@stigmer/protos 3.12.3 → 3.12.5

package/ai/stigmer/agentic/workflowinstance/v1/api_pb.d.ts

@@ -10,26 +10,6 @@ export declare const file_ai_stigmer_agentic_workflowinstance_v1_api: GenFile;
 /**
  * WorkflowInstance represents a configured deployment of a Workflow template.
  *
- * @internal
- * This is the "Instance" layer in the Template→Instance→Execution pattern.
- * It binds a reusable Workflow template to specific environments containing credentials,
- * configuration, and secrets needed for execution.
- *
- * A WorkflowInstance:
- * - References a Workflow template (the orchestration blueprint)
- * - Binds one or more Environment resources (configuration + secrets)
- * - Can be executed multiple times via WorkflowExecution resources
- * - Can be platform-scoped (global defaults), org-scoped (team instances), or user-scoped (personal)
- *
- * Example use case:
- * Workflow "deploy-to-cloud" (template) → WorkflowInstance "prod-deploy" (with aws-prod-env)
- * → WorkflowExecution "prod-deploy-20250111-001" (specific run)
- *
- * This separation allows:
- * - Workflow templates to be reusable across teams/environments
- * - Instances to maintain stateful configuration with secrets
- * - Executions to track individual runs with results
- *
  * @generated from message ai.stigmer.agentic.workflowinstance.v1.WorkflowInstance
  */
 export type WorkflowInstance = Message<"ai.stigmer.agentic.workflowinstance.v1.WorkflowInstance"> & {
@@ -60,10 +40,6 @@ export type WorkflowInstance = Message<"ai.stigmer.agentic.workflowinstance.v1.W
     /**
      * System-managed audit information.
      *
-     * @internal
-     * This is a simple status (no custom execution state) since WorkflowInstance
-     * is configuration only. Execution state is tracked in WorkflowExecution resources.
-     *
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceAuditStatus status = 5;
      */
     status?: ApiResourceAuditStatus;

package/ai/stigmer/agentic/workflowinstance/v1/api_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/api_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wIAAwI;AACxI,oBAAoB;AAWpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,gDAAgD,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAE3G,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,wkBAAwkB,EAAE,CAAC,gDAAgD,EAAE,4CAA4C,EAAE,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAoE/vB;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/api_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wIAAwI;AACxI,oBAAoB;AAWpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,gDAAgD,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAE3G,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,wkBAAwkB,EAAE,CAAC,gDAAgD,EAAE,4CAA4C,EAAE,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA4C/vB;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/workflowinstance/v1/command_connect.d.ts

