@stigmer/protos 3.12.1 → 3.12.3

package/ai/stigmer/agentic/mcpserver/v1/command_pb.d.ts

@@ -124,12 +124,13 @@ export declare const McpServerCommandController: GenService<{
      * @internal
      * Typical flows:
      * - Web console: user clicks Connect, backend resolves env vars from the
-     *   user's personal environment, starts a Temporal workflow on the agent-runner.
+     *   user's personal environment, starts a Temporal workflow on the runner
+     *   (stigmer-runner).
      * - CLI: `stigmer discover mcp-server <name>` calls connect with runtime_env
      *   populated from local env vars, delegating discovery to the backend.
-     * - Graphton backfill: agent-runner calls connect on first execution when
+     * - Runner backfill: the runner calls connect on first use when
      *   status.discovered_capabilities is empty, passing runtime_env from the
-     *   execution context.
+     *   execution context (shared/connect-backfill.ts).
      *
      * Errors:
      * - FAILED_PRECONDITION: Required credentials missing from personal environment

package/ai/stigmer/agentic/mcpserver/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,8qFAA8qF,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE75F;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GA+QlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,8qFAA8qF,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE75F;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAgRlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/io_pb.d.ts

@@ -34,7 +34,7 @@ export declare const McpServerIdSchema: GenMessage<McpServerId>;
  * Triggers server-side MCP discovery and tool approval classification:
  * the backend creates an ephemeral ExecutionContext with the resolved
  * environment variables, starts a Temporal workflow that connects to the
- * MCP server (via the agent-runner), enumerates tools and resource
+ * MCP server (via the runner), enumerates tools and resource
  * templates, classifies tool approval policies, and stores the results
  * in status.discovered_capabilities and status.tool_approvals.
  *
@@ -47,7 +47,7 @@ export declare const McpServerIdSchema: GenMessage<McpServerId>;
  * Callers:
  * - Web console: calls connect after saving credentials to personal environment.
  * - CLI: calls connect with runtime_env populated from local env vars.
- * - Graphton backfill: calls connect with runtime_env from execution context
+ * - Runner backfill: calls connect with runtime_env from execution context
  *   when status.discovered_capabilities is empty on first agent execution.
  *
  * Prerequisites:

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.d.ts

@@ -124,15 +124,20 @@ export type McpServerSpec = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSp
         [key: string]: EnvVarDeclaration;
     };
     /**
-     * Manual tool approval overrides set by the MCP server owner.
+     * Tools pinned by the MCP server owner to always require approval.
      *
      * @internal
      * These take precedence over system-generated `McpServerStatus.tool_approvals`.
      * Never auto-modified — only changed by explicit user action (apply/update).
      *
+     * Presence in this list IS the gate: every entry force-requires approval
+     * for its tool, overriding the classifier. The field cannot express the
+     * opposite direction — a pin can never exempt a tool. To un-gate a tool
+     * the classifier flagged, use `Agent.McpServerUsage.tool_approval_overrides`
+     * (layer 3 below), whose entries carry a real `requires_approval` boolean.
+     *
      * Use cases:
      * - Force approval for a tool the classifier marked as auto-approve
-     * - Exempt a safe tool the classifier flagged as needing approval
      * - Establish organization-wide safety policies for dangerous tools
      *
      * Policy chain (lowest to highest priority):

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,0mEAA0mE,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAgL7xE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA+D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA4E5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA6H5D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,0mEAA0mE,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAqL7xE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA+D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA4E5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA6H5D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/status_pb.d.ts

@@ -17,7 +17,7 @@ export declare const file_ai_stigmer_agentic_mcpserver_v1_status: GenFile;
  * 2. Discovered capabilities — the tools and resource templates the MCP server
  *    actually provides. Populated by:
  *      a. Static seedpack bootstrap (for built-in servers like stigmer-mcp-server)
- *      b. The connect RPC — the backend delegates to the agent-runner via a Temporal
+ *      b. The connect RPC — the backend delegates to the runner via a Temporal
  *         workflow, which connects to the MCP server and enumerates tools/resources.
  * 3. Tool approval policies — system-generated by a lightweight LLM classifier during
  *    the connect flow. Manual overrides live in McpServerSpec.pinned_tool_approvals.
@@ -108,7 +108,7 @@ export declare const McpServerStatusSchema: GenMessage<McpServerStatus>;
  *
  * Populated by:
  * - Seedpack bootstrap (built-in servers with known, stable tool sets)
- * - The connect RPC (web console, CLI, or Graphton first-time-use backfill)
+ * - The connect RPC (web console, CLI, or the runner's first-time-use backfill)
  *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.DiscoveredCapabilities
  */

package/ai/stigmer/agentic/session/v1/workspace_pb.d.ts

@@ -86,7 +86,7 @@ export declare const WorkspaceEntrySchema: GenMessage<WorkspaceEntry>;
  * and persistent. No copy or clone is made.
  *
  * @internal
- * Deployment constraint: only valid when the agent-runner is in local mode.
+ * Deployment constraint: only valid when the runner is in local mode.
  * Cloud runners reject this at provisioning time with a clear error, the same
  * way GitRepoSource rejects SSH URLs at validation time.
  *

