@stigmer/protos 3.12.3 → 3.12.4

package/ai/stigmer/iam/identityaccount/v1/spec_pb.d.ts

@@ -15,20 +15,6 @@ export declare const file_ai_stigmer_iam_identityaccount_v1_spec: GenFile;
  * credentials), or platform_client (provisioned via a PlatformClient's
  * mintUserToken endpoint).
  *
- * @internal
- * All FGA tuples use identity_account as the principal type.
- * Provisioning details:
- * - direct: Auth0 subject ID (e.g., "auth0|abc123")
- * - federated: raw OIDC sub claim (e.g., "google-oauth2|109876543210"),
- *   scoped by identity_provider_ref
- * - machine: Auth0 client ID with "@clients" suffix
- * - platform_client: composite "stgm_pc|{org}|{external_user_id}" where org
- *   is the Stigmer org that owns the PlatformClient(s) and external_user_id
- *   is the platform builder's stable identifier for the user. Scoping by org
- *   (not by PlatformClient) means a customer's end user resolves to a single
- *   IdentityAccount across all of that customer's PlatformClients. Globally
- *   unique by construction.
- *
  * @generated from message ai.stigmer.iam.identityaccount.v1.IdentityAccountSpec
  */
 export type IdentityAccountSpec = Message<"ai.stigmer.iam.identityaccount.v1.IdentityAccountSpec"> & {

package/ai/stigmer/iam/identityaccount/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAE/F,OAAO,EAAE,2CAA2C,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,kjBAAkjB,EAAE,CAAC,sCAAsC,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA8GlrB;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAE/F,OAAO,EAAE,2CAA2C,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,kjBAAkjB,EAAE,CAAC,sCAAsC,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAgGlrB;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityaccount/v1/webhook_pb.d.ts

@@ -7,11 +7,6 @@ export declare const file_ai_stigmer_iam_identityaccount_v1_webhook: GenFile;
 /**
  * Auth0Webhook represents a log-stream event payload from Auth0.
  *
- * @internal
- * Stigmer receives these events via a custom Auth0 log stream to trigger
- * identity account provisioning on signup.
- * See: https://auth0.com/docs/customize/log-streams/custom-log-streams
- *
  * @generated from message ai.stigmer.iam.identityaccount.v1.Auth0Webhook
  */
 export type Auth0Webhook = Message<"ai.stigmer.iam.identityaccount.v1.Auth0Webhook"> & {

package/ai/stigmer/iam/identityaccount/v1/webhook_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/webhook_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAY,aAAa,CAClF,QAAQ,CAAC,4UAA4U,CAAC,CAAC;AAsEzV;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"webhook_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/webhook_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAY,aAAa,CAClF,QAAQ,CAAC,4UAA4U,CAAC,CAAC;AAiEzV;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/command_connect.d.ts

@@ -12,11 +12,6 @@ export declare const IdentityProviderCommandController: {
          * If the resource does not exist, creates a new identity provider.
          * If the resource exists, updates the existing identity provider.
          *
-         * @internal
-         * The authorization and state-operation are determined depending on whether the
-         * identity provider is going to be created or updated, which is determined as
-         * part of the request execution.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.apply
          */
         readonly apply: {
@@ -30,9 +25,6 @@ export declare const IdentityProviderCommandController: {
          *
          * The creator's organization owns the identity provider.
          *
-         * @internal
-         * Authorization: Requires can_create_idp permission in the organization.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.create
          */
         readonly create: {
@@ -44,9 +36,6 @@ export declare const IdentityProviderCommandController: {
         /**
          * Update an existing identity provider.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the identity provider resource.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.update
          */
         readonly update: {
@@ -61,9 +50,6 @@ export declare const IdentityProviderCommandController: {
          * Deletion is blocked if any platform-managed organizations reference this
          * identity provider.
          *
-         * @internal
-         * Authorization: Requires can_delete permission on the identity provider resource.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.delete
          */
         readonly delete: {

