@stigmer/protos 3.11.0 → 3.12.0

package/ai/stigmer/iam/platformclient/v1/command_pb.d.ts

@@ -32,6 +32,10 @@ export declare const PlatformClientCommandController: GenService<{
      * The creator's organization owns the platform client. The creator is granted
      * the owner role automatically.
      *
+     * The slug `system-share-client` is platform-reserved (it identifies the org's
+     * system-managed share client) and is rejected with INVALID_ARGUMENT — including
+     * when derived from the resource name.
+     *
      * @internal
      * Authorization: Requires can_create_platform_client permission in the organization.
      *

package/ai/stigmer/iam/platformclient/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GA0EvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GA8EvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/spec_pb.d.ts

@@ -140,14 +140,27 @@ export type PlatformClientSpec = Message<"ai.stigmer.iam.platformclient.v1.Platf
      */
     autoGrantRole: IamRole;
     /**
-     * CORS origins allowed for browser-based requests using tokens minted by
-     * this PlatformClient.
-     *
-     * When non-empty, the server validates the Origin header of browser requests
-     * against this list. Requests from unlisted origins are rejected.
-     *
-     * When empty, origin validation is not enforced (suitable for development
-     * or when the platform controls all access points).
+     * Web origins allowed for browser-based requests using tokens minted by
+     * this PlatformClient (Stigmer Cloud).
+     *
+     * Enforced on every API request bearing a user token minted by this
+     * client (never on mintUserToken itself — minting is server-to-server and
+     * carries no browser Origin):
+     *   - Empty list: origin validation is not enforced (open mode — suitable
+     *     for development or when the platform controls all access points).
+     *   - Non-empty list: the request's Origin header must match an entry
+     *     (case-insensitive, per RFC 6454 origin comparison). Unlisted
+     *     origins — including the opaque-origin serialization "null" — are
+     *     refused PERMISSION_DENIED.
+     *   - Requests without an Origin header always pass: only browsers send
+     *     Origin, and only browsers guarantee it is not forgeable by page
+     *     script. This is a browser-context, CORS-class defense-in-depth
+     *     control against a leaked token being replayed from another site's
+     *     browser context; the client_secret remains the primary control,
+     *     and non-browser callers are not constrained by it.
+     *
+     * Edits propagate immediately: the enforcement cache is evicted on every
+     * PlatformClient update.
      *
      * @generated from field: repeated string allowed_origins = 9;
      */

package/ai/stigmer/iam/platformclient/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,wiBAAwiB,EAAE,CAAC,iDAAiD,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AA8JvqB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,wiBAAwiB,EAAE,CAAC,iDAAiD,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AA2KvqB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_connect.d.ts

@@ -42,11 +42,17 @@ export declare const PlatformClientTokenController: {
          * - UNAUTHENTICATED: Invalid client_id or client_secret
          * - FAILED_PRECONDITION: user_id does not exist and auto_provision_accounts
          *   is false, or the PlatformClient secret has expired
-         * - PERMISSION_DENIED: Origin not in allowed_origins (when configured)
          * - INTERNAL: Account provisioning could not be completed (for example, the
          *   auto_grant_on_org role grant failed). No partial account is left behind
          *   — the account is rolled back — so the request is safe to retry.
          *
+         * Origin enforcement (spec.allowed_origins) does NOT apply to this call:
+         * minting is server-to-server, so there is no browser Origin to check.
+         * It applies to the browser API calls that BEAR the minted token — when
+         * the PlatformClient lists allowed_origins, requests whose Origin header
+         * is not on the list are refused PERMISSION_DENIED (see the
+         * allowed_origins field docs in spec.proto for the exact semantics).
+         *
          * @internal
          * This RPC is public — no Bearer token is required. The caller authenticates
          * by providing client_id + client_secret in the request body. The handler

package/ai/stigmer/iam/platformclient/v1/token_connect.js

@@ -48,11 +48,17 @@ export const PlatformClientTokenController = {
          * - UNAUTHENTICATED: Invalid client_id or client_secret
          * - FAILED_PRECONDITION: user_id does not exist and auto_provision_accounts
          *   is false, or the PlatformClient secret has expired
-         * - PERMISSION_DENIED: Origin not in allowed_origins (when configured)
          * - INTERNAL: Account provisioning could not be completed (for example, the
          *   auto_grant_on_org role grant failed). No partial account is left behind
          *   — the account is rolled back — so the request is safe to retry.
          *
+         * Origin enforcement (spec.allowed_origins) does NOT apply to this call:
+         * minting is server-to-server, so there is no browser Origin to check.
+         * It applies to the browser API calls that BEAR the minted token — when
+         * the PlatformClient lists allowed_origins, requests whose Origin header
+         * is not on the list are refused PERMISSION_DENIED (see the
+         * allowed_origins field docs in spec.proto for the exact semantics).
+         *
          * @internal
          * This RPC is public — no Bearer token is required. The caller authenticates
          * by providing client_id + client_secret in the request body. The handler

package/ai/stigmer/iam/platformclient/v1/token_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAgCG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsCG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_pb.d.ts

