@stigmer/protos 3.11.1-dev.20260812192248 → 3.12.1

package/ai/stigmer/agentic/mcpserver/v1/command_pb.d.ts

@@ -239,6 +239,11 @@ export declare const McpServerCommandController: GenService<{
      * Idempotent: if an override already exists for this resource + org, the
      * existing OAuthApp is updated with the new credentials.
      *
+     * Edition scoping: hosted-only. UNIMPLEMENTED on the OSS server by
+     * design, as one capability with getOrgOAuthApp and deleteOrgOAuthApp —
+     * see the full scoping note on McpServerQueryController.getOrgOAuthApp,
+     * the RPC clients probe.
+     *
      * @internal
      * Authorization: Requires can_create_oauth_app permission on the organization.
      * This is an org-admin operation — setting credentials that affect all users
@@ -263,6 +268,11 @@ export declare const McpServerCommandController: GenService<{
      * was created for it. After this, the resolution chain falls back to
      * the platform default.
      *
+     * Edition scoping: hosted-only. UNIMPLEMENTED on the OSS server by
+     * design, as one capability with getOrgOAuthApp and setOrgOAuthApp —
+     * see the full scoping note on McpServerQueryController.getOrgOAuthApp,
+     * the RPC clients probe.
+     *
      * Existing user OAuthGrants that were issued using the org's OAuthApp
      * will fail on next token refresh — those users will need to
      * re-authenticate using the platform default or a new org override.

package/ai/stigmer/agentic/mcpserver/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,8qFAA8qF,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE75F;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAqQlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,8qFAA8qF,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE75F;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GA+QlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/oauth_pb.d.ts

@@ -147,6 +147,12 @@ export declare const OAuthGrantSchema: GenMessage<OAuthGrant>;
  *   2. McpServerAuth.oauth_app_ref on the resource spec — platform default
  *   3. None — no OAuth app available (manual token or DCR only)
  *
+ * Edition scoping: the override binding — and the whole resolution chain
+ * above it — exists only on the hosted platform. OSS resolves the
+ * oauth_app_ref directly against its flat OAuthApp store (the ref IS the
+ * whole resolution) and answers UNIMPLEMENTED for the org-OAuth-app RPCs;
+ * see McpServerQueryController.getOrgOAuthApp for the contract.
+ *
  * The override is resource-agnostic: currently used for MCP servers, but the
  * composite key supports any API resource kind that needs BYOA (e.g., workflows).
  *

package/ai/stigmer/agentic/mcpserver/v1/oauth_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/oauth_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,0nBAA0nB,CAAC,CAAC;AA8HvoB;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AAqE7D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"oauth_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/oauth_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,0nBAA0nB,CAAC,CAAC;AA8HvoB;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AA2E7D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/query_connect.d.ts

@@ -76,6 +76,18 @@ export declare const McpServerQueryController: {
          * exposing secrets. The frontend uses this to show which credential
          * source is active and to offer override management options to org admins.
          *
+         * Edition scoping: hosted-only, together with setOrgOAuthApp and
+         * deleteOrgOAuthApp — the three org-OAuth-app RPCs are ONE capability.
+         * The OSS server answers UNIMPLEMENTED for all of them by design: its
+         * flat OAuthApp store has no override binding, its OAuth resolution has
+         * no override level to consult, and BYOA's clone-from-platform-template
+         * model has no template to clone (self-hosted users apply their own
+         * OAuthApp and reference it from spec.auth.oauth_app_ref — a strictly
+         * more powerful path). Clients probe the capability through THIS RPC:
+         * an UNIMPLEMENTED answer means "hide every BYOA affordance" (see the
+         * SDK's useOrgOAuthApp.isSupported). Never implement one RPC of the
+         * surface without the other two and the client-side gate.
+         *
          * @internal
          * Authorization: Requires can_view permission on the mcp_server resource.
          * Any user who can view the MCP server can check whether their org has

package/ai/stigmer/agentic/mcpserver/v1/query_connect.js

@@ -84,6 +84,18 @@ export const McpServerQueryController = {
          * exposing secrets. The frontend uses this to show which credential
          * source is active and to offer override management options to org admins.
          *
+         * Edition scoping: hosted-only, together with setOrgOAuthApp and
+         * deleteOrgOAuthApp — the three org-OAuth-app RPCs are ONE capability.
+         * The OSS server answers UNIMPLEMENTED for all of them by design: its
+         * flat OAuthApp store has no override binding, its OAuth resolution has
+         * no override level to consult, and BYOA's clone-from-platform-template
+         * model has no template to clone (self-hosted users apply their own
+         * OAuthApp and reference it from spec.auth.oauth_app_ref — a strictly
+         * more powerful path). Clients probe the capability through THIS RPC:
+         * an UNIMPLEMENTED answer means "hide every BYOA affordance" (see the
+         * SDK's useOrgOAuthApp.isSupported). Never implement one RPC of the
+         * surface without the other two and the client-side gate.
+         *
          * @internal
          * Authorization: Requires can_view permission on the mcp_server resource.
          * Any user who can view the MCP server can check whether their org has

package/ai/stigmer/agentic/mcpserver/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4HAA4H;AAC5H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAE3H;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,0DAA0D;IACpE,OAAO,EAAE;QACP;;;;;;;;;;;WAWG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,mBAAmB;YACtB,CAAC,EAAE,oBAAoB;YACvB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4HAA4H;AAC5H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAE3H;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,0DAA0D;IACpE,OAAO,EAAE;QACP;;;;;;;;;;;WAWG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,mBAAmB;YACtB,CAAC,EAAE,oBAAoB;YACvB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/query_pb.d.ts

@@ -79,6 +79,18 @@ export declare const McpServerQueryController: GenService<{
      * exposing secrets. The frontend uses this to show which credential
      * source is active and to offer override management options to org admins.
      *
+     * Edition scoping: hosted-only, together with setOrgOAuthApp and
+     * deleteOrgOAuthApp — the three org-OAuth-app RPCs are ONE capability.
+     * The OSS server answers UNIMPLEMENTED for all of them by design: its
+     * flat OAuthApp store has no override binding, its OAuth resolution has
+     * no override level to consult, and BYOA's clone-from-platform-template
+     * model has no template to clone (self-hosted users apply their own
+     * OAuthApp and reference it from spec.auth.oauth_app_ref — a strictly
+     * more powerful path). Clients probe the capability through THIS RPC:
+     * an UNIMPLEMENTED answer means "hide every BYOA affordance" (see the
+     * SDK's useOrgOAuthApp.isSupported). Never implement one RPC of the
+     * surface without the other two and the client-side gate.
+     *
      * @internal
      * Authorization: Requires can_view permission on the mcp_server resource.
      * Any user who can view the MCP server can check whether their org has

package/ai/stigmer/agentic/mcpserver/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,kjCAAkjC,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEjyC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GA0EhC,aAAa,CAChB,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,kjCAAkjC,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEjyC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAsFhC,aAAa,CAChB,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.d.ts

