@stigmer/protos 3.12.2 → 3.12.4

package/ai/stigmer/iam/apikey/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8GAA8G;AAC9G,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,gDAAgD;IAC1D,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,MAAM;YACT,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,UAAU;YACb,CAAC,EAAE,MAAM;YACT,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,CAAC,EAAE,KAAK;YACR,CAAC,EAAE,OAAO;YACV,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8GAA8G;AAC9G,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,gDAAgD;IAC1D,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,MAAM;YACT,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,UAAU;YACb,CAAC,EAAE,MAAM;YACT,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,CAAC,EAAE,KAAK;YACR,CAAC,EAAE,OAAO;YACV,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/apikey/v1/query_pb.d.ts

@@ -25,10 +25,6 @@ export declare const ApiKeyQueryController: GenService<{
     /**
      * Get an API key by its hashed key value.
      *
-     * @internal
-     * Authorization is handled in the handler after loading the resource
-     * (input doesn't contain API key ID, so proto-level auth cannot work).
-     *
      * @generated from rpc ai.stigmer.iam.apikey.v1.ApiKeyQueryController.getByKeyHash
      */
     getByKeyHash: {
@@ -41,9 +37,6 @@ export declare const ApiKeyQueryController: GenService<{
      *
      * Returns only the keys owned by the identity account in the auth header.
      *
-     * @internal
-     * Scoped to the caller's own keys, so authorization is skipped.
-     *
      * @generated from rpc ai.stigmer.iam.apikey.v1.ApiKeyQueryController.findAll
      */
     findAll: {

package/ai/stigmer/iam/apikey/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8GAA8G;AAC9G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,qhBAAqhB,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAE1uB;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAwC7B,aAAa,CAChB,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8GAA8G;AAC9G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,qhBAAqhB,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAE1uB;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAiC7B,aAAa,CAChB,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/apikey/v1/spec_pb.d.ts

@@ -18,10 +18,6 @@ export type ApiKeySpec = Message<"ai.stigmer.iam.apikey.v1.ApiKeySpec"> & {
      * Hash of the raw API key.
      * The actual key is returned only in the create response and never persisted.
      *
-     * @internal
-     * SHA-256/Bcrypt hash of the raw key generated during creation.
-     * Only the last 6 chars are persisted in the fingerprint field for UI display.
-     *
      * @generated from field: string key_hash = 1;
      */
     keyHash: string;

package/ai/stigmer/iam/apikey/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6GAA6G;AAC7G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAY,aAAa,CACtE,QAAQ,CAAC,wRAAwR,EAAE,CAAC,iDAAiD,EAAE,8BAA8B,CAAC,CAAC,CAAC;AA6C1X;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/apikey/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6GAA6G;AAC7G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAY,aAAa,CACtE,QAAQ,CAAC,wRAAwR,EAAE,CAAC,iDAAiD,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAyC1X;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/api_pb.d.ts

@@ -35,11 +35,6 @@ export type IamPolicy = Message<"ai.stigmer.iam.iampolicy.v1.IamPolicy"> & {
     /**
      * Resource metadata including name, organization, and labels.
      *
-     * @internal
-     * id format: iamp_<ulid>
-     * name: human-readable identifier (e.g., "john-vpc-admin")
-     * org: organization this policy belongs to
-     *
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceMetadata metadata = 3;
      */
     metadata?: ApiResourceMetadata;

package/ai/stigmer/iam/iampolicy/v1/api_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/api_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kHAAkH;AAClH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAE3G,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAY,aAAa,CACxE,QAAQ,CAAC,klBAAklB,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwD9vB;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC;AAkBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/api_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kHAAkH;AAClH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAE3G,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAY,aAAa,CACxE,QAAQ,CAAC,klBAAklB,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAmD9vB;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC;AAkBvD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/command_connect.d.ts

