@stigmer/protos 3.12.3 → 3.12.5

package/ai/stigmer/agentic/mcpserver/v1/command_connect.js

@@ -9,15 +9,6 @@ import { CompleteOAuthConnectInput, CompleteOAuthConnectOutput, ConnectInput, De
 /**
  * McpServerCommandController provides write operations for MCP server resources.
  *
- * @internal
- * Authorization model for writes:
- * - Platform-scoped: Only platform operators can create/modify
- * - Organization-scoped: Org admins can create/modify
- * - Identity-account-scoped: Only the owner can create/modify
- *
- * Primary interface: The `apply` method provides Kubernetes-style idempotent
- * create-or-update semantics, which is the recommended approach for CLI usage.
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerCommandController
  */
 export const McpServerCommandController = {
@@ -29,12 +20,6 @@ export const McpServerCommandController = {
          * If the resource doesn't exist, creates it. If it exists, updates it.
          * The resource is identified by its (scope, org, slug) combination.
          *
-         * @internal
-         * The handler determines whether this is a create or update operation
-         * and performs appropriate scope-aware authorization:
-         * - Create: Requires permission to create in the target scope
-         * - Update: Requires can_edit on the existing resource
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.apply
          */
         apply: {
@@ -49,13 +34,6 @@ export const McpServerCommandController = {
          * Returns an error if a resource with the same (scope, org, slug) already exists.
          * Use `apply` for idempotent create-or-update semantics.
          *
-         * @internal
-         * Authorization: Custom authorization in handler.
-         * Requires permission to create MCP servers in the specified scope:
-         * - Platform: Requires platform operator role
-         * - Organization: Requires org admin role or can_create_mcp_server permission
-         * - Identity Account: Automatically allowed for the authenticated user
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.create
          */
         create: {
@@ -67,13 +45,6 @@ export const McpServerCommandController = {
         /**
          * Update an existing MCP server resource.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the mcp_server resource.
-         * Only the owner (based on scope) can update:
-         * - Platform: Platform operators
-         * - Organization: Org admins or resource owner
-         * - Identity Account: The owner
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.update
          */
         update: {
@@ -88,13 +59,6 @@ export const McpServerCommandController = {
          * Permanently removes the MCP server definition.
          * Agents referencing this server will need to be updated.
          *
-         * @internal
-         * Authorization: Requires can_delete permission on the mcp_server resource.
-         * Only the owner can delete:
-         * - Platform: Platform operators
-         * - Organization: Org admins or resource owner
-         * - Identity Account: The owner
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.delete
          */
         delete: {
@@ -109,8 +73,9 @@ export const McpServerCommandController = {
          * Only modifies metadata.visibility, leaving spec, status, and other
          * metadata fields untouched.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the mcp_server resource.
+         * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+         * every org boundary, so it is granted by the platform team on request.
+         * Un-publishing and all other levels stay self-service.
          *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateVisibility
          */
@@ -126,25 +91,15 @@ export const McpServerCommandController = {
          * Connects to the MCP server, enumerates tools and resource templates,
          * classifies tool approval policies via a lightweight LLM, and stores the
          * results in status.discovered_capabilities and status.tool_approvals.
-         * Blocks until completion (up to ~30 seconds) and returns the updated McpServer.
-         *
-         * @internal
-         * Typical flows:
-         * - Web console: user clicks Connect, backend resolves env vars from the
-         *   user's personal environment, starts a Temporal workflow on the runner
-         *   (stigmer-runner).
-         * - CLI: `stigmer discover mcp-server <name>` calls connect with runtime_env
-         *   populated from local env vars, delegating discovery to the backend.
-         * - Runner backfill: the runner calls connect on first use when
-         *   status.discovered_capabilities is empty, passing runtime_env from the
-         *   execution context (shared/connect-backfill.ts).
-         *
-         * Errors:
-         * - FAILED_PRECONDITION: Required credentials missing from personal environment
-         * - DEADLINE_EXCEEDED: Discovery did not complete within the timeout
-         * - NOT_FOUND: MCP server does not exist
-         *
-         * Authorization: Requires can_connect permission on the mcp_server resource.
+         * Blocks until the operation settles — legitimately minutes for heavy
+         * stdio servers (the server-side workflow ceiling is the bound) — and
+         * returns the updated McpServer.