@@ -78,11 +78,19 @@ export type McpServerSpec = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSp
      * Only names from discovered_capabilities.tools are valid here.
      * Do NOT include names from discovered_capabilities.resource_templates —
      * resource templates are read-only data endpoints, not callable tools.
-     * A name the server does not expose (including a resource template name)
-     * is warned and ignored at execution: the runner enforces the INTERSECTION
-     * with the server's live toolset, so a stale or mistyped entry narrows the
-     * toolset but never widens it or fails the run. Enforcement is per harness
-     * — see McpServerUsage.enabled_tools in agent/v1/spec.proto.
+     *
+     * Enforcement is two-layered:
+     *   - Apply time: mcpserver update/apply rejects (INVALID_ARGUMENT) any
+     *     name this server's own discovered_capabilities.tools does not
+     *     contain, with the valid names in the error. Skipped when the server
+     *     has never been connected (no capabilities yet) — which is always the
+     *     case on create, so the check only bites from the first re-apply
+     *     after discovery.
+     *   - Execution time: the runner enforces the INTERSECTION with the
+     *     server's live toolset — an unknown name is warned in the runner log
+     *     and ignored, so a stale entry narrows the toolset but never widens
+     *     it or fails the run. Enforcement is per harness — see
+     *     McpServerUsage.enabled_tools in agent/v1/spec.proto.
      *
      * @generated from field: repeated string default_enabled_tools = 7;
      */

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,0mEAA0mE,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwK7xE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA+D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA4E5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA6H5D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,0mEAA0mE,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAgL7xE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA+D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA4E5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA6H5D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/status_pb.d.ts

@@ -72,9 +72,9 @@ export type McpServerStatus = Message<"ai.stigmer.agentic.mcpserver.v1.McpServer
     toolApprovals: ToolApprovalPolicy[];
     /**
      * OAuth-related enrichment state, populated at query time by the backend.
-     * Contains vendor approval status (resolved from the referenced OAuthApp)
-     * and BYOA resolution chain results (which OAuthApp is effective for the
-     * caller's org context). None of these fields are persisted.
+     * Carries the vendor approval status resolved from the referenced OAuthApp
+     * (fields 1-2; fields 3-4 are never populated — see OAuthStatus).
+     * None of these fields are persisted.
      *
      * @generated from field: ai.stigmer.agentic.mcpserver.v1.OAuthStatus oauth_status = 5;
      */
@@ -217,17 +217,24 @@ export declare const DiscoveredResourceTemplateSchema: GenMessage<DiscoveredReso
  * OAuthStatus holds system-derived OAuth enrichment state for an MCP server.
  *
  * @internal
- * All fields are read-only, populated by the backend enricher at query time.
- * None are persisted on the McpServer document — they are computed fresh on
- * every get/getByReference response.
+ * All fields are read-only and never persisted on the McpServer document.
  *
- * Two categories of enrichment:
- * 1. Vendor approval (fields 1-2): Resolved from the referenced OAuthApp
- *    resource. Tells the frontend whether the sign-in button should be
- *    enabled and provides a BYOA documentation link when approval is pending.
- * 2. BYOA resolution (fields 3-4): Computed from the OAuth app resolution
- *    chain. Tells the frontend which credential source is active for the
- *    caller's org context and its OAuthApp ID.
+ * Two categories, with different production stories:
+ * 1. Vendor approval (fields 1-2): populated by the backend enricher on
+ *    every get/getByReference response, resolved from the referenced
+ *    OAuthApp. Tells the frontend whether the platform sign-in flow is
+ *    gated and provides a BYOA documentation link when approval is pending.
+ * 2. BYOA resolution (fields 3-4): NEVER POPULATED, by any edition. The
+ *    resolution is per (server, caller's active org), and the caller's
+ *    active org is client-side context the read RPCs never carry — get has
+ *    no org, and getByReference's org is the server's OWNING org (the
+ *    lookup key), which differs from the caller's org when browsing another
+ *    org's public server. Resolving against the owning org would misreport
+ *    exactly the cross-org marketplace flow BYOA exists for. The shared SDK
+ *    instead derives the signal client-side from the getOrgOAuthApp RPC,
+ *    keyed on the same org the connect flow uses. The fields are retained
+ *    for wire compatibility and as the home of this contract note; a future
+ *    server-side active-org mechanism could legitimately populate them.
  *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.OAuthStatus
  */
@@ -251,18 +258,17 @@ export type OAuthStatus = Message<"ai.stigmer.agentic.mcpserver.v1.OAuthStatus">
      */
     vendorApprovalDocsUrl: string;
     /**
-     * Where the effective OAuth app was resolved from for the caller's org.
-     * Computed from the resolution chain:
-     *   1. OAuthAppOverride for (resource_id, resource_kind, org_id) → ORG_OVERRIDE
-     *   2. McpServerAuth.oauth_app_ref → PLATFORM
-     *   3. Neither exists → NONE
+     * NEVER POPULATED (see the message comment): the caller's active org is
+     * client-side context, so no backend can evaluate the resolution chain at
+     * read time. The shared SDK derives this value client-side from the
+     * getOrgOAuthApp RPC (useMcpServerCredentials.effectiveOAuthSource).
      *
      * @generated from field: ai.stigmer.agentic.mcpserver.v1.OAuthAppSource effective_oauth_source = 3;
      */
     effectiveOauthSource: OAuthAppSource;
     /**
-     * System-generated ID (metadata.id) of the OAuthApp that the resolution
-     * chain selected. Empty when effective_oauth_source is NONE.
+     * NEVER POPULATED (see the message comment). The override's OAuthApp ID
+     * is available from the getOrgOAuthApp RPC (GetOrgOAuthAppOutput.oauth_app_id).
      *
      * @generated from field: string effective_oauth_app_id = 4;
      */
@@ -310,10 +316,17 @@ export declare enum ValidationState {
 export declare const ValidationStateSchema: GenEnum<ValidationState>;
 /**
  * OAuthAppSource identifies where the effective OAuth app for an MCP server
- * was resolved from. Populated at query time by the backend enricher to tell
- * the frontend which credential source is active for the current org context.
+ * was resolved from.
  *
- * Used in OAuthStatus.effective_oauth_source (read-only, not persisted).
+ * The resolution chain is the same one the OAuth connect flow evaluates:
+ *   1. OAuthAppOverride for (resource_id, resource_kind, org_id) → ORG_OVERRIDE
+ *   2. McpServerAuth.oauth_app_ref → PLATFORM
+ *   3. Neither exists → NONE
+ *
+ * Resolved CLIENT-SIDE by the shared SDK from the getOrgOAuthApp RPC: the
+ * resolution is per (server, caller's active org), and the caller's active
+ * org is client-side context the read RPCs never carry, so no backend can
+ * compute it at enrichment time (see OAuthStatus fields 3-4).
  *
  * @generated from enum ai.stigmer.agentic.mcpserver.v1.OAuthAppSource
  */

