@stigmer/protos 3.12.3 → 3.12.5

package/ai/stigmer/agentic/mcpserver/v1/io_pb.d.ts

@@ -30,32 +30,6 @@ export declare const McpServerIdSchema: GenMessage<McpServerId>;
 /**
  * ConnectInput is the request for the connect RPC.
  *
- * @internal
- * Triggers server-side MCP discovery and tool approval classification:
- * the backend creates an ephemeral ExecutionContext with the resolved
- * environment variables, starts a Temporal workflow that connects to the
- * MCP server (via the runner), enumerates tools and resource
- * templates, classifies tool approval policies, and stores the results
- * in status.discovered_capabilities and status.tool_approvals.
- *
- * Environment variable resolution:
- * - When runtime_env is provided, the backend creates an ExecutionContext directly
- *   from these values (one-time use, values are not persisted to any environment).
- * - When runtime_env is empty, the backend resolves values from the authenticated
- *   user's personal environment.
- *
- * Callers:
- * - Web console: calls connect after saving credentials to personal environment.
- * - CLI: calls connect with runtime_env populated from local env vars.
- * - Runner backfill: calls connect with runtime_env from execution context
- *   when status.discovered_capabilities is empty on first agent execution.
- *
- * Prerequisites:
- * - The MCP server must exist and have a valid server_type (stdio or http)
- * - org must be provided (the caller's active organization)
- * - Either runtime_env must contain all required keys, or the keys must be
- *   present in the user's personal environment / managed OAuth environment
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.ConnectInput
  */
 export type ConnectInput = Message<"ai.stigmer.agentic.mcpserver.v1.ConnectInput"> & {
@@ -97,17 +71,6 @@ export declare const ConnectInputSchema: GenMessage<ConnectInput>;
  * InitiateOAuthConnectInput starts the OAuth authorization flow for an
  * MCP server that has an auth block in its spec.
  *
- * @internal
- * Returns an authorization URL that the frontend redirects the user to.
- * The backend performs all setup (DCR registration for MCP OAuth servers,
- * OAuthApp credential lookup for vendor OAuth servers, PKCE pair generation)
- * and stores the pending state for the subsequent completeOAuthConnect call.
- *
- * Prerequisites:
- * - The MCP server must exist and have spec.auth configured
- * - For DCR: the server must use HTTP transport (discovery requires a URL)
- * - For vendor OAuth: the referenced OAuthApp must exist and be accessible
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.InitiateOAuthConnectInput
  */
 export type InitiateOAuthConnectInput = Message<"ai.stigmer.agentic.mcpserver.v1.InitiateOAuthConnectInput"> & {
@@ -179,22 +142,6 @@ export declare const InitiateOAuthConnectOutputSchema: GenMessage<InitiateOAuthC
  * CompleteOAuthConnectInput finishes the OAuth flow by exchanging the
  * authorization code for tokens.
  *
- * @internal
- * Called by the frontend after the user is redirected back from the
- * OAuth authorization server. The frontend extracts the authorization
- * code and state from the callback URL and passes them here.
- *
- * The backend:
- * 1. Validates the state parameter against the stored PendingOAuthState
- * 2. Exchanges the authorization code for tokens (using PKCE code_verifier)
- * 3. Stores the access token in the user's personal environment
- * 4. Stores the refresh token (if present) in the personal environment
- * 5. Creates an OAuthGrant record for pre-flight expiry checks
- *
- * After this succeeds, the frontend should call the regular connect RPC
- * to trigger tool discovery (which will find the fresh token in the
- * personal environment).
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.CompleteOAuthConnectInput
  */
 export type CompleteOAuthConnectInput = Message<"ai.stigmer.agentic.mcpserver.v1.CompleteOAuthConnectInput"> & {
@@ -260,11 +207,6 @@ export declare const CompleteOAuthConnectOutputSchema: GenMessage<CompleteOAuthC
 /**
  * GetOAuthGrantStatusInput queries the OAuth grant status for a resource.