@@ -26,29 +26,6 @@ export declare const IamPolicyCommandController: {
          * Creates a single IAM policy that grants a principal access to a resource with a specific relation.
          * This is the fundamental operation for establishing permissions.
          *
-         * @internal
-         * The operation:
-         * 1. Validates the input (principal, resource, relation are all valid)
-         * 2. Checks for duplicates (skips if the exact policy already exists, idempotent)
-         * 3. Creates the policy in the database with auto-generated ID and metadata
-         * 4. Writes the corresponding tuple to OpenFGA (where authorization is enforced)
-         *
-         * Authorization:
-         * - Caller must have 'can_grant_access' permission on the RESOURCE being shared
-         * - This ensures only resource owners/admins can grant access to their resources
-         *
-         * Example:
-         * Input:
-         *   principal: {kind: "identity_account", id: "ia_alice-123"}
-         *   resource: {kind: "organization", id: "org_demo-456"}
-         *   relation: "viewer"
-         * Result:
-         *   Created IamPolicy with auto-generated ID (e.g., "iamp_01HQ...")
-         *   Alice can view (but not modify) the organization
-         *
-         * Input: IamPolicySpec containing principal, resource, and relation
-         * Output: The created IamPolicy with generated ID and metadata
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.create
          */
         readonly create: {
@@ -63,31 +40,6 @@ export declare const IamPolicyCommandController: {
          * Removes an existing IAM policy by matching the principal, resource, and relation.
          * This is a surgical operation — it removes one specific policy without affecting others.
          *
-         * @internal
-         * The operation:
-         * 1. Finds the policy by matching principal+resource+relation
-         * 2. Removes it from the database
-         * 3. Deletes the corresponding tuple from OpenFGA
-         * 4. If no matching policy exists, the operation is idempotent (no error)
-         *
-         * Authorization:
-         * - Caller must have 'can_grant_access' permission on the RESOURCE referenced in the policy
-         *
-         * Use Cases:
-         * - Revoking a specific permission from a user
-         * - Removing access after a team member leaves
-         * - Cleaning up individual policies
-         *
-         * Example:
-         * Input:
-         *   principal: {kind: "identity_account", id: "ia_alice-123"}
-         *   resource: {kind: "organization", id: "org_demo-456"}
-         *   relation: "viewer"
-         * Result: The policy granting Alice viewer access to the organization is deleted
-         *
-         * Input: IamPolicySpec identifying the policy to delete (principal, resource, relation)
-         * Output: The deleted IamPolicy object (for audit/confirmation purposes)
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.delete
          */
         readonly delete: {
@@ -102,41 +54,6 @@ export declare const IamPolicyCommandController: {
          * Creates IAM policies during resource creation when standard authorization cannot work yet
          * because no tuples exist.
          *
-         * @internal
-         * Solves the chicken-and-egg problem where creating the first policy for a resource
-         * requires authorization, but authorization requires that first policy.
-         *
-         * The operation:
-         * 1. Validates that caller has can_bootstrap_iam permission on platform:stigmer
-         * 2. Validates the input (principal, resource, relation are all valid)
-         * 3. Checks for duplicates (skips if the exact policy already exists, idempotent)
-         * 4. Creates the policy in the database with auto-generated ID and metadata
-         * 5. Writes the corresponding tuple to OpenFGA (where authorization is enforced)
-         *
-         * Authorization:
-         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
-         * - This is typically only called by resource creation handlers running as machine accounts
-         *
-         * Use Cases:
-         * - Creating scope links (agent#organization@organization:acme) during agent creation
-         * - Creating owner relations (agent#owner@identity_account:alice) during agent creation
-         * - Establishing initial authorization tuples for any newly created resource
-         *
-         * Example:
-         * Input:
-         *   principal: {kind: "organization", id: "org_demo-123"}
-         *   resource: {kind: "agent", id: "agt_abc-456"}
-         *   relation: "organization"
-         * Result:
-         *   Created IamPolicy establishing agent's organization scope
-         *   Subsequent IAM policy operations can now use standard authorization
-         *
-         * Note: After the bootstrap policies are created, subsequent IAM policy modifications
-         * must use the standard 'create' RPC which requires 'can_grant_access' permission.
-         *
-         * Input: IamPolicySpec containing principal, resource, and relation
-         * Output: The created IamPolicy with generated ID and metadata
