAMEh8KG2Nhbl9jcmVhdGVfaWRlbnRpdHlfYWNjb3VudBAVEhgKFGNhbl9jcmVhdGVfb2F1dGhfYXBwEBcSHgoaY2FuX2NyZWF0ZV9wbGF0Zm9ybV9jbGllbnQQGBIbChdjYW5fY3JlYXRlX2V4ZWN1dGlvbl9pbhANEhcKE2Nhbl9jcmVhdGVfaW5zdGFuY2UQDhIPCgtjYW5fZXhlY3V0ZRAPEhQKEGNhbl9yZWFkX3NlY3JldHMQEBIVChFjYW5fYm9vdHN0cmFwX2lhbRAREiAKHGNhbl9tYW5hZ2VfaWRlbnRpdHlfYWNjb3VudHMQEhIYChRsb2dpbl90b19iYWNrX29mZmljZRAUEg8KC2Nhbl9jb25uZWN0EBYSFQoRY2FuX2NyZWF0ZV9ydW5uZXIQGRIWChJjYW5fZGVsZXRlX3Nlc3Npb24QGhIUChBjYW5fdmlld19iaWxsaW5nEBsSFgoSY2FuX21hbmFnZV9iaWxsaW5nEBwSGwoXY2FuX2V4ZWN1dGVfYmlsbGluZ19vcHMQHSpRCgdJYW1Sb2xlEhgKFGlhbV9yb2xlX3Vuc3BlY2lmaWVkEAASCQoFb3duZXIQARIJCgVhZG1pbhACEgoKBm1lbWJlchADEgoKBnZpZXdlchAEYgZwcm90bzM");
+export const file_ai_stigmer_iam_v1_enum = /*@__PURE__*/ fileDesc("ChxhaS9zdGlnbWVyL2lhbS92MS9lbnVtLnByb3RvEhFhaS5zdGlnbWVyLmlhbS52MSq2BQoNSWFtUGVybWlzc2lvbhIPCgt1bnNwZWNpZmllZBAAEgwKCGNhbl92aWV3EAESDAoIY2FuX2VkaXQQAhIOCgpjYW5fZGVsZXRlEAMSFAoQY2FuX2dyYW50X2FjY2VzcxAEEhMKD2Nhbl92aWV3X2FjY2VzcxAFEhQKEGNhbl9jcmVhdGVfYWdlbnQQBhIXChNjYW5fY3JlYXRlX3dvcmtmbG93EAcSFgoSY2FuX2NyZWF0ZV9zZXNzaW9uEAgSFAoQY2FuX2NyZWF0ZV9za2lsbBAJEhYKEmNhbl9jcmVhdGVfcHJvamVjdBAKEhIKDmNhbl9jcmVhdGVfaWRwEAsSGgoWY2FuX2NyZWF0ZV9lbnZpcm9ubWVudBAMEh8KG2Nhbl9jcmVhdGVfaWRlbnRpdHlfYWNjb3VudBAVEhgKFGNhbl9jcmVhdGVfb2F1dGhfYXBwEBcSHgoaY2FuX2NyZWF0ZV9wbGF0Zm9ybV9jbGllbnQQGBIbChdjYW5fY3JlYXRlX2V4ZWN1dGlvbl9pbhANEhcKE2Nhbl9jcmVhdGVfaW5zdGFuY2UQDhIPCgtjYW5fZXhlY3V0ZRAPEhQKEGNhbl9yZWFkX3NlY3JldHMQEBIVChFjYW5fYm9vdHN0cmFwX2lhbRAREiAKHGNhbl9tYW5hZ2VfaWRlbnRpdHlfYWNjb3VudHMQEhIYChRsb2dpbl90b19iYWNrX29mZmljZRAUEg8KC2Nhbl9jb25uZWN0EBYSFQoRY2FuX2NyZWF0ZV9ydW5uZXIQGRIaChJjYW5fZGVsZXRlX3Nlc3Npb24QGhoCCAESFAoQY2FuX3ZpZXdfYmlsbGluZxAbEhYKEmNhbl9tYW5hZ2VfYmlsbGluZxAcEhsKF2Nhbl9leGVjdXRlX2JpbGxpbmdfb3BzEB0qUQoHSWFtUm9sZRIYChRpYW1fcm9sZV91bnNwZWNpZmllZBAAEgkKBW93bmVyEAESCQoFYWRtaW4QAhIKCgZtZW1iZXIQAxIKCgZ2aWV3ZXIQBGIGcHJvdG8z");
 /**
  * IamPermission defines the permissions checked by the authorization
  * interceptor before an RPC handler executes.
@@ -143,10 +143,13 @@ export var IamPermission;
      */
     IamPermission[IamPermission["can_create_runner"] = 25] = "can_create_runner";
     /**
-     * Platform-level permission to delete sessions.
-     * Session deletion is restricted to operators to preserve billing audit trail.
+     * Deprecated: session deletion is authorized via can_delete on the
+     * session itself (owner-only). This platform-level permission is no
+     * longer referenced by any RPC or FGA relation; the value is retained
+     * because enum value removal is a breaking change.