  *
- * @internal
- * Returns whether the authenticated user has an active OAuth grant for the
- * specified resource in the given org. Used by the frontend to determine
- * whether to show "Connected" vs. "Connect with OAuth" UI states.
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.GetOAuthGrantStatusInput
  */
 export type GetOAuthGrantStatusInput = Message<"ai.stigmer.agentic.mcpserver.v1.GetOAuthGrantStatusInput"> & {
@@ -338,21 +280,6 @@ export declare const GetOAuthGrantStatusOutputSchema: GenMessage<GetOAuthGrantSt
 /**
  * DisconnectOAuthInput tears down a user's OAuth connection for a resource.
  *
- * @internal
- * The handler:
- * 1. Finds the OAuthGrant for (caller, resource_id, org)
- * 2. Deletes the managed Environment that holds the tokens
- * 3. Deletes the OAuthGrant record
- *
- * After this, the user's access token and refresh token are gone. The
- * MCP server remains configured — only the user's personal OAuth connection
- * is removed. Other users' connections to the same resource are unaffected.
- *
- * Idempotent: if no OAuthGrant exists for the (caller, resource_id, org)
- * tuple, the handler returns disconnected=false without error. This
- * supports race conditions (concurrent disconnect calls), retries after
- * partial failures, and desired-state semantics ("ensure no connection").
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.DisconnectOAuthInput
  */
 export type DisconnectOAuthInput = Message<"ai.stigmer.agentic.mcpserver.v1.DisconnectOAuthInput"> & {
@@ -400,30 +327,6 @@ export declare const DisconnectOAuthOutputSchema: GenMessage<DisconnectOAuthOutp
  * SetOrgOAuthAppInput creates or updates an org-level BYOA OAuth app
  * override for a resource.
  *
- * @internal
- * The handler:
- * 1. Looks up the platform-default OAuthApp via the resource's auth block
- *    to use as a template (authorization_url, token_url, scopes, etc.)
- * 2. Creates a new OAuthApp with the org-provided client_id + client_secret
- *    and the template's endpoint URLs and scopes
- * 3. Creates or updates an OAuthAppOverride binding
- *    (resource_id, resource_kind, org_id) → new OAuthApp ID
- *
- * If an override already exists for this resource + org, the handler
- * updates the existing OAuthApp's credentials and returns the same ID.
- *
- * After this, the resolution chain for this resource in this org will
- * return the org's OAuthApp instead of the platform default.
- *
- * Prerequisites:
- * - The resource must exist and have an auth block with oauth_app_ref
- *   (BYOA requires a platform template to clone from)
- * - The caller must have can_create_oauth_app permission in the org
- *
- * Errors:
- * - FAILED_PRECONDITION: Resource has no auth block or no oauth_app_ref
- * - NOT_FOUND: Resource does not exist
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.SetOrgOAuthAppInput
  */
 export type SetOrgOAuthAppInput = Message<"ai.stigmer.agentic.mcpserver.v1.SetOrgOAuthAppInput"> & {
@@ -481,11 +384,6 @@ export declare const SetOrgOAuthAppOutputSchema: GenMessage<SetOrgOAuthAppOutput
 /**
  * GetOrgOAuthAppInput queries whether an org has a BYOA override for a resource.
  *
- * @internal
- * Returns override metadata without exposing secrets. The frontend uses
- * this to show "Using org credentials" vs. "Using platform credentials"
- * and to offer the option to remove the override.
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.GetOrgOAuthAppInput
  */
 export type GetOrgOAuthAppInput = Message<"ai.stigmer.agentic.mcpserver.v1.GetOrgOAuthAppInput"> & {
@@ -543,23 +441,6 @@ export declare const GetOrgOAuthAppOutputSchema: GenMessage<GetOrgOAuthAppOutput
 /**
  * DeleteOrgOAuthAppInput removes an org-level BYOA override for a resource.