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapPolicy
          */
         readonly bootstrapPolicy: {
@@ -150,34 +67,6 @@ export declare const IamPolicyCommandController: {
          *
          * Removes all IAM policies associated with a deleted resource.
          *
-         * @internal
-         * Performs bidirectional cleanup:
-         * 1. Policies where resource is the TARGET (policies granting access TO this resource)
-         * 2. Policies where resource is the PRINCIPAL (policies where this resource HAS access)
-         *
-         * The operation:
-         * 1. Validates can_bootstrap_iam permission on platform:stigmer
-         * 2. Finds all policies where resource_id appears (as principal OR resource)
-         * 3. Deletes all matching policies from MongoDB
-         * 4. Removes all corresponding tuples from OpenFGA
-         * 5. Returns Empty (idempotent if no policies exist)
-         *
-         * Authorization:
-         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
-         * - This is typically only granted to platform services
-         *
-         * Use Cases:
-         * - Resource deletion cleanup
-         * - Preventing orphaned FGA tuples
-         * - Maintaining authorization system integrity
-         *
-         * Example:
-         * Input: {kind: "organization", id: "org_demo-123"}
-         * Result: All policies referencing org_demo-123 are deleted
-         *
-         * Input: ApiResourceRef with resource kind and ID
-         * Output: Empty (google.protobuf.Empty)
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.cleanupResourcePolicies
          */
         readonly cleanupResourcePolicies: {
@@ -193,27 +82,6 @@ export declare const IamPolicyCommandController: {
          * resources within the given organization, including policies on the organization
          * itself and on child resources (environments, agents, etc.).
          *
-         * @internal
-         * The operation:
-         * 1. Validates the input (identity_account_id and organization_id are present)
-         * 2. Authorizes caller (can_grant_access on the organization)
-         * 3. Loads all policies where the user is principal within the org scope
-         * 4. Deletes all matching policies from MongoDB
-         * 5. Removes all corresponding tuples from OpenFGA
-         *
-         * Authorization:
-         * - Caller must have 'can_grant_access' permission on the organization
-         * - System flows running as the platform machine account cannot satisfy this
-         *   check (the machine account holds no org-scoped grants by design) and must
-         *   use bootstrapRevokeOrgAccess instead
-         *
-         * Use Cases:
-         * - Removing a member from an organization
-         * - Offboarding a user from all org resources in one operation
-         *
-         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
-         * Output: Empty (google.protobuf.Empty)
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.revokeOrgAccess
          */
         readonly revokeOrgAccess: {
@@ -229,36 +97,6 @@ export declare const IamPolicyCommandController: {
          * authorized by can_bootstrap_iam on platform:stigmer instead of
          * can_grant_access on the organization.
          *
-         * @internal
-         * Exists because system flows execute the revoke as the platform machine
-         * account, which by design holds no org-scoped grants. The system channel does
-         * NOT bypass authorization — it authenticates as the machine account, which
-         * can only satisfy platform-scoped permissions. revokeOrgAccess therefore
-         * always fails with PERMISSION_DENIED on the system channel; this RPC is the
-         * sanctioned path, mirroring how bootstrapPolicy is the system-path twin of
-         * create (see https://github.com/stigmer/stigmer/issues/332).
-         *
-         * The operation (identical to revokeOrgAccess after authorization):
-         * 1. Validates can_bootstrap_iam permission on platform:stigmer
-         * 2. Loads all policies where the identity account is principal within the org
-         *    scope, plus policies directly on the organization itself
-         * 3. Deletes all matching policies from MongoDB
-         * 4. Removes all corresponding tuples from OpenFGA (idempotent if none exist)
-         *
-         * Authorization:
-         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
-         * - This is typically only granted to platform services (machine accounts)
-         *
-         * Use Cases:
-         * - Federated account deprovisioning (deprovisionFederatedAccount's revoke step)
-         * - Any platform-driven offboarding that runs under system credentials
-         *
-         * End-user member removal must use revokeOrgAccess, which checks
-         * can_grant_access on the organization.
-         *
-         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
-         * Output: Empty (google.protobuf.Empty)
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapRevokeOrgAccess
          */
         readonly bootstrapRevokeOrgAccess: {