package/ai/stigmer/agentic/skill/v1/command_connect.d.ts

@@ -33,6 +33,29 @@ export declare const SkillCommandController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Mint a short-lived, single-use upload URL for staging a skill artifact
+         * that exceeds the gRPC message-size cap (10MB). Flow:
+         *
+         * 1. createArtifactUploadUrl(org, size_bytes) → { url, artifact_upload_ref }
+         * 2. HTTP PUT the ZIP bytes to url
+         * 3. push(PushSkillRequest{ artifact_upload_ref }) — same pipeline,
+         *    validation, and versioning as an inline push
+         *
+         * The server refuses over-limit size_bytes here, before any bytes move.
+         *
+         * @internal
+         * Authorization matches push() — the URL is a capability to stage bytes,
+         * so minting one requires the same permission as consuming it.
+         *
+         * @generated from rpc ai.stigmer.agentic.skill.v1.SkillCommandController.createArtifactUploadUrl
+         */
+        readonly createArtifactUploadUrl: {
+            readonly name: "createArtifactUploadUrl";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
         /**
          * Push a skill from an execution artifact already in storage.
          * Use this when an agent execution has already produced a skill artifact

package/ai/stigmer/agentic/skill/v1/command_connect.js

@@ -2,7 +2,7 @@
 // @generated from file ai/stigmer/agentic/skill/v1/command.proto (package ai.stigmer.agentic.skill.v1, syntax proto3)
 /* eslint-disable */
 // @ts-nocheck
-import { PushSkillFromExecutionArtifactRequest, PushSkillRequest, SkillId } from "./io_pbjs";
+import { CreateSkillArtifactUploadUrlRequest, PushSkillFromExecutionArtifactRequest, PushSkillRequest, SkillArtifactUploadUrl, SkillId } from "./io_pbjs";
 import { Skill } from "./api_pbjs";
 import { MethodKind } from "@bufbuild/protobuf";
 import { UpdateVisibilityInput } from "../../../commons/apiresource/io_pbjs";
@@ -41,6 +41,29 @@ export const SkillCommandController = {
             O: Skill,
             kind: MethodKind.Unary,
         },
+        /**
+         * Mint a short-lived, single-use upload URL for staging a skill artifact
+         * that exceeds the gRPC message-size cap (10MB). Flow:
+         *
+         * 1. createArtifactUploadUrl(org, size_bytes) → { url, artifact_upload_ref }
+         * 2. HTTP PUT the ZIP bytes to url
+         * 3. push(PushSkillRequest{ artifact_upload_ref }) — same pipeline,
+         *    validation, and versioning as an inline push
+         *
+         * The server refuses over-limit size_bytes here, before any bytes move.
+         *
+         * @internal
+         * Authorization matches push() — the URL is a capability to stage bytes,
+         * so minting one requires the same permission as consuming it.
+         *
+         * @generated from rpc ai.stigmer.agentic.skill.v1.SkillCommandController.createArtifactUploadUrl
+         */
+        createArtifactUploadUrl: {
+            name: "createArtifactUploadUrl",
+            I: CreateSkillArtifactUploadUrlRequest,
+            O: SkillArtifactUploadUrl,
+            kind: MethodKind.Unary,
+        },
         /**
          * Push a skill from an execution artifact already in storage.
          * Use this when an agent execution has already produced a skill artifact

package/ai/stigmer/agentic/skill/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qCAAqC,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7F,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,oDAAoD;IAC9D,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,qCAAqC;YACxC,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1J,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,oDAAoD;IAC9D,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,mCAAmC;YACtC,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,qCAAqC;YACxC,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/skill/v1/command_pb.d.ts

@@ -1,6 +1,6 @@
 import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
 import type { SkillSchema } from "./api_pb.js";
-import type { PushSkillFromExecutionArtifactRequestSchema, PushSkillRequestSchema, SkillIdSchema } from "./io_pb.js";
+import type { CreateSkillArtifactUploadUrlRequestSchema, PushSkillFromExecutionArtifactRequestSchema, PushSkillRequestSchema, SkillArtifactUploadUrlSchema, SkillIdSchema } from "./io_pb.js";
 import type { UpdateVisibilityInputSchema } from "../../../commons/apiresource/io_pb.js";
 /**
  * Describes the file ai/stigmer/agentic/skill/v1/command.proto.
@@ -38,6 +38,28 @@ export declare const SkillCommandController: GenService<{
         input: typeof PushSkillRequestSchema;
         output: typeof SkillSchema;
     };
+    /**
+     * Mint a short-lived, single-use upload URL for staging a skill artifact
+     * that exceeds the gRPC message-size cap (10MB). Flow:
+     *
+     * 1. createArtifactUploadUrl(org, size_bytes) → { url, artifact_upload_ref }
+     * 2. HTTP PUT the ZIP bytes to url
+     * 3. push(PushSkillRequest{ artifact_upload_ref }) — same pipeline,
+     *    validation, and versioning as an inline push
+     *
+     * The server refuses over-limit size_bytes here, before any bytes move.
+     *
+     * @internal
+     * Authorization matches push() — the URL is a capability to stage bytes,
+     * so minting one requires the same permission as consuming it.
+     *
+     * @generated from rpc ai.stigmer.agentic.skill.v1.SkillCommandController.createArtifactUploadUrl
+     */
+    createArtifactUploadUrl: {
+        methodKind: "unary";
+        input: typeof CreateSkillArtifactUploadUrlRequestSchema;
+        output: typeof SkillArtifactUploadUrlSchema;
+    };
     /**
      * Push a skill from an execution artifact already in storage.
      * Use this when an agent execution has already produced a skill artifact