  *
- * @internal
- * The handler:
- * 1. Finds the OAuthAppOverride for (resource_id, resource_kind, org)
- * 2. Deletes the OAuthApp resource created for this override
- * 3. Deletes the OAuthAppOverride binding
- *
- * After this, the resolution chain falls back to the platform default.
- * Existing user OAuthGrants that were issued using the org's OAuthApp
- * will fail on next refresh — those users will need to re-authenticate
- * using the platform default (or a new org override).
- *
- * Prerequisites:
- * - An override must exist for this resource + org
- *
- * Errors:
- * - NOT_FOUND: No override exists for this resource + org
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.DeleteOrgOAuthAppInput
  */
 export type DeleteOrgOAuthAppInput = Message<"ai.stigmer.agentic.mcpserver.v1.DeleteOrgOAuthAppInput"> & {

package/ai/stigmer/agentic/mcpserver/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,gDAAgD,EAAE,MAAM,sCAAsC,CAAC;AACxG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,w/EAAw/E,EAAE,CAAC,gDAAgD,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAoBrlF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAgE1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAqC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA6C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAiD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAiC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA6B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAkD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAmB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA+D1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAkB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AA4B3D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAiC3D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAwC3D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAgB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAwCX;AAxCD,WAAY,qBAAqB;IAC/B;;;;OAIG;IACH,+HAAuC,CAAA;IAEvC;;;;OAIG;IACH,uHAAmC,CAAA;IAEnC;;;;;OAKG;IACH,mIAAyC,CAAA;IAEzC;;;;;;;OAOG;IACH,2JAAqD,CAAA;IAErD;;;;;OAKG;IACH,yHAAoC,CAAA;AACtC,CAAC,EAxCW,qBAAqB,KAArB,qBAAqB,QAwChC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,gDAAgD,EAAE,MAAM,sCAAsC,CAAC;AACxG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,w/EAAw/E,EAAE,CAAC,gDAAgD,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAoBrlF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAsC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA0B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA6C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAiC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAiC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyC,aAAa,CAC/F,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAkD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAmB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAkB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAuB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAiC3D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAuB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAgB3D;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,qBAwCX;AAxCD,WAAY,qBAAqB;IAC/B;;;;OAIG;IACH,+HAAuC,CAAA;IAEvC;;;;OAIG;IACH,uHAAmC,CAAA;IAEnC;;;;;OAKG;IACH,mIAAyC,CAAA;IAEzC;;;;;;;OAOG;IACH,2JAAqD,CAAA;IAErD;;;;;OAKG;IACH,yHAAoC,CAAA;AACtC,CAAC,EAxCW,qBAAqB,KAArB,qBAAqB,QAwChC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/oauth_pb.d.ts

@@ -8,28 +8,6 @@ export declare const file_ai_stigmer_agentic_mcpserver_v1_oauth: GenFile;
  * OAuthGrant tracks OAuth metadata for a user's OAuth connection to an
  * API resource.
  *
- * @internal
- * Infrastructure-only. Not a public API resource — no kind, no apiVersion,
- * no CRUD RPCs. Stored in the backend's database, keyed by the composite
- * of (identity_account_id, resource_id, org_id).
- *
- * The grant is resource-agnostic: currently used for MCP servers, but the
- * data model supports any API resource kind that needs OAuth credentials
- * (e.g., workflows in the future).
- *
- * Actual tokens (access + refresh) live in a managed environment
- * (stigmer.ai/managed=true label) as encrypted secret env vars.
- * OAuthGrant only holds non-secret metadata needed by the refresh
- * mechanism and pre-flight expiry checks.
- *
- * Storage split rationale:
- * - Managed environment: access token (target_env_var), refresh token
- *   ({target_env_var}_REFRESH_TOKEN). These are secrets, encrypted at rest,
- *   subject to Environment access control.
- * - OAuthGrant: expiry timestamp, client_id, token_endpoint, env var names.