package/ai/stigmer/agentic/mcpserver/v1/status_pb.js

@@ -73,10 +73,17 @@ export var ValidationState;
 export const ValidationStateSchema = /*@__PURE__*/ enumDesc(file_ai_stigmer_agentic_mcpserver_v1_status, 0);
 /**
  * OAuthAppSource identifies where the effective OAuth app for an MCP server
- * was resolved from. Populated at query time by the backend enricher to tell
- * the frontend which credential source is active for the current org context.
+ * was resolved from.
  *
- * Used in OAuthStatus.effective_oauth_source (read-only, not persisted).
+ * The resolution chain is the same one the OAuth connect flow evaluates:
+ *   1. OAuthAppOverride for (resource_id, resource_kind, org_id) → ORG_OVERRIDE
+ *   2. McpServerAuth.oauth_app_ref → PLATFORM
+ *   3. Neither exists → NONE
+ *
+ * Resolved CLIENT-SIDE by the shared SDK from the getOrgOAuthApp RPC: the
+ * resolution is per (server, caller's active org), and the caller's active
+ * org is client-side context the read RPCs never carry, so no backend can
+ * compute it at enrichment time (see OAuthStatus fields 3-4).
  *
  * @generated from enum ai.stigmer.agentic.mcpserver.v1.OAuthAppSource
  */

package/ai/stigmer/agentic/mcpserver/v1/status_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"status_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/status_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,yCAAyC,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGrG;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,y2DAAy2D,EAAE,CAAC,yCAAyC,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAsFljE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAkC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA2C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA6D9D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eA0BX;AA1BD,WAAY,eAAe;IACzB;;;;;OAKG;IACH,qGAAgC,CAAA;IAEhC;;;;;;OAMG;IACH,uDAAS,CAAA;IAET;;;;;;OAMG;IACH,2DAAW,CAAA;AACb,CAAC,EA1BW,eAAe,KAAf,eAAe,QA0B1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,cA6BX;AA7BD,WAAY,cAAc;IACxB;;;;OAIG;IACH,mGAAgC,CAAA;IAEhC;;;;OAIG;IACH,6FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,qFAAyB,CAAA;AAC3B,CAAC,EA7BW,cAAc,KAAd,cAAc,QA6BzB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA4B,aAAa,CACxE,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"status_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/status_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,yCAAyC,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGrG;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,y2DAAy2D,EAAE,CAAC,yCAAyC,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAsFljE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAkC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA2C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAmE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eA0BX;AA1BD,WAAY,eAAe;IACzB;;;;;OAKG;IACH,qGAAgC,CAAA;IAEhC;;;;;;OAMG;IACH,uDAAS,CAAA;IAET;;;;;;OAMG;IACH,2DAAW,CAAA;AACb,CAAC,EA1BW,eAAe,KAAf,eAAe,QA0B1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,cA6BX;AA7BD,WAAY,cAAc;IACxB;;;;OAIG;IACH,mGAAgC,CAAA;IAEhC;;;;OAIG;IACH,6FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,qFAAyB,CAAA;AAC3B,CAAC,EA7BW,cAAc,KAAd,cAAc,QA6BzB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA4B,aAAa,CACxE,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/session/v1/workspace_pb.d.ts

@@ -112,10 +112,13 @@ export declare const LocalPathSourceSchema: GenMessage<LocalPathSource>;
  *
  * @internal
  * Authentication: The provisioner resolves GITHUB_TOKEN from the merged
- * environment (Agent defaults < Environment < ExecutionContext.runtime_env)
- * and injects it into the clone URL. The token is consumed by provisioning
- * and stripped before forwarding to the agent runtime (see AD-05).
- * SSH key authentication is a future enhancement.
+ * environment (instance environment_refs < ExecutionContext.runtime_env). As a
+ * workspace-provisioning key it is re-injected past the Agent.spec.env
+ * declared-key filter when the session has git_repo entries, with a fallback
+ * to the caller's personal environment (see the agentexecution controller's
+ * executionContextBuilder). The token is injected into the clone URL, consumed
+ * by provisioning, and stripped before forwarding to the agent runtime (see
+ * AD-05). SSH key authentication is a future enhancement.
  *
  * @generated from message ai.stigmer.agentic.session.v1.GitRepoSource
  */

package/ai/stigmer/agentic/session/v1/workspace_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/session/v1/workspace_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,uCAAuC,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,o+BAAo+B,EAAE,CAAC,uCAAuC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAmCxjC;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAiC/D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAwB/D;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AA+E/D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"workspace_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/session/v1/workspace_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,uCAAuC,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,o+BAAo+B,EAAE,CAAC,uCAAuC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAmCxjC;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAiC/D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAwB/D;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAkF/D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/workflowexecution/v1/spec_pb.d.ts