@@ -56,10 +56,13 @@ export type MintUserTokenRequest = Message<"ai.stigmer.iam.platformclient.v1.Min
      */
     userName: string;
     /**
-     * Optional organization to scope the minted token to.
-     * When set, the JWT's claims include this org context, and the user must
-     * have access to this organization. When empty, the token is scoped to
-     * the PlatformClient's owning organization.
+     * Optional confirmation of the organization the token is scoped to.
+     * The minted token is ALWAYS scoped to the PlatformClient's owning
+     * organization (metadata.org) — identity resolution and the optional
+     * auto-grant are keyed on it, so cross-organization minting is not
+     * supported. When set, this value must equal that owning organization;
+     * any other value is rejected INVALID_ARGUMENT before the user is
+     * resolved or provisioned. When empty, the owning organization applies.
      *
      * @generated from field: string org_id = 6;
      */
@@ -258,11 +261,17 @@ export declare const PlatformClientTokenController: GenService<{
      * - UNAUTHENTICATED: Invalid client_id or client_secret
      * - FAILED_PRECONDITION: user_id does not exist and auto_provision_accounts
      *   is false, or the PlatformClient secret has expired
-     * - PERMISSION_DENIED: Origin not in allowed_origins (when configured)
      * - INTERNAL: Account provisioning could not be completed (for example, the
      *   auto_grant_on_org role grant failed). No partial account is left behind
      *   — the account is rolled back — so the request is safe to retry.
      *
+     * Origin enforcement (spec.allowed_origins) does NOT apply to this call:
+     * minting is server-to-server, so there is no browser Origin to check.
+     * It applies to the browser API calls that BEAR the minted token — when
+     * the PlatformClient lists allowed_origins, requests whose Origin header
+     * is not on the list are refused PERMISSION_DENIED (see the
+     * allowed_origins field docs in spec.proto for the exact semantics).
+     *
      * @internal
      * This RPC is public — no Bearer token is required. The caller authenticates
      * by providing client_id + client_secret in the request body. The handler

package/ai/stigmer/iam/platformclient/v1/token_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,omDAAomD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAqE3rD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8E9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAwC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GA4DrC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,omDAAomD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwE3rD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8E9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAwC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAkErC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/v1/enum_pb.d.ts

@@ -195,30 +195,6 @@ export declare enum IamPermission {
      * @generated from enum value: can_manage_model_pricing = 32;
      */
     can_manage_model_pricing = 32,
-    /**
-     * Resource-level permission to reach a datastore's record RPCs.
-     *
-     * @internal
-     * Layer 1 of the datastore's two-layer authorization model: gates
-     * "may this principal touch this datastore's records at all" for
-     * direct platform principals (console, CLI, SDK, workflow executions).
-     * Checked in-handler via RequestAuthorizationService — the record RPCs
-     * are slug-addressed and carry is_skip_authorization, so the
-     * declarative interceptor never runs for them. Session-bound runner
-     * credentials do NOT pass through this permission — they take the
-     * usage-edge reach chain (agent's datastore_usages + org match) in
-     * domain logic. Layer 2 (role/verb/scope grants) always runs in
-     * datastore domain logic in both editions.
-     *
-     * @generated from enum value: can_use_records = 33;
-     */
-    can_use_records = 33,
-    /**
-     * Organization-level permission to create datastores.
-     *
-     * @generated from enum value: can_create_datastore = 34;
-     */
-    can_create_datastore = 34,
     /**
      * Platform-level permission to manage Cursor accounts: the managed
      * Cursor teams (admin keys, member execution keys, org assignments)
@@ -242,7 +218,19 @@ export declare enum IamPermission {
      *
      * @generated from enum value: can_participate = 36;
      */
-    can_participate = 36
+    can_participate = 36,
+    /**
+     * Platform-level permission to introduce or change labels in the
+     * reserved stigmer.ai/* key namespace through client-facing write
+     * boundaries. Gated to platform operators (the seeding machine
+     * account): reserved labels carry platform semantics — most
+     * critically stigmer.ai/default-agent, which selects the platform
+     * default agent served to every organization — so ordinary requests
+     * may echo or remove them but never write them (cloud#320).
+     *
+     * @generated from enum value: can_write_reserved_labels = 37;
+     */
+    can_write_reserved_labels = 37
 }
 /**
  * Describes the enum ai.stigmer.iam.v1.IamPermission.