+         *
+         * Prefer startConnect for interactive clients: browsers can drop a
+         * no-bytes-yet unary response around ~300s, below the workflow ceiling,
+         * so a blocking connect can appear to fail while succeeding server-side.
+         * This RPC remains for callers that want synchronous semantics (and for
+         * backends that do not yet serve startConnect).
          *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.connect
          */
@@ -154,6 +109,32 @@ export const McpServerCommandController = {
             O: McpServer,
             kind: MethodKind.Unary,
         },
+        /**
+         * Start a connect operation without waiting for it: discovery and
+         * classification run server-side, and the caller observes progress by
+         * polling the resource.
+         *
+         * Returns the McpServer immediately with status.connect_status describing
+         * the accepted operation (phase CONNECTING, plus a warning when no runner
+         * appears to be polling the task queue). Poll get/getByReference until
+         * status.connect_status reaches a terminal phase; results land in
+         * status.discovered_capabilities and status.tool_approvals exactly as with
+         * the blocking connect.
+         *
+         * Idempotent while an operation is in flight: a startConnect that finds a
+         * live CONNECTING operation attaches to it (the in-flight operation's
+         * runtime_env wins) instead of starting a second workflow. A CONNECTING
+         * entry orphaned by a backend restart is reconciled against Temporal
+         * before a new operation starts.
+         *
+         * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.startConnect
+         */
+        startConnect: {
+            name: "startConnect",
+            I: ConnectInput,
+            O: McpServer,
+            kind: MethodKind.Unary,
+        },
         /**
          * Start the OAuth authorization flow for an MCP server.
          *
@@ -162,21 +143,6 @@ export const McpServerCommandController = {
          * redirect the user to. The frontend calls completeOAuthConnect after
          * the user authorizes.
          *
-         * @internal
-         * Two auth modes determined by the MCP server's spec.auth block:
-         * - No oauth_app_ref: MCP Authorization spec (DCR + PKCE). Backend
-         *   discovers the authorization server, registers a client via DCR,
-         *   and builds the auth URL automatically.
-         * - oauth_app_ref set: Vendor OAuth. Backend loads the referenced
-         *   OAuthApp for client credentials and endpoint URLs.
-         *
-         * Errors:
-         * - FAILED_PRECONDITION: MCP server has no auth block, or is stdio
-         *   without oauth_app_ref (DCR requires HTTP transport)
-         * - NOT_FOUND: MCP server or referenced OAuthApp does not exist
-         *
-         * Authorization: Requires can_connect permission on the mcp_server resource.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.initiateOAuthConnect
          */
         initiateOAuthConnect: {
@@ -197,15 +163,6 @@ export const McpServerCommandController = {
          * After success, the frontend should call connect() to trigger tool
          * discovery using the freshly acquired token.
          *
-         * @internal
-         * Errors:
-         * - FAILED_PRECONDITION: State parameter is invalid, expired, or does
-         *   not match the mcp_server_id
-         * - UNAVAILABLE: Token exchange with the authorization server failed
-         * - NOT_FOUND: No pending OAuth state found for the given state param
-         *
-         * Authorization: Requires can_connect permission on the mcp_server resource.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.completeOAuthConnect
          */
         completeOAuthConnect: {
@@ -228,11 +185,6 @@ export const McpServerCommandController = {
          * disconnected=false when no grant existed. Never returns an error
          * for a missing grant.
          *
-         * @internal
-         * Authorization: Requires can_connect permission on the mcp_server resource.
-         * Uses the same permission as connect/initiateOAuthConnect — if you can
-         * establish a connection, you can tear it down.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.disconnectOAuth
          */
         disconnectOAuth: {
@@ -256,16 +208,6 @@ export const McpServerCommandController = {
          * see the full scoping note on McpServerQueryController.getOrgOAuthApp,
          * the RPC clients probe.
          *
-         * @internal
-         * Authorization: Requires can_create_oauth_app permission on the organization.
-         * This is an org-admin operation — setting credentials that affect all users
-         * in the org who connect to this resource.