@@ -103,25 +103,31 @@ export type WorkflowExecutionSpec = Message<"ai.stigmer.agentic.workflowexecutio
         [key: string]: string;
     };
     /**
-     * Execution-scoped environment variables and secrets that override instance defaults.
+     * Execution-scoped environment variables and secrets, available only to this
+     * execution. Values here take the highest merge priority, overriding values
+     * from Environments bound via the instance's environment_refs. A key must be
+     * declared in Workflow.spec.env to survive the merge: the workflow env map is
+     * a declaration whitelist (name + is_secret + optional), never a value source
+     * — undeclared keys are dropped.
      *
      * @internal
-     * These values are only available for this specific execution and override values
-     * from Environments and Workflow defaults.
-     *
-     * Merge Priority (highest to lowest):
-     * 1. runtime_env (this field) - Execution-specific overrides
-     * 2. Environment values (from WorkflowInstance.environment_ids)
-     * 3. Workflow defaults (from Workflow.default_env)
-     *
-     * Value Types:
-     * - value: Plain text value (not encrypted, use for non-sensitive config)
-     * - secret_ref: Reference to a Secret resource (encrypted, use for API keys, passwords)
+     * Merge priority (lowest to highest):
+     * 1. Environment values (resolved from WorkflowInstance.environment_refs, in
+     *    order; a later ref wins on key conflicts)
+     * 2. runtime_env (this field)
+     *
+     * The merged map is then filtered to the keys declared in Workflow.spec.env
+     * (no filtering when the workflow declares none); a declared-but-required key
+     * that is still missing only logs a warning — the run is not failed. The
+     * merge is owned by backend/libs/go/envmerge and the workflowexecution
+     * controller's createExecutionContextStep, and asserted by
+     * test/conformance/src/suites-execution/envmerge.conformance.test.ts.
      *
      * Security:
-     * - runtime_env values are stored in ExecutionContext
+     * - runtime_env values are consumed into the ExecutionContext at create time
+     *   and cleared from the persisted execution (never in Temporal history)
      * - ExecutionContext is deleted when execution completes (ephemeral secrets)
-     * - Secret references are resolved at runtime (never exposed in logs)
+     * - Values with is_secret=true are encrypted at rest and redacted in logs
      *
      * Tasks can access these values using: {{env.VARIABLE_NAME}}
      *

package/ai/stigmer/agentic/workflowexecution/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowexecution/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2IAA2I;AAC3I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,gDAAgD,EAAE,MAAM,sCAAsC,CAAC;AAExG,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AAGtF;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,w4BAAw4B,EAAE,CAAC,gDAAgD,EAAE,uCAAuC,CAAC,CAAC,CAAC;AAsLl/B;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowexecution/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2IAA2I;AAC3I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,gDAAgD,EAAE,MAAM,sCAAsC,CAAC;AAExG,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AAGtF;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,w4BAAw4B,EAAE,CAAC,gDAAgD,EAAE,uCAAuC,CAAC,CAAC,CAAC;AA4Ll/B;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.d.ts

@@ -280,13 +280,6 @@ export declare enum ApiResourceKind {
      * @generated from enum value: channel_app = 48;
      */
     channel_app = 48,
-    /**
-     * Declared collections of typed business records with role-aware access
-     * grants; agents read and write records through grant-checked tools.
-     *
-     * @generated from enum value: datastore = 49;
-     */
-    datastore = 49,
     /**
      * Multi-step orchestration defining how agents collaborate on a task.
      *