package/ai/stigmer/iam/v1/enum_pb.js

@@ -5,7 +5,7 @@ import { enumDesc, fileDesc } from "@bufbuild/protobuf/codegenv1";
 /**
  * Describes the file ai/stigmer/iam/v1/enum.proto.
  */
-export const file_ai_stigmer_iam_v1_enum = /*@__PURE__*/ fileDesc("ChxhaS9zdGlnbWVyL2lhbS92MS9lbnVtLnByb3RvEhFhaS5zdGlnbWVyLmlhbS52MSrwBgoNSWFtUGVybWlzc2lvbhIPCgt1bnNwZWNpZmllZBAAEgwKCGNhbl92aWV3EAESDAoIY2FuX2VkaXQQAhIOCgpjYW5fZGVsZXRlEAMSFAoQY2FuX2dyYW50X2FjY2VzcxAEEhMKD2Nhbl92aWV3X2FjY2VzcxAFEhQKEGNhbl9jcmVhdGVfYWdlbnQQBhIXChNjYW5fY3JlYXRlX3dvcmtmbG93EAcSFgoSY2FuX2NyZWF0ZV9zZXNzaW9uEAgSFAoQY2FuX2NyZWF0ZV9za2lsbBAJEhYKEmNhbl9jcmVhdGVfcHJvamVjdBAKEhIKDmNhbl9jcmVhdGVfaWRwEAsSGgoWY2FuX2NyZWF0ZV9lbnZpcm9ubWVudBAMEh8KG2Nhbl9jcmVhdGVfaWRlbnRpdHlfYWNjb3VudBAVEhgKFGNhbl9jcmVhdGVfb2F1dGhfYXBwEBcSHgoaY2FuX2NyZWF0ZV9wbGF0Zm9ybV9jbGllbnQQGBIbChdjYW5fY3JlYXRlX2V4ZWN1dGlvbl9pbhANEhcKE2Nhbl9jcmVhdGVfaW5zdGFuY2UQDhIPCgtjYW5fZXhlY3V0ZRAPEhQKEGNhbl9yZWFkX3NlY3JldHMQEBIVChFjYW5fYm9vdHN0cmFwX2lhbRAREiAKHGNhbl9tYW5hZ2VfaWRlbnRpdHlfYWNjb3VudHMQEhIYChRsb2dpbl90b19iYWNrX29mZmljZRAUEg8KC2Nhbl9jb25uZWN0EBYSFQoRY2FuX2NyZWF0ZV9ydW5uZXIQGRIaChJjYW5fZGVsZXRlX3Nlc3Npb24QGhoCCAESFAoQY2FuX3ZpZXdfYmlsbGluZxAbEhYKEmNhbl9tYW5hZ2VfYmlsbGluZxAcEhsKF2Nhbl9leGVjdXRlX2JpbGxpbmdfb3BzEB0SGgoWY2FuX2NyZWF0ZV9hZ2VudF9zaGFyZRAeEhoKFmNhbl9jcmVhdGVfY2hhbm5lbF9hcHAQHxIcChhjYW5fbWFuYWdlX21vZGVsX3ByaWNpbmcQIBITCg9jYW5fdXNlX3JlY29yZHMQIRIYChRjYW5fY3JlYXRlX2RhdGFzdG9yZRAiEh4KGmNhbl9tYW5hZ2VfY3Vyc29yX2FjY291bnRzECMSEwoPY2FuX3BhcnRpY2lwYXRlECQqYgoHSWFtUm9sZRIYChRpYW1fcm9sZV91bnNwZWNpZmllZBAAEgkKBW93bmVyEAESCQoFYWRtaW4QAhIKCgZtZW1iZXIQAxIKCgZ2aWV3ZXIQBBIPCgtwYXJ0aWNpcGFudBAFYgZwcm90bzM");
+export const file_ai_stigmer_iam_v1_enum = /*@__PURE__*/ fileDesc("ChxhaS9zdGlnbWVyL2lhbS92MS9lbnVtLnByb3RvEhFhaS5zdGlnbWVyLmlhbS52MSqTBwoNSWFtUGVybWlzc2lvbhIPCgt1bnNwZWNpZmllZBAAEgwKCGNhbl92aWV3EAESDAoIY2FuX2VkaXQQAhIOCgpjYW5fZGVsZXRlEAMSFAoQY2FuX2dyYW50X2FjY2VzcxAEEhMKD2Nhbl92aWV3X2FjY2VzcxAFEhQKEGNhbl9jcmVhdGVfYWdlbnQQBhIXChNjYW5fY3JlYXRlX3dvcmtmbG93EAcSFgoSY2FuX2NyZWF0ZV9zZXNzaW9uEAgSFAoQY2FuX2NyZWF0ZV9za2lsbBAJEhYKEmNhbl9jcmVhdGVfcHJvamVjdBAKEhIKDmNhbl9jcmVhdGVfaWRwEAsSGgoWY2FuX2NyZWF0ZV9lbnZpcm9ubWVudBAMEh8KG2Nhbl9jcmVhdGVfaWRlbnRpdHlfYWNjb3VudBAVEhgKFGNhbl9jcmVhdGVfb2F1dGhfYXBwEBcSHgoaY2FuX2NyZWF0ZV9wbGF0Zm9ybV9jbGllbnQQGBIbChdjYW5fY3JlYXRlX2V4ZWN1dGlvbl9pbhANEhcKE2Nhbl9jcmVhdGVfaW5zdGFuY2UQDhIPCgtjYW5fZXhlY3V0ZRAPEhQKEGNhbl9yZWFkX3NlY3JldHMQEBIVChFjYW5fYm9vdHN0cmFwX2lhbRAREiAKHGNhbl9tYW5hZ2VfaWRlbnRpdHlfYWNjb3VudHMQEhIYChRsb2dpbl90b19iYWNrX29mZmljZRAUEg8KC2Nhbl9jb25uZWN0EBYSFQoRY2FuX2NyZWF0ZV9ydW5uZXIQGRIaChJjYW5fZGVsZXRlX3Nlc3Npb24QGhoCCAESFAoQY2FuX3ZpZXdfYmlsbGluZxAbEhYKEmNhbl9tYW5hZ2VfYmlsbGluZxAcEhsKF2Nhbl9leGVjdXRlX2JpbGxpbmdfb3BzEB0SGgoWY2FuX2NyZWF0ZV9hZ2VudF9zaGFyZRAeEhoKFmNhbl9jcmVhdGVfY2hhbm5lbF9hcHAQHxIcChhjYW5fbWFuYWdlX21vZGVsX3ByaWNpbmcQIBIeChpjYW5fbWFuYWdlX2N1cnNvcl9hY2NvdW50cxAjEhMKD2Nhbl9wYXJ0aWNpcGF0ZRAkEh0KGWNhbl93cml0ZV9yZXNlcnZlZF9sYWJlbHMQJSIECCEQISIECCIQIioPY2FuX3VzZV9yZWNvcmRzKhRjYW5fY3JlYXRlX2RhdGFzdG9yZSpiCgdJYW1Sb2xlEhgKFGlhbV9yb2xlX3Vuc3BlY2lmaWVkEAASCQoFb3duZXIQARIJCgVhZG1pbhACEgoKBm1lbWJlchADEgoKBnZpZXdlchAEEg8KC3BhcnRpY2lwYW50EAViBnByb3RvMw");
 /**
  * IamPermission defines the permissions checked by the authorization
  * interceptor before an RPC handler executes.
@@ -199,30 +199,6 @@ export var IamPermission;
      * @generated from enum value: can_manage_model_pricing = 32;
      */
     IamPermission[IamPermission["can_manage_model_pricing"] = 32] = "can_manage_model_pricing";
-    /**
-     * Resource-level permission to reach a datastore's record RPCs.
-     *
-     * @internal
-     * Layer 1 of the datastore's two-layer authorization model: gates
-     * "may this principal touch this datastore's records at all" for
-     * direct platform principals (console, CLI, SDK, workflow executions).
-     * Checked in-handler via RequestAuthorizationService — the record RPCs
-     * are slug-addressed and carry is_skip_authorization, so the
-     * declarative interceptor never runs for them. Session-bound runner
-     * credentials do NOT pass through this permission — they take the
-     * usage-edge reach chain (agent's datastore_usages + org match) in
-     * domain logic. Layer 2 (role/verb/scope grants) always runs in
-     * datastore domain logic in both editions.
-     *
-     * @generated from enum value: can_use_records = 33;
-     */
-    IamPermission[IamPermission["can_use_records"] = 33] = "can_use_records";
-    /**
-     * Organization-level permission to create datastores.
-     *
-     * @generated from enum value: can_create_datastore = 34;
-     */
-    IamPermission[IamPermission["can_create_datastore"] = 34] = "can_create_datastore";
     /**
      * Platform-level permission to manage Cursor accounts: the managed
      * Cursor teams (admin keys, member execution keys, org assignments)
@@ -247,6 +223,18 @@ export var IamPermission;
      * @generated from enum value: can_participate = 36;
      */
     IamPermission[IamPermission["can_participate"] = 36] = "can_participate";
+    /**
+     * Platform-level permission to introduce or change labels in the
+     * reserved stigmer.ai/* key namespace through client-facing write
+     * boundaries. Gated to platform operators (the seeding machine
+     * account): reserved labels carry platform semantics — most
+     * critically stigmer.ai/default-agent, which selects the platform
+     * default agent served to every organization — so ordinary requests
+     * may echo or remove them but never write them (cloud#320).
+     *
+     * @generated from enum value: can_write_reserved_labels = 37;
+     */
+    IamPermission[IamPermission["can_write_reserved_labels"] = 37] = "can_write_reserved_labels";
 })(IamPermission || (IamPermission = {}));
 /**
  * Describes the enum ai.stigmer.iam.v1.IamPermission.