package/ai/stigmer/iam/identityprovider/v1/command_connect.js

@@ -19,11 +19,6 @@ export const IdentityProviderCommandController = {
          * If the resource does not exist, creates a new identity provider.
          * If the resource exists, updates the existing identity provider.
          *
-         * @internal
-         * The authorization and state-operation are determined depending on whether the
-         * identity provider is going to be created or updated, which is determined as
-         * part of the request execution.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.apply
          */
         apply: {
@@ -37,9 +32,6 @@ export const IdentityProviderCommandController = {
          *
          * The creator's organization owns the identity provider.
          *
-         * @internal
-         * Authorization: Requires can_create_idp permission in the organization.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.create
          */
         create: {
@@ -51,9 +43,6 @@ export const IdentityProviderCommandController = {
         /**
          * Update an existing identity provider.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the identity provider resource.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.update
          */
         update: {
@@ -68,9 +57,6 @@ export const IdentityProviderCommandController = {
          * Deletion is blocked if any platform-managed organizations reference this
          * identity provider.
          *
-         * @internal
-         * Authorization: Requires can_delete permission on the identity provider resource.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.delete
          */
         delete: {

package/ai/stigmer/iam/identityprovider/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oIAAoI;AACpI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,sEAAsE;IAChF,OAAO,EAAE;QACP;;;;;;;;;;;;WAYG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oIAAoI;AACpI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,sEAAsE;IAChF,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/command_pb.d.ts

@@ -17,11 +17,6 @@ export declare const IdentityProviderCommandController: GenService<{
      * If the resource does not exist, creates a new identity provider.
      * If the resource exists, updates the existing identity provider.
      *
-     * @internal
-     * The authorization and state-operation are determined depending on whether the
-     * identity provider is going to be created or updated, which is determined as
-     * part of the request execution.
-     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.apply
      */
     apply: {
@@ -34,9 +29,6 @@ export declare const IdentityProviderCommandController: GenService<{
      *
      * The creator's organization owns the identity provider.
      *
-     * @internal
-     * Authorization: Requires can_create_idp permission in the organization.
-     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.create
      */
     create: {
@@ -47,9 +39,6 @@ export declare const IdentityProviderCommandController: GenService<{
     /**
      * Update an existing identity provider.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the identity provider resource.
-     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.update
      */
     update: {
@@ -63,9 +52,6 @@ export declare const IdentityProviderCommandController: GenService<{
      * Deletion is blocked if any platform-managed organizations reference this
      * identity provider.
      *
-     * @internal
-     * Authorization: Requires can_delete permission on the identity provider resource.
-     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderCommandController.delete
      */
     delete: {

package/ai/stigmer/iam/identityprovider/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oIAAoI;AACpI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,2CAA2C,EAAE,MAAM,aAAa,CAAC;AAE1E;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,slCAAslC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAE/xC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GA+DzC,aAAa,CAChB,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oIAAoI;AACpI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,2CAA2C,EAAE,MAAM,aAAa,CAAC;AAE1E;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,slCAAslC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAE/xC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAiDzC,aAAa,CAChB,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/query_connect.d.ts

@@ -9,9 +9,6 @@ export declare const IdentityProviderQueryController: {
         /**
          * Get an identity provider by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the identity provider resource.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.get
          */
         readonly get: {
@@ -26,10 +23,6 @@ export declare const IdentityProviderQueryController: {
          * Resolves a human-readable reference like "acme/planton" to the full
          * IdentityProvider resource.
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getByReference
          */
         readonly getByReference: {
@@ -44,9 +37,6 @@ export declare const IdentityProviderQueryController: {
          * Returns every IdentityProvider whose metadata.org matches the input org.
          * Typically a small set (1-3 per org), so results are not paginated.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the organization resource.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.listByOrg
          */
         readonly listByOrg: {
@@ -66,9 +56,6 @@ export declare const IdentityProviderQueryController: {
          * authenticated, so it requires no authorization. The response intentionally
          * omits internal IdP configuration (JWKS URI, rate limits, userinfo endpoint).
          *
-         * @internal
-         * Authorization: none — unauthenticated, public endpoint for login page rendering.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getSsoProvider
          */
         readonly getSsoProvider: {

package/ai/stigmer/iam/identityprovider/v1/query_connect.js

@@ -17,9 +17,6 @@ export const IdentityProviderQueryController = {
         /**
          * Get an identity provider by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the identity provider resource.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.get
          */
         get: {
@@ -34,10 +31,6 @@ export const IdentityProviderQueryController = {
          * Resolves a human-readable reference like "acme/planton" to the full
          * IdentityProvider resource.
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getByReference
          */
         getByReference: {
@@ -52,9 +45,6 @@ export const IdentityProviderQueryController = {
          * Returns every IdentityProvider whose metadata.org matches the input org.
          * Typically a small set (1-3 per org), so results are not paginated.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the organization resource.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.listByOrg
          */
         listByOrg: {
@@ -74,9 +64,6 @@ export const IdentityProviderQueryController = {
          * authenticated, so it requires no authorization. The response intentionally
          * omits internal IdP configuration (JWKS URI, rate limits, userinfo endpoint).
          *
-         * @internal
-         * Authorization: none — unauthenticated, public endpoint for login page rendering.
-         *
          * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getSsoProvider
          */
         getSsoProvider: {