package/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.js

@@ -8,7 +8,7 @@ import { file_google_protobuf_descriptor } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind.proto.
  */
-export const file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind = /*@__PURE__*/ fileDesc("CkZhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2FwaV9yZXNvdXJjZV9raW5kLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIswDChNBcGlSZXNvdXJjZUtpbmRNZXRhEk8KBWdyb3VwGAEgASgOMkAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUdyb3VwElMKB3ZlcnNpb24YAiABKA4yQi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlVmVyc2lvbhIMCgRuYW1lGAMgASgJEhQKDGRpc3BsYXlfbmFtZRgEIAEoCRIRCglpZF9wcmVmaXgYBSABKAkSFAoMaXNfdmVyc2lvbmVkGAYgASgIEhoKEm5vdF9zZWFyY2hfaW5kZXhlZBgHIAEoCBJKCgR0aWVyGAggASgOMjwuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5SZXNvdXJjZVRpZXISWgoNYXV0aG9yaXphdGlvbhgJIAEoCzJDLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuQXV0aG9yaXphdGlvbkNvbmZpZypCChJBcGlSZXNvdXJjZVZlcnNpb24SJAogYXBpX3Jlc291cmNlX3ZlcnNpb25fdW5zcGVjaWZpZWQQABIGCgJ2MRABKk4KDFJlc291cmNlVGllchIdChlyZXNvdXJjZV90aWVyX3Vuc3BlY2lmaWVkEAASDwoLb3Blbl9zb3VyY2UQARIOCgpjbG91ZF9vbmx5EAIqQQoPUGxhdGZvcm1JZFZhbHVlEiEKHXBsYXRmb3JtX2lkX3ZhbHVlX3Vuc3BlY2lmaWVkEAASCwoHc3RpZ21lchABKsURCg9BcGlSZXNvdXJjZUtpbmQSHQoZYXBpX3Jlc291cmNlX2tpbmRfdW5rbm93bhAAElsKFGFwaV9yZXNvdXJjZV92ZXJzaW9uEAEaQar/Kz0IARABGhJBcGlSZXNvdXJjZVZlcnNpb24iFEFQSSBSZXNvdXJjZSBWZXJzaW9uKgN2ZXI4AUACSgQIBRAEEj8KCmlhbV9wb2xpY3kQChovqv8rKwgCEAEaCUlhbVBvbGljeSIKSUFNIFBvbGljeSoEaWFtcDgBQAJKBAgCEAESTgoQaWRlbnRpdHlfYWNjb3VudBALGjiq/ys0CAIQARoPSWRlbnRpdHlBY2NvdW50IhBJZGVudGl0eSBBY2NvdW50KgNpZGFAAkoECAQQAxI1CgdhcGlfa2V5EAwaKKr/KyQIAhABGgZBcGlLZXkiB0FQSSBLZXkqA2tleTgBQAJKBAgEEAESPwoKaW52aXRhdGlvbhAUGi+q/ysrCAIQARoKSW52aXRhdGlvbiIKSW52aXRhdGlvbioDaW52OAFAAkoECAIQARJXChFpZGVudGl0eV9wcm92aWRlchAVGkCq/ys8CAIQARoQSWRlbnRpdHlQcm92aWRlciIRSWRlbnRpdHkgUHJvdmlkZXIqA2lkcDgBQAJKCAgCEAE6AgEEEkAKCW9hdXRoX2FwcBAWGjGq/ystCAIQARoIT0F1dGhBcHAiCU9BdXRoIEFwcCoEb2FwcDgBQAJKCAgCEAE6AgEEElEKD3BsYXRmb3JtX2NsaWVudBAXGjyq/ys4CAIQARoOUGxhdGZvcm1DbGllbnQiD1BsYXRmb3JtIENsaWVudCoDcGNsOAFAAkoICAIQAToCAQQSSQoMb3JnYW5pemF0aW9uEB4aN6r/KzMIAxABGgxPcmdhbml6YXRpb24iDE9yZ2FuaXphdGlvbioDb3JnQAFKCggEEAE6BAECAwQSOQoIcGxhdGZvcm0QHxorqv8rJwgDEAEaCFBsYXRmb3JtIghQbGF0Zm9ybSoDcGx0OAFAAkoECAUQBBI8CgVhZ2VudBAoGjGq/ystCAEQARoFQWdlbnQiBUFnZW50KgNhZ3RAAUoSCAIQASoICAEQARgBIAE6AgEEEmsKD2FnZW50X2V4ZWN1dGlvbhApGlaq/ytSCAEQARoOQWdlbnRFeGVjdXRpb24iD0FnZW50IEV4ZWN1dGlvbioDYWV4QAFKJAgDEAIaHgoHc2Vzc2lvbhIHc2Vzc2lvbhoKc2Vzc2lvbl9pZBI4CgdzZXNzaW9uECoaK6r/KycIARABGgdTZXNzaW9uIgdTZXNzaW9uKgNzZXNAAUoICAIQAToCAQQSPgoFc2tpbGwQKxozqv8rLwgBEAEaBVNraWxsIgVTa2lsbCoDc2tsMAFAAUoSCAIQASoICAEQARgBIAE6AgEEEkoKCm1jcF9zZXJ2ZXIQLBo6qv8rNggBEAEaCU1jcFNlcnZlciIKTUNQIFNlcnZlcioDbWNwQAFKEggCEAEqCAgBEAEYASABOgIBBBJsCg5hZ2VudF9pbnN0YW5jZRAtGliq/ytUCAEQARoNQWdlbnRJbnN0YW5jZSIOQWdlbnQgSW5zdGFuY2UqA2FpbkABSigIAhABIhgKBWFnZW50EgVhZ2VudBoIYWdlbnRfaWQqBAgBGAE6AgEEEkUKC2FnZW50X3NoYXJlEC4aNKr/KzAIARABGgpBZ2VudFNoYXJlIgtBZ2VudCBTaGFyZSoDYXNoOAFAAUoICAIQAToCAQQSTAoNYWdlbnRfY2hhbm5lbBAvGjmq/ys1CAEQARoMQWdlbnRDaGFubmVsIg1BZ2VudCBDaGFubmVsKgNhY2g4AUABSgkIAhABOgMBBAUSRwoLY2hhbm5lbF9hcHAQMBo2qv8rMggBEAEaCkNoYW5uZWxBcHAiC0NoYW5uZWwgQXBwKgVjaGFwcDgBQAFKCAgCEAE6AgEEEkQKCWRhdGFzdG9yZRAxGjWq/ysxCAEQARoJRGF0YXN0b3JlIglEYXRhc3RvcmUqA2RzdEABSg4IAhABKgIYATABOgIBBBJHCgh3b3JrZmxvdxAyGjmq/ys1CAEQARoIV29ya2Zsb3ciCFdvcmtmbG93KgN3ZmwwAUABShIIAhABKggIARABGAEgAToCAQQSfgoRd29ya2Zsb3dfaW5zdGFuY2UQMxpnqv8rYwgBEAEaEFdvcmtmbG93SW5zdGFuY2UiEVdvcmtmbG93IEluc3RhbmNlKgN3aW5AAUoxCAIQASIhCgh3b3JrZmxvdxIId29ya2Zsb3caC3dvcmtmbG93X2lkKgQIARgBOgIBBBKWAQoSd29ya2Zsb3dfZXhlY3V0aW9uEDQafqr/K3oIARABGhFXb3JrZmxvd0V4ZWN1dGlvbiISV29ya2Zsb3cgRXhlY3V0aW9uKgN3ZXhAAUpGCAIQASI8ChF3b3JrZmxvd19pbnN0YW5jZRIRd29ya2Zsb3dfaW5zdGFuY2UaFHdvcmtmbG93X2luc3RhbmNlX2lkOgIBBBJKCgtlbnZpcm9ubWVudBA1Gjmq/ys1CAEQARoLRW52aXJvbm1lbnQiC0Vudmlyb25tZW50KgNlbnZAAUoOCAIQASoCGAEwAToCAQQSOwoIYXJ0aWZhY3QQNxotqv8rKQgBEAEaCEFydGlmYWN0IghBcnRpZmFjdCoDYXJ0QAFKCAgCEAE6AgEEElIKEWV4ZWN1dGlvbl9jb250ZXh0EDYaO6r/KzcIARABGhBFeGVjdXRpb25Db250ZXh0IhFFeGVjdXRpb24gQ29udGV4dCoEZWN0eEABSgQIBBABEj0KCHNjaGVkdWxlEDgaL6r/KysIARABGghTY2hlZHVsZSIIU2NoZWR1bGUqA3NjaDgBQAFKCAgCEAE6AgEEEjgKB3Byb2plY3QQPBorqv8rJwgDEAEaB1Byb2plY3QiB1Byb2plY3QqA3ByakABSggIAhABOgIBBDqFAQoJa2luZF9tZXRhEiEuZ29vZ2xlLnByb3RvYnVmLkVudW1WYWx1ZU9wdGlvbnMY9b8FIAEoCzJDLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuQXBpUmVzb3VyY2VLaW5kTWV0YVIIa2luZE1ldGFCG0IZQXBpUmVzb3VyY2VLaW5kT3V0ZXJDbGFzc2IGcHJvdG8z", [file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_group, file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config, file_google_protobuf_descriptor]);
