@stigmer/protos 3.12.2 → 3.12.4

package/ai/stigmer/agentic/mcpserver/v1/command_connect.js

@@ -9,15 +9,6 @@ import { CompleteOAuthConnectInput, CompleteOAuthConnectOutput, ConnectInput, De
 /**
  * McpServerCommandController provides write operations for MCP server resources.
  *
- * @internal
- * Authorization model for writes:
- * - Platform-scoped: Only platform operators can create/modify
- * - Organization-scoped: Org admins can create/modify
- * - Identity-account-scoped: Only the owner can create/modify
- *
- * Primary interface: The `apply` method provides Kubernetes-style idempotent
- * create-or-update semantics, which is the recommended approach for CLI usage.
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerCommandController
  */
 export const McpServerCommandController = {
@@ -29,12 +20,6 @@ export const McpServerCommandController = {
          * If the resource doesn't exist, creates it. If it exists, updates it.
          * The resource is identified by its (scope, org, slug) combination.
          *
-         * @internal
-         * The handler determines whether this is a create or update operation
-         * and performs appropriate scope-aware authorization:
-         * - Create: Requires permission to create in the target scope
-         * - Update: Requires can_edit on the existing resource
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.apply
          */
         apply: {
@@ -49,13 +34,6 @@ export const McpServerCommandController = {
          * Returns an error if a resource with the same (scope, org, slug) already exists.
          * Use `apply` for idempotent create-or-update semantics.
          *
-         * @internal
-         * Authorization: Custom authorization in handler.
-         * Requires permission to create MCP servers in the specified scope:
-         * - Platform: Requires platform operator role
-         * - Organization: Requires org admin role or can_create_mcp_server permission
-         * - Identity Account: Automatically allowed for the authenticated user
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.create
          */
         create: {
@@ -67,13 +45,6 @@ export const McpServerCommandController = {
         /**
          * Update an existing MCP server resource.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the mcp_server resource.
-         * Only the owner (based on scope) can update:
-         * - Platform: Platform operators
-         * - Organization: Org admins or resource owner
-         * - Identity Account: The owner
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.update
          */
         update: {
@@ -88,13 +59,6 @@ export const McpServerCommandController = {
          * Permanently removes the MCP server definition.
          * Agents referencing this server will need to be updated.
          *
-         * @internal
-         * Authorization: Requires can_delete permission on the mcp_server resource.
-         * Only the owner can delete:
-         * - Platform: Platform operators
-         * - Organization: Org admins or resource owner
-         * - Identity Account: The owner
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.delete
          */
         delete: {
@@ -109,9 +73,6 @@ export const McpServerCommandController = {
          * Only modifies metadata.visibility, leaving spec, status, and other
          * metadata fields untouched.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the mcp_server resource.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateVisibility
          */
         updateVisibility: {
@@ -128,24 +89,6 @@ export const McpServerCommandController = {
          * results in status.discovered_capabilities and status.tool_approvals.
          * Blocks until completion (up to ~30 seconds) and returns the updated McpServer.
          *
-         * @internal
-         * Typical flows:
-         * - Web console: user clicks Connect, backend resolves env vars from the
-         *   user's personal environment, starts a Temporal workflow on the runner
-         *   (stigmer-runner).
-         * - CLI: `stigmer discover mcp-server <name>` calls connect with runtime_env
-         *   populated from local env vars, delegating discovery to the backend.
-         * - Runner backfill: the runner calls connect on first use when
-         *   status.discovered_capabilities is empty, passing runtime_env from the
-         *   execution context (shared/connect-backfill.ts).
-         *
-         * Errors:
-         * - FAILED_PRECONDITION: Required credentials missing from personal environment
-         * - DEADLINE_EXCEEDED: Discovery did not complete within the timeout
-         * - NOT_FOUND: MCP server does not exist
-         *
-         * Authorization: Requires can_connect permission on the mcp_server resource.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.connect
          */
         connect: {
@@ -162,21 +105,6 @@ export const McpServerCommandController = {
          * redirect the user to. The frontend calls completeOAuthConnect after
          * the user authorizes.
          *
-         * @internal
-         * Two auth modes determined by the MCP server's spec.auth block:
-         * - No oauth_app_ref: MCP Authorization spec (DCR + PKCE). Backend
-         *   discovers the authorization server, registers a client via DCR,
-         *   and builds the auth URL automatically.