package/ai/stigmer/iam/iampolicy/v1/command_connect.js

@@ -34,29 +34,6 @@ export const IamPolicyCommandController = {
          * Creates a single IAM policy that grants a principal access to a resource with a specific relation.
          * This is the fundamental operation for establishing permissions.
          *
-         * @internal
-         * The operation:
-         * 1. Validates the input (principal, resource, relation are all valid)
-         * 2. Checks for duplicates (skips if the exact policy already exists, idempotent)
-         * 3. Creates the policy in the database with auto-generated ID and metadata
-         * 4. Writes the corresponding tuple to OpenFGA (where authorization is enforced)
-         *
-         * Authorization:
-         * - Caller must have 'can_grant_access' permission on the RESOURCE being shared
-         * - This ensures only resource owners/admins can grant access to their resources
-         *
-         * Example:
-         * Input:
-         *   principal: {kind: "identity_account", id: "ia_alice-123"}
-         *   resource: {kind: "organization", id: "org_demo-456"}
-         *   relation: "viewer"
-         * Result:
-         *   Created IamPolicy with auto-generated ID (e.g., "iamp_01HQ...")
-         *   Alice can view (but not modify) the organization
-         *
-         * Input: IamPolicySpec containing principal, resource, and relation
-         * Output: The created IamPolicy with generated ID and metadata
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.create
          */
         create: {
@@ -71,31 +48,6 @@ export const IamPolicyCommandController = {
          * Removes an existing IAM policy by matching the principal, resource, and relation.
          * This is a surgical operation — it removes one specific policy without affecting others.
          *
-         * @internal
-         * The operation:
-         * 1. Finds the policy by matching principal+resource+relation
-         * 2. Removes it from the database
-         * 3. Deletes the corresponding tuple from OpenFGA
-         * 4. If no matching policy exists, the operation is idempotent (no error)
-         *
-         * Authorization:
-         * - Caller must have 'can_grant_access' permission on the RESOURCE referenced in the policy
-         *
-         * Use Cases:
-         * - Revoking a specific permission from a user
-         * - Removing access after a team member leaves
-         * - Cleaning up individual policies
-         *
-         * Example:
-         * Input:
-         *   principal: {kind: "identity_account", id: "ia_alice-123"}
-         *   resource: {kind: "organization", id: "org_demo-456"}
-         *   relation: "viewer"
-         * Result: The policy granting Alice viewer access to the organization is deleted
-         *
-         * Input: IamPolicySpec identifying the policy to delete (principal, resource, relation)
-         * Output: The deleted IamPolicy object (for audit/confirmation purposes)
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.delete
          */
         delete: {
@@ -110,41 +62,6 @@ export const IamPolicyCommandController = {
          * Creates IAM policies during resource creation when standard authorization cannot work yet
          * because no tuples exist.
          *
-         * @internal
-         * Solves the chicken-and-egg problem where creating the first policy for a resource
-         * requires authorization, but authorization requires that first policy.
-         *
-         * The operation:
-         * 1. Validates that caller has can_bootstrap_iam permission on platform:stigmer
-         * 2. Validates the input (principal, resource, relation are all valid)
-         * 3. Checks for duplicates (skips if the exact policy already exists, idempotent)
-         * 4. Creates the policy in the database with auto-generated ID and metadata
-         * 5. Writes the corresponding tuple to OpenFGA (where authorization is enforced)
-         *
-         * Authorization:
-         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
-         * - This is typically only called by resource creation handlers running as machine accounts
-         *
-         * Use Cases:
-         * - Creating scope links (agent#organization@organization:acme) during agent creation
-         * - Creating owner relations (agent#owner@identity_account:alice) during agent creation
-         * - Establishing initial authorization tuples for any newly created resource
-         *
-         * Example:
-         * Input:
-         *   principal: {kind: "organization", id: "org_demo-123"}
-         *   resource: {kind: "agent", id: "agt_abc-456"}
-         *   relation: "organization"
-         * Result:
-         *   Created IamPolicy establishing agent's organization scope
-         *   Subsequent IAM policy operations can now use standard authorization
-         *
-         * Note: After the bootstrap policies are created, subsequent IAM policy modifications
-         * must use the standard 'create' RPC which requires 'can_grant_access' permission.
-         *
-         * Input: IamPolicySpec containing principal, resource, and relation
-         * Output: The created IamPolicy with generated ID and metadata
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapPolicy
          */
         bootstrapPolicy: {
@@ -158,34 +75,6 @@ export const IamPolicyCommandController = {