+export const file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind = /*@__PURE__*/ fileDesc("CkZhaS9zdGlnbWVyL2NvbW1vbnMvYXBpcmVzb3VyY2UvYXBpcmVzb3VyY2VraW5kL2FwaV9yZXNvdXJjZV9raW5kLnByb3RvEi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kIswDChNBcGlSZXNvdXJjZUtpbmRNZXRhEk8KBWdyb3VwGAEgASgOMkAuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUdyb3VwElMKB3ZlcnNpb24YAiABKA4yQi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlVmVyc2lvbhIMCgRuYW1lGAMgASgJEhQKDGRpc3BsYXlfbmFtZRgEIAEoCRIRCglpZF9wcmVmaXgYBSABKAkSFAoMaXNfdmVyc2lvbmVkGAYgASgIEhoKEm5vdF9zZWFyY2hfaW5kZXhlZBgHIAEoCBJKCgR0aWVyGAggASgOMjwuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5SZXNvdXJjZVRpZXISWgoNYXV0aG9yaXphdGlvbhgJIAEoCzJDLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuQXV0aG9yaXphdGlvbkNvbmZpZypCChJBcGlSZXNvdXJjZVZlcnNpb24SJAogYXBpX3Jlc291cmNlX3ZlcnNpb25fdW5zcGVjaWZpZWQQABIGCgJ2MRABKk4KDFJlc291cmNlVGllchIdChlyZXNvdXJjZV90aWVyX3Vuc3BlY2lmaWVkEAASDwoLb3Blbl9zb3VyY2UQARIOCgpjbG91ZF9vbmx5EAIqQQoPUGxhdGZvcm1JZFZhbHVlEiEKHXBsYXRmb3JtX2lkX3ZhbHVlX3Vuc3BlY2lmaWVkEAASCwoHc3RpZ21lchABKpARCg9BcGlSZXNvdXJjZUtpbmQSHQoZYXBpX3Jlc291cmNlX2tpbmRfdW5rbm93bhAAElsKFGFwaV9yZXNvdXJjZV92ZXJzaW9uEAEaQar/Kz0IARABGhJBcGlSZXNvdXJjZVZlcnNpb24iFEFQSSBSZXNvdXJjZSBWZXJzaW9uKgN2ZXI4AUACSgQIBRAEEj8KCmlhbV9wb2xpY3kQChovqv8rKwgCEAEaCUlhbVBvbGljeSIKSUFNIFBvbGljeSoEaWFtcDgBQAJKBAgCEAESTgoQaWRlbnRpdHlfYWNjb3VudBALGjiq/ys0CAIQARoPSWRlbnRpdHlBY2NvdW50IhBJZGVudGl0eSBBY2NvdW50KgNpZGFAAkoECAQQAxI1CgdhcGlfa2V5EAwaKKr/KyQIAhABGgZBcGlLZXkiB0FQSSBLZXkqA2tleTgBQAJKBAgEEAESPwoKaW52aXRhdGlvbhAUGi+q/ysrCAIQARoKSW52aXRhdGlvbiIKSW52aXRhdGlvbioDaW52OAFAAkoECAIQARJXChFpZGVudGl0eV9wcm92aWRlchAVGkCq/ys8CAIQARoQSWRlbnRpdHlQcm92aWRlciIRSWRlbnRpdHkgUHJvdmlkZXIqA2lkcDgBQAJKCAgCEAE6AgEEEkAKCW9hdXRoX2FwcBAWGjGq/ystCAIQARoIT0F1dGhBcHAiCU9BdXRoIEFwcCoEb2FwcDgBQAJKCAgCEAE6AgEEElEKD3BsYXRmb3JtX2NsaWVudBAXGjyq/ys4CAIQARoOUGxhdGZvcm1DbGllbnQiD1BsYXRmb3JtIENsaWVudCoDcGNsOAFAAkoICAIQAToCAQQSSQoMb3JnYW5pemF0aW9uEB4aN6r/KzMIAxABGgxPcmdhbml6YXRpb24iDE9yZ2FuaXphdGlvbioDb3JnQAFKCggEEAE6BAECAwQSOQoIcGxhdGZvcm0QHxorqv8rJwgDEAEaCFBsYXRmb3JtIghQbGF0Zm9ybSoDcGx0OAFAAkoECAUQBBI8CgVhZ2VudBAoGjGq/ystCAEQARoFQWdlbnQiBUFnZW50KgNhZ3RAAUoSCAIQASoICAEQARgBIAE6AgEEEmsKD2FnZW50X2V4ZWN1dGlvbhApGlaq/ytSCAEQARoOQWdlbnRFeGVjdXRpb24iD0FnZW50IEV4ZWN1dGlvbioDYWV4QAFKJAgDEAIaHgoHc2Vzc2lvbhIHc2Vzc2lvbhoKc2Vzc2lvbl9pZBI4CgdzZXNzaW9uECoaK6r/KycIARABGgdTZXNzaW9uIgdTZXNzaW9uKgNzZXNAAUoICAIQAToCAQQSPgoFc2tpbGwQKxozqv8rLwgBEAEaBVNraWxsIgVTa2lsbCoDc2tsMAFAAUoSCAIQASoICAEQARgBIAE6AgEEEkoKCm1jcF9zZXJ2ZXIQLBo6qv8rNggBEAEaCU1jcFNlcnZlciIKTUNQIFNlcnZlcioDbWNwQAFKEggCEAEqCAgBEAEYASABOgIBBBJsCg5hZ2VudF9pbnN0YW5jZRAtGliq/ytUCAEQARoNQWdlbnRJbnN0YW5jZSIOQWdlbnQgSW5zdGFuY2UqA2FpbkABSigIAhABIhgKBWFnZW50EgVhZ2VudBoIYWdlbnRfaWQqBAgBGAE6AgEEEkUKC2FnZW50X3NoYXJlEC4aNKr/KzAIARABGgpBZ2VudFNoYXJlIgtBZ2VudCBTaGFyZSoDYXNoOAFAAUoICAIQAToCAQQSTAoNYWdlbnRfY2hhbm5lbBAvGjmq/ys1CAEQARoMQWdlbnRDaGFubmVsIg1BZ2VudCBDaGFubmVsKgNhY2g4AUABSgkIAhABOgMBBAUSRwoLY2hhbm5lbF9hcHAQMBo2qv8rMggBEAEaCkNoYW5uZWxBcHAiC0NoYW5uZWwgQXBwKgVjaGFwcDgBQAFKCAgCEAE6AgEEEkcKCHdvcmtmbG93EDIaOar/KzUIARABGghXb3JrZmxvdyIIV29ya2Zsb3cqA3dmbDABQAFKEggCEAEqCAgBEAEYASABOgIBBBJ+ChF3b3JrZmxvd19pbnN0YW5jZRAzGmeq/ytjCAEQARoQV29ya2Zsb3dJbnN0YW5jZSIRV29ya2Zsb3cgSW5zdGFuY2UqA3dpbkABSjEIAhABIiEKCHdvcmtmbG93Egh3b3JrZmxvdxoLd29ya2Zsb3dfaWQqBAgBGAE6AgEEEpYBChJ3b3JrZmxvd19leGVjdXRpb24QNBp+qv8reggBEAEaEVdvcmtmbG93RXhlY3V0aW9uIhJXb3JrZmxvdyBFeGVjdXRpb24qA3dleEABSkYIAhABIjwKEXdvcmtmbG93X2luc3RhbmNlEhF3b3JrZmxvd19pbnN0YW5jZRoUd29ya2Zsb3dfaW5zdGFuY2VfaWQ6AgEEEkoKC2Vudmlyb25tZW50EDUaOar/KzUIARABGgtFbnZpcm9ubWVudCILRW52aXJvbm1lbnQqA2VudkABSg4IAhABKgIYATABOgIBBBI7CghhcnRpZmFjdBA3Gi2q/yspCAEQARoIQXJ0aWZhY3QiCEFydGlmYWN0KgNhcnRAAUoICAIQAToCAQQSUgoRZXhlY3V0aW9uX2NvbnRleHQQNho7qv8rNwgBEAEaEEV4ZWN1dGlvbkNvbnRleHQiEUV4ZWN1dGlvbiBDb250ZXh0KgRlY3R4QAFKBAgEEAESPQoIc2NoZWR1bGUQOBovqv8rKwgBEAEaCFNjaGVkdWxlIghTY2hlZHVsZSoDc2NoOAFAAUoICAIQAToCAQQSOAoHcHJvamVjdBA8Giuq/ysnCAMQARoHUHJvamVjdCIHUHJvamVjdCoDcHJqQAFKCAgCEAE6AgEEIgQIMRAxKglkYXRhc3RvcmU6hQEKCWtpbmRfbWV0YRIhLmdvb2dsZS5wcm90b2J1Zi5FbnVtVmFsdWVPcHRpb25zGPW/BSABKAsyQy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlS2luZE1ldGFSCGtpbmRNZXRhQhtCGUFwaVJlc291cmNlS2luZE91dGVyQ2xhc3NiBnByb3RvMw", [file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_group, file_ai_stigmer_commons_apiresource_apiresourcekind_authorization_config, file_google_protobuf_descriptor]);
 /**
  * Describes the message ai.stigmer.commons.apiresource.apiresourcekind.ApiResourceKindMeta.
  * Use `create(ApiResourceKindMetaSchema)` to create a new message.
@@ -225,13 +225,6 @@ export var ApiResourceKind;
      * @generated from enum value: channel_app = 48;
      */
     ApiResourceKind[ApiResourceKind["channel_app"] = 48] = "channel_app";
-    /**
-     * Declared collections of typed business records with role-aware access
-     * grants; agents read and write records through grant-checked tools.
-     *
-     * @generated from enum value: datastore = 49;
-     */
-    ApiResourceKind[ApiResourceKind["datastore"] = 49] = "datastore";
     /**
      * Multi-step orchestration defining how agents collaborate on a task.
      *

