@stigmer/protos 3.10.0 → 3.11.1-dev.20260812192248

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.d.ts

@@ -71,13 +71,18 @@ export type McpServerSpec = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSp
     /**
      * Default tools to enable from this MCP server.
      * Empty list means all tools are enabled by default.
+     * Applies whenever an agent's McpServerUsage.enabled_tools is empty.
      *
      * @internal
      * Tool names must match exactly what the MCP server reports via tools/list.
      * Only names from discovered_capabilities.tools are valid here.
      * Do NOT include names from discovered_capabilities.resource_templates —
      * resource templates are read-only data endpoints, not callable tools.
-     * Including a resource template name here causes a fatal runtime error.
+     * A name the server does not expose (including a resource template name)
+     * is warned and ignored at execution: the runner enforces the INTERSECTION
+     * with the server's live toolset, so a stale or mistyped entry narrows the
+     * toolset but never widens it or fails the run. Enforcement is per harness
+     * — see McpServerUsage.enabled_tools in agent/v1/spec.proto.
      *
      * @generated from field: repeated string default_enabled_tools = 7;
      */

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,0mEAA0mE,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAmK7xE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA+D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA4E5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA6H5D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,0mEAA0mE,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwK7xE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA+D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA4E5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA6H5D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/status_pb.d.ts

@@ -102,8 +102,9 @@ export declare const McpServerStatusSchema: GenMessage<McpServerStatus>;
  *   - tools: Callable actions the agent can invoke (e.g., search_code, create_pr).
  *     Only tool names are valid in Agent enabled_tools and McpServer default_enabled_tools.
  *   - resource_templates: Read-only data endpoints accessed by URI template.
- *     Resource template names must NEVER appear in enabled_tools — doing so causes
- *     a fatal runtime error.
+ *     Resource template names must NEVER appear in enabled_tools — such a name
+ *     never matches a discovered tool, so the runner warns and ignores it
+ *     (enforcing the intersection with the live toolset).
  *
  * Populated by:
  * - Seedpack bootstrap (built-in servers with known, stable tool sets)

package/ai/stigmer/agentic/mcpserver/v1/status_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"status_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/status_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,yCAAyC,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGrG;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,y2DAAy2D,EAAE,CAAC,yCAAyC,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAsFljE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA6C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAkC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA2C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA6D9D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eA0BX;AA1BD,WAAY,eAAe;IACzB;;;;;OAKG;IACH,qGAAgC,CAAA;IAEhC;;;;;;OAMG;IACH,uDAAS,CAAA;IAET;;;;;;OAMG;IACH,2DAAW,CAAA;AACb,CAAC,EA1BW,eAAe,KAAf,eAAe,QA0B1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,cA6BX;AA7BD,WAAY,cAAc;IACxB;;;;OAIG;IACH,mGAAgC,CAAA;IAEhC;;;;OAIG;IACH,6FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,qFAAyB,CAAA;AAC3B,CAAC,EA7BW,cAAc,KAAd,cAAc,QA6BzB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA4B,aAAa,CACxE,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"status_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/status_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,yCAAyC,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGrG;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,y2DAAy2D,EAAE,CAAC,yCAAyC,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAsFljE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAkC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA2C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA6D9D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eA0BX;AA1BD,WAAY,eAAe;IACzB;;;;;OAKG;IACH,qGAAgC,CAAA;IAEhC;;;;;;OAMG;IACH,uDAAS,CAAA;IAET;;;;;;OAMG;IACH,2DAAW,CAAA;AACb,CAAC,EA1BW,eAAe,KAAf,eAAe,QA0B1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,cA6BX;AA7BD,WAAY,cAAc;IACxB;;;;OAIG;IACH,mGAAgC,CAAA;IAEhC;;;;OAIG;IACH,6FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,qFAAyB,CAAA;AAC3B,CAAC,EA7BW,cAAc,KAAd,cAAc,QA6BzB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA4B,aAAa,CACxE,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/workflowexecution/v1/io_pb.d.ts

@@ -857,9 +857,16 @@ export type SendSignalInput = Message<"ai.stigmer.agentic.workflowexecution.v1.S
      * Optional idempotency key for deduplication of signal delivery.
      *
      * @internal
-     * When provided, duplicate signals with the same key (within the 24-hour TTL window)
-     * return the cached response instead of re-delivering the signal.
-     * Keys are scoped to the organization to prevent cross-org collisions.
+     * When provided, a signal whose key was already DELIVERED (within a 24-hour
+     * window anchored at delivery) is rejected with ALREADY_EXISTS instead of
+     * being re-delivered; nothing is cached or replayed. A same-key request
+     * whose delivery is currently in flight is rejected with ABORTED — a
+     * retryable conflict, unlike ALREADY_EXISTS. A FAILED delivery frees the
+     * key (immediately on a clean failure, within a short in-flight hold after
+     * a crash), so retrying a failed attempt with the same key works — the
+     * scenario idempotency keys exist for. Both editions enforce this
+     * identically. Keys are scoped to the organization to prevent cross-org
+     * collisions.
      *
      * @since Gap B2 (Event Dedupe)
      *