- *   These are non-secret metadata that the backend reads during pre-flight
- *   checks without needing secret-read permissions on the Environment.
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.OAuthGrant
  */
 export type OAuthGrant = Message<"ai.stigmer.agentic.mcpserver.v1.OAuthGrant"> & {
@@ -126,36 +104,6 @@ export declare const OAuthGrantSchema: GenMessage<OAuthGrant>;
  * OAuthAppOverride binds a specific OAuthApp to an API resource within an
  * organization, overriding the platform-default OAuthApp for that resource.
  *
- * @internal
- * Infrastructure-only. Not a public API resource — no kind, no apiVersion,
- * no CRUD RPCs. Stored in the backend's database, keyed by the composite
- * of (resource_id, resource_kind, org_id).
- *
- * This is the "Bring Your Own App" (BYOA) binding: it records that org Z
- * wants resource Y to use OAuthApp X instead of the platform default
- * referenced by McpServerAuth.oauth_app_ref.
- *
- * Separation of concerns:
- * - OAuthApp (credential resource): holds client_id, client_secret, and
- *   vendor endpoint URLs. Reusable — may be referenced by multiple overrides
- *   or MCP servers.
- * - OAuthAppOverride (binding document): maps (resource, org) to an OAuthApp.
- *   Analogous to OAuthGrant, which maps (user, resource, org) to token metadata.
- *
- * Resolution chain (evaluated at connect time and token refresh):
- *   1. OAuthAppOverride for (resource_id, resource_kind, org_id) — org override
- *   2. McpServerAuth.oauth_app_ref on the resource spec — platform default
- *   3. None — no OAuth app available (manual token or DCR only)
- *
- * Edition scoping: the override binding — and the whole resolution chain
- * above it — exists only on the hosted platform. OSS resolves the
- * oauth_app_ref directly against its flat OAuthApp store (the ref IS the
- * whole resolution) and answers UNIMPLEMENTED for the org-OAuth-app RPCs;
- * see McpServerQueryController.getOrgOAuthApp for the contract.
- *
- * The override is resource-agnostic: currently used for MCP servers, but the
- * composite key supports any API resource kind that needs BYOA (e.g., workflows).
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.OAuthAppOverride
  */
 export type OAuthAppOverride = Message<"ai.stigmer.agentic.mcpserver.v1.OAuthAppOverride"> & {

package/ai/stigmer/agentic/mcpserver/v1/oauth_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/oauth_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,0nBAA0nB,CAAC,CAAC;AA8HvoB;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AA2E7D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"oauth_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/oauth_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,0nBAA0nB,CAAC,CAAC;AAwGvoB;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;AA6C7D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/query_connect.d.ts

@@ -1,12 +1,6 @@
 /**
  * McpServerQueryController provides read operations for MCP server resources.
  *
- * @internal
- * Authorization model:
- * - Platform-scoped: Anyone can view (public marketplace)
- * - Organization-scoped: Org members can view
- * - Identity-account-scoped: Only the owner can view
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerQueryController
  */
 export declare const McpServerQueryController: {
@@ -15,13 +9,6 @@ export declare const McpServerQueryController: {
         /**
          * Get an MCP server by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the mcp_server resource.
-         * The caller must have access based on the resource's scope:
-         * - Platform: All authenticated users
-         * - Organization: Organization members
-         * - Identity Account: Only the owner
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.get
          */
         readonly get: {
@@ -36,10 +23,6 @@ export declare const McpServerQueryController: {
          * Preferred method for looking up MCP servers by name/slug rather than
          * system-generated ID.
          *
-         * @internal
-         * Authorization: Custom authorization in handler.
-         * The handler performs scope-aware authorization based on the reference.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.getByReference
          */
         readonly getByReference: {
@@ -57,10 +40,6 @@ export declare const McpServerQueryController: {
          * render the correct OAuth state in the MCP server detail page and
          * session composer.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the mcp_server resource.