package/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_resource_kind_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sKAAsK;AACtK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAExF,OAAO,EAAE,sEAAsE,EAAE,MAAM,4BAA4B,CAAC;AAEpH,OAAO,EAAE,wEAAwE,EAAE,MAAM,8BAA8B,CAAC;AAExH,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAGzE;;GAEG;AACH,MAAM,CAAC,MAAM,qEAAqE,GAAY,aAAa,CACzG,QAAQ,CAAC,ssIAAssI,EAAE,CAAC,sEAAsE,EAAE,wEAAwE,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAwEx4I;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAcX;AAdD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,mHAAoC,CAAA;IAEpC;;;;OAIG;IACH,uDAAM,CAAA;AACR,CAAC,EAdW,kBAAkB,KAAlB,kBAAkB,QAc7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,YAmBX;AAnBD,WAAY,YAAY;IACtB;;OAEG;IACH,yFAA6B,CAAA;IAE7B;;;;OAIG;IACH,6DAAe,CAAA;IAEf;;;;OAIG;IACH,2DAAc,CAAA;AAChB,CAAC,EAnBW,YAAY,KAAZ,YAAY,QAmBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0B,aAAa,CACpE,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eAaX;AAbD,WAAY,eAAe;IACzB;;OAEG;IACH,uGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,2DAAW,CAAA;AACb,CAAC,EAbW,eAAe,KAAf,eAAe,QAa1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAoNX;AApND,WAAY,eAAe;IACzB;;;;OAIG;IACH,+FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qFAAwB,CAAA;IAExB;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,8EAAqB,CAAA;IAErB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,gEAAc,CAAA;IAEd;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;;;;;;;;OAWG;IACH,sEAAiB,CAAA;IAEjB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,0EAAmB,CAAA;IAEnB;;;;OAIG;IACH,oEAAgB,CAAA;IAEhB;;;;OAIG;IACH,wEAAkB,CAAA;IAElB;;;;;OAKG;IACH,oEAAgB,CAAA;IAEhB;;;;;OAKG;IACH,gEAAc,CAAA;IAEd;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,kFAAuB,CAAA;IAEvB;;;;OAIG;IACH,oEAAgB,CAAA;IAEhB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,4DAAY,CAAA;AACd,CAAC,EApNW,eAAe,KAAf,eAAe,QAoN1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAwD,aAAa,CACzF,OAAO,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api_resource_kind_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sKAAsK;AACtK,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAExF,OAAO,EAAE,sEAAsE,EAAE,MAAM,4BAA4B,CAAC;AAEpH,OAAO,EAAE,wEAAwE,EAAE,MAAM,8BAA8B,CAAC;AAExH,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAGzE;;GAEG;AACH,MAAM,CAAC,MAAM,qEAAqE,GAAY,aAAa,CACzG,QAAQ,CAAC,goIAAgoI,EAAE,CAAC,sEAAsE,EAAE,wEAAwE,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAwEl0I;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAcX;AAdD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,mHAAoC,CAAA;IAEpC;;;;OAIG;IACH,uDAAM,CAAA;AACR,CAAC,EAdW,kBAAkB,KAAlB,kBAAkB,QAc7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,YAmBX;AAnBD,WAAY,YAAY;IACtB;;OAEG;IACH,yFAA6B,CAAA;IAE7B;;;;OAIG;IACH,6DAAe,CAAA;IAEf;;;;OAIG;IACH,2DAAc,CAAA;AAChB,CAAC,EAnBW,YAAY,KAAZ,YAAY,QAmBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0B,aAAa,CACpE,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eAaX;AAbD,WAAY,eAAe;IACzB;;OAEG;IACH,uGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,2DAAW,CAAA;AACb,CAAC,EAbW,eAAe,KAAf,eAAe,QAa1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,CAAN,IAAY,eA4MX;AA5MD,WAAY,eAAe;IACzB;;;;OAIG;IACH,+FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qFAAwB,CAAA;IAExB;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,8EAAqB,CAAA;IAErB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,gEAAc,CAAA;IAEd;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;;;;;;;;OAWG;IACH,sEAAiB,CAAA;IAEjB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,4EAAoB,CAAA;IAEpB;;;;OAIG;IACH,4DAAY,CAAA;IAEZ;;;;OAIG;IACH,wDAAU,CAAA;IAEV;;;;OAIG;IACH,kEAAe,CAAA;IAEf;;;;OAIG;IACH,0EAAmB,CAAA;IAEnB;;;;OAIG;IACH,oEAAgB,CAAA;IAEhB;;;;OAIG;IACH,wEAAkB,CAAA;IAElB;;;;;OAKG;IACH,oEAAgB,CAAA;IAEhB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,kFAAuB,CAAA;IAEvB;;;;OAIG;IACH,oEAAgB,CAAA;IAEhB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,gFAAsB,CAAA;IAEtB;;;;OAIG;IACH,8DAAa,CAAA;IAEb;;;;OAIG;IACH,4DAAY,CAAA;AACd,CAAC,EA5MW,eAAe,KAAf,eAAe,QA4M1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAwD,aAAa,CACzF,OAAO,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/metadata_pb.d.ts