package/ai/stigmer/agentic/workflowexecution/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowexecution/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yIAAyI;AACzI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,8CAA8C,EAAE,MAAM,oCAAoC,CAAC;AAEpG,OAAO,EAAE,gDAAgD,EAAE,MAAM,aAAa,CAAC;AAE/E,OAAO,EAAE,iDAAiD,EAAE,MAAM,cAAc,CAAC;AAEjF,OAAO,EAAE,kDAAkD,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGpI;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,8qOAA8qO,EAAE,CAAC,8CAA8C,EAAE,gDAAgD,EAAE,iDAAiD,EAAE,kDAAkD,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAuB9/O;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAsBlE;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA+BlE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAqGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAmElE;;;GAGG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAwD,aAAa,CAC7H,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA+GlE;;;GAGG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAmD,aAAa,CACnH,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA6DlE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAsGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAiGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAuBlE;;;GAGG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAkD,aAAa,CACjH,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAoClE;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAoCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA6CnE;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAgCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAyBnE;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA4DnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAqCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAgEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAoFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA0BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA0BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA+BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAmCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAiFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA8BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kBAqCX;AArCD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,yEAAe,CAAA;IAEf;;;;OAIG;IACH,uEAAc,CAAA;IAEd;;;;;;OAMG;IACH,mEAAY,CAAA;IAEZ;;;;OAIG;IACH,2DAAQ,CAAA;IAER;;;;OAIG;IACH,+DAAU,CAAA;AACZ,CAAC,EArCW,kBAAkB,KAAlB,kBAAkB,QAqC7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAyBX;AAzBD,WAAY,iBAAiB;IAC3B;;OAEG;IACH,uEAAe,CAAA;IAEf;;OAEG;IACH,iEAAY,CAAA;IAEZ;;OAEG;IACH,+DAAW,CAAA;IAEX;;OAEG;IACH,iEAAY,CAAA;IAEZ;;OAEG;IACH,iEAAY,CAAA;AACd,CAAC,EAzBW,iBAAiB,KAAjB,iBAAiB,QAyB5B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA+B,aAAa,CAC9E,QAAQ,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowexecution/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yIAAyI;AACzI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,8CAA8C,EAAE,MAAM,oCAAoC,CAAC;AAEpG,OAAO,EAAE,gDAAgD,EAAE,MAAM,aAAa,CAAC;AAE/E,OAAO,EAAE,iDAAiD,EAAE,MAAM,cAAc,CAAC;AAEjF,OAAO,EAAE,kDAAkD,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGpI;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,8qOAA8qO,EAAE,CAAC,8CAA8C,EAAE,gDAAgD,EAAE,iDAAiD,EAAE,kDAAkD,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAuB9/O;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAsBlE;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA+BlE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAqGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAmElE;;;GAGG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAwD,aAAa,CAC7H,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA+GlE;;;GAGG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAmD,aAAa,CACnH,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA6DlE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAsGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAiGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAuBlE;;;GAGG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAkD,aAAa,CACjH,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAoClE;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAoCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA6CnE;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAgCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAyBnE;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAmEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAqCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAgEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAoFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA0BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA0BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA+BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAmCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAiFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA8BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kBAqCX;AArCD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,yEAAe,CAAA;IAEf;;;;OAIG;IACH,uEAAc,CAAA;IAEd;;;;;;OAMG;IACH,mEAAY,CAAA;IAEZ;;;;OAIG;IACH,2DAAQ,CAAA;IAER;;;;OAIG;IACH,+DAAU,CAAA;AACZ,CAAC,EArCW,kBAAkB,KAAlB,kBAAkB,QAqC7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAyBX;AAzBD,WAAY,iBAAiB;IAC3B;;OAEG;IACH,uEAAe,CAAA;IAEf;;OAEG;IACH,iEAAY,CAAA;IAEZ;;OAEG;IACH,+DAAW,CAAA;IAEX;;OAEG;IACH,iEAAY,CAAA;IAEZ;;OAEG;IACH,iEAAY,CAAA;AACd,CAAC,EAzBW,iBAAiB,KAAjB,iBAAiB,QAyB5B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA+B,aAAa,CAC9E,QAAQ,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/billing/v1/model_pricing_baseline_pb.d.ts

@@ -300,6 +300,23 @@ export type ModelPricingBaseline = Message<"ai.stigmer.billing.v1.ModelPricingBa
     pricingVariants: {
         [key: string]: PricingVariant;
     };
+    /**
+     * Wire model names that resolve directly to this base entry — the
+     * base-level twin of PricingVariant.wire_ids, for served-model names
+     * that neither match the canonical id nor normalize to a clean
+     * "base + suffix" form (e.g. "gemini-3-flash-preview" for
+     * gemini-3-flash, "accounts/fireworks/models/kimi-k2p7-code" for
+     * kimi-k2.7-code — Cursor's serving stack reports upstream serving
+     * names the catalog never uses). Matched case-insensitively; billed
+     * at the base rates.
+     *
+     * Distinct from api_model_id, which is the single OUTBOUND identifier
+     * the runner dispatches with. Wire ids are INBOUND aliases only: they
+     * must never appear in pickers or dispatch requests.
+     *
+     * @generated from field: repeated string wire_ids = 24;
+     */
+    wireIds: string[];
     /**
      * @generated from field: int32 context_window_tokens = 13;
      */