package/ai/stigmer/agentic/skill/v1/command_pb.js

@@ -10,7 +10,7 @@ import { file_ai_stigmer_commons_rpc_method_options } from "../../../commons/rpc
 /**
  * Describes the file ai/stigmer/agentic/skill/v1/command.proto.
  */
-export const file_ai_stigmer_agentic_skill_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxMrQFChZTa2lsbENvbW1hbmRDb250cm9sbGVyEpkBCgRwdXNoEi0uYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlB1c2hTa2lsbFJlcXVlc3QaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiPsK4GDoICRAeIgNvcmcqL3VuYXV0aG9yaXplZCB0byBwdXNoIHNraWxsIGluIHRoaXMgb3JnYW5pemF0aW9uEsMBChlwdXNoRnJvbUV4ZWN1dGlvbkFydGlmYWN0EkIuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlB1c2hTa2lsbEZyb21FeGVjdXRpb25BcnRpZmFjdFJlcXVlc3QaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiPsK4GDoICRAeIgNvcmcqL3VuYXV0aG9yaXplZCB0byBwdXNoIHNraWxsIGluIHRoaXMgb3JnYW5pemF0aW9uEq0BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbCI+wrgYOggCECsiC3Jlc291cmNlX2lkKid1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHNraWxsIHZpc2liaWxpdHkSgQEKBmRlbGV0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbElkGiIuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsIi3CuBgpCAMQKyIFdmFsdWUqHHVuYXV0aG9yaXplZCB0byBkZWxldGUgc2tpbGwaBKD/KytiBnByb3RvMw", [file_ai_stigmer_agentic_skill_v1_api, file_ai_stigmer_agentic_skill_v1_io, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options]);
+export const file_ai_stigmer_agentic_skill_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxMocHChZTa2lsbENvbW1hbmRDb250cm9sbGVyEpkBCgRwdXNoEi0uYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlB1c2hTa2lsbFJlcXVlc3QaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiPsK4GDoICRAeIgNvcmcqL3VuYXV0aG9yaXplZCB0byBwdXNoIHNraWxsIGluIHRoaXMgb3JnYW5pemF0aW9uEtABChdjcmVhdGVBcnRpZmFjdFVwbG9hZFVybBJALmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5DcmVhdGVTa2lsbEFydGlmYWN0VXBsb2FkVXJsUmVxdWVzdBozLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbEFydGlmYWN0VXBsb2FkVXJsIj7CuBg6CAkQHiIDb3JnKi91bmF1dGhvcml6ZWQgdG8gcHVzaCBza2lsbCBpbiB0aGlzIG9yZ2FuaXphdGlvbhLDAQoZcHVzaEZyb21FeGVjdXRpb25BcnRpZmFjdBJCLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5QdXNoU2tpbGxGcm9tRXhlY3V0aW9uQXJ0aWZhY3RSZXF1ZXN0GiIuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsIj7CuBg6CAkQHiIDb3JnKi91bmF1dGhvcml6ZWQgdG8gcHVzaCBza2lsbCBpbiB0aGlzIG9yZ2FuaXphdGlvbhKtAQoQdXBkYXRlVmlzaWJpbGl0eRI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5VcGRhdGVWaXNpYmlsaXR5SW5wdXQaIi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGwiPsK4GDoIAhArIgtyZXNvdXJjZV9pZCondW5hdXRob3JpemVkIHRvIHVwZGF0ZSBza2lsbCB2aXNpYmlsaXR5EoEBCgZkZWxldGUSJC5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuU2tpbGxJZBoiLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbCItwrgYKQgDECsiBXZhbHVlKhx1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHNraWxsGgSg/ysrYgZwcm90bzM", [file_ai_stigmer_agentic_skill_v1_api, file_ai_stigmer_agentic_skill_v1_io, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options]);
 /**
  * SkillCommandController handles write operations for skills.
  *

package/ai/stigmer/agentic/skill/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,4gCAA4gC,EAAE,CAAC,oCAAoC,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEnvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GA6E9B,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,qyCAAqyC,EAAE,CAAC,oCAAoC,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE5gD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAmG9B,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/skill/v1/io_pb.d.ts

