@stigmer/protos 3.12.2 → 3.12.4

package/ai/stigmer/iam/oauthapp/v1/command_connect.js

@@ -8,11 +8,6 @@ import { ApiResourceDeleteInput } from "../../../commons/apiresource/io_pbjs";
 /**
  * OAuthAppCommandController provides write operations for OAuth app resources.
  *
- * @internal
- * OAuthApps hold vendor client credentials (client_secret) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController
  */
 export const OAuthAppCommandController = {
@@ -24,11 +19,6 @@ export const OAuthAppCommandController = {
          * If the resource does not exist, creates a new OAuth app.
          * If the resource exists, updates the existing OAuth app.
          *
-         * @internal
-         * The authorization and state-operation are determined depending on whether the
-         * OAuth app is going to be created or updated, which is determined as
-         * part of the request execution.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.apply
          */
         apply: {
@@ -43,9 +33,6 @@ export const OAuthAppCommandController = {
          * The creator's organization owns the OAuth app. The creator is granted
          * the owner role automatically.
          *
-         * @internal
-         * Authorization: Requires can_create_oauth_app permission in the organization.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.create
          */
         create: {
@@ -57,9 +44,6 @@ export const OAuthAppCommandController = {
         /**
          * Update an existing OAuth app.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the oauth_app resource.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.update
          */
         update: {
@@ -74,9 +58,6 @@ export const OAuthAppCommandController = {
          * Deletion should be blocked if any McpServer resources reference this
          * OAuth app via McpServerVendorOAuth.oauth_app_ref.
          *
-         * @internal
-         * Authorization: Requires can_delete permission on the oauth_app resource.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.delete
          */
         delete: {

package/ai/stigmer/iam/oauthapp/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE;QACP;;;;;;;;;;;;WAYG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,sDAAsD;IAChE,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/oauthapp/v1/command_pb.d.ts

@@ -8,11 +8,6 @@ export declare const file_ai_stigmer_iam_oauthapp_v1_command: GenFile;
 /**
  * OAuthAppCommandController provides write operations for OAuth app resources.
  *
- * @internal
- * OAuthApps hold vendor client credentials (client_secret) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController
  */
 export declare const OAuthAppCommandController: GenService<{
@@ -22,11 +17,6 @@ export declare const OAuthAppCommandController: GenService<{
      * If the resource does not exist, creates a new OAuth app.
      * If the resource exists, updates the existing OAuth app.
      *
-     * @internal
-     * The authorization and state-operation are determined depending on whether the
-     * OAuth app is going to be created or updated, which is determined as
-     * part of the request execution.
-     *
      * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.apply
      */
     apply: {
@@ -40,9 +30,6 @@ export declare const OAuthAppCommandController: GenService<{
      * The creator's organization owns the OAuth app. The creator is granted
      * the owner role automatically.
      *
-     * @internal
-     * Authorization: Requires can_create_oauth_app permission in the organization.
-     *
      * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.create
      */
     create: {
@@ -53,9 +40,6 @@ export declare const OAuthAppCommandController: GenService<{
     /**
      * Update an existing OAuth app.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the oauth_app resource.
-     *
      * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.update
      */
     update: {
@@ -69,9 +53,6 @@ export declare const OAuthAppCommandController: GenService<{
      * Deletion should be blocked if any McpServer resources reference this
      * OAuth app via McpServerVendorOAuth.oauth_app_ref.
      *
-     * @internal
-     * Authorization: Requires can_delete permission on the oauth_app resource.
-     *
      * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.delete
      */
     delete: {

package/ai/stigmer/iam/oauthapp/v1/command_pb.js

@@ -13,11 +13,6 @@ export const file_ai_stigmer_iam_oauthapp_v1_command = /*@__PURE__*/ fileDesc("C
 /**
  * OAuthAppCommandController provides write operations for OAuth app resources.
  *
- * @internal
- * OAuthApps hold vendor client credentials (client_secret) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController
  */
 export const OAuthAppCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_iam_oauthapp_v1_command, 0);

package/ai/stigmer/iam/oauthapp/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,aAAa,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,i4BAAi4B,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,mCAAmC,CAAC,CAAC,CAAC;AAElkC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAgEjC,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,aAAa,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,i4BAAi4B,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,mCAAmC,CAAC,CAAC,CAAC;AAElkC;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAkDjC,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/oauthapp/v1/query_connect.d.ts