      *
-     * @generated from enum value: can_delete_session = 26;
+     * @generated from enum value: can_delete_session = 26 [deprecated = true];
+     * @deprecated
      */
     IamPermission[IamPermission["can_delete_session"] = 26] = "can_delete_session";
     /**

package/ai/stigmer/iam/v1/enum_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/iam/v1/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+FAA+F;AAC/F,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAY,aAAa,CAC/D,QAAQ,CAAC,ylCAAylC,CAAC,CAAC;AAEtmC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,aA6KX;AA7KD,WAAY,aAAa;IACvB;;OAEG;IACH,+DAAe,CAAA;IAEf;;;;OAIG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,6DAAc,CAAA;IAEd;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,uEAAmB,CAAA;IAEnB;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,+EAAuB,CAAA;IAEvB;;OAEG;IACH,6EAAsB,CAAA;IAEtB;;OAEG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;OAEG;IACH,sEAAmB,CAAA;IAEnB;;OAEG;IACH,sFAA2B,CAAA;IAE3B;;OAEG;IACH,gGAAgC,CAAA;IAEhC;;OAEG;IACH,kFAAyB,CAAA;IAEzB;;OAEG;IACH,8FAA+B,CAAA;IAE/B;;;;OAIG;IACH,wFAA4B,CAAA;IAE5B;;OAEG;IACH,gFAAwB,CAAA;IAExB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;OAEG;IACH,kGAAiC,CAAA;IAEjC;;;;OAIG;IACH,kFAAyB,CAAA;IAEzB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;;;;OAKG;IACH,8EAAuB,CAAA;IAEvB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;;;;OAKG;IACH,wFAA4B,CAAA;AAC9B,CAAC,EA7KW,aAAa,KAAb,aAAa,QA6KxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;AAE3C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,OAiCX;AAjCD,WAAY,OAAO;IACjB;;OAEG;IACH,qEAAwB,CAAA;IAExB;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;OAIG;IACH,yCAAU,CAAA;AACZ,CAAC,EAjCW,OAAO,KAAP,OAAO,QAiClB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqB,aAAa,CAC1D,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/iam/v1/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+FAA+F;AAC/F,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAY,aAAa,CAC/D,QAAQ,CAAC,8lCAA8lC,CAAC,CAAC;AAE3mC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,aAgLX;AAhLD,WAAY,aAAa;IACvB;;OAEG;IACH,+DAAe,CAAA;IAEf;;;;OAIG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,6DAAc,CAAA;IAEd;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,uEAAmB,CAAA;IAEnB;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,+EAAuB,CAAA;IAEvB;;OAEG;IACH,6EAAsB,CAAA;IAEtB;;OAEG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;OAEG;IACH,sEAAmB,CAAA;IAEnB;;OAEG;IACH,sFAA2B,CAAA;IAE3B;;OAEG;IACH,gGAAgC,CAAA;IAEhC;;OAEG;IACH,kFAAyB,CAAA;IAEzB;;OAEG;IACH,8FAA+B,CAAA;IAE/B;;;;OAIG;IACH,wFAA4B,CAAA;IAE5B;;OAEG;IACH,gFAAwB,CAAA;IAExB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;OAEG;IACH,kGAAiC,CAAA;IAEjC;;;;OAIG;IACH,kFAAyB,CAAA;IAEzB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;;;;;;;OAQG;IACH,8EAAuB,CAAA;IAEvB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;;;;OAKG;IACH,wFAA4B,CAAA;AAC9B,CAAC,EAhLW,aAAa,KAAb,aAAa,QAgLxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;AAE3C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,OAiCX;AAjCD,WAAY,OAAO;IACjB;;OAEG;IACH,qEAAwB,CAAA;IAExB;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;OAIG;IACH,yCAAU,CAAA;AACZ,CAAC,EAjCW,OAAO,KAAP,OAAO,QAiClB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqB,aAAa,CAC1D,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/platform/v1/server_info_connect.d.ts

@@ -63,5 +63,45 @@ export declare const PlatformQueryController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Exchanges an embedded runner's bootstrap credential for a token scoped to
+         * one unit of dispatched work.
+         *
+         * The bootstrap token from getRunnerBootstrapConfig identifies a runner but
+         * is minted before any execution exists, so it carries no session or
+         * execution scope. Secrets are only released to runner credentials bound to
+         * the exact work they serve. At task start the runner presents its bootstrap
+         * token and names the execution it was dispatched; the control plane verifies
+         * the caller and returns a short-lived token scoped to that work, which the
+         * runner then uses for its ExecutionContext fetch. This makes a desktop
+         * runner indistinguishable, at the secret-release gate, from a
+         * server-provisioned sandbox runner.
+         *
+         * The token fields are empty when the server cannot mint (OSS, or no signing
+         * key configured) — the runner falls back to its existing credential.
+         *
+         * @internal
+         * Cloud mints via SandboxTokenService: an agent_execution_id yields a
+         * token_type=sandbox token carrying the execution's parent session_id (one
+         * session sandbox serves multi-turn executions); a workflow_execution_id
+         * yields token_type=workflow_sandbox carrying that id. Both are then bound by
+         * RunnerScopeVerifier on the getByExecutionId decrypt path exactly like
+         * cloud-sandbox-injected tokens (stigmer-cloud#155/#156).
+         *
+         * is_skip_authorization because the FGA target is derived from the input
+         * oneof, which the declarative interceptor cannot express — the handler
+         * enforces authorization itself (same pattern as getRunnerBootstrapConfig):
+         * the caller must present a runner-class token_type=embedded_runner
+         * credential AND pass the same can_view check getByExecutionId performs on
+         * the named execution.
+         *
+         * @generated from rpc ai.stigmer.platform.v1.PlatformQueryController.getRunnerScopedToken
+         */
+        readonly getRunnerScopedToken: {
+            readonly name: "getRunnerScopedToken";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
     };
 };