-         * - oauth_app_ref set: Vendor OAuth. Backend loads the referenced
-         *   OAuthApp for client credentials and endpoint URLs.
-         *
-         * Errors:
-         * - FAILED_PRECONDITION: MCP server has no auth block, or is stdio
-         *   without oauth_app_ref (DCR requires HTTP transport)
-         * - NOT_FOUND: MCP server or referenced OAuthApp does not exist
-         *
-         * Authorization: Requires can_connect permission on the mcp_server resource.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.initiateOAuthConnect
          */
         initiateOAuthConnect: {
@@ -197,15 +125,6 @@ export const McpServerCommandController = {
          * After success, the frontend should call connect() to trigger tool
          * discovery using the freshly acquired token.
          *
-         * @internal
-         * Errors:
-         * - FAILED_PRECONDITION: State parameter is invalid, expired, or does
-         *   not match the mcp_server_id
-         * - UNAVAILABLE: Token exchange with the authorization server failed
-         * - NOT_FOUND: No pending OAuth state found for the given state param
-         *
-         * Authorization: Requires can_connect permission on the mcp_server resource.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.completeOAuthConnect
          */
         completeOAuthConnect: {
@@ -228,11 +147,6 @@ export const McpServerCommandController = {
          * disconnected=false when no grant existed. Never returns an error
          * for a missing grant.
          *
-         * @internal
-         * Authorization: Requires can_connect permission on the mcp_server resource.
-         * Uses the same permission as connect/initiateOAuthConnect — if you can
-         * establish a connection, you can tear it down.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.disconnectOAuth
          */
         disconnectOAuth: {
@@ -256,16 +170,6 @@ export const McpServerCommandController = {
          * see the full scoping note on McpServerQueryController.getOrgOAuthApp,
          * the RPC clients probe.
          *
-         * @internal
-         * Authorization: Requires can_create_oauth_app permission on the organization.
-         * This is an org-admin operation — setting credentials that affect all users
-         * in the org who connect to this resource.
-         *
-         * Errors:
-         * - FAILED_PRECONDITION: Resource has no auth block or no oauth_app_ref
-         *   (BYOA requires a platform template to clone from)
-         * - NOT_FOUND: Resource does not exist
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.setOrgOAuthApp
          */
         setOrgOAuthApp: {
@@ -290,13 +194,6 @@ export const McpServerCommandController = {
          * will fail on next token refresh — those users will need to
          * re-authenticate using the platform default or a new org override.
          *
-         * @internal
-         * Authorization: Requires can_create_oauth_app permission on the organization.
-         * Same gate as setOrgOAuthApp — org-admin authority for credential management.
-         *
-         * Errors:
-         * - NOT_FOUND: No override exists for this resource + org
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.deleteOrgOAuthApp
          */
         deleteOrgOAuthApp: {

package/ai/stigmer/agentic/mcpserver/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEhS;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,4DAA4D;IACtE,OAAO,EAAE;QACP;;;;;;;;;;;;;WAaG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,mBAAmB;YACtB,CAAC,EAAE,oBAAoB;YACvB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,uBAAuB;YAC1B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEhS;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,4DAA4D;IACtE,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,mBAAmB;YACtB,CAAC,EAAE,oBAAoB;YACvB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,uBAAuB;YAC1B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/command_pb.d.ts

@@ -9,15 +9,6 @@ export declare const file_ai_stigmer_agentic_mcpserver_v1_command: GenFile;
 /**
  * McpServerCommandController provides write operations for MCP server resources.
  *
- * @internal
- * Authorization model for writes:
- * - Platform-scoped: Only platform operators can create/modify
- * - Organization-scoped: Org admins can create/modify
- * - Identity-account-scoped: Only the owner can create/modify
- *
- * Primary interface: The `apply` method provides Kubernetes-style idempotent
- * create-or-update semantics, which is the recommended approach for CLI usage.
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerCommandController
  */
 export declare const McpServerCommandController: GenService<{
@@ -27,12 +18,6 @@ export declare const McpServerCommandController: GenService<{
      * If the resource doesn't exist, creates it. If it exists, updates it.
      * The resource is identified by its (scope, org, slug) combination.