package/ai/stigmer/billing/v1/model_pricing_baseline_pb.js

@@ -7,7 +7,7 @@ import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/billing/v1/model_pricing_baseline.proto.
  */
-export const file_ai_stigmer_billing_v1_model_pricing_baseline = /*@__PURE__*/ fileDesc("CjJhaS9zdGlnbWVyL2JpbGxpbmcvdjEvbW9kZWxfcHJpY2luZ19iYXNlbGluZS5wcm90bxIVYWkuc3RpZ21lci5iaWxsaW5nLnYxIoADCgxQcmljaW5nQmxvY2sSLwoeaW5wdXRfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAEgASgDQge6SAQiAigAEjAKH291dHB1dF9wcmljZV9taWNyb3NfcGVyX21pbGxpb24YAiABKANCB7pIBCICKAASNQokY2FjaGVfd3JpdGVfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAMgASgDQge6SAQiAigAEjQKI2NhY2hlX3JlYWRfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAQgASgDQge6SAQiAigAEjUKJGN1cnNvcl90b2tlbl9yYXRlX21pY3Jvc19wZXJfbWlsbGlvbhgFIAEoA0IHukgEIgIoABIYCgZzb3VyY2UYBiABKAlCCLpIBXIDGIABEh0KC3NvdXJjZV9ub3RlGAcgASgJQgi6SAVyAxiAEBIwCgxlZmZlY3RpdmVfYXQYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIm8KDlByaWNpbmdWYXJpYW50EjwKB3ByaWNpbmcYASABKAsyIy5haS5zdGlnbWVyLmJpbGxpbmcudjEuUHJpY2luZ0Jsb2NrQga6SAPIAQESHwoId2lyZV9pZHMYAiADKAlCDbpICpIBByIFcgMYgAEifgoTU3VtbWFyaXphdGlvbkNvbmZpZxIiChF0cmlnZ2VyX3RocmVzaG9sZBgBIAEoBUIHukgEGgIoABIeCg10YXJnZXRfdG9rZW5zGAIgASgFQge6SAQaAigAEiMKEm1heF9zdW1tYXJ5X3Rva2VucxgDIAEoBUIHukgEGgIoACJ1ChFNb2RlbENhcGFiaWxpdGllcxIQCgh0b29sX3VzZRgBIAEoCBIOCgZ2aXNpb24YAiABKAgSEQoJc3RyZWFtaW5nGAMgASgIEhAKCHRoaW5raW5nGAQgASgIEhkKEWFkYXB0aXZlX3RoaW5raW5nGAUgASgIItYIChRNb2RlbFByaWNpbmdCYXNlbGluZRITCgtiYXNlbGluZV9pZBgBIAEoCRIdCghtb2RlbF9pZBgCIAEoCUILukgIyAEBcgMYgAESHgoMYXBpX21vZGVsX2lkGAMgASgJQgi6SAVyAxiAARIcCghwcm92aWRlchgEIAEoCUIKukgHyAEBcgIYQBIbCgdoYXJuZXNzGAUgASgJQgq6SAfIAQFyAhhAEiEKDGRpc3BsYXlfbmFtZRgGIAEoCUILukgIyAEBcgMYgAESIwoRc2hvcnRfZGVzY3JpcHRpb24YByABKAlCCLpIBXIDGIACEjgKCnNwZWVkX3RpZXIYCCABKAlCJLpIIXIfUgdmYXN0ZXN0UgRmYXN0UghiYWxhbmNlZFIEc2xvdxI0Cgljb3N0X3RpZXIYCSABKAlCIbpIHnIcUgdlY29ub215UghzdGFuZGFyZFIHcHJlbWl1bRIQCghmZWF0dXJlZBgKIAEoCBI8CgdwcmljaW5nGAsgASgLMiMuYWkuc3RpZ21lci5iaWxsaW5nLnYxLlByaWNpbmdCbG9ja0IGukgDyAEBEloKEHByaWNpbmdfdmFyaWFudHMYDCADKAsyQC5haS5zdGlnbWVyLmJpbGxpbmcudjEuTW9kZWxQcmljaW5nQmFzZWxpbmUuUHJpY2luZ1ZhcmlhbnRzRW50cnkSJgoVY29udGV4dF93aW5kb3dfdG9rZW5zGA0gASgFQge6SAQaAigAEiIKEW1heF9vdXRwdXRfdG9rZW5zGA4gASgFQge6SAQaAigAEiUKFHRva2VuX2NvdW50ZXJfbWV0aG9kGA8gASgJQge6SARyAhhAEkEKDXN1bW1hcml6YXRpb24YECABKAsyKi5haS5zdGlnbWVyLmJpbGxpbmcudjEuU3VtbWFyaXphdGlvbkNvbmZpZxI+CgxjYXBhYmlsaXRpZXMYESABKAsyKC5haS5zdGlnbWVyLmJpbGxpbmcudjEuTW9kZWxDYXBhYmlsaXRpZXMSQQoGc3RhdHVzGBIgASgOMjEuYWkuc3RpZ21lci5iaWxsaW5nLnYxLk1vZGVsUHJpY2luZ0Jhc2VsaW5lU3RhdHVzEh4KFnN1cGVyc2VkZXNfYmFzZWxpbmVfaWQYEyABKAkSEgoKZGVjaWRlZF9ieRgUIAEoCRIuCgpkZWNpZGVkX2F0GBUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIfCg1yZXZpc2lvbl9ub3RlGBYgASgJQgi6SAVyAxiACBIuCgpjcmVhdGVkX2F0GBcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBpdChRQcmljaW5nVmFyaWFudHNFbnRyeRILCgNrZXkYASABKAkSNAoFdmFsdWUYAiABKAsyJS5haS5zdGlnbWVyLmJpbGxpbmcudjEuUHJpY2luZ1ZhcmlhbnQ6AjgBKqcBChpNb2RlbFByaWNpbmdCYXNlbGluZVN0YXR1cxItCiltb2RlbF9wcmljaW5nX2Jhc2VsaW5lX3N0YXR1c191bnNwZWNpZmllZBAAEhsKF3ByaWNpbmdfYmFzZWxpbmVfYWN0aXZlEAESHwobcHJpY2luZ19iYXNlbGluZV9zdXBlcnNlZGVkEAISHAoYcHJpY2luZ19iYXNlbGluZV9yZXRpcmVkEANiBnByb3RvMw", [file_buf_validate_validate, file_google_protobuf_timestamp]);
+export const file_ai_stigmer_billing_v1_model_pricing_baseline = /*@__PURE__*/ fileDesc("CjJhaS9zdGlnbWVyL2JpbGxpbmcvdjEvbW9kZWxfcHJpY2luZ19iYXNlbGluZS5wcm90bxIVYWkuc3RpZ21lci5iaWxsaW5nLnYxIoADCgxQcmljaW5nQmxvY2sSLwoeaW5wdXRfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAEgASgDQge6SAQiAigAEjAKH291dHB1dF9wcmljZV9taWNyb3NfcGVyX21pbGxpb24YAiABKANCB7pIBCICKAASNQokY2FjaGVfd3JpdGVfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAMgASgDQge6SAQiAigAEjQKI2NhY2hlX3JlYWRfcHJpY2VfbWljcm9zX3Blcl9taWxsaW9uGAQgASgDQge6SAQiAigAEjUKJGN1cnNvcl90b2tlbl9yYXRlX21pY3Jvc19wZXJfbWlsbGlvbhgFIAEoA0IHukgEIgIoABIYCgZzb3VyY2UYBiABKAlCCLpIBXIDGIABEh0KC3NvdXJjZV9ub3RlGAcgASgJQgi6SAVyAxiAEBIwCgxlZmZlY3RpdmVfYXQYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIm8KDlByaWNpbmdWYXJpYW50EjwKB3ByaWNpbmcYASABKAsyIy5haS5zdGlnbWVyLmJpbGxpbmcudjEuUHJpY2luZ0Jsb2NrQga6SAPIAQESHwoId2lyZV9pZHMYAiADKAlCDbpICpIBByIFcgMYgAEifgoTU3VtbWFyaXphdGlvbkNvbmZpZxIiChF0cmlnZ2VyX3RocmVzaG9sZBgBIAEoBUIHukgEGgIoABIeCg10YXJnZXRfdG9rZW5zGAIgASgFQge6SAQaAigAEiMKEm1heF9zdW1tYXJ5X3Rva2VucxgDIAEoBUIHukgEGgIoACJ1ChFNb2RlbENhcGFiaWxpdGllcxIQCgh0b29sX3VzZRgBIAEoCBIOCgZ2aXNpb24YAiABKAgSEQoJc3RyZWFtaW5nGAMgASgIEhAKCHRoaW5raW5nGAQgASgIEhkKEWFkYXB0aXZlX3RoaW5raW5nGAUgASgIIvcIChRNb2RlbFByaWNpbmdCYXNlbGluZRITCgtiYXNlbGluZV9pZBgBIAEoCRIdCghtb2RlbF9pZBgCIAEoCUILukgIyAEBcgMYgAESHgoMYXBpX21vZGVsX2lkGAMgASgJQgi6SAVyAxiAARIcCghwcm92aWRlchgEIAEoCUIKukgHyAEBcgIYQBIbCgdoYXJuZXNzGAUgASgJQgq6SAfIAQFyAhhAEiEKDGRpc3BsYXlfbmFtZRgGIAEoCUILukgIyAEBcgMYgAESIwoRc2hvcnRfZGVzY3JpcHRpb24YByABKAlCCLpIBXIDGIACEjgKCnNwZWVkX3RpZXIYCCABKAlCJLpIIXIfUgdmYXN0ZXN0UgRmYXN0UghiYWxhbmNlZFIEc2xvdxI0Cgljb3N0X3RpZXIYCSABKAlCIbpIHnIcUgdlY29ub215UghzdGFuZGFyZFIHcHJlbWl1bRIQCghmZWF0dXJlZBgKIAEoCBI8CgdwcmljaW5nGAsgASgLMiMuYWkuc3RpZ21lci5iaWxsaW5nLnYxLlByaWNpbmdCbG9ja0IGukgDyAEBEloKEHByaWNpbmdfdmFyaWFudHMYDCADKAsyQC5haS5zdGlnbWVyLmJpbGxpbmcudjEuTW9kZWxQcmljaW5nQmFzZWxpbmUuUHJpY2luZ1ZhcmlhbnRzRW50cnkSHwoId2lyZV9pZHMYGCADKAlCDbpICpIBByIFcgMYgAESJgoVY29udGV4dF93aW5kb3dfdG9rZW5zGA0gASgFQge6SAQaAigAEiIKEW1heF9vdXRwdXRfdG9rZW5zGA4gASgFQge6SAQaAigAEiUKFHRva2VuX2NvdW50ZXJfbWV0aG9kGA8gASgJQge6SARyAhhAEkEKDXN1bW1hcml6YXRpb24YECABKAsyKi5haS5zdGlnbWVyLmJpbGxpbmcudjEuU3VtbWFyaXphdGlvbkNvbmZpZxI+CgxjYXBhYmlsaXRpZXMYESABKAsyKC5haS5zdGlnbWVyLmJpbGxpbmcudjEuTW9kZWxDYXBhYmlsaXRpZXMSQQoGc3RhdHVzGBIgASgOMjEuYWkuc3RpZ21lci5iaWxsaW5nLnYxLk1vZGVsUHJpY2luZ0Jhc2VsaW5lU3RhdHVzEh4KFnN1cGVyc2VkZXNfYmFzZWxpbmVfaWQYEyABKAkSEgoKZGVjaWRlZF9ieRgUIAEoCRIuCgpkZWNpZGVkX2F0GBUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIfCg1yZXZpc2lvbl9ub3RlGBYgASgJQgi6SAVyAxiACBIuCgpjcmVhdGVkX2F0GBcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBpdChRQcmljaW5nVmFyaWFudHNFbnRyeRILCgNrZXkYASABKAkSNAoFdmFsdWUYAiABKAsyJS5haS5zdGlnbWVyLmJpbGxpbmcudjEuUHJpY2luZ1ZhcmlhbnQ6AjgBKqcBChpNb2RlbFByaWNpbmdCYXNlbGluZVN0YXR1cxItCiltb2RlbF9wcmljaW5nX2Jhc2VsaW5lX3N0YXR1c191bnNwZWNpZmllZBAAEhsKF3ByaWNpbmdfYmFzZWxpbmVfYWN0aXZlEAESHwobcHJpY2luZ19iYXNlbGluZV9zdXBlcnNlZGVkEAISHAoYcHJpY2luZ19iYXNlbGluZV9yZXRpcmVkEANiBnByb3RvMw", [file_buf_validate_validate, file_google_protobuf_timestamp]);
 /**
  * Describes the message ai.stigmer.billing.v1.PricingBlock.
  * Use `create(PricingBlockSchema)` to create a new message.