@@ -1,17 +1,6 @@
 /**
  * WorkflowInstanceCommandController handles write operations for workflow instances.
  *
- * @internal
- * This service provides the CUD (Create, Update, Delete) operations following the
- * Command-Query Separation pattern. All RPCs that modify state go through this controller.
- *
- * Authorization:
- * - create: Custom authorization logic (validates workflow_id access, environment_refs access)
- * - update: Standard authorization (requires update permission on the instance)
- * - delete: Standard authorization (requires delete permission on the instance)
- *
- * All workflow instances belong to an organization.
- *
  * @generated from service ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController
  */
 export declare const WorkflowInstanceCommandController: {
@@ -20,10 +9,6 @@ export declare const WorkflowInstanceCommandController: {
         /**
          * Create or update a workflow instance.
          *
-         * @internal
-         * The authorization and state-operation are determined depending on whether the workflow instance
-         * is going to be created or updated which is determined as part of the request execution.
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.apply
          */
         readonly apply: {
@@ -35,18 +20,6 @@ export declare const WorkflowInstanceCommandController: {
         /**
          * Create a workflow instance.
          *
-         * @internal
-         * Input validation:
-         * - metadata.org must be specified
-         * - spec.workflow_id must be a valid Workflow resource ID
-         * - spec.environment_refs must reference valid Environment resources
-         *
-         * Authorization:
-         * Uses custom authorization logic to verify:
-         * 1. User has permission to access the referenced Workflow template
-         * 2. User has permission to access all referenced Environment resources
-         * 3. Owner scope is valid for the user's organization/identity
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.create
          */
         readonly create: {
@@ -58,22 +31,6 @@ export declare const WorkflowInstanceCommandController: {
         /**
          * Update an existing workflow instance.
          *
-         * @internal
-         * Mutable fields:
-         * - spec.description, spec.environment_refs
-         * - metadata.labels, metadata.tags, metadata.annotations
-         *
-         * Immutable fields (must delete and recreate to change):
-         * - spec.workflow_id, metadata.id, metadata.org
-         *
-         * Authorization:
-         * Requires "update" permission on the specific WorkflowInstance resource.
-         * Field path "metadata.id" identifies which resource to authorize.
-         *
-         * Each update increments status.audit.version and updates status.audit.updated_at.
-         *
-         * Error: PERMISSION_DENIED if user lacks update permission
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.update
          */
         readonly update: {
@@ -94,13 +51,9 @@ export declare const WorkflowInstanceCommandController: {
          * instance via FGA. An ORG-visible instance means all org members can see
          * all executions — zero per-execution tuples needed.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the workflow instance.
-         * Visibility transitions trigger FGA tuple management in Cloud mode:
-         * - PRIVATE → ORG: creates workflow_instance#viewer@organization:<org>#member
-         * - PRIVATE → PUBLIC: creates workflow_instance#viewer@identity_account:*
-         * - ORG → PRIVATE: deletes the org member viewer tuple
-         * - PUBLIC → PRIVATE: deletes the wildcard viewer tuple
+         * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+         * every org boundary, so it is granted by the platform team on request.
+         * Un-publishing and all other levels stay self-service.
          *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.updateVisibility
          */
@@ -121,15 +74,6 @@ export declare const WorkflowInstanceCommandController: {
          * Supported levels: PRIVATE (only the user who ran each execution) and
          * ORGANIZATION (all org members). Public/platform are unsupported.
          *
-         * @internal
-         * Authorization: requires can_grant_access on the workflow instance —
-         * sharing run history is an access-granting action, consistent with the
-         * per-execution share flow. In Cloud mode the transition reconciles the
-         * instance's `execution_viewer` FGA relation:
-         * - PRIVATE -> ORGANIZATION: creates
-         *   workflow_instance#execution_viewer@organization:<org>#member
-         * - ORGANIZATION -> PRIVATE: deletes that tuple
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.updateExecutionVisibility
          */
         readonly updateExecutionVisibility: {
@@ -141,21 +85,6 @@ export declare const WorkflowInstanceCommandController: {
         /**
          * Delete a workflow instance.
          *
-         * @internal
-         * Permanently removes a WorkflowInstance resource.
-         * - Does NOT delete the referenced Workflow template (templates are reusable)
-         * - Does NOT delete the referenced Environment resources (environments are reusable)
-         * - DOES cascade delete any dependent WorkflowExecution resources (executions belong to instance)
-         *
-         * Authorization:
-         * Requires "delete" permission on the specific WorkflowInstance resource.
-         * Field path "value" extracts the resource ID from WorkflowInstanceId wrapper.
-         *
-         * Returns the deleted WorkflowInstance (final state before deletion).
-         *
-         * Error: PERMISSION_DENIED if user lacks delete permission
-         * Error: NOT_FOUND if instance ID doesn't exist
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.delete
          */
         readonly delete: {