package/ai/stigmer/iam/v1/enum_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/iam/v1/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+FAA+F;AAC/F,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAY,aAAa,CAC/D,QAAQ,CAAC,62CAA62C,CAAC,CAAC;AAE13C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,aAqQX;AArQD,WAAY,aAAa;IACvB;;OAEG;IACH,+DAAe,CAAA;IAEf;;;;OAIG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,6DAAc,CAAA;IAEd;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,uEAAmB,CAAA;IAEnB;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,+EAAuB,CAAA;IAEvB;;OAEG;IACH,6EAAsB,CAAA;IAEtB;;OAEG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;OAEG;IACH,sEAAmB,CAAA;IAEnB;;OAEG;IACH,sFAA2B,CAAA;IAE3B;;OAEG;IACH,gGAAgC,CAAA;IAEhC;;OAEG;IACH,kFAAyB,CAAA;IAEzB;;OAEG;IACH,8FAA+B,CAAA;IAE/B;;;;OAIG;IACH,wFAA4B,CAAA;IAE5B;;OAEG;IACH,gFAAwB,CAAA;IAExB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;OAEG;IACH,kGAAiC,CAAA;IAEjC;;;;OAIG;IACH,kFAAyB,CAAA;IAEzB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;;;;;;;OAQG;IACH,8EAAuB,CAAA;IAEvB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;;;;OAKG;IACH,wFAA4B,CAAA;IAE5B;;;;;;;;;;;OAWG;IACH,sFAA2B,CAAA;IAE3B;;;;;;OAMG;IACH,sFAA2B,CAAA;IAE3B;;;;;;;OAOG;IACH,0FAA6B,CAAA;IAE7B;;;;;;;;;;;;;;;;OAgBG;IACH,wEAAoB,CAAA;IAEpB;;;;OAIG;IACH,kFAAyB,CAAA;IAEzB;;;;;;;;OAQG;IACH,8FAA+B,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,wEAAoB,CAAA;AACtB,CAAC,EArQW,aAAa,KAAb,aAAa,QAqQxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;AAE3C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,OAiDX;AAjDD,WAAY,OAAO;IACjB;;OAEG;IACH,qEAAwB,CAAA;IAExB;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;;;;;;;;;;OAaG;IACH,mDAAe,CAAA;AACjB,CAAC,EAjDW,OAAO,KAAP,OAAO,QAiDlB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqB,aAAa,CAC1D,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/iam/v1/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+FAA+F;AAC/F,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAY,aAAa,CAC/D,QAAQ,CAAC,45CAA45C,CAAC,CAAC;AAEz6C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,aAwPX;AAxPD,WAAY,aAAa;IACvB;;OAEG;IACH,+DAAe,CAAA;IAEf;;;;OAIG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,6DAAc,CAAA;IAEd;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,uEAAmB,CAAA;IAEnB;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,+EAAuB,CAAA;IAEvB;;OAEG;IACH,6EAAsB,CAAA;IAEtB;;OAEG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;OAEG;IACH,sEAAmB,CAAA;IAEnB;;OAEG;IACH,sFAA2B,CAAA;IAE3B;;OAEG;IACH,gGAAgC,CAAA;IAEhC;;OAEG;IACH,kFAAyB,CAAA;IAEzB;;OAEG;IACH,8FAA+B,CAAA;IAE/B;;;;OAIG;IACH,wFAA4B,CAAA;IAE5B;;OAEG;IACH,gFAAwB,CAAA;IAExB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;OAEG;IACH,kGAAiC,CAAA;IAEjC;;;;OAIG;IACH,kFAAyB,CAAA;IAEzB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;;;;;;;OAQG;IACH,8EAAuB,CAAA;IAEvB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;;;;OAKG;IACH,wFAA4B,CAAA;IAE5B;;;;;;;;;;;OAWG;IACH,sFAA2B,CAAA;IAE3B;;;;;;OAMG;IACH,sFAA2B,CAAA;IAE3B;;;;;;;OAOG;IACH,0FAA6B,CAAA;IAE7B;;;;;;;;OAQG;IACH,8FAA+B,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,wEAAoB,CAAA;IAEpB;;;;;;;;;;OAUG;IACH,4FAA8B,CAAA;AAChC,CAAC,EAxPW,aAAa,KAAb,aAAa,QAwPxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;AAE3C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,OAiDX;AAjDD,WAAY,OAAO;IACjB;;OAEG;IACH,qEAAwB,CAAA;IAExB;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;;;;;;;;;;OAaG;IACH,mDAAe,CAAA;AACjB,CAAC,EAjDW,OAAO,KAAP,OAAO,QAiDlB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqB,aAAa,CAC1D,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/platform/v1/server_info_pb.d.ts