@@ -28,6 +28,14 @@ export declare const SkillIdSchema: GenMessage<SkillId>;
  * Creates a skill if it does not exist, or creates a new version of an
  * existing skill.
  *
+ * The artifact travels one of two ways (exactly one must be set):
+ * - artifact: inline ZIP bytes. Simple one-round-trip push, but bounded by
+ *   the gRPC transport's message-size cap (10MB) — well below the 100MB
+ *   skill limit.
+ * - artifact_upload_ref: reference to bytes already staged via
+ *   createArtifactUploadUrl() + HTTP PUT. Required for artifacts above the
+ *   transport cap; works for any size up to the skill limit.
+ *
  * @internal
  * The skill name and description are extracted by the backend from the SKILL.md
  * YAML frontmatter within the artifact. The CLI validates the format but does not
@@ -51,6 +59,8 @@ export type PushSkillRequest = Message<"ai.stigmer.agentic.skill.v1.PushSkillReq
      * - Tool executables/scripts (optional)
      * - Additional files referenced in SKILL.md
      *
+     * Mutually exclusive with artifact_upload_ref (see the message comment).
+     *
      * @generated from field: bytes artifact = 2;
      */
     artifact: Uint8Array;
@@ -85,12 +95,139 @@ export type PushSkillRequest = Message<"ai.stigmer.agentic.skill.v1.PushSkillReq
      * @generated from field: string message = 6;
      */
     message: string;
+    /**
+     * Reference to an artifact staged via createArtifactUploadUrl().
+     * Set this instead of artifact when the ZIP exceeds the gRPC message-size
+     * cap. The reference is single-use and expires with its upload URL.
+     *
+     * Mutually exclusive with artifact (see the message comment).
+     *
+     * @generated from field: string artifact_upload_ref = 7;
+     */
+    artifactUploadRef: string;
 };
 /**
  * Describes the message ai.stigmer.agentic.skill.v1.PushSkillRequest.
  * Use `create(PushSkillRequestSchema)` to create a new message.
  */
 export declare const PushSkillRequestSchema: GenMessage<PushSkillRequest>;
+/**
+ * CreateSkillArtifactUploadUrlRequest asks the server to mint a staging
+ * slot for a skill artifact that is too large to travel inline in
+ * PushSkillRequest.artifact (the gRPC message cap is 10MB; skills may be
+ * up to 100MB).
+ *
+ * @generated from message ai.stigmer.agentic.skill.v1.CreateSkillArtifactUploadUrlRequest
+ */
+export type CreateSkillArtifactUploadUrlRequest = Message<"ai.stigmer.agentic.skill.v1.CreateSkillArtifactUploadUrlRequest"> & {
+    /**
+     * Organization that will own the skill (authorization scope — the caller
+     * needs the same can_create_skill permission that push requires).
+     *
+     * @generated from field: string org = 1;
+     */
+    org: string;
+    /**
+     * Declared size of the artifact ZIP in bytes.
+     *
+     * Lets the server refuse over-limit artifacts BEFORE any bytes move —
+     * the fail-loud-at-authoring contract from #675. The upload endpoint
+     * additionally enforces the declared size against the actual bytes.
+     *
+     * @generated from field: int64 size_bytes = 2;
+     */
+    sizeBytes: bigint;
+};
+/**
+ * Describes the message ai.stigmer.agentic.skill.v1.CreateSkillArtifactUploadUrlRequest.
+ * Use `create(CreateSkillArtifactUploadUrlRequestSchema)` to create a new message.
+ */
+export declare const CreateSkillArtifactUploadUrlRequestSchema: GenMessage<CreateSkillArtifactUploadUrlRequest>;
+/**
+ * SkillArtifactUploadUrl is a short-lived, single-use capability for
+ * staging a skill artifact over HTTP.
+ *
+ * @internal
+ * The upload strategy differs by edition (mirrors ArtifactDownloadUrl):
+ * - Cloud: pre-signed R2/S3 PUT URL with short TTL
+ * - OSS: capability URL on the server's own HTTP lane (the unguessable
+ *   token in the path is the credential, exactly like a presigned URL)
+ *
+ * This pattern avoids streaming large blobs through the gRPC control plane.
+ *
+ * @generated from message ai.stigmer.agentic.skill.v1.SkillArtifactUploadUrl
+ */
+export type SkillArtifactUploadUrl = Message<"ai.stigmer.agentic.skill.v1.SkillArtifactUploadUrl"> & {
+    /**
+     * URL to PUT the artifact ZIP bytes to. Content-Type: application/zip.
+     *
+     * @generated from field: string url = 1;
+     */
+    url: string;
+    /**
+     * Opaque reference to pass as PushSkillRequest.artifact_upload_ref after
+     * the PUT succeeds. Single-use; invalid after the push consumes it or
+     * the TTL lapses.
+     *
+     * @generated from field: string artifact_upload_ref = 2;
+     */
+    artifactUploadRef: string;
+    /**
+     * Time-to-live for the upload URL in seconds. After this duration the
+     * URL and the reference expire and a new one must be requested.
+     *
+     * @generated from field: int32 ttl_seconds = 3;
+     */
+    ttlSeconds: number;
+};
+/**
+ * Describes the message ai.stigmer.agentic.skill.v1.SkillArtifactUploadUrl.
+ * Use `create(SkillArtifactUploadUrlSchema)` to create a new message.
+ */
+export declare const SkillArtifactUploadUrlSchema: GenMessage<SkillArtifactUploadUrl>;
+/**
+ * SkillArtifactDownloadUrl provides a URL for downloading a skill
+ * artifact over HTTP.
+ *
+ * @internal
+ * The download strategy differs by edition (mirrors ArtifactDownloadUrl):
+ * - Cloud: pre-signed R2/S3 URL with short TTL (e.g., 15 minutes)
+ * - OSS: capability URL on the server's own HTTP lane; the content-hash
+ *   storage key in the path is the capability (the same trust model as
+ *   getArtifact, which deliberately skips authorization)
+ *
+ * This pattern avoids streaming large blobs through the gRPC control
+ * plane — the transport cap stays at 10MB while skills may be 100MB.
+ *
+ * @generated from message ai.stigmer.agentic.skill.v1.SkillArtifactDownloadUrl
+ */
+export type SkillArtifactDownloadUrl = Message<"ai.stigmer.agentic.skill.v1.SkillArtifactDownloadUrl"> & {
+    /**
+     * URL to download the artifact ZIP via HTTP GET.
+     *
+     * @generated from field: string url = 1;
+     */
+    url: string;
+    /**
+     * Time-to-live for the download URL in seconds.
+     * Typically 900 (15 minutes) for Cloud, 0 (no expiry) for OSS.
+     *
+     * @generated from field: int32 ttl_seconds = 2;
+     */
+    ttlSeconds: number;
+    /**
+     * Size of the artifact ZIP in bytes. Lets clients pre-allocate or
+     * sanity-check before fetching.
+     *
+     * @generated from field: int64 size_bytes = 3;
+     */
+    sizeBytes: bigint;
+};
+/**
+ * Describes the message ai.stigmer.agentic.skill.v1.SkillArtifactDownloadUrl.
+ * Use `create(SkillArtifactDownloadUrlSchema)` to create a new message.
+ */
+export declare const SkillArtifactDownloadUrlSchema: GenMessage<SkillArtifactDownloadUrl>;
 /**
  * PushSkillFromExecutionArtifactRequest publishes a skill from an execution
  * artifact already in storage, without downloading and re-uploading the ZIP.