      *
-     * @internal
-     * The handler determines whether this is a create or update operation
-     * and performs appropriate scope-aware authorization:
-     * - Create: Requires permission to create in the target scope
-     * - Update: Requires can_edit on the existing resource
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.apply
      */
     apply: {
@@ -46,13 +31,6 @@ export declare const McpServerCommandController: GenService<{
      * Returns an error if a resource with the same (scope, org, slug) already exists.
      * Use `apply` for idempotent create-or-update semantics.
      *
-     * @internal
-     * Authorization: Custom authorization in handler.
-     * Requires permission to create MCP servers in the specified scope:
-     * - Platform: Requires platform operator role
-     * - Organization: Requires org admin role or can_create_mcp_server permission
-     * - Identity Account: Automatically allowed for the authenticated user
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.create
      */
     create: {
@@ -63,13 +41,6 @@ export declare const McpServerCommandController: GenService<{
     /**
      * Update an existing MCP server resource.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the mcp_server resource.
-     * Only the owner (based on scope) can update:
-     * - Platform: Platform operators
-     * - Organization: Org admins or resource owner
-     * - Identity Account: The owner
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.update
      */
     update: {
@@ -83,13 +54,6 @@ export declare const McpServerCommandController: GenService<{
      * Permanently removes the MCP server definition.
      * Agents referencing this server will need to be updated.
      *
-     * @internal
-     * Authorization: Requires can_delete permission on the mcp_server resource.
-     * Only the owner can delete:
-     * - Platform: Platform operators
-     * - Organization: Org admins or resource owner
-     * - Identity Account: The owner
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.delete
      */
     delete: {
@@ -103,9 +67,6 @@ export declare const McpServerCommandController: GenService<{
      * Only modifies metadata.visibility, leaving spec, status, and other
      * metadata fields untouched.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the mcp_server resource.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateVisibility
      */
     updateVisibility: {
@@ -121,24 +82,6 @@ export declare const McpServerCommandController: GenService<{
      * results in status.discovered_capabilities and status.tool_approvals.
      * Blocks until completion (up to ~30 seconds) and returns the updated McpServer.
      *
-     * @internal
-     * Typical flows:
-     * - Web console: user clicks Connect, backend resolves env vars from the
-     *   user's personal environment, starts a Temporal workflow on the runner
-     *   (stigmer-runner).
-     * - CLI: `stigmer discover mcp-server <name>` calls connect with runtime_env
-     *   populated from local env vars, delegating discovery to the backend.
-     * - Runner backfill: the runner calls connect on first use when
-     *   status.discovered_capabilities is empty, passing runtime_env from the
-     *   execution context (shared/connect-backfill.ts).
-     *
-     * Errors:
-     * - FAILED_PRECONDITION: Required credentials missing from personal environment
-     * - DEADLINE_EXCEEDED: Discovery did not complete within the timeout
-     * - NOT_FOUND: MCP server does not exist
-     *
-     * Authorization: Requires can_connect permission on the mcp_server resource.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.connect
      */
     connect: {
@@ -154,21 +97,6 @@ export declare const McpServerCommandController: GenService<{
      * redirect the user to. The frontend calls completeOAuthConnect after
      * the user authorizes.
      *
-     * @internal
-     * Two auth modes determined by the MCP server's spec.auth block:
-     * - No oauth_app_ref: MCP Authorization spec (DCR + PKCE). Backend
-     *   discovers the authorization server, registers a client via DCR,
-     *   and builds the auth URL automatically.
-     * - oauth_app_ref set: Vendor OAuth. Backend loads the referenced
-     *   OAuthApp for client credentials and endpoint URLs.
-     *
-     * Errors:
-     * - FAILED_PRECONDITION: MCP server has no auth block, or is stdio
-     *   without oauth_app_ref (DCR requires HTTP transport)
-     * - NOT_FOUND: MCP server or referenced OAuthApp does not exist
-     *
-     * Authorization: Requires can_connect permission on the mcp_server resource.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.initiateOAuthConnect
      */
     initiateOAuthConnect: {
@@ -188,15 +116,6 @@ export declare const McpServerCommandController: GenService<{
      * After success, the frontend should call connect() to trigger tool
      * discovery using the freshly acquired token.