@@ -105,6 +105,52 @@ export type GetRunnerBootstrapConfigOutput = Message<"ai.stigmer.platform.v1.Get
      * @generated from field: int32 runner_access_token_expires_in_seconds = 5;
      */
     runnerAccessTokenExpiresInSeconds: number;
+    /**
+     * Temporal payload-encryption key for this runner: base64-encoded 32-byte
+     * AES-256 key, minted once per caller identity and persisted by the control
+     * plane, so every boot of the same identity's runners receives the SAME
+     * key. Persistence is what makes encryption safe for a restartable runner —
+     * Temporal replay must decode history payloads written before the restart.
+     *
+     * Empty when the server does not manage runner keys — OSS (a self-hosted
+     * deployment configures one shared key on server and runner via
+     * STIGMER_PAYLOAD_ENCRYPTION_KEY) or a cloud server predating key
+     * management. The runner then falls back to its env-configured key, or runs
+     * without payload encryption. An explicitly env-configured key always wins
+     * over this field.
+     *
+     * @internal
+     * Cloud-only. Per-identity rather than platform-wide because a desktop
+     * runner must never hold the platform key: compromise of one user's machine
+     * exposes only payloads encrypted under that identity's key. The control
+     * plane's decode-only codec resolves these keys by key id, so the service
+     * can read every runner's results while runners cannot read each other's.
+     *
+     * @generated from field: string payload_encryption_key = 6;
+     */
+    payloadEncryptionKey: string;
+    /**
+     * Key id stamped on payloads encrypted under payload_encryption_key.
+     * Present exactly when the key is present.
+     *
+     * @generated from field: string payload_encryption_key_id = 7;
+     */
+    payloadEncryptionKeyId: string;
+    /**
+     * Previous key for this identity, present during a rotation window so the
+     * runner can replay history written under it. Decrypt-only: new payloads
+     * are always written under payload_encryption_key.
+     *
+     * @generated from field: string payload_encryption_secondary_key = 8;
+     */
+    payloadEncryptionSecondaryKey: string;
+    /**
+     * Key id of payload_encryption_secondary_key. Present exactly when the
+     * secondary key is present.
+     *
+     * @generated from field: string payload_encryption_secondary_key_id = 9;
+     */
+    payloadEncryptionSecondaryKeyId: string;
 };
 /**
  * Describes the message ai.stigmer.platform.v1.GetRunnerBootstrapConfigOutput.