-         *
-         * Errors:
-         * - FAILED_PRECONDITION: Resource has no auth block or no oauth_app_ref
-         *   (BYOA requires a platform template to clone from)
-         * - NOT_FOUND: Resource does not exist
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.setOrgOAuthApp
          */
         setOrgOAuthApp: {
@@ -290,13 +232,6 @@ export const McpServerCommandController = {
          * will fail on next token refresh — those users will need to
          * re-authenticate using the platform default or a new org override.
          *
-         * @internal
-         * Authorization: Requires can_create_oauth_app permission on the organization.
-         * Same gate as setOrgOAuthApp — org-admin authority for credential management.
-         *
-         * Errors:
-         * - NOT_FOUND: No override exists for this resource + org
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.deleteOrgOAuthApp
          */
         deleteOrgOAuthApp: {

package/ai/stigmer/agentic/mcpserver/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEhS;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,4DAA4D;IACtE,OAAO,EAAE;QACP;;;;;;;;;;;;;WAaG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,mBAAmB;YACtB,CAAC,EAAE,oBAAoB;YACvB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,uBAAuB;YAC1B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEhS;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,4DAA4D;IACtE,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,SAAS;YACZ,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,YAAY;YACf,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,mBAAmB;YACtB,CAAC,EAAE,oBAAoB;YACvB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,uBAAuB;YAC1B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/command_pb.d.ts

@@ -9,15 +9,6 @@ export declare const file_ai_stigmer_agentic_mcpserver_v1_command: GenFile;
 /**
  * McpServerCommandController provides write operations for MCP server resources.
  *
- * @internal
- * Authorization model for writes:
- * - Platform-scoped: Only platform operators can create/modify
- * - Organization-scoped: Org admins can create/modify
- * - Identity-account-scoped: Only the owner can create/modify
- *
- * Primary interface: The `apply` method provides Kubernetes-style idempotent
- * create-or-update semantics, which is the recommended approach for CLI usage.
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerCommandController
  */
 export declare const McpServerCommandController: GenService<{
@@ -27,12 +18,6 @@ export declare const McpServerCommandController: GenService<{
      * If the resource doesn't exist, creates it. If it exists, updates it.
      * The resource is identified by its (scope, org, slug) combination.
      *
-     * @internal
-     * The handler determines whether this is a create or update operation
-     * and performs appropriate scope-aware authorization:
-     * - Create: Requires permission to create in the target scope
-     * - Update: Requires can_edit on the existing resource
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.apply
      */
     apply: {
@@ -46,13 +31,6 @@ export declare const McpServerCommandController: GenService<{
      * Returns an error if a resource with the same (scope, org, slug) already exists.
      * Use `apply` for idempotent create-or-update semantics.
      *
-     * @internal
-     * Authorization: Custom authorization in handler.
-     * Requires permission to create MCP servers in the specified scope:
-     * - Platform: Requires platform operator role
-     * - Organization: Requires org admin role or can_create_mcp_server permission
-     * - Identity Account: Automatically allowed for the authenticated user
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.create
      */
     create: {
@@ -63,13 +41,6 @@ export declare const McpServerCommandController: GenService<{
     /**
      * Update an existing MCP server resource.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the mcp_server resource.
-     * Only the owner (based on scope) can update:
-     * - Platform: Platform operators
-     * - Organization: Org admins or resource owner
-     * - Identity Account: The owner
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.update
      */
     update: {
@@ -83,13 +54,6 @@ export declare const McpServerCommandController: GenService<{
      * Permanently removes the MCP server definition.
      * Agents referencing this server will need to be updated.
      *
-     * @internal
-     * Authorization: Requires can_delete permission on the mcp_server resource.
-     * Only the owner can delete:
-     * - Platform: Platform operators
-     * - Organization: Org admins or resource owner
-     * - Identity Account: The owner
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.delete
      */
     delete: {
@@ -103,8 +67,9 @@ export declare const McpServerCommandController: GenService<{
      * Only modifies metadata.visibility, leaving spec, status, and other
      * metadata fields untouched.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the mcp_server resource.
+     * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+     * every org boundary, so it is granted by the platform team on request.
+     * Un-publishing and all other levels stay self-service.
      *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.updateVisibility
      */
@@ -119,25 +84,15 @@ export declare const McpServerCommandController: GenService<{
      * Connects to the MCP server, enumerates tools and resource templates,
      * classifies tool approval policies via a lightweight LLM, and stores the
      * results in status.discovered_capabilities and status.tool_approvals.