package/ai/stigmer/billing/v1/model_pricing_baseline_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"model_pricing_baseline_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/billing/v1/model_pricing_baseline_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAErF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,owFAAowF,EAAE,CAAC,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AA+E/0F;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AA0BpE;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AAgCpE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AAsEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AA6KpE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,0BA4BX;AA5BD,WAAY,0BAA0B;IACpC;;OAEG;IACH,qJAA6C,CAAA;IAE7C;;;;;OAKG;IACH,iHAA2B,CAAA;IAE3B;;;;OAIG;IACH,yHAA+B,CAAA;IAE/B;;;;;OAKG;IACH,mHAA4B,CAAA;AAC9B,CAAC,EA5BW,0BAA0B,KAA1B,0BAA0B,QA4BrC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAwC,aAAa,CAChG,QAAQ,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"model_pricing_baseline_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/billing/v1/model_pricing_baseline_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAErF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,gzFAAgzF,EAAE,CAAC,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AA+E33F;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AA0BpE;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AAgCpE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AAsEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AA+LpE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,0BA4BX;AA5BD,WAAY,0BAA0B;IACpC;;OAEG;IACH,qJAA6C,CAAA;IAE7C;;;;;OAKG;IACH,iHAA2B,CAAA;IAE3B;;;;OAIG;IACH,yHAA+B,CAAA;IAE/B;;;;;OAKG;IACH,mHAA4B,CAAA;AAC9B,CAAC,EA5BW,0BAA0B,KAA1B,0BAA0B,QA4BrC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAwC,aAAa,CAChG,QAAQ,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/enum_pb.d.ts