package/ai/stigmer/agentic/workflowinstance/v1/command_connect.js

@@ -10,17 +10,6 @@ import { UpdateExecutionVisibilityInput, WorkflowInstanceId } from "./io_pbjs";
 /**
  * WorkflowInstanceCommandController handles write operations for workflow instances.
  *
- * @internal
- * This service provides the CUD (Create, Update, Delete) operations following the
- * Command-Query Separation pattern. All RPCs that modify state go through this controller.
- *
- * Authorization:
- * - create: Custom authorization logic (validates workflow_id access, environment_refs access)
- * - update: Standard authorization (requires update permission on the instance)
- * - delete: Standard authorization (requires delete permission on the instance)
- *
- * All workflow instances belong to an organization.
- *
  * @generated from service ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController
  */
 export const WorkflowInstanceCommandController = {
@@ -29,10 +18,6 @@ export const WorkflowInstanceCommandController = {
         /**
          * Create or update a workflow instance.
          *
-         * @internal
-         * The authorization and state-operation are determined depending on whether the workflow instance
-         * is going to be created or updated which is determined as part of the request execution.
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.apply
          */
         apply: {
@@ -44,18 +29,6 @@ export const WorkflowInstanceCommandController = {
         /**
          * Create a workflow instance.
          *
-         * @internal
-         * Input validation:
-         * - metadata.org must be specified
-         * - spec.workflow_id must be a valid Workflow resource ID
-         * - spec.environment_refs must reference valid Environment resources
-         *
-         * Authorization:
-         * Uses custom authorization logic to verify:
-         * 1. User has permission to access the referenced Workflow template
-         * 2. User has permission to access all referenced Environment resources
-         * 3. Owner scope is valid for the user's organization/identity
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.create
          */
         create: {
@@ -67,22 +40,6 @@ export const WorkflowInstanceCommandController = {
         /**
          * Update an existing workflow instance.
          *
-         * @internal
-         * Mutable fields:
-         * - spec.description, spec.environment_refs
-         * - metadata.labels, metadata.tags, metadata.annotations
-         *
-         * Immutable fields (must delete and recreate to change):
-         * - spec.workflow_id, metadata.id, metadata.org
-         *
-         * Authorization:
-         * Requires "update" permission on the specific WorkflowInstance resource.
-         * Field path "metadata.id" identifies which resource to authorize.
-         *
-         * Each update increments status.audit.version and updates status.audit.updated_at.
-         *
-         * Error: PERMISSION_DENIED if user lacks update permission
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.update
          */
         update: {
@@ -103,13 +60,9 @@ export const WorkflowInstanceCommandController = {
          * instance via FGA. An ORG-visible instance means all org members can see
          * all executions — zero per-execution tuples needed.
          *
-         * @internal
-         * Authorization: Requires can_edit permission on the workflow instance.
-         * Visibility transitions trigger FGA tuple management in Cloud mode:
-         * - PRIVATE → ORG: creates workflow_instance#viewer@organization:<org>#member
-         * - PRIVATE → PUBLIC: creates workflow_instance#viewer@identity_account:*
-         * - ORG → PRIVATE: deletes the org member viewer tuple
-         * - PUBLIC → PRIVATE: deletes the wildcard viewer tuple
+         * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+         * every org boundary, so it is granted by the platform team on request.
+         * Un-publishing and all other levels stay self-service.
          *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.updateVisibility
          */
@@ -130,15 +83,6 @@ export const WorkflowInstanceCommandController = {
          * Supported levels: PRIVATE (only the user who ran each execution) and
          * ORGANIZATION (all org members). Public/platform are unsupported.
          *
-         * @internal
-         * Authorization: requires can_grant_access on the workflow instance —
-         * sharing run history is an access-granting action, consistent with the
-         * per-execution share flow. In Cloud mode the transition reconciles the
-         * instance's `execution_viewer` FGA relation:
-         * - PRIVATE -> ORGANIZATION: creates
-         *   workflow_instance#execution_viewer@organization:<org>#member
-         * - ORGANIZATION -> PRIVATE: deletes that tuple
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.updateExecutionVisibility
          */
         updateExecutionVisibility: {
@@ -150,21 +94,6 @@ export const WorkflowInstanceCommandController = {
         /**
          * Delete a workflow instance.
          *
-         * @internal
-         * Permanently removes a WorkflowInstance resource.
-         * - Does NOT delete the referenced Workflow template (templates are reusable)
-         * - Does NOT delete the referenced Environment resources (environments are reusable)
-         * - DOES cascade delete any dependent WorkflowExecution resources (executions belong to instance)
-         *
-         * Authorization:
-         * Requires "delete" permission on the specific WorkflowInstance resource.
-         * Field path "value" extracts the resource ID from WorkflowInstanceId wrapper.
-         *
-         * Returns the deleted WorkflowInstance (final state before deletion).
-         *
-         * Error: PERMISSION_DENIED if user lacks delete permission
-         * Error: NOT_FOUND if instance ID doesn't exist
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.delete
          */
         delete: {

package/ai/stigmer/agentic/workflowinstance/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4IAA4I;AAC5I,oBAAoB;AACpB,cAAc;AAEd,kGAAkG;AAElG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,0EAA0E;IACpF,OAAO,EAAE;QACP;;;;;;;;WAQG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;WAgBG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4IAA4I;AAC5I,oBAAoB;AACpB,cAAc;AAEd,kGAAkG;AAElG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,0EAA0E;IACpF,OAAO,EAAE;QACP;;;;WAIG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/workflowinstance/v1/command_pb.d.ts