      *
-     * @internal
-     * Errors:
-     * - FAILED_PRECONDITION: State parameter is invalid, expired, or does
-     *   not match the mcp_server_id
-     * - UNAVAILABLE: Token exchange with the authorization server failed
-     * - NOT_FOUND: No pending OAuth state found for the given state param
-     *
-     * Authorization: Requires can_connect permission on the mcp_server resource.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.completeOAuthConnect
      */
     completeOAuthConnect: {
@@ -218,11 +137,6 @@ export declare const McpServerCommandController: GenService<{
      * disconnected=false when no grant existed. Never returns an error
      * for a missing grant.
      *
-     * @internal
-     * Authorization: Requires can_connect permission on the mcp_server resource.
-     * Uses the same permission as connect/initiateOAuthConnect — if you can
-     * establish a connection, you can tear it down.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.disconnectOAuth
      */
     disconnectOAuth: {
@@ -245,16 +159,6 @@ export declare const McpServerCommandController: GenService<{
      * see the full scoping note on McpServerQueryController.getOrgOAuthApp,
      * the RPC clients probe.
      *
-     * @internal
-     * Authorization: Requires can_create_oauth_app permission on the organization.
-     * This is an org-admin operation — setting credentials that affect all users
-     * in the org who connect to this resource.
-     *
-     * Errors:
-     * - FAILED_PRECONDITION: Resource has no auth block or no oauth_app_ref
-     *   (BYOA requires a platform template to clone from)
-     * - NOT_FOUND: Resource does not exist
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.setOrgOAuthApp
      */
     setOrgOAuthApp: {
@@ -278,13 +182,6 @@ export declare const McpServerCommandController: GenService<{
      * will fail on next token refresh — those users will need to
      * re-authenticate using the platform default or a new org override.
      *
-     * @internal
-     * Authorization: Requires can_create_oauth_app permission on the organization.
-     * Same gate as setOrgOAuthApp — org-admin authority for credential management.
-     *
-     * Errors:
-     * - NOT_FOUND: No override exists for this resource + org
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.deleteOrgOAuthApp
      */
     deleteOrgOAuthApp: {

package/ai/stigmer/agentic/mcpserver/v1/command_pb.js

@@ -14,15 +14,6 @@ export const file_ai_stigmer_agentic_mcpserver_v1_command = /*@__PURE__*/ fileDe
 /**
  * McpServerCommandController provides write operations for MCP server resources.
  *
- * @internal
- * Authorization model for writes:
- * - Platform-scoped: Only platform operators can create/modify
- * - Organization-scoped: Org admins can create/modify
- * - Identity-account-scoped: Only the owner can create/modify
- *
- * Primary interface: The `apply` method provides Kubernetes-style idempotent
- * create-or-update semantics, which is the recommended approach for CLI usage.
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerCommandController
  */
 export const McpServerCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_command, 0);

package/ai/stigmer/agentic/mcpserver/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,8qFAA8qF,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE75F;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAgRlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,8qFAA8qF,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE75F;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAkLlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/io_pb.d.ts

@@ -30,32 +30,6 @@ export declare const McpServerIdSchema: GenMessage<McpServerId>;
 /**
  * ConnectInput is the request for the connect RPC.
  *
- * @internal
- * Triggers server-side MCP discovery and tool approval classification:
- * the backend creates an ephemeral ExecutionContext with the resolved
- * environment variables, starts a Temporal workflow that connects to the
- * MCP server (via the runner), enumerates tools and resource
- * templates, classifies tool approval policies, and stores the results
- * in status.discovered_capabilities and status.tool_approvals.
- *
- * Environment variable resolution:
- * - When runtime_env is provided, the backend creates an ExecutionContext directly
- *   from these values (one-time use, values are not persisted to any environment).
- * - When runtime_env is empty, the backend resolves values from the authenticated
- *   user's personal environment.
- *
- * Callers:
- * - Web console: calls connect after saving credentials to personal environment.
- * - CLI: calls connect with runtime_env populated from local env vars.
- * - Runner backfill: calls connect with runtime_env from execution context
- *   when status.discovered_capabilities is empty on first agent execution.