@@ -9,9 +9,6 @@ export declare const OAuthAppQueryController: {
         /**
          * Get an OAuth app by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the oauth_app resource.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppQueryController.get
          */
         readonly get: {
@@ -26,10 +23,6 @@ export declare const OAuthAppQueryController: {
          * Resolves a human-readable reference like "acme/slack-oauth" to the full
          * OAuthApp resource.
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppQueryController.getByReference
          */
         readonly getByReference: {
@@ -44,9 +37,6 @@ export declare const OAuthAppQueryController: {
          * Returns every OAuthApp whose metadata.org matches the input org.
          * Typically a small set (1-5 per org), so results are not paginated.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the organization resource.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppQueryController.listByOrg
          */
         readonly listByOrg: {

package/ai/stigmer/iam/oauthapp/v1/query_connect.js

@@ -17,9 +17,6 @@ export const OAuthAppQueryController = {
         /**
          * Get an OAuth app by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the oauth_app resource.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppQueryController.get
          */
         get: {
@@ -34,10 +31,6 @@ export const OAuthAppQueryController = {
          * Resolves a human-readable reference like "acme/slack-oauth" to the full
          * OAuthApp resource.
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppQueryController.getByReference
          */
         getByReference: {
@@ -52,9 +45,6 @@ export const OAuthAppQueryController = {
          * Returns every OAuthApp whose metadata.org matches the input org.
          * Typically a small set (1-5 per org), so results are not paginated.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the organization resource.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppQueryController.listByOrg
          */
         listByOrg: {

package/ai/stigmer/iam/oauthapp/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,kHAAkH;AAClH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,oDAAoD;IAC9D,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,kHAAkH;AAClH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,oDAAoD;IAC9D,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/oauthapp/v1/query_pb.d.ts

@@ -15,9 +15,6 @@ export declare const OAuthAppQueryController: GenService<{
     /**
      * Get an OAuth app by its unique identifier.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the oauth_app resource.
-     *
      * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppQueryController.get
      */
     get: {
@@ -31,10 +28,6 @@ export declare const OAuthAppQueryController: GenService<{
      * Resolves a human-readable reference like "acme/slack-oauth" to the full
      * OAuthApp resource.
      *
-     * @internal
-     * Custom authorization in handler — checks both direct resource access
-     * and organization-level visibility permissions.
-     *
      * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppQueryController.getByReference
      */
     getByReference: {
@@ -48,9 +41,6 @@ export declare const OAuthAppQueryController: GenService<{
      * Returns every OAuthApp whose metadata.org matches the input org.
      * Typically a small set (1-5 per org), so results are not paginated.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the organization resource.
-     *
      * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppQueryController.listByOrg
      */
     listByOrg: {

package/ai/stigmer/iam/oauthapp/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kHAAkH;AAClH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEhE;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAY,aAAa,CACzE,QAAQ,CAAC,stBAAstB,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,mCAAmC,EAAE,kCAAkC,CAAC,CAAC,CAAC;AAE37B;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GA+C/B,aAAa,CAChB,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kHAAkH;AAClH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,mCAAmC,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAEhE;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAY,aAAa,CACzE,QAAQ,CAAC,stBAAstB,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,mCAAmC,EAAE,kCAAkC,CAAC,CAAC,CAAC;AAE37B;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAqC/B,aAAa,CAChB,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/oauthapp/v1/spec_pb.d.ts