package/ai/stigmer/iam/identityprovider/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,kIAAkI;AAClI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEvH;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,iBAAiB;YACpB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,kIAAkI;AAClI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEvH;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,iBAAiB;YACpB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/identityprovider/v1/query_pb.d.ts

@@ -15,9 +15,6 @@ export declare const IdentityProviderQueryController: GenService<{
     /**
      * Get an identity provider by its unique identifier.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the identity provider resource.
-     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.get
      */
     get: {
@@ -31,10 +28,6 @@ export declare const IdentityProviderQueryController: GenService<{
      * Resolves a human-readable reference like "acme/planton" to the full
      * IdentityProvider resource.
      *
-     * @internal
-     * Custom authorization in handler — checks both direct resource access
-     * and organization-level visibility permissions.
-     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getByReference
      */
     getByReference: {
@@ -48,9 +41,6 @@ export declare const IdentityProviderQueryController: GenService<{
      * Returns every IdentityProvider whose metadata.org matches the input org.
      * Typically a small set (1-3 per org), so results are not paginated.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the organization resource.
-     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.listByOrg
      */
     listByOrg: {
@@ -69,9 +59,6 @@ export declare const IdentityProviderQueryController: GenService<{
      * authenticated, so it requires no authorization. The response intentionally
      * omits internal IdP configuration (JWKS URI, rate limits, userinfo endpoint).
      *
-     * @internal
-     * Authorization: none — unauthenticated, public endpoint for login page rendering.
-     *
      * @generated from rpc ai.stigmer.iam.identityprovider.v1.IdentityProviderQueryController.getSsoProvider
      */
     getSsoProvider: {

package/ai/stigmer/iam/identityprovider/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,2CAA2C,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,0CAA0C,EAAE,MAAM,YAAY,CAAC;AAExE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yhCAAyhC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,2CAA2C,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE9wC;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAoEvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityprovider/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kIAAkI;AAClI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,2CAA2C,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,0CAA0C,EAAE,MAAM,YAAY,CAAC;AAExE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yhCAAyhC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,2CAA2C,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE9wC;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAuDvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/invitation/v1/command_connect.d.ts

@@ -16,9 +16,6 @@ export declare const InvitationCommandController: {
          * The specified role must be in the organization's grantable_roles.
          * Platform-managed organizations cannot create invitations.
          *
-         * @internal
-         * Authorization: Requires can_grant_access permission on the organization.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationCommandController.create
          */
         readonly create: {
@@ -33,12 +30,6 @@ export declare const InvitationCommandController: {
          * Sets the invitation state to revoked. Idempotent — revoking an
          * already-revoked invitation is a no-op.
          *
-         * @internal
-         * Authorization is handled in the handler: loads the invitation,
-         * resolves its organization, and checks can_grant_access on the org.
-         * Proto-level auth is skipped because the input (InvitationId) does
-         * not directly identify the org.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationCommandController.revoke
          */
         readonly revoke: {
@@ -61,12 +52,6 @@ export declare const InvitationCommandController: {
          * - Invitation must not have reached max_redemptions (if > 0)
          * - Redeemer must not already be a member of the organization
          *
-         * @internal
-         * Authorization: The token itself is the authorization mechanism.
-         * The redeemer's identity is resolved from the authentication header.
-         * FGA authorization is skipped — any authenticated user with a valid
-         * token can redeem.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationCommandController.redeem
          */
         readonly redeem: {