package/ai/stigmer/agentic/skill/v1/io_pb.js

@@ -9,7 +9,7 @@ import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/agentic/skill/v1/io.proto.
  */
-export const file_ai_stigmer_agentic_skill_v1_io = /*@__PURE__*/ fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MSIgCgdTa2lsbElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEixgEKEFB1c2hTa2lsbFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESGAoIYXJ0aWZhY3QYAiABKAxCBrpIA8gBARIoCgN0YWcYAyABKAlCG7pIGHIWMhReJHxeW2EtekEtWjAtOS5fLV0rJBJCCg5naXRfcHJvdmVuYW5jZRgEIAEoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5HaXRQcm92ZW5hbmNlEg8KB21lc3NhZ2UYBiABKAlKBAgFEAYiowEKJVB1c2hTa2lsbEZyb21FeGVjdXRpb25BcnRpZmFjdFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESHQoMZXhlY3V0aW9uX2lkGAIgASgJQge6SARyAhABEhwKC3N0b3JhZ2Vfa2V5GAMgASgJQge6SARyAhABEigKA3RhZxgEIAEoCUIbukgYchYyFF4kfF5bYS16QS1aMC05Ll8tXSskIjoKEkdldEFydGlmYWN0UmVxdWVzdBIkChRhcnRpZmFjdF9zdG9yYWdlX2tleRgBIAEoCUIGukgDyAEBIicKE0dldEFydGlmYWN0UmVzcG9uc2USEAoIYXJ0aWZhY3QYASABKAwiagoWTGlzdFNraWxsVmVyc2lvbnNJbnB1dBITCgNvcmcYASABKAlCBrpIA8gBARIUCgRzbHVnGAIgASgJQga6SAPIAQESEgoKcGFnZV90b2tlbhgDIAEoCRIRCglwYWdlX3NpemUYBCABKAUitgIKEVNraWxsVmVyc2lvbkVudHJ5EhQKDHZlcnNpb25faGFzaBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSQgoOZ2l0X3Byb3ZlbmFuY2UYBiABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAcgASgJEhwKFGFydGlmYWN0X3N0b3JhZ2Vfa2V5GAggASgJIosBChlMaXN0U2tpbGxWZXJzaW9uc1Jlc3BvbnNlEkAKCHZlcnNpb25zGAEgAygLMi4uYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsVmVyc2lvbkVudHJ5EhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRITCgt0b3RhbF9jb3VudBgDIAEoBWIGcHJvdG8z", [file_ai_stigmer_agentic_skill_v1_status, file_ai_stigmer_commons_apiresource_status, file_buf_validate_validate, file_google_protobuf_timestamp]);
+export const file_ai_stigmer_agentic_skill_v1_io = /*@__PURE__*/ fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MSIgCgdTa2lsbElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEilAMKEFB1c2hTa2lsbFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESEAoIYXJ0aWZhY3QYAiABKAwSKAoDdGFnGAMgASgJQhu6SBhyFjIUXiR8XlthLXpBLVowLTkuXy1dKyQSQgoOZ2l0X3Byb3ZlbmFuY2UYBCABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAYgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYByABKAk6tgG6SLIBGq8BCiJwdXNoX3NraWxsX3JlcXVlc3QuYXJ0aWZhY3Rfc291cmNlEklleGFjdGx5IG9uZSBvZiBhcnRpZmFjdCAoaW5saW5lIGJ5dGVzKSBvciBhcnRpZmFjdF91cGxvYWRfcmVmIG11c3QgYmUgc2V0Gj4odGhpcy5hcnRpZmFjdC5zaXplKCkgPiAwKSAhPSAodGhpcy5hcnRpZmFjdF91cGxvYWRfcmVmICE9ICcnKUoECAUQBiJXCiNDcmVhdGVTa2lsbEFydGlmYWN0VXBsb2FkVXJsUmVxdWVzdBITCgNvcmcYASABKAlCBrpIA8gBARIbCgpzaXplX2J5dGVzGAIgASgDQge6SAQiAiAAIlcKFlNraWxsQXJ0aWZhY3RVcGxvYWRVcmwSCwoDdXJsGAEgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAiABKAkSEwoLdHRsX3NlY29uZHMYAyABKAUiUAoYU2tpbGxBcnRpZmFjdERvd25sb2FkVXJsEgsKA3VybBgBIAEoCRITCgt0dGxfc2Vjb25kcxgCIAEoBRISCgpzaXplX2J5dGVzGAMgASgDIqMBCiVQdXNoU2tpbGxGcm9tRXhlY3V0aW9uQXJ0aWZhY3RSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEh0KDGV4ZWN1dGlvbl9pZBgCIAEoCUIHukgEcgIQARIcCgtzdG9yYWdlX2tleRgDIAEoCUIHukgEcgIQARIoCgN0YWcYBCABKAlCG7pIGHIWMhReJHxeW2EtekEtWjAtOS5fLV0rJCI6ChJHZXRBcnRpZmFjdFJlcXVlc3QSJAoUYXJ0aWZhY3Rfc3RvcmFnZV9rZXkYASABKAlCBrpIA8gBASInChNHZXRBcnRpZmFjdFJlc3BvbnNlEhAKCGFydGlmYWN0GAEgASgMImoKFkxpc3RTa2lsbFZlcnNpb25zSW5wdXQSEwoDb3JnGAEgASgJQga6SAPIAQESFAoEc2x1ZxgCIAEoCUIGukgDyAEBEhIKCnBhZ2VfdG9rZW4YAyABKAkSEQoJcGFnZV9zaXplGAQgASgFIrYCChFTa2lsbFZlcnNpb25FbnRyeRIUCgx2ZXJzaW9uX2hhc2gYASABKAkSLQoJcHVzaGVkX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBJICglwdXNoZWRfYnkYAyABKAsyNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdEFjdG9yEgsKA3RhZxgEIAEoCRISCgppc19jdXJyZW50GAUgASgIEkIKDmdpdF9wcm92ZW5hbmNlGAYgASgLMiouYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLkdpdFByb3ZlbmFuY2USDwoHbWVzc2FnZRgHIAEoCRIcChRhcnRpZmFjdF9zdG9yYWdlX2tleRgIIAEoCSKLAQoZTGlzdFNraWxsVmVyc2lvbnNSZXNwb25zZRJACgh2ZXJzaW9ucxgBIAMoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MS5Ta2lsbFZlcnNpb25FbnRyeRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEwoLdG90YWxfY291bnQYAyABKAViBnByb3RvMw", [file_ai_stigmer_agentic_skill_v1_status, file_ai_stigmer_commons_apiresource_status, file_buf_validate_validate, file_google_protobuf_timestamp]);