@@ -56,6 +56,14 @@ export type ApiResourceMetadata = Message<"ai.stigmer.commons.apiresource.ApiRes
      * Default: config-driven per kind — blueprint kinds (marked
      * defaults_to_org_visibility) default to ORG; all other kinds default to PRIVATE.
      *
+     * Mutation contract: visibility is set at create and changed ONLY through
+     * the kind's UpdateVisibility RPC, where the visibility guards live
+     * (per-kind level support, default-instance rejection). A plain Update
+     * preserves the stored value — a request-carried level is ignored, never
+     * applied. Declarative clients that want a manifest's visibility to land
+     * on update must follow up with UpdateVisibility (the CLI and MCP apply
+     * surfaces do this automatically).
+     *
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceVisibility visibility = 5;
      */
     visibility: ApiResourceVisibility;

package/ai/stigmer/commons/apiresource/metadata_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/metadata_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,s/BAAs/B,EAAE,CAAC,wCAAwC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA0F3kC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAkD/D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"metadata_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/metadata_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,s/BAAs/B,EAAE,CAAC,wCAAwC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAkG3kC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;AAkD/D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/command_connect.d.ts

@@ -26,6 +26,10 @@ export declare const PlatformClientCommandController: {
          * The creator's organization owns the platform client. The creator is granted
          * the owner role automatically.
          *
+         * The slug `system-share-client` is platform-reserved (it identifies the org's
+         * system-managed share client) and is rejected with INVALID_ARGUMENT — including
+         * when derived from the resource name.
+         *
          * @internal
          * Authorization: Requires can_create_platform_client permission in the organization.
          *

package/ai/stigmer/iam/platformclient/v1/command_connect.js

@@ -34,6 +34,10 @@ export const PlatformClientCommandController = {
          * The creator's organization owns the platform client. The creator is granted
          * the owner role automatically.
          *
+         * The slug `system-share-client` is platform-reserved (it identifies the org's
+         * system-managed share client) and is rejected with INVALID_ARGUMENT — including
+         * when derived from the resource name.
+         *
          * @internal
          * Authorization: Requires can_create_platform_client permission in the organization.
          *

package/ai/stigmer/iam/platformclient/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gIAAgI;AAChI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,kEAAkE;IAC5E,OAAO,EAAE;QACP;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gIAAgI;AAChI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,kEAAkE;IAC5E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;WAkBG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/platformclient/v1/command_pb.d.ts

@@ -32,6 +32,10 @@ export declare const PlatformClientCommandController: GenService<{
      * The creator's organization owns the platform client. The creator is granted
      * the owner role automatically.
      *
+     * The slug `system-share-client` is platform-reserved (it identifies the org's
+     * system-managed share client) and is rejected with INVALID_ARGUMENT — including
+     * when derived from the resource name.
+     *
      * @internal
      * Authorization: Requires can_create_platform_client permission in the organization.
      *

package/ai/stigmer/iam/platformclient/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GA0EvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GA8EvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_pb.d.ts

@@ -144,14 +144,25 @@ export type MintGuestTokenRequest = Message<"ai.stigmer.iam.platformclient.v1.Mi
      * @internal
      * Validated at mint against the share's spec.allowed_origins: empty list
      * admits any origin; a non-empty list refuses PERMISSION_DENIED for
-     * unlisted origins and for "null". An empty field always passes (the
-     * anyone-with-link hosted page). The validated value is stamped into the
-     * guest JWT as the embed_origin claim and re-validated against the live
-     * list by the guest create-time gate. Self-reported by design: the widget
-     * code inside the iframe derives it from browser-authentic sources the
-     * embedder cannot alter; non-browser callers gain nothing by omitting it
-     * since the hosted link is anyone-with-link (decision 001) — rate limits
-     * and the billing gate remain the API guards.
+     * unlisted origins and for "null". An empty field always passes for
+     * hosted-page and non-browser requests (the anyone-with-link hosted
+     * page). The validated value is stamped into the guest JWT as the
+     * embed_origin claim and re-validated against the live list by the
+     * guest create-time gate.
+     *
+     * The hosted server cross-checks this field against the request's
+     * browser-enforced Origin header (stigmer-cloud#341). When the header
+     * is a third-party origin (a direct SDK embed), the header is
+     * authoritative: a non-empty field that disagrees with it is refused
+     * PERMISSION_DENIED naming both origins, and an empty field resolves
+     * to the header instead of the hosted-page exemption. When the header
+     * is Stigmer's own hosted-page origin, this self-report is the only
+     * embedder signal (the iframe'd page's RPCs carry Stigmer's origin) —
+     * the widget code derives it from browser-authentic sources the
+     * embedder cannot alter. Non-browser callers send no Origin header and
+     * keep the self-report semantics; they gain nothing by omitting it
+     * since the hosted link is anyone-with-link (decision 001) — rate
+     * limits and the billing gate remain the API guards.
      *
      * @generated from field: string embed_origin = 4;
      */

package/ai/stigmer/iam/platformclient/v1/token_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,omDAAomD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwE3rD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8E9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAwC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAkErC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,omDAAomD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwE3rD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAyF9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAwC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAkErC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}