package/ai/stigmer/platform/v1/server_info_pb.js

@@ -7,7 +7,7 @@ import { file_buf_validate_validate } from "../../../../buf/validate/validate_pb
 /**
  * Describes the file ai/stigmer/platform/v1/server_info.proto.
  */
-export const file_ai_stigmer_platform_v1_server_info = /*@__PURE__*/ fileDesc("CihhaS9zdGlnbWVyL3BsYXRmb3JtL3YxL3NlcnZlcl9pbmZvLnByb3RvEhZhaS5zdGlnbWVyLnBsYXRmb3JtLnYxIhQKEkdldFNlcnZlckluZm9JbnB1dCJeChNHZXRTZXJ2ZXJJbmZvT3V0cHV0EjYKB2VkaXRpb24YASABKA4yJS5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLlNlcnZlckVkaXRpb24SDwoHdmVyc2lvbhgCIAEoCSIfCh1HZXRSdW5uZXJCb290c3RyYXBDb25maWdJbnB1dCLJAQoeR2V0UnVubmVyQm9vdHN0cmFwQ29uZmlnT3V0cHV0EiEKEHRlbXBvcmFsX2FkZHJlc3MYASABKAlCB7pIBHICEAESIwoSdGVtcG9yYWxfbmFtZXNwYWNlGAIgASgJQge6SARyAhABEhsKE3J1bm5lcl9hY2Nlc3NfdG9rZW4YAyABKAkSEgoKdG9rZW5fdHlwZRgEIAEoCRIuCiZydW5uZXJfYWNjZXNzX3Rva2VuX2V4cGlyZXNfaW5fc2Vjb25kcxgFIAEoBSLcAQoZR2V0UnVubmVyU2NvcGVkVG9rZW5JbnB1dBIcChJhZ2VudF9leGVjdXRpb25faWQYASABKAlIABIfChV3b3JrZmxvd19leGVjdXRpb25faWQYAiABKAlIABI3Cgpwb29sX2NsYWltGAMgASgLMiEuYWkuc3RpZ21lci5wbGF0Zm9ybS52MS5Qb29sQ2xhaW1IABI3CgdyZW5ld2FsGAQgASgLMiQuYWkuc3RpZ21lci5wbGF0Zm9ybS52MS5Ub2tlblJlbmV3YWxIAEIOCgVzY29wZRIFukgCCAEiKAoJUG9vbENsYWltEhsKCnNlc3Npb25faWQYASABKAlCB7pIBHICEAEiDgoMVG9rZW5SZW5ld2FsImkKGkdldFJ1bm5lclNjb3BlZFRva2VuT3V0cHV0EhsKE3J1bm5lcl9zY29wZWRfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRIaChJleHBpcmVzX2luX3NlY29uZHMYAyABKAUqQwoNU2VydmVyRWRpdGlvbhIeChpzZXJ2ZXJfZWRpdGlvbl91bnNwZWNpZmllZBAAEgcKA29zcxABEgkKBWNsb3VkEAIyoQMKF1BsYXRmb3JtUXVlcnlDb250cm9sbGVyEm4KDWdldFNlcnZlckluZm8SKi5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFNlcnZlckluZm9JbnB1dBorLmFpLnN0aWdtZXIucGxhdGZvcm0udjEuR2V0U2VydmVySW5mb091dHB1dCIEyLgYARKPAQoYZ2V0UnVubmVyQm9vdHN0cmFwQ29uZmlnEjUuYWkuc3RpZ21lci5wbGF0Zm9ybS52MS5HZXRSdW5uZXJCb290c3RyYXBDb25maWdJbnB1dBo2LmFpLnN0aWdtZXIucGxhdGZvcm0udjEuR2V0UnVubmVyQm9vdHN0cmFwQ29uZmlnT3V0cHV0IgTQuBgBEoMBChRnZXRSdW5uZXJTY29wZWRUb2tlbhIxLmFpLnN0aWdtZXIucGxhdGZvcm0udjEuR2V0UnVubmVyU2NvcGVkVG9rZW5JbnB1dBoyLmFpLnN0aWdtZXIucGxhdGZvcm0udjEuR2V0UnVubmVyU2NvcGVkVG9rZW5PdXRwdXQiBNC4GAFCEUIPU2VydmVySW5mb1Byb3RvYgZwcm90bzM", [file_ai_stigmer_commons_rpc_method_options, file_buf_validate_validate]);
+export const file_ai_stigmer_platform_v1_server_info = /*@__PURE__*/ fileDesc("CihhaS9zdGlnbWVyL3BsYXRmb3JtL3YxL3NlcnZlcl9pbmZvLnByb3RvEhZhaS5zdGlnbWVyLnBsYXRmb3JtLnYxIhQKEkdldFNlcnZlckluZm9JbnB1dCJeChNHZXRTZXJ2ZXJJbmZvT3V0cHV0EjYKB2VkaXRpb24YASABKA4yJS5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLlNlcnZlckVkaXRpb24SDwoHdmVyc2lvbhgCIAEoCSIfCh1HZXRSdW5uZXJCb290c3RyYXBDb25maWdJbnB1dCLjAgoeR2V0UnVubmVyQm9vdHN0cmFwQ29uZmlnT3V0cHV0EiEKEHRlbXBvcmFsX2FkZHJlc3MYASABKAlCB7pIBHICEAESIwoSdGVtcG9yYWxfbmFtZXNwYWNlGAIgASgJQge6SARyAhABEhsKE3J1bm5lcl9hY2Nlc3NfdG9rZW4YAyABKAkSEgoKdG9rZW5fdHlwZRgEIAEoCRIuCiZydW5uZXJfYWNjZXNzX3Rva2VuX2V4cGlyZXNfaW5fc2Vjb25kcxgFIAEoBRIeChZwYXlsb2FkX2VuY3J5cHRpb25fa2V5GAYgASgJEiEKGXBheWxvYWRfZW5jcnlwdGlvbl9rZXlfaWQYByABKAkSKAogcGF5bG9hZF9lbmNyeXB0aW9uX3NlY29uZGFyeV9rZXkYCCABKAkSKwojcGF5bG9hZF9lbmNyeXB0aW9uX3NlY29uZGFyeV9rZXlfaWQYCSABKAki3AEKGUdldFJ1bm5lclNjb3BlZFRva2VuSW5wdXQSHAoSYWdlbnRfZXhlY3V0aW9uX2lkGAEgASgJSAASHwoVd29ya2Zsb3dfZXhlY3V0aW9uX2lkGAIgASgJSAASNwoKcG9vbF9jbGFpbRgDIAEoCzIhLmFpLnN0aWdtZXIucGxhdGZvcm0udjEuUG9vbENsYWltSAASNwoHcmVuZXdhbBgEIAEoCzIkLmFpLnN0aWdtZXIucGxhdGZvcm0udjEuVG9rZW5SZW5ld2FsSABCDgoFc2NvcGUSBbpIAggBIigKCVBvb2xDbGFpbRIbCgpzZXNzaW9uX2lkGAEgASgJQge6SARyAhABIg4KDFRva2VuUmVuZXdhbCJpChpHZXRSdW5uZXJTY29wZWRUb2tlbk91dHB1dBIbChNydW5uZXJfc2NvcGVkX3Rva2VuGAEgASgJEhIKCnRva2VuX3R5cGUYAiABKAkSGgoSZXhwaXJlc19pbl9zZWNvbmRzGAMgASgFKkMKDVNlcnZlckVkaXRpb24SHgoac2VydmVyX2VkaXRpb25fdW5zcGVjaWZpZWQQABIHCgNvc3MQARIJCgVjbG91ZBACMqEDChdQbGF0Zm9ybVF1ZXJ5Q29udHJvbGxlchJuCg1nZXRTZXJ2ZXJJbmZvEiouYWkuc3RpZ21lci5wbGF0Zm9ybS52MS5HZXRTZXJ2ZXJJbmZvSW5wdXQaKy5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFNlcnZlckluZm9PdXRwdXQiBMi4GAESjwEKGGdldFJ1bm5lckJvb3RzdHJhcENvbmZpZxI1LmFpLnN0aWdtZXIucGxhdGZvcm0udjEuR2V0UnVubmVyQm9vdHN0cmFwQ29uZmlnSW5wdXQaNi5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFJ1bm5lckJvb3RzdHJhcENvbmZpZ091dHB1dCIE0LgYARKDAQoUZ2V0UnVubmVyU2NvcGVkVG9rZW4SMS5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFJ1bm5lclNjb3BlZFRva2VuSW5wdXQaMi5haS5zdGlnbWVyLnBsYXRmb3JtLnYxLkdldFJ1bm5lclNjb3BlZFRva2VuT3V0cHV0IgTQuBgBQhFCD1NlcnZlckluZm9Qcm90b2IGcHJvdG8z", [file_ai_stigmer_commons_rpc_method_options, file_buf_validate_validate]);
 /**
  * Describes the message ai.stigmer.platform.v1.GetServerInfoInput.
  * Use `create(GetServerInfoInputSchema)` to create a new message.