 /**
  * Describes the message ai.stigmer.agentic.skill.v1.SkillId.
  * Use `create(SkillIdSchema)` to create a new message.
@@ -20,34 +20,49 @@ export const SkillIdSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_s
  * Use `create(PushSkillRequestSchema)` to create a new message.
  */
 export const PushSkillRequestSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 1);
+/**
+ * Describes the message ai.stigmer.agentic.skill.v1.CreateSkillArtifactUploadUrlRequest.
+ * Use `create(CreateSkillArtifactUploadUrlRequestSchema)` to create a new message.
+ */
+export const CreateSkillArtifactUploadUrlRequestSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 2);
+/**
+ * Describes the message ai.stigmer.agentic.skill.v1.SkillArtifactUploadUrl.
+ * Use `create(SkillArtifactUploadUrlSchema)` to create a new message.
+ */
+export const SkillArtifactUploadUrlSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 3);
+/**
+ * Describes the message ai.stigmer.agentic.skill.v1.SkillArtifactDownloadUrl.
+ * Use `create(SkillArtifactDownloadUrlSchema)` to create a new message.
+ */
+export const SkillArtifactDownloadUrlSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 4);
 /**
  * Describes the message ai.stigmer.agentic.skill.v1.PushSkillFromExecutionArtifactRequest.
  * Use `create(PushSkillFromExecutionArtifactRequestSchema)` to create a new message.
  */
-export const PushSkillFromExecutionArtifactRequestSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 2);
+export const PushSkillFromExecutionArtifactRequestSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 5);
 /**
  * Describes the message ai.stigmer.agentic.skill.v1.GetArtifactRequest.
  * Use `create(GetArtifactRequestSchema)` to create a new message.
  */
-export const GetArtifactRequestSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 3);
+export const GetArtifactRequestSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 6);
 /**
  * Describes the message ai.stigmer.agentic.skill.v1.GetArtifactResponse.
  * Use `create(GetArtifactResponseSchema)` to create a new message.
  */
-export const GetArtifactResponseSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 4);
+export const GetArtifactResponseSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 7);
 /**
  * Describes the message ai.stigmer.agentic.skill.v1.ListSkillVersionsInput.
  * Use `create(ListSkillVersionsInputSchema)` to create a new message.
  */
-export const ListSkillVersionsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 5);
+export const ListSkillVersionsInputSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 8);
 /**
  * Describes the message ai.stigmer.agentic.skill.v1.SkillVersionEntry.
  * Use `create(SkillVersionEntrySchema)` to create a new message.
  */
-export const SkillVersionEntrySchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 6);
+export const SkillVersionEntrySchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 9);
 /**
  * Describes the message ai.stigmer.agentic.skill.v1.ListSkillVersionsResponse.
  * Use `create(ListSkillVersionsResponseSchema)` to create a new message.
  */
-export const ListSkillVersionsResponseSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 7);
+export const ListSkillVersionsResponseSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_agentic_skill_v1_io, 10);
 //# sourceMappingURL=io_pb.js.map