@@ -119,7 +119,9 @@ export declare const ApiResourceStateOperationTypeSchema: GenEnum<ApiResourceSta
  *
  * The visibility levels map to FGA tuples:
  * - PRIVATE: no additional viewer tuples (owner-only access)
- * - ORG: resource#viewer@organization:<org>#member tuple (all org members)
+ * - ORG: resource#viewer@organization:<org>#viewer tuple (everyone in the
+ *   org — the org role hierarchy flows downward, so owners, admins, members
+ *   AND read-only viewers all satisfy the organization#viewer userset)
  * - PUBLIC: resource#viewer@identity_account:* with allow_public (all users)
  * - PLATFORM: resource#platform_viewer@identity_provider:<idp>#platform_user
  *   (all members of all organizations managed by the owning org's
@@ -165,14 +167,23 @@ export declare enum ApiResourceVisibility {
      */
     visibility_public = 2,
     /**
-     * All members of the owning organization can access (read) this resource.
+     * Everyone in the owning organization can access (read) this resource —
+     * all org roles including read-only viewers (the role SSO auto-provisioning
+     * grants by default). Running or otherwise spending against the resource
+     * still requires the org-level member-or-guest permissions
+     * (can_create_session / can_create_execution_in); org visibility widens
+     * read, never spend.
      * Used for instances where a team wants shared observability of executions
      * without granting access to all authenticated users.
      *
-     * FGA tuple: resource#viewer@organization:<org>#member
+     * FGA tuple: resource#viewer@organization:<org>#viewer
+     * (Before cloud#257 the tuple targeted organization#member, which
+     * excluded viewer-role users; legacy tuples keep resolving until the
+     * cloud's boot-time backfill converges them.)
      *
      * For workflow instances, this enables zero-tuple-per-execution shared
-     * observability: all org members see all executions via inheritance.
+     * observability: everyone in the org sees all executions via inheritance
+     * once the instance opts in.
      *
      * @generated from enum value: visibility_org = 3;
      */

package/ai/stigmer/commons/apiresource/enum_pb.js

@@ -124,7 +124,9 @@ export const ApiResourceStateOperationTypeSchema = /*@__PURE__*/ enumDesc(file_a
  *
  * The visibility levels map to FGA tuples:
  * - PRIVATE: no additional viewer tuples (owner-only access)
- * - ORG: resource#viewer@organization:<org>#member tuple (all org members)
+ * - ORG: resource#viewer@organization:<org>#viewer tuple (everyone in the
+ *   org — the org role hierarchy flows downward, so owners, admins, members
+ *   AND read-only viewers all satisfy the organization#viewer userset)
  * - PUBLIC: resource#viewer@identity_account:* with allow_public (all users)
  * - PLATFORM: resource#platform_viewer@identity_provider:<idp>#platform_user
  *   (all members of all organizations managed by the owning org's
@@ -171,14 +173,23 @@ export var ApiResourceVisibility;
      */
     ApiResourceVisibility[ApiResourceVisibility["visibility_public"] = 2] = "visibility_public";
     /**
-     * All members of the owning organization can access (read) this resource.
+     * Everyone in the owning organization can access (read) this resource —
+     * all org roles including read-only viewers (the role SSO auto-provisioning
+     * grants by default). Running or otherwise spending against the resource
+     * still requires the org-level member-or-guest permissions
+     * (can_create_session / can_create_execution_in); org visibility widens
+     * read, never spend.
      * Used for instances where a team wants shared observability of executions
      * without granting access to all authenticated users.
      *
-     * FGA tuple: resource#viewer@organization:<org>#member
+     * FGA tuple: resource#viewer@organization:<org>#viewer
+     * (Before cloud#257 the tuple targeted organization#member, which
+     * excluded viewer-role users; legacy tuples keep resolving until the
+     * cloud's boot-time backfill converges them.)
      *
      * For workflow instances, this enables zero-tuple-per-execution shared
-     * observability: all org members see all executions via inheritance.
+     * observability: everyone in the org sees all executions via inheritance
+     * once the instance opts in.
      *
      * @generated from enum value: visibility_org = 3;
      */

package/ai/stigmer/commons/apiresource/enum_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,oqBAAoqB,CAAC,CAAC;AAEjrB;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,qBA+EX;AA/ED,WAAY,qBAAqB;IAC/B;;;;;;;OAOG;IACH,+HAAuC,CAAA;IAEvC;;;;;;;;;;;;;;;;OAgBG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;OAOG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;OAWG;IACH,qFAAkB,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,+FAAuB,CAAA;AACzB,CAAC,EA/EW,qBAAqB,KAArB,qBAAqB,QA+EhC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,oqBAAoqB,CAAC,CAAC;AAEjrB;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,qBAwFX;AAxFD,WAAY,qBAAqB;IAC/B;;;;;;;OAOG;IACH,+HAAuC,CAAA;IAEvC;;;;;;;;;;;;;;;;OAgBG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;OAOG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qFAAkB,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,+FAAuB,CAAA;AACzB,CAAC,EAxFW,qBAAqB,KAArB,qBAAqB,QAwFhC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/command_connect.d.ts