@@ -7,43 +7,6 @@ export declare const file_ai_stigmer_iam_oauthapp_v1_spec: GenFile;
 /**
  * OAuthAppSpec defines a registered OAuth application with an external vendor.
  *
- * @internal
- * Represents Stigmer's (or a platform builder's) OAuth app registration
- * with an external vendor like Slack, Salesforce, or Figma.
- *
- * Created by org admins or platform operators. Referenced by McpServer
- * resources that need vendor OAuth authentication via McpServerVendorOAuth.
- *
- * Analogous to IdentityProvider (inbound auth trust), OAuthApp represents
- * outbound auth — how Stigmer authenticates with external services on
- * behalf of users.
- *
- * The redirect URI is intentionally omitted: the platform derives its
- * OAuth callback URL from server configuration, not from per-app settings.
- * When registering the OAuth app with a vendor, the admin uses the
- * callback URL documented in Stigmer's deployment settings.
- *
- * Security:
- * - client_secret is encrypted at rest and redacted in logs.
- * - The resource should have visibility_private to prevent secret leakage.
- * - OAuthApp does not support public visibility.
- *
- * Example YAML:
- *   apiVersion: iam.stigmer.ai/v1
- *   kind: OAuthApp
- *   metadata:
- *     name: Slack OAuth
- *     slug: slack-oauth
- *     org: acme
- *   spec:
- *     provider: "Slack"
- *     client_id: "1234567890.abcdef"
- *     client_secret: "xoxs-..."
- *     authorization_url: "https://slack.com/oauth/v2/authorize"
- *     token_url: "https://slack.com/api/oauth.v2.access"
- *     scopes: ["channels:read", "chat:write"]
- *     scope_parameter_name: "user_scope"
- *
  * @generated from message ai.stigmer.iam.oauthapp.v1.OAuthAppSpec
  */
 export type OAuthAppSpec = Message<"ai.stigmer.iam.oauthapp.v1.OAuthAppSpec"> & {

package/ai/stigmer/iam/oauthapp/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAY,aAAa,CACxE,QAAQ,CAAC,4xBAA4xB,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAkJv0B;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA+BX;AA/BD,WAAY,oBAAoB;IAC9B;;;;;;OAMG;IACH,6EAAe,CAAA;IAEf;;;;;OAKG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,uEAAY,CAAA;IAEZ;;;;OAIG;IACH,uEAAY,CAAA;AACd,CAAC,EA/BW,oBAAoB,KAApB,oBAAoB,QA+B/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAY,aAAa,CACxE,QAAQ,CAAC,4xBAA4xB,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AA6Gv0B;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA+BX;AA/BD,WAAY,oBAAoB;IAC9B;;;;;;OAMG;IACH,6EAAe,CAAA;IAEf;;;;;OAKG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,uEAAY,CAAA;IAEZ;;;;OAIG;IACH,uEAAY,CAAA;AACd,CAAC,EA/BW,oBAAoB,KAApB,oBAAoB,QA+B/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/command_connect.d.ts

@@ -6,11 +6,6 @@
  * is generated server-side and returned only once in the create and
  * rotateSecret responses.
  *
- * @internal
- * PlatformClients hold credential material (client_secret_hash) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientCommandController
  */
 export declare const PlatformClientCommandController: {
@@ -30,9 +25,6 @@ export declare const PlatformClientCommandController: {
          * system-managed share client) and is rejected with INVALID_ARGUMENT — including
          * when derived from the resource name.
          *
-         * @internal
-         * Authorization: Requires can_create_platform_client permission in the organization.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.create
          */
         readonly create: {
@@ -49,9 +41,6 @@ export declare const PlatformClientCommandController: {
          * client_secret_hash, secret_fingerprint) are immutable after creation.
          * Use rotateSecret to change the client secret.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.update
          */
         readonly update: {
@@ -67,9 +56,6 @@ export declare const PlatformClientCommandController: {
          * previously minted by this platform client remain valid until their
          * own expiration — deletion does not revoke already-issued tokens.
          *
-         * @internal
-         * Authorization: Requires can_delete permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.delete
          */
         readonly delete: {
@@ -86,9 +72,6 @@ export declare const PlatformClientCommandController: {
          * unchanged — platform builders do not need to update their client_id
          * configuration after rotation.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.rotateSecret
          */
         readonly rotateSecret: {