package/ai/stigmer/agentic/skill/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,k/CAAk/C,EAAE,CAAC,uCAAuC,EAAE,0CAA0C,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAclpD;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,aAAa,CAC7D,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAsEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA4DtD;;;GAGG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAsD,aAAa,CACzH,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAmBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA2CtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA8BtD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,gmEAAgmE,EAAE,CAAC,uCAAuC,EAAE,0CAA0C,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAchwE;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,aAAa,CAC7D,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA2FtD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA+BtD;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAoD,aAAa,CACrH,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA0CtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA2CtD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA4DtD;;;GAGG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAsD,aAAa,CACzH,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAmBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAiBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA2CtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AA8BtD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC"}

package/ai/stigmer/agentic/skill/v1/query_connect.d.ts

@@ -42,7 +42,7 @@ export declare const SkillQueryController: {
          * Returns the ZIP file containing SKILL.md and implementation files.
          *
          * @internal
-         * Used by the agent-runner to download and extract skill artifacts into the
+         * Used by the runner to download and extract skill artifacts into the
          * sandbox at /bin/skills/{version_hash}/. Authorization is skipped as the
          * storage key itself acts as a capability token.
          *
@@ -54,6 +54,27 @@ export declare const SkillQueryController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Mint a URL for downloading a skill artifact over HTTP.
+         *
+         * Preferred over getArtifact for anything that might exceed the gRPC
+         * message-size cap (10MB): the bytes ride HTTP, so the full 100MB skill
+         * limit is deliverable. Callers should try this first and fall back to
+         * getArtifact against servers that predate it (UNIMPLEMENTED).
+         *
+         * @internal
+         * Authorization is skipped for the same reason as getArtifact: the
+         * content-hash storage key acts as the capability token. Cloud returns a
+         * pre-signed R2 URL; OSS returns a capability URL on its own HTTP lane.
+         *
+         * @generated from rpc ai.stigmer.agentic.skill.v1.SkillQueryController.getArtifactDownloadUrl
+         */
+        readonly getArtifactDownloadUrl: {
+            readonly name: "getArtifactDownloadUrl";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
         /**
          * List version history for a skill.
          *