@@ -203,6 +203,9 @@ export declare const IamPolicyCommandController: {
          *
          * Authorization:
          * - Caller must have 'can_grant_access' permission on the organization
+         * - System flows running as the platform machine account cannot satisfy this
+         *   check (the machine account holds no org-scoped grants by design) and must
+         *   use bootstrapRevokeOrgAccess instead
          *
          * Use Cases:
          * - Removing a member from an organization
@@ -219,5 +222,50 @@ export declare const IamPolicyCommandController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Revoke all of a user's access to an organization via the system (bootstrap) path.
+         *
+         * The system-flow twin of revokeOrgAccess: identical revocation behavior, but
+         * authorized by can_bootstrap_iam on platform:stigmer instead of
+         * can_grant_access on the organization.
+         *
+         * @internal
+         * Exists because system flows execute the revoke as the platform machine
+         * account, which by design holds no org-scoped grants. The system channel does
+         * NOT bypass authorization — it authenticates as the machine account, which
+         * can only satisfy platform-scoped permissions. revokeOrgAccess therefore
+         * always fails with PERMISSION_DENIED on the system channel; this RPC is the
+         * sanctioned path, mirroring how bootstrapPolicy is the system-path twin of
+         * create (see https://github.com/stigmer/stigmer/issues/332).
+         *
+         * The operation (identical to revokeOrgAccess after authorization):
+         * 1. Validates can_bootstrap_iam permission on platform:stigmer
+         * 2. Loads all policies where the identity account is principal within the org
+         *    scope, plus policies directly on the organization itself
+         * 3. Deletes all matching policies from MongoDB
+         * 4. Removes all corresponding tuples from OpenFGA (idempotent if none exist)
+         *
+         * Authorization:
+         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
+         * - This is typically only granted to platform services (machine accounts)
+         *
+         * Use Cases:
+         * - Federated account deprovisioning (deprovisionFederatedAccount's revoke step)
+         * - Any platform-driven offboarding that runs under system credentials
+         *
+         * End-user member removal must use revokeOrgAccess, which checks
+         * can_grant_access on the organization.
+         *
+         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+         * Output: Empty (google.protobuf.Empty)
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapRevokeOrgAccess
+         */
+        readonly bootstrapRevokeOrgAccess: {
+            readonly name: "bootstrapRevokeOrgAccess";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
     };
 };

package/ai/stigmer/iam/iampolicy/v1/command_connect.js

@@ -211,6 +211,9 @@ export const IamPolicyCommandController = {
          *
          * Authorization:
          * - Caller must have 'can_grant_access' permission on the organization
+         * - System flows running as the platform machine account cannot satisfy this
+         *   check (the machine account holds no org-scoped grants by design) and must
+         *   use bootstrapRevokeOrgAccess instead
          *
          * Use Cases:
          * - Removing a member from an organization
@@ -227,6 +230,51 @@ export const IamPolicyCommandController = {
             O: Empty,
             kind: MethodKind.Unary,
         },
+        /**
+         * Revoke all of a user's access to an organization via the system (bootstrap) path.
+         *
+         * The system-flow twin of revokeOrgAccess: identical revocation behavior, but
+         * authorized by can_bootstrap_iam on platform:stigmer instead of
+         * can_grant_access on the organization.
+         *
+         * @internal
+         * Exists because system flows execute the revoke as the platform machine
+         * account, which by design holds no org-scoped grants. The system channel does
+         * NOT bypass authorization — it authenticates as the machine account, which
+         * can only satisfy platform-scoped permissions. revokeOrgAccess therefore
+         * always fails with PERMISSION_DENIED on the system channel; this RPC is the
+         * sanctioned path, mirroring how bootstrapPolicy is the system-path twin of
+         * create (see https://github.com/stigmer/stigmer/issues/332).
+         *
+         * The operation (identical to revokeOrgAccess after authorization):
+         * 1. Validates can_bootstrap_iam permission on platform:stigmer
+         * 2. Loads all policies where the identity account is principal within the org
+         *    scope, plus policies directly on the organization itself
+         * 3. Deletes all matching policies from MongoDB
+         * 4. Removes all corresponding tuples from OpenFGA (idempotent if none exist)
+         *
+         * Authorization:
+         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
+         * - This is typically only granted to platform services (machine accounts)
+         *
+         * Use Cases:
+         * - Federated account deprovisioning (deprovisionFederatedAccount's revoke step)
+         * - Any platform-driven offboarding that runs under system credentials
+         *
+         * End-user member removal must use revokeOrgAccess, which checks
+         * can_grant_access on the organization.
+         *
+         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+         * Output: Empty (google.protobuf.Empty)
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapRevokeOrgAccess
+         */
+        bootstrapRevokeOrgAccess: {
+            name: "bootstrapRevokeOrgAccess",
+            I: RevokeOrgAccessInput,
+            O: Empty,
+            kind: MethodKind.Unary,
+        },
     }
 };
 //# sourceMappingURL=command_connect.js.map

package/ai/stigmer/iam/iampolicy/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAgCG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0CG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAgCG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0CG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsCG;QACH,wBAAwB,EAAE;YACxB,IAAI,EAAE,0BAA0B;YAChC,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/command_pb.d.ts