-         * The resource_id field contains the MCP server's system-generated ID.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.getOAuthGrantStatus
          */
         readonly getOAuthGrantStatus: {
@@ -88,11 +67,6 @@ export declare const McpServerQueryController: {
          * SDK's useOrgOAuthApp.isSupported). Never implement one RPC of the
          * surface without the other two and the client-side gate.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the mcp_server resource.
-         * Any user who can view the MCP server can check whether their org has
-         * an override — no secrets are exposed.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.getOrgOAuthApp
          */
         readonly getOrgOAuthApp: {

package/ai/stigmer/agentic/mcpserver/v1/query_connect.js

@@ -9,12 +9,6 @@ import { GetOAuthGrantStatusInput, GetOAuthGrantStatusOutput, GetOrgOAuthAppInpu
 /**
  * McpServerQueryController provides read operations for MCP server resources.
  *
- * @internal
- * Authorization model:
- * - Platform-scoped: Anyone can view (public marketplace)
- * - Organization-scoped: Org members can view
- * - Identity-account-scoped: Only the owner can view
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerQueryController
  */
 export const McpServerQueryController = {
@@ -23,13 +17,6 @@ export const McpServerQueryController = {
         /**
          * Get an MCP server by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the mcp_server resource.
-         * The caller must have access based on the resource's scope:
-         * - Platform: All authenticated users
-         * - Organization: Organization members
-         * - Identity Account: Only the owner
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.get
          */
         get: {
@@ -44,10 +31,6 @@ export const McpServerQueryController = {
          * Preferred method for looking up MCP servers by name/slug rather than
          * system-generated ID.
          *
-         * @internal
-         * Authorization: Custom authorization in handler.
-         * The handler performs scope-aware authorization based on the reference.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.getByReference
          */
         getByReference: {
@@ -65,10 +48,6 @@ export const McpServerQueryController = {
          * render the correct OAuth state in the MCP server detail page and
          * session composer.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the mcp_server resource.
-         * The resource_id field contains the MCP server's system-generated ID.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.getOAuthGrantStatus
          */
         getOAuthGrantStatus: {
@@ -96,11 +75,6 @@ export const McpServerQueryController = {
          * SDK's useOrgOAuthApp.isSupported). Never implement one RPC of the
          * surface without the other two and the client-side gate.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the mcp_server resource.
-         * Any user who can view the MCP server can check whether their org has
-         * an override — no secrets are exposed.
-         *
          * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.getOrgOAuthApp
          */
         getOrgOAuthApp: {

package/ai/stigmer/agentic/mcpserver/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4HAA4H;AAC5H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAE3H;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,0DAA0D;IACpE,OAAO,EAAE;QACP;;;;;;;;;;;WAWG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,mBAAmB;YACtB,CAAC,EAAE,oBAAoB;YACvB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4HAA4H;AAC5H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAE3H;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,0DAA0D;IACpE,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,mBAAmB;YACtB,CAAC,EAAE,oBAAoB;YACvB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/query_pb.d.ts

@@ -9,25 +9,12 @@ export declare const file_ai_stigmer_agentic_mcpserver_v1_query: GenFile;
 /**
  * McpServerQueryController provides read operations for MCP server resources.
  *
- * @internal
- * Authorization model:
- * - Platform-scoped: Anyone can view (public marketplace)
- * - Organization-scoped: Org members can view
- * - Identity-account-scoped: Only the owner can view
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerQueryController
  */
 export declare const McpServerQueryController: GenService<{
     /**
      * Get an MCP server by its unique identifier.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the mcp_server resource.
-     * The caller must have access based on the resource's scope:
-     * - Platform: All authenticated users
-     * - Organization: Organization members
-     * - Identity Account: Only the owner
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.get
      */
     get: {
@@ -41,10 +28,6 @@ export declare const McpServerQueryController: GenService<{
      * Preferred method for looking up MCP servers by name/slug rather than
      * system-generated ID.