package/ai/stigmer/iam/platformclient/v1/command_connect.js

@@ -14,11 +14,6 @@ import { ApiResourceDeleteInput } from "../../../commons/apiresource/io_pbjs";
  * is generated server-side and returned only once in the create and
  * rotateSecret responses.
  *
- * @internal
- * PlatformClients hold credential material (client_secret_hash) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientCommandController
  */
 export const PlatformClientCommandController = {
@@ -38,9 +33,6 @@ export const PlatformClientCommandController = {
          * system-managed share client) and is rejected with INVALID_ARGUMENT — including
          * when derived from the resource name.
          *
-         * @internal
-         * Authorization: Requires can_create_platform_client permission in the organization.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.create
          */
         create: {
@@ -57,9 +49,6 @@ export const PlatformClientCommandController = {
          * client_secret_hash, secret_fingerprint) are immutable after creation.
          * Use rotateSecret to change the client secret.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.update
          */
         update: {
@@ -75,9 +64,6 @@ export const PlatformClientCommandController = {
          * previously minted by this platform client remain valid until their
          * own expiration — deletion does not revoke already-issued tokens.
          *
-         * @internal
-         * Authorization: Requires can_delete permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.delete
          */
         delete: {
@@ -94,9 +80,6 @@ export const PlatformClientCommandController = {
          * unchanged — platform builders do not need to update their client_id
          * configuration after rotation.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.rotateSecret
          */
         rotateSecret: {

package/ai/stigmer/iam/platformclient/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gIAAgI;AAChI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,kEAAkE;IAC5E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;WAkBG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gIAAgI;AAChI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,kEAAkE;IAC5E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;WAeG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/platformclient/v1/command_pb.d.ts

@@ -14,11 +14,6 @@ export declare const file_ai_stigmer_iam_platformclient_v1_command: GenFile;
  * is generated server-side and returned only once in the create and
  * rotateSecret responses.
  *
- * @internal
- * PlatformClients hold credential material (client_secret_hash) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientCommandController
  */
 export declare const PlatformClientCommandController: GenService<{
@@ -36,9 +31,6 @@ export declare const PlatformClientCommandController: GenService<{
      * system-managed share client) and is rejected with INVALID_ARGUMENT — including
      * when derived from the resource name.
      *
-     * @internal
-     * Authorization: Requires can_create_platform_client permission in the organization.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.create
      */
     create: {
@@ -54,9 +46,6 @@ export declare const PlatformClientCommandController: GenService<{
      * client_secret_hash, secret_fingerprint) are immutable after creation.
      * Use rotateSecret to change the client secret.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the platform client resource.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.update
      */
     update: {
@@ -71,9 +60,6 @@ export declare const PlatformClientCommandController: GenService<{
      * previously minted by this platform client remain valid until their
      * own expiration — deletion does not revoke already-issued tokens.
      *
-     * @internal
-     * Authorization: Requires can_delete permission on the platform client resource.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.delete
      */
     delete: {
@@ -89,9 +75,6 @@ export declare const PlatformClientCommandController: GenService<{
      * unchanged — platform builders do not need to update their client_id
      * configuration after rotation.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the platform client resource.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.rotateSecret
      */
     rotateSecret: {

package/ai/stigmer/iam/platformclient/v1/command_pb.js

@@ -19,11 +19,6 @@ export const file_ai_stigmer_iam_platformclient_v1_command = /*@__PURE__*/ fileD
  * is generated server-side and returned only once in the create and
  * rotateSecret responses.
  *
- * @internal
- * PlatformClients hold credential material (client_secret_hash) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientCommandController
  */
 export const PlatformClientCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_iam_platformclient_v1_command, 0);

package/ai/stigmer/iam/platformclient/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GA8EvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAkEvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/query_connect.d.ts

@@ -9,9 +9,6 @@ export declare const PlatformClientQueryController: {
         /**
          * Get a platform client by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.get
          */
         readonly get: {
@@ -26,10 +23,6 @@ export declare const PlatformClientQueryController: {
          * Resolves a human-readable reference like "acme/acme-dashboard" to the full
          * PlatformClient resource.
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.getByReference
          */
         readonly getByReference: {
@@ -44,9 +37,6 @@ export declare const PlatformClientQueryController: {
          * Returns every PlatformClient whose metadata.org matches the input org.
          * Typically a small set per org, so results are not paginated.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the organization resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.listByOrg
          */
         readonly listByOrg: {