-     * Blocks until completion (up to ~30 seconds) and returns the updated McpServer.
-     *
-     * @internal
-     * Typical flows:
-     * - Web console: user clicks Connect, backend resolves env vars from the
-     *   user's personal environment, starts a Temporal workflow on the runner
-     *   (stigmer-runner).
-     * - CLI: `stigmer discover mcp-server <name>` calls connect with runtime_env
-     *   populated from local env vars, delegating discovery to the backend.
-     * - Runner backfill: the runner calls connect on first use when
-     *   status.discovered_capabilities is empty, passing runtime_env from the
-     *   execution context (shared/connect-backfill.ts).
-     *
-     * Errors:
-     * - FAILED_PRECONDITION: Required credentials missing from personal environment
-     * - DEADLINE_EXCEEDED: Discovery did not complete within the timeout
-     * - NOT_FOUND: MCP server does not exist
-     *
-     * Authorization: Requires can_connect permission on the mcp_server resource.
+     * Blocks until the operation settles — legitimately minutes for heavy
+     * stdio servers (the server-side workflow ceiling is the bound) — and
+     * returns the updated McpServer.
+     *
+     * Prefer startConnect for interactive clients: browsers can drop a
+     * no-bytes-yet unary response around ~300s, below the workflow ceiling,
+     * so a blocking connect can appear to fail while succeeding server-side.
+     * This RPC remains for callers that want synchronous semantics (and for
+     * backends that do not yet serve startConnect).
      *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.connect
      */
@@ -146,6 +101,31 @@ export declare const McpServerCommandController: GenService<{
         input: typeof ConnectInputSchema;
         output: typeof McpServerSchema;
     };
+    /**
+     * Start a connect operation without waiting for it: discovery and
+     * classification run server-side, and the caller observes progress by
+     * polling the resource.
+     *
+     * Returns the McpServer immediately with status.connect_status describing
+     * the accepted operation (phase CONNECTING, plus a warning when no runner
+     * appears to be polling the task queue). Poll get/getByReference until
+     * status.connect_status reaches a terminal phase; results land in
+     * status.discovered_capabilities and status.tool_approvals exactly as with
+     * the blocking connect.
+     *
+     * Idempotent while an operation is in flight: a startConnect that finds a
+     * live CONNECTING operation attaches to it (the in-flight operation's
+     * runtime_env wins) instead of starting a second workflow. A CONNECTING
+     * entry orphaned by a backend restart is reconciled against Temporal
+     * before a new operation starts.
+     *
+     * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.startConnect
+     */
+    startConnect: {
+        methodKind: "unary";
+        input: typeof ConnectInputSchema;
+        output: typeof McpServerSchema;
+    };
     /**
      * Start the OAuth authorization flow for an MCP server.
      *
@@ -154,21 +134,6 @@ export declare const McpServerCommandController: GenService<{
      * redirect the user to. The frontend calls completeOAuthConnect after
      * the user authorizes.
      *
-     * @internal
-     * Two auth modes determined by the MCP server's spec.auth block:
-     * - No oauth_app_ref: MCP Authorization spec (DCR + PKCE). Backend
-     *   discovers the authorization server, registers a client via DCR,
-     *   and builds the auth URL automatically.
-     * - oauth_app_ref set: Vendor OAuth. Backend loads the referenced
-     *   OAuthApp for client credentials and endpoint URLs.
-     *
-     * Errors:
-     * - FAILED_PRECONDITION: MCP server has no auth block, or is stdio
-     *   without oauth_app_ref (DCR requires HTTP transport)
-     * - NOT_FOUND: MCP server or referenced OAuthApp does not exist
-     *
-     * Authorization: Requires can_connect permission on the mcp_server resource.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.initiateOAuthConnect
      */
     initiateOAuthConnect: {
@@ -188,15 +153,6 @@ export declare const McpServerCommandController: GenService<{
      * After success, the frontend should call connect() to trigger tool
      * discovery using the freshly acquired token.