      *
-     * @internal
-     * Authorization: Custom authorization in handler.
-     * The handler performs scope-aware authorization based on the reference.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.getByReference
      */
     getByReference: {
@@ -61,10 +44,6 @@ export declare const McpServerQueryController: GenService<{
      * render the correct OAuth state in the MCP server detail page and
      * session composer.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the mcp_server resource.
-     * The resource_id field contains the MCP server's system-generated ID.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.getOAuthGrantStatus
      */
     getOAuthGrantStatus: {
@@ -91,11 +70,6 @@ export declare const McpServerQueryController: GenService<{
      * SDK's useOrgOAuthApp.isSupported). Never implement one RPC of the
      * surface without the other two and the client-side gate.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the mcp_server resource.
-     * Any user who can view the MCP server can check whether their org has
-     * an override — no secrets are exposed.
-     *
      * @generated from rpc ai.stigmer.agentic.mcpserver.v1.McpServerQueryController.getOrgOAuthApp
      */
     getOrgOAuthApp: {

package/ai/stigmer/agentic/mcpserver/v1/query_pb.js

@@ -14,12 +14,6 @@ export const file_ai_stigmer_agentic_mcpserver_v1_query = /*@__PURE__*/ fileDesc
 /**
  * McpServerQueryController provides read operations for MCP server resources.
  *
- * @internal
- * Authorization model:
- * - Platform-scoped: Anyone can view (public marketplace)
- * - Organization-scoped: Org members can view
- * - Identity-account-scoped: Only the owner can view
- *
  * @generated from service ai.stigmer.agentic.mcpserver.v1.McpServerQueryController
  */
 export const McpServerQueryController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_query, 0);

package/ai/stigmer/agentic/mcpserver/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,kjCAAkjC,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEjyC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAsFhC,aAAa,CAChB,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,wCAAwC,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,kjCAAkjC,EAAE,CAAC,wCAAwC,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEjyC;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAkEhC,aAAa,CAChB,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.d.ts

@@ -9,10 +9,6 @@ export declare const file_ai_stigmer_agentic_mcpserver_v1_spec: GenFile;
 /**
  * McpServerSpec defines the configurable properties of an MCP server.
  *
- * @internal
- * This is the "Template" layer — declares capabilities and requirements.
- * The overview.md file provides the SDK-facing description and example YAML.
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.McpServerSpec
  */
 export type McpServerSpec = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSpec"> & {
@@ -73,25 +69,6 @@ export type McpServerSpec = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSp
      * Empty list means all tools are enabled by default.
      * Applies whenever an agent's McpServerUsage.enabled_tools is empty.
      *
-     * @internal
-     * Tool names must match exactly what the MCP server reports via tools/list.
-     * Only names from discovered_capabilities.tools are valid here.
-     * Do NOT include names from discovered_capabilities.resource_templates —
-     * resource templates are read-only data endpoints, not callable tools.
-     *
-     * Enforcement is two-layered:
-     *   - Apply time: mcpserver update/apply rejects (INVALID_ARGUMENT) any
-     *     name this server's own discovered_capabilities.tools does not
-     *     contain, with the valid names in the error. Skipped when the server
-     *     has never been connected (no capabilities yet) — which is always the
-     *     case on create, so the check only bites from the first re-apply
-     *     after discovery.
-     *   - Execution time: the runner enforces the INTERSECTION with the
-     *     server's live toolset — an unknown name is warned in the runner log
-     *     and ignored, so a stale entry narrows the toolset but never widens
-     *     it or fails the run. Enforcement is per harness — see
-     *     McpServerUsage.enabled_tools in agent/v1/spec.proto.
-     *
      * @generated from field: repeated string default_enabled_tools = 7;
      */
     defaultEnabledTools: string[];
@@ -99,25 +76,6 @@ export type McpServerSpec = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSp
      * Environment variable declarations for this MCP server.
      * Keys are variable names; values describe their metadata and optionality.