package/ai/stigmer/agentic/skill/v1/query_connect.js

@@ -2,7 +2,7 @@
 // @generated from file ai/stigmer/agentic/skill/v1/query.proto (package ai.stigmer.agentic.skill.v1, syntax proto3)
 /* eslint-disable */
 // @ts-nocheck
-import { GetArtifactRequest, GetArtifactResponse, ListSkillVersionsInput, ListSkillVersionsResponse, SkillId } from "./io_pbjs";
+import { GetArtifactRequest, GetArtifactResponse, ListSkillVersionsInput, ListSkillVersionsResponse, SkillArtifactDownloadUrl, SkillId } from "./io_pbjs";
 import { Skill } from "./api_pbjs";
 import { MethodKind } from "@bufbuild/protobuf";
 import { ApiResourceReference } from "../../../commons/apiresource/io_pbjs";
@@ -50,7 +50,7 @@ export const SkillQueryController = {
          * Returns the ZIP file containing SKILL.md and implementation files.
          *
          * @internal
-         * Used by the agent-runner to download and extract skill artifacts into the
+         * Used by the runner to download and extract skill artifacts into the
          * sandbox at /bin/skills/{version_hash}/. Authorization is skipped as the
          * storage key itself acts as a capability token.
          *
@@ -62,6 +62,27 @@ export const SkillQueryController = {
             O: GetArtifactResponse,
             kind: MethodKind.Unary,
         },
+        /**
+         * Mint a URL for downloading a skill artifact over HTTP.
+         *
+         * Preferred over getArtifact for anything that might exceed the gRPC
+         * message-size cap (10MB): the bytes ride HTTP, so the full 100MB skill
+         * limit is deliverable. Callers should try this first and fall back to
+         * getArtifact against servers that predate it (UNIMPLEMENTED).
+         *
+         * @internal
+         * Authorization is skipped for the same reason as getArtifact: the
+         * content-hash storage key acts as the capability token. Cloud returns a
+         * pre-signed R2 URL; OSS returns a capability URL on its own HTTP lane.
+         *
+         * @generated from rpc ai.stigmer.agentic.skill.v1.SkillQueryController.getArtifactDownloadUrl
+         */
+        getArtifactDownloadUrl: {
+            name: "getArtifactDownloadUrl",
+            I: GetArtifactRequest,
+            O: SkillArtifactDownloadUrl,
+            kind: MethodKind.Unary,
+        },
         /**
          * List version history for a skill.
          *

package/ai/stigmer/agentic/skill/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChI,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ,EAAE,kDAAkD;IAC5D,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,WAAW,EAAE;YACX,IAAI,EAAE,aAAa;YACnB,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,mBAAmB;YACtB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1J,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ,EAAE,kDAAkD;IAC5D,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,WAAW,EAAE;YACX,IAAI,EAAE,aAAa;YACnB,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,mBAAmB;YACtB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,sBAAsB,EAAE;YACtB,IAAI,EAAE,wBAAwB;YAC9B,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,wBAAwB;YAC3B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/skill/v1/query_pb.d.ts

@@ -1,6 +1,6 @@
 import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
 import type { SkillSchema } from "./api_pb.js";
-import type { GetArtifactRequestSchema, GetArtifactResponseSchema, ListSkillVersionsInputSchema, ListSkillVersionsResponseSchema, SkillIdSchema } from "./io_pb.js";
+import type { GetArtifactRequestSchema, GetArtifactResponseSchema, ListSkillVersionsInputSchema, ListSkillVersionsResponseSchema, SkillArtifactDownloadUrlSchema, SkillIdSchema } from "./io_pb.js";
 import type { ApiResourceReferenceSchema } from "../../../commons/apiresource/io_pb.js";
 /**
  * Describes the file ai/stigmer/agentic/skill/v1/query.proto.
@@ -46,7 +46,7 @@ export declare const SkillQueryController: GenService<{
      * Returns the ZIP file containing SKILL.md and implementation files.
      *
      * @internal
-     * Used by the agent-runner to download and extract skill artifacts into the
+     * Used by the runner to download and extract skill artifacts into the
      * sandbox at /bin/skills/{version_hash}/. Authorization is skipped as the
      * storage key itself acts as a capability token.
      *
@@ -57,6 +57,26 @@ export declare const SkillQueryController: GenService<{
         input: typeof GetArtifactRequestSchema;
         output: typeof GetArtifactResponseSchema;
     };
+    /**
+     * Mint a URL for downloading a skill artifact over HTTP.
+     *
+     * Preferred over getArtifact for anything that might exceed the gRPC
+     * message-size cap (10MB): the bytes ride HTTP, so the full 100MB skill
+     * limit is deliverable. Callers should try this first and fall back to
+     * getArtifact against servers that predate it (UNIMPLEMENTED).
+     *
+     * @internal
+     * Authorization is skipped for the same reason as getArtifact: the
+     * content-hash storage key acts as the capability token. Cloud returns a
+     * pre-signed R2 URL; OSS returns a capability URL on its own HTTP lane.
+     *
+     * @generated from rpc ai.stigmer.agentic.skill.v1.SkillQueryController.getArtifactDownloadUrl
+     */
+    getArtifactDownloadUrl: {
+        methodKind: "unary";
+        input: typeof GetArtifactRequestSchema;
+        output: typeof SkillArtifactDownloadUrlSchema;
+    };
     /**
      * List version history for a skill.
      *