      *
-     * @internal
-     * Errors:
-     * - FAILED_PRECONDITION: State parameter is invalid, expired, or does
-     *   not match the mcp_server_id
-     * - UNAVAILABLE: Token exchange with the authorization server failed
-     * - NOT_FOUND: No pending OAuth state found for the given state param
-     *
-     * Authorization: Requires can_connect permission on the mcp_server resource.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.completeOAuthConnect
      */
     completeOAuthConnect: {
@@ -218,11 +174,6 @@ export declare const McpServerCommandController: GenService<{
      * disconnected=false when no grant existed. Never returns an error
      * for a missing grant.
      *
-     * @internal
-     * Authorization: Requires can_connect permission on the mcp_server resource.
-     * Uses the same permission as connect/initiateOAuthConnect — if you can
-     * establish a connection, you can tear it down.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.disconnectOAuth
      */
     disconnectOAuth: {
@@ -245,16 +196,6 @@ export declare const McpServerCommandController: GenService<{
      * see the full scoping note on McpServerQueryController.getOrgOAuthApp,
      * the RPC clients probe.
      *
-     * @internal
-     * Authorization: Requires can_create_oauth_app permission on the organization.
-     * This is an org-admin operation — setting credentials that affect all users
-     * in the org who connect to this resource.
-     *
-     * Errors:
-     * - FAILED_PRECONDITION: Resource has no auth block or no oauth_app_ref
-     *   (BYOA requires a platform template to clone from)
-     * - NOT_FOUND: Resource does not exist
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.setOrgOAuthApp
      */
     setOrgOAuthApp: {
@@ -278,13 +219,6 @@ export declare const McpServerCommandController: GenService<{
      * will fail on next token refresh — those users will need to
      * re-authenticate using the platform default or a new org override.
      *
-     * @internal
-     * Authorization: Requires can_create_oauth_app permission on the organization.
-     * Same gate as setOrgOAuthApp — org-admin authority for credential management.
-     *
-     * Errors:
-     * - NOT_FOUND: No override exists for this resource + org
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerCommandController.deleteOrgOAuthApp
      */
     deleteOrgOAuthApp: {

package/ai/stigmer/agentic/mcpserver/v1/command_pb.js

@@ -10,19 +10,10 @@ import { file_ai_stigmer_commons_rpc_method_options } from "../../../commons/rpc
 /**
  * Describes the file ai/stigmer/agentic/mcpserver/v1/command.proto.
  */
-export const file_ai_stigmer_agentic_mcpserver_v1_command = /*@__PURE__*/ fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEypg8KGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchJmCgZjcmVhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAIQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgDECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IAhAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkSpAEKB2Nvbm5lY3QSLS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIj7CuBg6CBYQLCINbWNwX3NlcnZlcl9pZColdW5hdXRob3JpemVkIHRvIGNvbm5lY3QgdG8gbWNwIHNlcnZlchLfAQoUaW5pdGlhdGVPQXV0aENvbm5lY3QSOi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkluaXRpYXRlT0F1dGhDb25uZWN0SW5wdXQaOy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkluaXRpYXRlT0F1dGhDb25uZWN0T3V0cHV0Ik7CuBhKCBYQLCINbWNwX3NlcnZlcl9pZCo1dW5hdXRob3JpemVkIHRvIGluaXRpYXRlIG9hdXRoIGNvbm5lY3QgZm9yIG1jcCBzZXJ2ZXIS3wEKFGNvbXBsZXRlT0F1dGhDb25uZWN0EjouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Db21wbGV0ZU9BdXRoQ29ubmVjdElucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Db21wbGV0ZU9BdXRoQ29ubmVjdE91dHB1dCJOwrgYSggWECwiDW1jcF9zZXJ2ZXJfaWQqNXVuYXV0aG9yaXplZCB0byBjb21wbGV0ZSBvYXV0aCBjb25uZWN0IGZvciBtY3Agc2VydmVyEsgBCg9kaXNjb25uZWN0T0F1dGgSNS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRpc2Nvbm5lY3RPQXV0aElucHV0GjYuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5EaXNjb25uZWN0T0F1dGhPdXRwdXQiRsK4GEIIFhAsIgtyZXNvdXJjZV9pZCovdW5hdXRob3JpemVkIHRvIGRpc2Nvbm5lY3Qgb2F1dGggZm9yIG1jcCBzZXJ2ZXISuAEKDnNldE9yZ09BdXRoQXBwEjQuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5TZXRPcmdPQXV0aEFwcElucHV0GjUuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5TZXRPcmdPQXV0aEFwcE91dHB1dCI5wrgYNQgXEB4iA29yZyoqdW5hdXRob3JpemVkIHRvIHNldCBvcmcgb2F1dGggYXBwIG92ZXJyaWRlEsQBChFkZWxldGVPcmdPQXV0aEFwcBI3LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuRGVsZXRlT3JnT0F1dGhBcHBJbnB1dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuRGVsZXRlT3JnT0F1dGhBcHBPdXRwdXQiPMK4GDgIFxAeIgNvcmcqLXVuYXV0aG9yaXplZCB0byBkZWxldGUgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRoEoP8rLGIGcHJvdG8z", [file_ai_stigmer_agentic_mcpserver_v1_api, file_ai_stigmer_agentic_mcpserver_v1_io, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options]);
+export const file_ai_stigmer_agentic_mcpserver_v1_command = /*@__PURE__*/ fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEy0hAKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchJmCgZjcmVhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAIQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgDECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IAhAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkSpAEKB2Nvbm5lY3QSLS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIj7CuBg6CBYQLCINbWNwX3NlcnZlcl9pZColdW5hdXRob3JpemVkIHRvIGNvbm5lY3QgdG8gbWNwIHNlcnZlchKpAQoMc3RhcnRDb25uZWN0Ei0uYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Db25uZWN0SW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI+wrgYOggWECwiDW1jcF9zZXJ2ZXJfaWQqJXVuYXV0aG9yaXplZCB0byBjb25uZWN0IHRvIG1jcCBzZXJ2ZXIS3wEKFGluaXRpYXRlT0F1dGhDb25uZWN0EjouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdElucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdE91dHB1dCJOwrgYSggWECwiDW1jcF9zZXJ2ZXJfaWQqNXVuYXV0aG9yaXplZCB0byBpbml0aWF0ZSBvYXV0aCBjb25uZWN0IGZvciBtY3Agc2VydmVyEt8BChRjb21wbGV0ZU9BdXRoQ29ubmVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RJbnB1dBo7LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RPdXRwdXQiTsK4GEoIFhAsIg1tY3Bfc2VydmVyX2lkKjV1bmF1dGhvcml6ZWQgdG8gY29tcGxldGUgb2F1dGggY29ubmVjdCBmb3IgbWNwIHNlcnZlchLIAQoPZGlzY29ubmVjdE9BdXRoEjUuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5EaXNjb25uZWN0T0F1dGhJbnB1dBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuRGlzY29ubmVjdE9BdXRoT3V0cHV0IkbCuBhCCBYQLCILcmVzb3VyY2VfaWQqL3VuYXV0aG9yaXplZCB0byBkaXNjb25uZWN0IG9hdXRoIGZvciBtY3Agc2VydmVyErgBCg5zZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBPdXRwdXQiOcK4GDUIFxAeIgNvcmcqKnVuYXV0aG9yaXplZCB0byBzZXQgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRLEAQoRZGVsZXRlT3JnT0F1dGhBcHASNy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0IjzCuBg4CBcQHiIDb3JnKi11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG9yZyBvYXV0aCBhcHAgb3ZlcnJpZGUaBKD/KyxiBnByb3RvMw", [file_ai_stigmer_agentic_mcpserver_v1_api, file_ai_stigmer_agentic_mcpserver_v1_io, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options]);
 /**
  * McpServerCommandController provides write operations for MCP server resources.
  *
- * @internal
- * Authorization model for writes:
- * - Platform-scoped: Only platform operators can create/modify
- * - Organization-scoped: Org admins can create/modify
- * - Identity-account-scoped: Only the owner can create/modify
- *
- * Primary interface: The `apply` method provides Kubernetes-style idempotent
- * create-or-update semantics, which is the recommended approach for CLI usage.
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerCommandController
  */
 export const McpServerCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_command, 0);

package/ai/stigmer/agentic/mcpserver/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,8qFAA8qF,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE75F;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAgRlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAY,aAAa,CAChF,QAAQ,CAAC,o5FAAo5F,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEnoG;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAuNlC,aAAa,CAChB,WAAW,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC"}