package/ai/stigmer/platform/v1/server_info_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"server_info_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,yuDAAyuD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAUh0D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAW1D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA8D1D;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA+B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAqC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA2C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,aAqBX;AArBD,WAAY,aAAa;IACvB;;OAEG;IACH,6FAA8B,CAAA;IAE9B;;;;;OAKG;IACH,+CAAO,CAAA;IAEP;;;;;OAKG;IACH,mDAAS,CAAA;AACX,CAAC,EArBW,aAAa,KAAb,aAAa,QAqBxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GA8F/B,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server_info_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,s7DAAs7D,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAU7gE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAW1D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAgH1D;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA+B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAqC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA2C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,aAqBX;AArBD,WAAY,aAAa;IACvB;;OAEG;IACH,6FAA8B,CAAA;IAE9B;;;;;OAKG;IACH,+CAAO,CAAA;IAEP;;;;;OAKG;IACH,mDAAS,CAAA;AACX,CAAC,EArBW,aAAa,KAAb,aAAa,QAqBxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GA8F/B,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/search/v1/io_pb.d.ts

@@ -36,7 +36,9 @@ export type SearchRequest = Message<"ai.stigmer.search.v1.SearchRequest"> & {
      *
      * The searchable set is edition-defined (the cloud and open-source servers
      * each publish their own); kinds outside it are silently ignored
-     * (allows forward compatibility).
+     * (allows forward compatibility). A request naming ONLY non-searchable
+     * kinds returns an empty result — it does NOT fall back to discover mode
+     * (only an empty kinds list means discover).
      *
      * @generated from field: repeated ai.stigmer.commons.apiresource.apiresourcekind.ApiResourceKind kinds = 1;
      */

package/ai/stigmer/search/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/search/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mGAAmG;AACnG,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,qEAAqE,EAAE,MAAM,mEAAmE,CAAC;AAE1J,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAEhG,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAErF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAY,aAAa,CAChE,QAAQ,CAAC,wzCAAwzC,EAAE,CAAC,qEAAqE,EAAE,wCAAwC,EAAE,sCAAsC,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAkH5hD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;AA8D/C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;AA4K/C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/search/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mGAAmG;AACnG,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,qEAAqE,EAAE,MAAM,mEAAmE,CAAC;AAE1J,OAAO,EAAE,wCAAwC,EAAE,MAAM,sCAAsC,CAAC;AAEhG,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAErF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAY,aAAa,CAChE,QAAQ,CAAC,wzCAAwzC,EAAE,CAAC,qEAAqE,EAAE,wCAAwC,EAAE,sCAAsC,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAoH5hD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;AA8D/C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;AA4K/C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/protos",
-  "version": "3.11.0",
+  "version": "3.12.0",
   "description": "Generated TypeScript protobuf stubs for Stigmer APIs",
   "license": "Apache-2.0",
   "type": "module",

package/ai/stigmer/agentic/datastore/v1/api_pb.d.ts

@@ -1,64 +0,0 @@
-import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
-import type { DatastoreSpec } from "./spec_pb.js";
-import type { DatastoreStatus } from "./status_pb.js";
-import type { ApiResourceMetadata } from "../../../commons/apiresource/metadata_pb.js";
-import type { Message } from "@bufbuild/protobuf";
-/**
- * Describes the file ai/stigmer/agentic/datastore/v1/api.proto.
- */
-export declare const file_ai_stigmer_agentic_datastore_v1_api: GenFile;
-/**
- * Datastore declares collections of typed business records that agents
- * read and write through built-in, permission-checked tools.
- *
- * @internal
- * Org-scoped. Deleting a datastore destroys business records, so delete
- * is guarded: non-empty datastores require the force acknowledgment,
- * and datastores referenced by any agent's datastore_usages are
- * blocked. Collection removal on apply/update requires the
- * datastore.stigmer.ai/acknowledge-collection-removal annotation.
- *
- * @generated from message ai.stigmer.agentic.datastore.v1.Datastore
- */
-export type Datastore = Message<"ai.stigmer.agentic.datastore.v1.Datastore"> & {
-    /**
-     * API version for this resource type.
-     *
-     * @generated from field: string api_version = 1;
-     */
-    apiVersion: string;
-    /**
-     * Resource kind identifier.
-     *
-     * @generated from field: string kind = 2;
-     */
-    kind: string;
-    /**
-     * Resource metadata including name, organization, visibility, and labels.
-     *
-     * @internal
-     * Visibility ceiling is org (kind_meta VisibilityConfig); default is
-     * private. Visibility governs human administrative reach only — no
-     * record-RPC path consults it.
-     *
-     * @generated from field: ai.stigmer.commons.apiresource.ApiResourceMetadata metadata = 3;
-     */
-    metadata?: ApiResourceMetadata;
-    /**
-     * Declared collections, constraints, authorization, and seed data.
-     *
-     * @generated from field: ai.stigmer.agentic.datastore.v1.DatastoreSpec spec = 4;
-     */
-    spec?: DatastoreSpec;
-    /**
-     * System-managed status: sync report and audit information.
-     *
-     * @generated from field: ai.stigmer.agentic.datastore.v1.DatastoreStatus status = 5;
-     */
-    status?: DatastoreStatus;
-};
-/**
- * Describes the message ai.stigmer.agentic.datastore.v1.Datastore.
- * Use `create(DatastoreSchema)` to create a new message.
- */
-export declare const DatastoreSchema: GenMessage<Datastore>;