@@ -206,6 +206,9 @@ export declare const IamPolicyCommandController: GenService<{
      *
      * Authorization:
      * - Caller must have 'can_grant_access' permission on the organization
+     * - System flows running as the platform machine account cannot satisfy this
+     *   check (the machine account holds no org-scoped grants by design) and must
+     *   use bootstrapRevokeOrgAccess instead
      *
      * Use Cases:
      * - Removing a member from an organization
@@ -221,4 +224,48 @@ export declare const IamPolicyCommandController: GenService<{
         input: typeof RevokeOrgAccessInputSchema;
         output: typeof EmptySchema;
     };
+    /**
+     * Revoke all of a user's access to an organization via the system (bootstrap) path.
+     *
+     * The system-flow twin of revokeOrgAccess: identical revocation behavior, but
+     * authorized by can_bootstrap_iam on platform:stigmer instead of
+     * can_grant_access on the organization.
+     *
+     * @internal
+     * Exists because system flows execute the revoke as the platform machine
+     * account, which by design holds no org-scoped grants. The system channel does
+     * NOT bypass authorization — it authenticates as the machine account, which
+     * can only satisfy platform-scoped permissions. revokeOrgAccess therefore
+     * always fails with PERMISSION_DENIED on the system channel; this RPC is the
+     * sanctioned path, mirroring how bootstrapPolicy is the system-path twin of
+     * create (see https://github.com/stigmer/stigmer/issues/332).
+     *
+     * The operation (identical to revokeOrgAccess after authorization):
+     * 1. Validates can_bootstrap_iam permission on platform:stigmer
+     * 2. Loads all policies where the identity account is principal within the org
+     *    scope, plus policies directly on the organization itself
+     * 3. Deletes all matching policies from MongoDB
+     * 4. Removes all corresponding tuples from OpenFGA (idempotent if none exist)
+     *
+     * Authorization:
+     * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
+     * - This is typically only granted to platform services (machine accounts)
+     *
+     * Use Cases:
+     * - Federated account deprovisioning (deprovisionFederatedAccount's revoke step)
+     * - Any platform-driven offboarding that runs under system credentials
+     *
+     * End-user member removal must use revokeOrgAccess, which checks
+     * can_grant_access on the organization.
+     *
+     * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+     * Output: Empty (google.protobuf.Empty)
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapRevokeOrgAccess
+     */
+    bootstrapRevokeOrgAccess: {
+        methodKind: "unary";
+        input: typeof RevokeOrgAccessInputSchema;
+        output: typeof EmptySchema;
+    };
 }>;

package/ai/stigmer/iam/iampolicy/v1/command_pb.js

@@ -11,7 +11,7 @@ import { file_google_protobuf_empty } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/command.proto.
  */
-export const file_ai_stigmer_iam_iampolicy_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMswGChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKCAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IiTCuBggCAQqHHVuYXV0aG9yaXplZCB0byBncmFudCBhY2Nlc3MSgwEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjGiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSIlwrgYIQgEKh11bmF1dGhvcml6ZWQgdG8gcmV2b2tlIGFjY2VzcxLCAQoPYm9vdHN0cmFwUG9saWN5EiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlvCuBhXCBEQHypIdW5hdXRob3JpemVkIHRvIGJvb3RzdHJhcCBwb2xpY3kgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEsQBChdjbGVhbnVwUmVzb3VyY2VQb2xpY2llcxIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSJkwrgYYAgREB8qUXVuYXV0aG9yaXplZCB0byBjbGVhbnVwIHJlc291cmNlIHBvbGljaWVzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchKQAQoPcmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IjLCuBguCAQqKnVuYXV0aG9yaXplZCB0byByZXZva2Ugb3JnYW5pemF0aW9uIGFjY2VzcxoEoP8rCmIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io, file_ai_stigmer_iam_iampolicy_v1_spec, file_google_protobuf_empty]);
+export const file_ai_stigmer_iam_iampolicy_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMpsIChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKCAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IiTCuBggCAQqHHVuYXV0aG9yaXplZCB0byBncmFudCBhY2Nlc3MSgwEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjGiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSIlwrgYIQgEKh11bmF1dGhvcml6ZWQgdG8gcmV2b2tlIGFjY2VzcxLCAQoPYm9vdHN0cmFwUG9saWN5EiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlvCuBhXCBEQHypIdW5hdXRob3JpemVkIHRvIGJvb3RzdHJhcCBwb2xpY3kgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEsQBChdjbGVhbnVwUmVzb3VyY2VQb2xpY2llcxIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSJkwrgYYAgREB8qUXVuYXV0aG9yaXplZCB0byBjbGVhbnVwIHJlc291cmNlIHBvbGljaWVzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchKQAQoPcmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IjLCuBguCAQqKnVuYXV0aG9yaXplZCB0byByZXZva2Ugb3JnYW5pemF0aW9uIGFjY2VzcxLMAQoYYm9vdHN0cmFwUmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5ImXCuBhhCBEQHypSdW5hdXRob3JpemVkIHRvIHJldm9rZSBvcmdhbml6YXRpb24gYWNjZXNzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchoEoP8rCmIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io, file_ai_stigmer_iam_iampolicy_v1_spec, file_google_protobuf_empty]);
 /**
  * IAM Policy Command Controller
  *

package/ai/stigmer/iam/iampolicy/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,stCAAstC,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEx9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAmMlC,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,0+CAA0+C,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAE5uD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAkPlC,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/spec_pb.d.ts