package/ai/stigmer/iam/invitation/v1/command_connect.js

@@ -23,9 +23,6 @@ export const InvitationCommandController = {
          * The specified role must be in the organization's grantable_roles.
          * Platform-managed organizations cannot create invitations.
          *
-         * @internal
-         * Authorization: Requires can_grant_access permission on the organization.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationCommandController.create
          */
         create: {
@@ -40,12 +37,6 @@ export const InvitationCommandController = {
          * Sets the invitation state to revoked. Idempotent — revoking an
          * already-revoked invitation is a no-op.
          *
-         * @internal
-         * Authorization is handled in the handler: loads the invitation,
-         * resolves its organization, and checks can_grant_access on the org.
-         * Proto-level auth is skipped because the input (InvitationId) does
-         * not directly identify the org.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationCommandController.revoke
          */
         revoke: {
@@ -68,12 +59,6 @@ export const InvitationCommandController = {
          * - Invitation must not have reached max_redemptions (if > 0)
          * - Redeemer must not already be a member of the organization
          *
-         * @internal
-         * Authorization: The token itself is the authorization mechanism.
-         * The redeemer's identity is resolved from the authentication header.
-         * FGA authorization is skipped — any authenticated user with a valid
-         * token can redeem.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationCommandController.redeem
          */
         redeem: {

package/ai/stigmer/iam/invitation/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/invitation/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,wHAAwH;AACxH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,QAAQ,EAAE,0DAA0D;IACpE,OAAO,EAAE;QACP;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,UAAU;YACb,CAAC,EAAE,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/invitation/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,wHAAwH;AACxH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,QAAQ,EAAE,0DAA0D;IACpE,OAAO,EAAE;QACP;;;;;;;;;;;WAWG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,UAAU;YACb,CAAC,EAAE,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/invitation/v1/command_pb.d.ts

@@ -21,9 +21,6 @@ export declare const InvitationCommandController: GenService<{
      * The specified role must be in the organization's grantable_roles.
      * Platform-managed organizations cannot create invitations.
      *
-     * @internal
-     * Authorization: Requires can_grant_access permission on the organization.
-     *
      * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationCommandController.create
      */
     create: {
@@ -37,12 +34,6 @@ export declare const InvitationCommandController: GenService<{
      * Sets the invitation state to revoked. Idempotent — revoking an
      * already-revoked invitation is a no-op.
      *
-     * @internal
-     * Authorization is handled in the handler: loads the invitation,
-     * resolves its organization, and checks can_grant_access on the org.
-     * Proto-level auth is skipped because the input (InvitationId) does
-     * not directly identify the org.
-     *
      * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationCommandController.revoke
      */
     revoke: {
@@ -64,12 +55,6 @@ export declare const InvitationCommandController: GenService<{
      * - Invitation must not have reached max_redemptions (if > 0)
      * - Redeemer must not already be a member of the organization
      *
-     * @internal
-     * Authorization: The token itself is the authorization mechanism.
-     * The redeemer's identity is resolved from the authentication header.
-     * FGA authorization is skipped — any authenticated user with a valid
-     * token can redeem.
-     *
      * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationCommandController.redeem
      */
     redeem: {

package/ai/stigmer/iam/invitation/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/invitation/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wHAAwH;AACxH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,wqBAAwqB,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,qCAAqC,EAAE,oCAAoC,CAAC,CAAC,CAAC;AAEz2B;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAmEnC,aAAa,CAChB,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/invitation/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wHAAwH;AACxH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,wqBAAwqB,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,qCAAqC,EAAE,oCAAoC,CAAC,CAAC,CAAC;AAEz2B;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAoDnC,aAAa,CAChB,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/invitation/v1/query_connect.d.ts

@@ -9,9 +9,6 @@ export declare const InvitationQueryController: {
         /**
          * Get an invitation by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the invitation resource.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationQueryController.get
          */
         readonly get: {
@@ -25,11 +22,6 @@ export declare const InvitationQueryController: {
          *
          * Returns invitations ordered by creation time (newest first).
          *
-         * @internal
-         * Authorization: Requires can_view_access permission on the organization.
-         * This is intentionally stricter than can_view — only users who can
-         * manage org access (admins and owners) should see invitation links.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationQueryController.listByOrg
          */
         readonly listByOrg: {
@@ -51,11 +43,6 @@ export declare const InvitationQueryController: {
          * intentionally omits the token value, redemption history, and internal
          * invitation metadata.
          *
-         * @internal
-         * Authorization: none — unauthenticated, public endpoint for rendering
-         * the invite acceptance page. Marked is_public so the authentication
-         * interceptor skips token validation entirely.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationQueryController.getByToken
          */
         readonly getByToken: {