package/ai/stigmer/agentic/datastore/v1/api_pb.js

@@ -1,18 +0,0 @@
-// @generated by protoc-gen-es v2.2.2 with parameter "target=ts,import_extension=js"
-// @generated from file ai/stigmer/agentic/datastore/v1/api.proto (package ai.stigmer.agentic.datastore.v1, syntax proto3)
-/* eslint-disable */
-import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
-import { file_ai_stigmer_agentic_datastore_v1_spec } from "./spec_pb.js";
-import { file_ai_stigmer_agentic_datastore_v1_status } from "./status_pb.js";
-import { file_ai_stigmer_commons_apiresource_metadata } from "../../../commons/apiresource/metadata_pb.js";
-import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb.js";
-/**
- * Describes the file ai/stigmer/agentic/datastore/v1/api.proto.
- */
-export const file_ai_stigmer_agentic_datastore_v1_api = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvZGF0YXN0b3JlL3YxL2FwaS5wcm90bxIfYWkuc3RpZ21lci5hZ2VudGljLmRhdGFzdG9yZS52MSKtAgoJRGF0YXN0b3JlEjEKC2FwaV92ZXJzaW9uGAEgASgJQhy6SBlyFwoVYWdlbnRpYy5zdGlnbWVyLmFpL3YxEh4KBGtpbmQYAiABKAlCELpIDXILCglEYXRhc3RvcmUSTQoIbWV0YWRhdGEYAyABKAsyMy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VNZXRhZGF0YUIGukgDyAEBEjwKBHNwZWMYBCABKAsyLi5haS5zdGlnbWVyLmFnZW50aWMuZGF0YXN0b3JlLnYxLkRhdGFzdG9yZVNwZWMSQAoGc3RhdHVzGAUgASgLMjAuYWkuc3RpZ21lci5hZ2VudGljLmRhdGFzdG9yZS52MS5EYXRhc3RvcmVTdGF0dXNiBnByb3RvMw", [file_ai_stigmer_agentic_datastore_v1_spec, file_ai_stigmer_agentic_datastore_v1_status, file_ai_stigmer_commons_apiresource_metadata, file_buf_validate_validate]);
-/**
- * Describes the message ai.stigmer.agentic.datastore.v1.Datastore.
- * Use `create(DatastoreSchema)` to create a new message.
- */
-export const DatastoreSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_datastore_v1_api, 0);
-//# sourceMappingURL=api_pb.js.map

package/ai/stigmer/agentic/datastore/v1/api_pb.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/datastore/v1/api_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,0HAA0H;AAC1H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,yCAAyC,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,2CAA2C,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAC3G,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,wgBAAwgB,EAAE,CAAC,yCAAyC,EAAE,2CAA2C,EAAE,4CAA4C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAyDzrB;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/datastore/v1/command_connect.d.ts

@@ -1,111 +0,0 @@
-/**
- * DatastoreCommandController handles write operations for datastores.
- *
- * @generated from service ai.stigmer.agentic.datastore.v1.DatastoreCommandController
- */
-export declare const DatastoreCommandController: {
-    readonly typeName: "ai.stigmer.agentic.datastore.v1.DatastoreCommandController";
-    readonly methods: {
-        /**
-         * Create or update a datastore.
-         *
-         * @internal
-         * The authorization and state-operation are determined depending on
-         * whether the datastore is going to be created or updated, which is
-         * resolved as part of the request execution. Schema sync runs as a
-         * synchronous, gating step after persist (additive-plus change
-         * matrix); removing a non-empty collection requires the
-         * datastore.stigmer.ai/acknowledge-collection-removal annotation
-         * naming it, otherwise the request fails with FAILED_PRECONDITION.
-         *
-         * @generated from rpc ai.stigmer.agentic.datastore.v1.DatastoreCommandController.apply
-         */
-        readonly apply: {
-            readonly name: "apply";
-            readonly I: any;
-            readonly O: any;
-            readonly kind: any;
-        };
-        /**
-         * Create a datastore.
-         *
-         * @internal
-         * Authorization: caller must have can_create_datastore permission in
-         * the organization. Max datastores per org is enforced as a domain
-         * validation constant in this pipeline.
-         *
-         * @generated from rpc ai.stigmer.agentic.datastore.v1.DatastoreCommandController.create
-         */
-        readonly create: {
-            readonly name: "create";
-            readonly I: any;
-            readonly O: any;
-            readonly kind: any;
-        };
-        /**
-         * Update an existing datastore.
-         *
-         * @internal
-         * Authorization: requires can_edit permission on the datastore
-         * resource. Updates are full spec replaces; the gating schema-sync
-         * step diffs against the loaded existing spec and applies the
-         * additive-plus change matrix (DD-004): no transition silently
-         * destroys or nulls record data.
-         *
-         * @generated from rpc ai.stigmer.agentic.datastore.v1.DatastoreCommandController.update
-         */
-        readonly update: {
-            readonly name: "update";
-            readonly I: any;
-            readonly O: any;
-            readonly kind: any;
-        };
-        /**
-         * Update the visibility of an existing datastore.
-         *
-         * Only modifies metadata.visibility. Datastores support two levels:
-         * private (the default) and org. Setting org shares the datastore
-         * with the owning organization for human administration; it does not
-         * change record-layer access, which is governed solely by the
-         * datastore's authorization block and agent datastore_usages.
-         *
-         * @internal
-         * Authorization: requires can_edit permission on the datastore
-         * resource. public/platform levels are rejected via the kind's
-         * VisibilityConfig (supports_org only) — business records must never
-         * be resolvable across the org boundary.
-         *
-         * @generated from rpc ai.stigmer.agentic.datastore.v1.DatastoreCommandController.updateVisibility
-         */
-        readonly updateVisibility: {
-            readonly name: "updateVisibility";
-            readonly I: any;
-            readonly O: any;
-            readonly kind: any;
-        };
-        /**
-         * Delete a datastore and every record it holds.
-         *
-         * Deleting a non-empty datastore requires force: without it the
-         * request fails with FAILED_PRECONDITION reporting how many records
-         * across how many collections would be destroyed. A datastore
-         * referenced by any agent's datastore_usages cannot be deleted until
-         * the references are removed.
-         *
-         * @internal
-         * Authorization: requires can_edit permission on the datastore
-         * resource. The two guards (record-count acknowledgment via force;
-         * agent-reference block, never forceable) run in the delete pipeline
-         * of both editions. Record tools never delete structures — this RPC
-         * is the only path that destroys collections.
-         *
-         * @generated from rpc ai.stigmer.agentic.datastore.v1.DatastoreCommandController.delete
-         */
-        readonly delete: {
-            readonly name: "delete";
-            readonly I: any;
-            readonly O: any;
-            readonly kind: any;
-        };
-    };
-};