- *
- * Prerequisites:
- * - The MCP server must exist and have a valid server_type (stdio or http)
- * - org must be provided (the caller's active organization)
- * - Either runtime_env must contain all required keys, or the keys must be
- *   present in the user's personal environment / managed OAuth environment
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.ConnectInput
  */
 export type ConnectInput = Message<"ai.stigmer.agentic.mcpserver.v1.ConnectInput"> & {
@@ -97,17 +71,6 @@ export declare const ConnectInputSchema: GenMessage<ConnectInput>;
  * InitiateOAuthConnectInput starts the OAuth authorization flow for an
  * MCP server that has an auth block in its spec.
  *
- * @internal
- * Returns an authorization URL that the frontend redirects the user to.
- * The backend performs all setup (DCR registration for MCP OAuth servers,
- * OAuthApp credential lookup for vendor OAuth servers, PKCE pair generation)
- * and stores the pending state for the subsequent completeOAuthConnect call.
- *
- * Prerequisites:
- * - The MCP server must exist and have spec.auth configured
- * - For DCR: the server must use HTTP transport (discovery requires a URL)
- * - For vendor OAuth: the referenced OAuthApp must exist and be accessible
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.InitiateOAuthConnectInput
  */
 export type InitiateOAuthConnectInput = Message<"ai.stigmer.agentic.mcpserver.v1.InitiateOAuthConnectInput"> & {
@@ -179,22 +142,6 @@ export declare const InitiateOAuthConnectOutputSchema: GenMessage<InitiateOAuthC
  * CompleteOAuthConnectInput finishes the OAuth flow by exchanging the
  * authorization code for tokens.
  *
- * @internal
- * Called by the frontend after the user is redirected back from the
- * OAuth authorization server. The frontend extracts the authorization
- * code and state from the callback URL and passes them here.
- *
- * The backend:
- * 1. Validates the state parameter against the stored PendingOAuthState
- * 2. Exchanges the authorization code for tokens (using PKCE code_verifier)
- * 3. Stores the access token in the user's personal environment
- * 4. Stores the refresh token (if present) in the personal environment
- * 5. Creates an OAuthGrant record for pre-flight expiry checks
- *
- * After this succeeds, the frontend should call the regular connect RPC
- * to trigger tool discovery (which will find the fresh token in the
- * personal environment).
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.CompleteOAuthConnectInput
  */
 export type CompleteOAuthConnectInput = Message<"ai.stigmer.agentic.mcpserver.v1.CompleteOAuthConnectInput"> & {
@@ -260,11 +207,6 @@ export declare const CompleteOAuthConnectOutputSchema: GenMessage<CompleteOAuthC
 /**
  * GetOAuthGrantStatusInput queries the OAuth grant status for a resource.
  *
- * @internal
- * Returns whether the authenticated user has an active OAuth grant for the
- * specified resource in the given org. Used by the frontend to determine
- * whether to show "Connected" vs. "Connect with OAuth" UI states.
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.GetOAuthGrantStatusInput
  */
 export type GetOAuthGrantStatusInput = Message<"ai.stigmer.agentic.mcpserver.v1.GetOAuthGrantStatusInput"> & {
@@ -338,21 +280,6 @@ export declare const GetOAuthGrantStatusOutputSchema: GenMessage<GetOAuthGrantSt
 /**
  * DisconnectOAuthInput tears down a user's OAuth connection for a resource.
  *
- * @internal
- * The handler:
- * 1. Finds the OAuthGrant for (caller, resource_id, org)
- * 2. Deletes the managed Environment that holds the tokens
- * 3. Deletes the OAuthGrant record
- *
- * After this, the user's access token and refresh token are gone. The
- * MCP server remains configured — only the user's personal OAuth connection
- * is removed. Other users' connections to the same resource are unaffected.
- *
- * Idempotent: if no OAuthGrant exists for the (caller, resource_id, org)
- * tuple, the handler returns disconnected=false without error. This
- * supports race conditions (concurrent disconnect calls), retries after
- * partial failures, and desired-state semantics ("ensure no connection").
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.DisconnectOAuthInput
  */
 export type DisconnectOAuthInput = Message<"ai.stigmer.agentic.mcpserver.v1.DisconnectOAuthInput"> & {
@@ -400,30 +327,6 @@ export declare const DisconnectOAuthOutputSchema: GenMessage<DisconnectOAuthOutp
  * SetOrgOAuthAppInput creates or updates an org-level BYOA OAuth app
  * override for a resource.