package/ai/stigmer/iam/invitation/v1/query_connect.js

@@ -16,9 +16,6 @@ export const InvitationQueryController = {
         /**
          * Get an invitation by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the invitation resource.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationQueryController.get
          */
         get: {
@@ -32,11 +29,6 @@ export const InvitationQueryController = {
          *
          * Returns invitations ordered by creation time (newest first).
          *
-         * @internal
-         * Authorization: Requires can_view_access permission on the organization.
-         * This is intentionally stricter than can_view — only users who can
-         * manage org access (admins and owners) should see invitation links.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationQueryController.listByOrg
          */
         listByOrg: {
@@ -58,11 +50,6 @@ export const InvitationQueryController = {
          * intentionally omits the token value, redemption history, and internal
          * invitation metadata.
          *
-         * @internal
-         * Authorization: none — unauthenticated, public endpoint for rendering
-         * the invite acceptance page. Marked is_public so the authentication
-         * interceptor skips token validation entirely.
-         *
          * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationQueryController.getByToken
          */
         getByToken: {

package/ai/stigmer/iam/invitation/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/invitation/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,WAAW;YACd,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,YAAY;YAClB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,iBAAiB;YACpB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/invitation/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,WAAW;YACd,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,YAAY;YAClB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,iBAAiB;YACpB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/invitation/v1/query_pb.d.ts

@@ -14,9 +14,6 @@ export declare const InvitationQueryController: GenService<{
     /**
      * Get an invitation by its unique identifier.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the invitation resource.
-     *
      * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationQueryController.get
      */
     get: {
@@ -29,11 +26,6 @@ export declare const InvitationQueryController: GenService<{
      *
      * Returns invitations ordered by creation time (newest first).
      *
-     * @internal
-     * Authorization: Requires can_view_access permission on the organization.
-     * This is intentionally stricter than can_view — only users who can
-     * manage org access (admins and owners) should see invitation links.
-     *
      * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationQueryController.listByOrg
      */
     listByOrg: {
@@ -54,11 +46,6 @@ export declare const InvitationQueryController: GenService<{
      * intentionally omits the token value, redemption history, and internal
      * invitation metadata.
      *
-     * @internal
-     * Authorization: none — unauthenticated, public endpoint for rendering
-     * the invite acceptance page. Marked is_public so the authentication
-     * interceptor skips token validation entirely.
-     *
      * @generated from rpc ai.stigmer.iam.invitation.v1.InvitationQueryController.getByToken
      */
     getByToken: {

package/ai/stigmer/iam/invitation/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/invitation/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,ovBAAovB,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,qCAAqC,EAAE,oCAAoC,CAAC,CAAC,CAAC;AAEr7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAwDjC,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/invitation/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,ovBAAovB,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,qCAAqC,EAAE,oCAAoC,CAAC,CAAC,CAAC;AAEr7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GA2CjC,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/oauthapp/v1/command_connect.d.ts

@@ -1,11 +1,6 @@
 /**
  * OAuthAppCommandController provides write operations for OAuth app resources.
  *
- * @internal
- * OAuthApps hold vendor client credentials (client_secret) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController
  */
 export declare const OAuthAppCommandController: {
@@ -17,11 +12,6 @@ export declare const OAuthAppCommandController: {
          * If the resource does not exist, creates a new OAuth app.
          * If the resource exists, updates the existing OAuth app.
          *
-         * @internal
-         * The authorization and state-operation are determined depending on whether the
-         * OAuth app is going to be created or updated, which is determined as
-         * part of the request execution.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.apply
          */
         readonly apply: {
@@ -36,9 +26,6 @@ export declare const OAuthAppCommandController: {
          * The creator's organization owns the OAuth app. The creator is granted
          * the owner role automatically.
          *
-         * @internal
-         * Authorization: Requires can_create_oauth_app permission in the organization.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.create
          */
         readonly create: {
@@ -50,9 +37,6 @@ export declare const OAuthAppCommandController: {
         /**
          * Update an existing OAuth app.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the oauth_app resource.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.update
          */
         readonly update: {
@@ -67,9 +51,6 @@ export declare const OAuthAppCommandController: {
          * Deletion should be blocked if any McpServer resources reference this
          * OAuth app via McpServerVendorOAuth.oauth_app_ref.
          *
-         * @internal
-         * Authorization: Requires can_delete permission on the oauth_app resource.
-         *
          * @generated from rpc ai.stigmer.iam.oauthapp.v1.OAuthAppCommandController.delete
          */
         readonly delete: {