@@ -140,14 +140,27 @@ export type PlatformClientSpec = Message<"ai.stigmer.iam.platformclient.v1.Platf
      */
     autoGrantRole: IamRole;
     /**
-     * CORS origins allowed for browser-based requests using tokens minted by
-     * this PlatformClient.
-     *
-     * When non-empty, the server validates the Origin header of browser requests
-     * against this list. Requests from unlisted origins are rejected.
-     *
-     * When empty, origin validation is not enforced (suitable for development
-     * or when the platform controls all access points).
+     * Web origins allowed for browser-based requests using tokens minted by
+     * this PlatformClient (Stigmer Cloud).
+     *
+     * Enforced on every API request bearing a user token minted by this
+     * client (never on mintUserToken itself — minting is server-to-server and
+     * carries no browser Origin):
+     *   - Empty list: origin validation is not enforced (open mode — suitable
+     *     for development or when the platform controls all access points).
+     *   - Non-empty list: the request's Origin header must match an entry
+     *     (case-insensitive, per RFC 6454 origin comparison). Unlisted
+     *     origins — including the opaque-origin serialization "null" — are
+     *     refused PERMISSION_DENIED.
+     *   - Requests without an Origin header always pass: only browsers send
+     *     Origin, and only browsers guarantee it is not forgeable by page
+     *     script. This is a browser-context, CORS-class defense-in-depth
+     *     control against a leaked token being replayed from another site's
+     *     browser context; the client_secret remains the primary control,
+     *     and non-browser callers are not constrained by it.
+     *
+     * Edits propagate immediately: the enforcement cache is evicted on every
+     * PlatformClient update.
      *
      * @generated from field: repeated string allowed_origins = 9;
      */

package/ai/stigmer/iam/platformclient/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,wiBAAwiB,EAAE,CAAC,iDAAiD,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AA8JvqB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,wiBAAwiB,EAAE,CAAC,iDAAiD,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AA2KvqB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_connect.d.ts

@@ -42,11 +42,17 @@ export declare const PlatformClientTokenController: {
          * - UNAUTHENTICATED: Invalid client_id or client_secret
          * - FAILED_PRECONDITION: user_id does not exist and auto_provision_accounts
          *   is false, or the PlatformClient secret has expired
-         * - PERMISSION_DENIED: Origin not in allowed_origins (when configured)
          * - INTERNAL: Account provisioning could not be completed (for example, the
          *   auto_grant_on_org role grant failed). No partial account is left behind
          *   — the account is rolled back — so the request is safe to retry.
          *
+         * Origin enforcement (spec.allowed_origins) does NOT apply to this call:
+         * minting is server-to-server, so there is no browser Origin to check.
+         * It applies to the browser API calls that BEAR the minted token — when
+         * the PlatformClient lists allowed_origins, requests whose Origin header
+         * is not on the list are refused PERMISSION_DENIED (see the
+         * allowed_origins field docs in spec.proto for the exact semantics).
+         *
          * @internal
          * This RPC is public — no Bearer token is required. The caller authenticates
          * by providing client_id + client_secret in the request body. The handler

package/ai/stigmer/iam/platformclient/v1/token_connect.js

@@ -48,11 +48,17 @@ export const PlatformClientTokenController = {
          * - UNAUTHENTICATED: Invalid client_id or client_secret
          * - FAILED_PRECONDITION: user_id does not exist and auto_provision_accounts
          *   is false, or the PlatformClient secret has expired
-         * - PERMISSION_DENIED: Origin not in allowed_origins (when configured)
          * - INTERNAL: Account provisioning could not be completed (for example, the
          *   auto_grant_on_org role grant failed). No partial account is left behind
          *   — the account is rolled back — so the request is safe to retry.
          *
+         * Origin enforcement (spec.allowed_origins) does NOT apply to this call:
+         * minting is server-to-server, so there is no browser Origin to check.
+         * It applies to the browser API calls that BEAR the minted token — when
+         * the PlatformClient lists allowed_origins, requests whose Origin header
+         * is not on the list are refused PERMISSION_DENIED (see the
+         * allowed_origins field docs in spec.proto for the exact semantics).
+         *
          * @internal
          * This RPC is public — no Bearer token is required. The caller authenticates
          * by providing client_id + client_secret in the request body. The handler

package/ai/stigmer/iam/platformclient/v1/token_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAgCG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsCG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_pb.d.ts

@@ -56,10 +56,13 @@ export type MintUserTokenRequest = Message<"ai.stigmer.iam.platformclient.v1.Min
      */
     userName: string;
     /**
-     * Optional organization to scope the minted token to.
-     * When set, the JWT's claims include this org context, and the user must
-     * have access to this organization. When empty, the token is scoped to
-     * the PlatformClient's owning organization.
+     * Optional confirmation of the organization the token is scoped to.
+     * The minted token is ALWAYS scoped to the PlatformClient's owning
+     * organization (metadata.org) — identity resolution and the optional
+     * auto-grant are keyed on it, so cross-organization minting is not
+     * supported. When set, this value must equal that owning organization;
+     * any other value is rejected INVALID_ARGUMENT before the user is
+     * resolved or provisioned. When empty, the owning organization applies.
      *
      * @generated from field: string org_id = 6;
      */
@@ -258,11 +261,17 @@ export declare const PlatformClientTokenController: GenService<{
      * - UNAUTHENTICATED: Invalid client_id or client_secret
      * - FAILED_PRECONDITION: user_id does not exist and auto_provision_accounts
      *   is false, or the PlatformClient secret has expired
-     * - PERMISSION_DENIED: Origin not in allowed_origins (when configured)
      * - INTERNAL: Account provisioning could not be completed (for example, the
      *   auto_grant_on_org role grant failed). No partial account is left behind
      *   — the account is rolled back — so the request is safe to retry.
      *
+     * Origin enforcement (spec.allowed_origins) does NOT apply to this call:
+     * minting is server-to-server, so there is no browser Origin to check.
+     * It applies to the browser API calls that BEAR the minted token — when
+     * the PlatformClient lists allowed_origins, requests whose Origin header
+     * is not on the list are refused PERMISSION_DENIED (see the
+     * allowed_origins field docs in spec.proto for the exact semantics).
+     *
      * @internal
      * This RPC is public — no Bearer token is required. The caller authenticates
      * by providing client_id + client_secret in the request body. The handler

package/ai/stigmer/iam/platformclient/v1/token_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,omDAAomD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAqE3rD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8E9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAwC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GA4DrC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,omDAAomD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwE3rD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8E9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAwC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAkErC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}