  *
- * @internal
- * The handler:
- * 1. Looks up the platform-default OAuthApp via the resource's auth block
- *    to use as a template (authorization_url, token_url, scopes, etc.)
- * 2. Creates a new OAuthApp with the org-provided client_id + client_secret
- *    and the template's endpoint URLs and scopes
- * 3. Creates or updates an OAuthAppOverride binding
- *    (resource_id, resource_kind, org_id) → new OAuthApp ID
- *
- * If an override already exists for this resource + org, the handler
- * updates the existing OAuthApp's credentials and returns the same ID.
- *
- * After this, the resolution chain for this resource in this org will
- * return the org's OAuthApp instead of the platform default.
- *
- * Prerequisites:
- * - The resource must exist and have an auth block with oauth_app_ref
- *   (BYOA requires a platform template to clone from)
- * - The caller must have can_create_oauth_app permission in the org
- *
- * Errors:
- * - FAILED_PRECONDITION: Resource has no auth block or no oauth_app_ref
- * - NOT_FOUND: Resource does not exist
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.SetOrgOAuthAppInput
  */
 export type SetOrgOAuthAppInput = Message<"ai.stigmer.agentic.mcpserver.v1.SetOrgOAuthAppInput"> & {
@@ -481,11 +384,6 @@ export declare const SetOrgOAuthAppOutputSchema: GenMessage<SetOrgOAuthAppOutput
 /**
  * GetOrgOAuthAppInput queries whether an org has a BYOA override for a resource.
  *
- * @internal
- * Returns override metadata without exposing secrets. The frontend uses
- * this to show "Using org credentials" vs. "Using platform credentials"
- * and to offer the option to remove the override.
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.GetOrgOAuthAppInput
  */
 export type GetOrgOAuthAppInput = Message<"ai.stigmer.agentic.mcpserver.v1.GetOrgOAuthAppInput"> & {
@@ -543,23 +441,6 @@ export declare const GetOrgOAuthAppOutputSchema: GenMessage<GetOrgOAuthAppOutput
 /**
  * DeleteOrgOAuthAppInput removes an org-level BYOA override for a resource.
  *
- * @internal
- * The handler:
- * 1. Finds the OAuthAppOverride for (resource_id, resource_kind, org)
- * 2. Deletes the OAuthApp resource created for this override
- * 3. Deletes the OAuthAppOverride binding
- *
- * After this, the resolution chain falls back to the platform default.
- * Existing user OAuthGrants that were issued using the org's OAuthApp
- * will fail on next refresh — those users will need to re-authenticate
- * using the platform default (or a new org override).
- *
- * Prerequisites:
- * - An override must exist for this resource + org
- *
- * Errors:
- * - NOT_FOUND: No override exists for this resource + org
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.DeleteOrgOAuthAppInput
  */
 export type DeleteOrgOAuthAppInput = Message<"ai.stigmer.agentic.mcpserver.v1.DeleteOrgOAuthAppInput"> & {

package/ai/stigmer/agentic/mcpserver/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,gDAAgD,EAAE,MAAM,sCAAsC,CAAC;AACxG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,w/EAAw/E,EAAE,CAAC,gDAAgD,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAoBrlF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAgE1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAqC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA6C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAiD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAiC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA6B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAkD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAmB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA+D1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAkB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AA4B3D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAiC3D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAwC3D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAgB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAwCX;AAxCD,WAAY,qBAAqB;IAC/B;;;;OAIG;IACH,+HAAuC,CAAA;IAEvC;;;;OAIG;IACH,uHAAmC,CAAA;IAEnC;;;;;OAKG;IACH,mIAAyC,CAAA;IAEzC;;;;;;;OAOG;IACH,2JAAqD,CAAA;IAErD;;;;;OAKG;IACH,yHAAoC,CAAA;AACtC,CAAC,EAxCW,qBAAqB,KAArB,qBAAqB,QAwChC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,gDAAgD,EAAE,MAAM,sCAAsC,CAAC;AACxG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,w/EAAw/E,EAAE,CAAC,gDAAgD,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAoBrlF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAsC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA0B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA6C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAiC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAiC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAkD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAmB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAkB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAuB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAiC3D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAuB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAgB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAwCX;AAxCD,WAAY,qBAAqB;IAC/B;;;;OAIG;IACH,+HAAuC,CAAA;IAEvC;;;;OAIG;IACH,uHAAmC,CAAA;IAEnC;;;;;OAKG;IACH,mIAAyC,CAAA;IAEzC;;;;;;;OAOG;IACH,2JAAqD,CAAA;IAErD;;;;;OAKG;IACH,yHAAoC,CAAA;AACtC,CAAC,EAxCW,qBAAqB,KAArB,qBAAqB,QAwChC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/oauth_pb.d.ts

@@ -8,28 +8,6 @@ export declare const file_ai_stigmer_agentic_mcpserver_v1_oauth: GenFile;
  * OAuthGrant tracks OAuth metadata for a user's OAuth connection to an
  * API resource.