      *
-     * @internal
-     * Reserved platform keys — declared here like any other variable, but
-     * their values are injected by the runner per resolution context and are
-     * authoritative over same-named user env entries:
-     *   STIGMER_CALLER_IDENTITY_KIND  — the verified caller's kind token
-     *       ("whatsapp_phone", "slack_user_id", "stigmer_user", "anonymous")
-     *   STIGMER_CALLER_IDENTITY_VALUE — the identity value (wa_id, user id,
-     *       email); empty for anonymous
-     *   STIGMER_SESSION_ID            — the session the identity was
-     *       resolved for; empty outside a session
-     * Reserved keys MUST be declared `optional: true`: they have no value at
-     * execution-create time, and a required declaration fails the pipeline's
-     * env-completeness validation before the runner ever injects them.
-     * Discovery (the connect workflow) runs with no session and injects the
-     * anonymous sentinel — a server consuming these keys must answer
-     * tools/list for anonymous callers and gate tool CALLS instead. The
-     * injected header is runner-asserted, not signed: pair it with a shared
-     * secret and treat it as trustworthy only for servers you operate.
-     *
      * @generated from field: map<string, ai.stigmer.agentic.environment.v1.EnvVarDeclaration> env = 8;
      */
     env: {
@@ -126,26 +84,6 @@ export type McpServerSpec = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSp
     /**
      * Tools pinned by the MCP server owner to always require approval.
      *
-     * @internal
-     * These take precedence over system-generated `McpServerStatus.tool_approvals`.
-     * Never auto-modified — only changed by explicit user action (apply/update).
-     *
-     * Presence in this list IS the gate: every entry force-requires approval
-     * for its tool, overriding the classifier. The field cannot express the
-     * opposite direction — a pin can never exempt a tool. To un-gate a tool
-     * the classifier flagged, use `Agent.McpServerUsage.tool_approval_overrides`
-     * (layer 3 below), whose entries carry a real `requires_approval` boolean.
-     *
-     * Use cases:
-     * - Force approval for a tool the classifier marked as auto-approve
-     * - Establish organization-wide safety policies for dangerous tools
-     *
-     * Policy chain (lowest to highest priority):
-     * 1. McpServerStatus.tool_approvals - System-generated defaults
-     * 2. McpServerSpec.pinned_tool_approvals - Manual overrides (this field)
-     * 3. Agent.McpServerUsage.tool_approval_overrides - Per-agent customization
-     * 4. AgentExecution.auto_approve_all - Runtime bypass
-     *
      * @generated from field: repeated ai.stigmer.agentic.mcpserver.v1.ToolApprovalPolicy pinned_tool_approvals = 11;
      */
     pinnedToolApprovals: ToolApprovalPolicy[];
@@ -188,15 +126,6 @@ export declare const McpServerSpecSchema: GenMessage<McpServerSpec>;
 /**
  * StdioServerConfig defines an MCP server that runs as a subprocess.
  *
- * @internal
- * Communication happens via stdin/stdout using JSON-RPC messages.
- * The agent runner starts this process and communicates via stdio.
- *
- * Common examples:
- * - Node.js servers: npx @modelcontextprotocol/server-github
- * - Python servers: python -m mcp_server_sqlite
- * - Go servers: ./mcp-server-binary
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.StdioServerConfig
  */
 export type StdioServerConfig = Message<"ai.stigmer.agentic.mcpserver.v1.StdioServerConfig"> & {
@@ -251,16 +180,6 @@ export declare const StdioServerConfigSchema: GenMessage<StdioServerConfig>;
 /**
  * HttpServerConfig defines an MCP server accessible via HTTP + Server-Sent Events.