          *
          * Removes all IAM policies associated with a deleted resource.
          *
-         * @internal
-         * Performs bidirectional cleanup:
-         * 1. Policies where resource is the TARGET (policies granting access TO this resource)
-         * 2. Policies where resource is the PRINCIPAL (policies where this resource HAS access)
-         *
-         * The operation:
-         * 1. Validates can_bootstrap_iam permission on platform:stigmer
-         * 2. Finds all policies where resource_id appears (as principal OR resource)
-         * 3. Deletes all matching policies from MongoDB
-         * 4. Removes all corresponding tuples from OpenFGA
-         * 5. Returns Empty (idempotent if no policies exist)
-         *
-         * Authorization:
-         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
-         * - This is typically only granted to platform services
-         *
-         * Use Cases:
-         * - Resource deletion cleanup
-         * - Preventing orphaned FGA tuples
-         * - Maintaining authorization system integrity
-         *
-         * Example:
-         * Input: {kind: "organization", id: "org_demo-123"}
-         * Result: All policies referencing org_demo-123 are deleted
-         *
-         * Input: ApiResourceRef with resource kind and ID
-         * Output: Empty (google.protobuf.Empty)
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.cleanupResourcePolicies
          */
         cleanupResourcePolicies: {
@@ -201,27 +90,6 @@ export const IamPolicyCommandController = {
          * resources within the given organization, including policies on the organization
          * itself and on child resources (environments, agents, etc.).
          *
-         * @internal
-         * The operation:
-         * 1. Validates the input (identity_account_id and organization_id are present)
-         * 2. Authorizes caller (can_grant_access on the organization)
-         * 3. Loads all policies where the user is principal within the org scope
-         * 4. Deletes all matching policies from MongoDB
-         * 5. Removes all corresponding tuples from OpenFGA
-         *
-         * Authorization:
-         * - Caller must have 'can_grant_access' permission on the organization
-         * - System flows running as the platform machine account cannot satisfy this
-         *   check (the machine account holds no org-scoped grants by design) and must
-         *   use bootstrapRevokeOrgAccess instead
-         *
-         * Use Cases:
-         * - Removing a member from an organization
-         * - Offboarding a user from all org resources in one operation
-         *
-         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
-         * Output: Empty (google.protobuf.Empty)
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.revokeOrgAccess
          */
         revokeOrgAccess: {
@@ -237,36 +105,6 @@ export const IamPolicyCommandController = {
          * authorized by can_bootstrap_iam on platform:stigmer instead of
          * can_grant_access on the organization.
          *
-         * @internal
-         * Exists because system flows execute the revoke as the platform machine
-         * account, which by design holds no org-scoped grants. The system channel does
-         * NOT bypass authorization — it authenticates as the machine account, which
-         * can only satisfy platform-scoped permissions. revokeOrgAccess therefore
-         * always fails with PERMISSION_DENIED on the system channel; this RPC is the
-         * sanctioned path, mirroring how bootstrapPolicy is the system-path twin of
-         * create (see https://github.com/stigmer/stigmer/issues/332).
-         *
-         * The operation (identical to revokeOrgAccess after authorization):
-         * 1. Validates can_bootstrap_iam permission on platform:stigmer
-         * 2. Loads all policies where the identity account is principal within the org
-         *    scope, plus policies directly on the organization itself
-         * 3. Deletes all matching policies from MongoDB
-         * 4. Removes all corresponding tuples from OpenFGA (idempotent if none exist)
-         *
-         * Authorization:
-         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
-         * - This is typically only granted to platform services (machine accounts)
-         *
-         * Use Cases:
-         * - Federated account deprovisioning (deprovisionFederatedAccount's revoke step)
-         * - Any platform-driven offboarding that runs under system credentials
-         *
-         * End-user member removal must use revokeOrgAccess, which checks
-         * can_grant_access on the organization.
-         *
-         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
-         * Output: Empty (google.protobuf.Empty)
-         *
          * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapRevokeOrgAccess
          */
         bootstrapRevokeOrgAccess: {

package/ai/stigmer/iam/iampolicy/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAgCG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0CG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsCG;QACH,wBAAwB,EAAE;YACxB,IAAI,EAAE,0BAA0B;YAChC,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,wBAAwB,EAAE;YACxB,IAAI,EAAE,0BAA0B;YAChC,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}