  *
- * @internal
- * Infrastructure-only. Not a public API resource — no kind, no apiVersion,
- * no CRUD RPCs. Stored in the backend's database, keyed by the composite
- * of (identity_account_id, resource_id, org_id).
- *
- * The grant is resource-agnostic: currently used for MCP servers, but the
- * data model supports any API resource kind that needs OAuth credentials
- * (e.g., workflows in the future).
- *
- * Actual tokens (access + refresh) live in a managed environment
- * (stigmer.ai/managed=true label) as encrypted secret env vars.
- * OAuthGrant only holds non-secret metadata needed by the refresh
- * mechanism and pre-flight expiry checks.
- *
- * Storage split rationale:
- * - Managed environment: access token (target_env_var), refresh token
- *   ({target_env_var}_REFRESH_TOKEN). These are secrets, encrypted at rest,
- *   subject to Environment access control.
- * - OAuthGrant: expiry timestamp, client_id, token_endpoint, env var names.
- *   These are non-secret metadata that the backend reads during pre-flight
- *   checks without needing secret-read permissions on the Environment.
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.OAuthGrant
  */
 export type OAuthGrant = Message<"ai.stigmer.agentic.mcpserver.v1.OAuthGrant"> & {
@@ -126,36 +104,6 @@ export declare const OAuthGrantSchema: GenMessage<OAuthGrant>;
  * OAuthAppOverride binds a specific OAuthApp to an API resource within an
  * organization, overriding the platform-default OAuthApp for that resource.
  *
- * @internal
- * Infrastructure-only. Not a public API resource — no kind, no apiVersion,
- * no CRUD RPCs. Stored in the backend's database, keyed by the composite
- * of (resource_id, resource_kind, org_id).
- *
- * This is the "Bring Your Own App" (BYOA) binding: it records that org Z
- * wants resource Y to use OAuthApp X instead of the platform default
- * referenced by McpServerAuth.oauth_app_ref.
- *
- * Separation of concerns:
- * - OAuthApp (credential resource): holds client_id, client_secret, and
- *   vendor endpoint URLs. Reusable — may be referenced by multiple overrides
- *   or MCP servers.
- * - OAuthAppOverride (binding document): maps (resource, org) to an OAuthApp.
- *   Analogous to OAuthGrant, which maps (user, resource, org) to token metadata.
- *
- * Resolution chain (evaluated at connect time and token refresh):
- *   1. OAuthAppOverride for (resource_id, resource_kind, org_id) — org override
- *   2. McpServerAuth.oauth_app_ref on the resource spec — platform default
- *   3. None — no OAuth app available (manual token or DCR only)
- *
- * Edition scoping: the override binding — and the whole resolution chain
- * above it — exists only on the hosted platform. OSS resolves the
- * oauth_app_ref directly against its flat OAuthApp store (the ref IS the
- * whole resolution) and answers UNIMPLEMENTED for the org-OAuth-app RPCs;
- * see McpServerQueryController.getOrgOAuthApp for the contract.
- *
- * The override is resource-agnostic: currently used for MCP servers, but the
- * composite key supports any API resource kind that needs BYOA (e.g., workflows).
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.OAuthAppOverride
  */
 export type OAuthAppOverride = Message<"ai.stigmer.agentic.mcpserver.v1.OAuthAppOverride"> & {

package/ai/stigmer/agentic/mcpserver/v1/oauth_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/oauth_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,0nBAA0nB,CAAC,CAAC;AA8HvoB;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AA2E7D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"oauth_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/oauth_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,0nBAA0nB,CAAC,CAAC;AAwGvoB;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AA6C7D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}