  *
- * @internal
- * Communication flow:
- * 1. Agent sends JSON-RPC requests via HTTP POST
- * 2. Server streams responses via Server-Sent Events (SSE)
- *
- * Use cases:
- * - Managed MCP services (e.g., hosted by a cloud provider)
- * - MCP servers behind a reverse proxy or API gateway
- * - Sharing a single MCP server instance across multiple agents
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.HttpServerConfig
  */
 export type HttpServerConfig = Message<"ai.stigmer.agentic.mcpserver.v1.HttpServerConfig"> & {
@@ -287,13 +206,6 @@ export type HttpServerConfig = Message<"ai.stigmer.agentic.mcpserver.v1.HttpServ
      *   "X-API-Version": "2024-01"
      *   "X-Tenant-ID": "${TENANT_ID}"
      *
-     * @internal
-     * Templates may also reference the reserved caller-identity keys
-     * (STIGMER_CALLER_IDENTITY_KIND / _VALUE, STIGMER_SESSION_ID) when the
-     * server declares them in spec.env — see the env field's reserved-key
-     * contract. Placeholders resolve against the env FILTERED to declared
-     * keys, so an undeclared reserved key in a template fails resolution.
-     *
      * @generated from field: map<string, string> headers = 2;
      */
     headers: {
@@ -330,23 +242,6 @@ export declare const HttpServerConfigSchema: GenMessage<HttpServerConfig>;
 /**
  * ToolApprovalPolicy defines approval requirements for a specific tool.
  *
- * @internal
- * The message field supports {{args.field}} placeholders that are resolved
- * at runtime using the actual tool arguments. This enables contextual
- * approval messages that help users make informed decisions.
- *
- * Placeholder syntax:
- *   {{args.field_name}} - Replaced with the tool argument value
- *   {{tool_name}} - Replaced with the tool name (always available)
- *
- * If a placeholder references a missing argument, it's replaced with "<unknown>".
- *
- * Policy chain (lowest to highest priority):
- * 1. McpServerStatus.tool_approvals - System-generated defaults
- * 2. McpServerSpec.pinned_tool_approvals - Manual overrides
- * 3. Agent.McpServerUsage.tool_approval_overrides - Per-agent customization
- * 4. AgentExecution.auto_approve_all - Runtime bypass
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.ToolApprovalPolicy
  */
 export type ToolApprovalPolicy = Message<"ai.stigmer.agentic.mcpserver.v1.ToolApprovalPolicy"> & {
@@ -399,32 +294,6 @@ export declare const ToolApprovalPolicySchema: GenMessage<ToolApprovalPolicy>;
 /**
  * McpServerAuth configures automated credential acquisition via OAuth.
  *
- * @internal
- * Two authentication modes are determined by the presence of oauth_app_ref:
- *
- * - When oauth_app_ref is empty: the MCP server implements the MCP
- *   Authorization specification (RFC 8414 discovery, RFC 7591 Dynamic Client
- *   Registration, OAuth 2.1 with PKCE). Stigmer auto-discovers everything
- *   from the server URL. No OAuthApp resource is needed — credentials are
- *   obtained automatically via DCR.
- *
- * - When oauth_app_ref is set: the MCP server requires pre-registered OAuth
- *   app credentials from a specific vendor (Slack, Salesforce, Figma, etc.).
- *   The referenced OAuthApp holds the client_id, client_secret, and endpoint
- *   URLs needed for the authorization code flow.
- *
- * In both cases, the acquired access token is stored in a system-managed
- * environment (labeled stigmer.ai/managed=true) as target_env_var. A refresh
- * token (if issued by the vendor) is stored alongside as
- * {target_env_var}_REFRESH_TOKEN by convention. The managed environment ID
- * is recorded on the OAuthGrant for all subsequent reads and refreshes.
- *
- * Token lifecycle:
- * - Pre-flight check before execution: if the access token is expired,
- *   the backend uses the refresh token to obtain a new one automatically.
- * - If the refresh token is also expired: execution fails with a clear
- *   error, and the user re-authenticates from the MCP server Connect page.
- *
  * @generated from message ai.stigmer.agentic.mcpserver.v1.McpServerAuth
  */
 export type McpServerAuth = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerAuth"> & {