package/ai/stigmer/iam/platformclient/v1/query_connect.js

@@ -17,9 +17,6 @@ export const PlatformClientQueryController = {
         /**
          * Get a platform client by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.get
          */
         get: {
@@ -34,10 +31,6 @@ export const PlatformClientQueryController = {
          * Resolves a human-readable reference like "acme/acme-dashboard" to the full
          * PlatformClient resource.
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.getByReference
          */
         getByReference: {
@@ -52,9 +45,6 @@ export const PlatformClientQueryController = {
          * Returns every PlatformClient whose metadata.org matches the input org.
          * Typically a small set per org, so results are not paginated.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the organization resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.listByOrg
          */
         listByOrg: {

package/ai/stigmer/iam/platformclient/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,6BAA6B;YAChC,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,6BAA6B;YAChC,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/platformclient/v1/query_pb.d.ts

@@ -15,9 +15,6 @@ export declare const PlatformClientQueryController: GenService<{
     /**
      * Get a platform client by its unique identifier.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the platform client resource.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.get
      */
     get: {
@@ -31,10 +28,6 @@ export declare const PlatformClientQueryController: GenService<{
      * Resolves a human-readable reference like "acme/acme-dashboard" to the full
      * PlatformClient resource.
      *
-     * @internal
-     * Custom authorization in handler — checks both direct resource access
-     * and organization-level visibility permissions.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.getByReference
      */
     getByReference: {
@@ -48,9 +41,6 @@ export declare const PlatformClientQueryController: GenService<{
      * Returns every PlatformClient whose metadata.org matches the input org.
      * Typically a small set per org, so results are not paginated.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the organization resource.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.listByOrg
      */
     listByOrg: {

package/ai/stigmer/iam/platformclient/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,8zBAA8zB,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE/iC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GA+CrC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,8zBAA8zB,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE/iC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAqCrC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_connect.d.ts

@@ -53,11 +53,6 @@ export declare const PlatformClientTokenController: {
          * is not on the list are refused PERMISSION_DENIED (see the
          * allowed_origins field docs in spec.proto for the exact semantics).
          *
-         * @internal
-         * This RPC is public — no Bearer token is required. The caller authenticates
-         * by providing client_id + client_secret in the request body. The handler
-         * validates these credentials as business logic, not via the auth interceptor.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintUserToken
          */
         readonly mintUserToken: {
@@ -73,13 +68,6 @@ export declare const PlatformClientTokenController: {
          * PlatformClient and guest identity account lazily, and returns a short-lived
          * Stigmer-signed JWT scoped to that org.
          *
-         * @internal
-         * Public — no Bearer token. No PlatformClient credentials. The handler gates
-         * on an enabled public-audience share (NOT_FOUND when disabled or missing)
-         * and stamps the resolved share's id into the guest JWT as the share_id
-         * claim — the create-time gate re-reads the live share by that id on every
-         * session/execution create (decision 011 D6).
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintGuestToken
          */
         readonly mintGuestToken: {

package/ai/stigmer/iam/platformclient/v1/token_connect.js

@@ -59,11 +59,6 @@ export const PlatformClientTokenController = {
          * is not on the list are refused PERMISSION_DENIED (see the
          * allowed_origins field docs in spec.proto for the exact semantics).
          *
-         * @internal
-         * This RPC is public — no Bearer token is required. The caller authenticates
-         * by providing client_id + client_secret in the request body. The handler
-         * validates these credentials as business logic, not via the auth interceptor.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintUserToken
          */
         mintUserToken: {
@@ -79,13 +74,6 @@ export const PlatformClientTokenController = {
          * PlatformClient and guest identity account lazily, and returns a short-lived
          * Stigmer-signed JWT scoped to that org.
          *
-         * @internal
-         * Public — no Bearer token. No PlatformClient credentials. The handler gates
-         * on an enabled public-audience share (NOT_FOUND when disabled or missing)
-         * and stamps the resolved share's id into the guest JWT as the share_id
-         * claim — the create-time gate re-reads the live share by that id on every
-         * session/execution create (decision 011 D6).
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintGuestToken
          */
         mintGuestToken: {

package/ai/stigmer/iam/platformclient/v1/token_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsCG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}