@@ -9,27 +9,12 @@ export declare const file_ai_stigmer_agentic_workflowinstance_v1_command: GenFil
 /**
  * WorkflowInstanceCommandController handles write operations for workflow instances.
  *
- * @internal
- * This service provides the CUD (Create, Update, Delete) operations following the
- * Command-Query Separation pattern. All RPCs that modify state go through this controller.
- *
- * Authorization:
- * - create: Custom authorization logic (validates workflow_id access, environment_refs access)
- * - update: Standard authorization (requires update permission on the instance)
- * - delete: Standard authorization (requires delete permission on the instance)
- *
- * All workflow instances belong to an organization.
- *
  * @generated from service ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController
  */
 export declare const WorkflowInstanceCommandController: GenService<{
     /**
      * Create or update a workflow instance.
      *
-     * @internal
-     * The authorization and state-operation are determined depending on whether the workflow instance
-     * is going to be created or updated which is determined as part of the request execution.
-     *
      * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.apply
      */
     apply: {
@@ -40,18 +25,6 @@ export declare const WorkflowInstanceCommandController: GenService<{
     /**
      * Create a workflow instance.
      *
-     * @internal
-     * Input validation:
-     * - metadata.org must be specified
-     * - spec.workflow_id must be a valid Workflow resource ID
-     * - spec.environment_refs must reference valid Environment resources
-     *
-     * Authorization:
-     * Uses custom authorization logic to verify:
-     * 1. User has permission to access the referenced Workflow template
-     * 2. User has permission to access all referenced Environment resources
-     * 3. Owner scope is valid for the user's organization/identity
-     *
      * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.create
      */
     create: {
@@ -62,22 +35,6 @@ export declare const WorkflowInstanceCommandController: GenService<{
     /**
      * Update an existing workflow instance.
      *
-     * @internal
-     * Mutable fields:
-     * - spec.description, spec.environment_refs
-     * - metadata.labels, metadata.tags, metadata.annotations
-     *
-     * Immutable fields (must delete and recreate to change):
-     * - spec.workflow_id, metadata.id, metadata.org
-     *
-     * Authorization:
-     * Requires "update" permission on the specific WorkflowInstance resource.
-     * Field path "metadata.id" identifies which resource to authorize.
-     *
-     * Each update increments status.audit.version and updates status.audit.updated_at.
-     *
-     * Error: PERMISSION_DENIED if user lacks update permission
-     *
      * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.update
      */
     update: {
@@ -97,13 +54,9 @@ export declare const WorkflowInstanceCommandController: GenService<{
      * instance via FGA. An ORG-visible instance means all org members can see
      * all executions — zero per-execution tuples needed.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the workflow instance.
-     * Visibility transitions trigger FGA tuple management in Cloud mode:
-     * - PRIVATE → ORG: creates workflow_instance#viewer@organization:<org>#member
-     * - PRIVATE → PUBLIC: creates workflow_instance#viewer@identity_account:*
-     * - ORG → PRIVATE: deletes the org member viewer tuple
-     * - PUBLIC → PRIVATE: deletes the wildcard viewer tuple
+     * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+     * every org boundary, so it is granted by the platform team on request.
+     * Un-publishing and all other levels stay self-service.
      *
      * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.updateVisibility
      */
@@ -123,15 +76,6 @@ export declare const WorkflowInstanceCommandController: GenService<{
      * Supported levels: PRIVATE (only the user who ran each execution) and
      * ORGANIZATION (all org members). Public/platform are unsupported.
      *
-     * @internal
-     * Authorization: requires can_grant_access on the workflow instance —
-     * sharing run history is an access-granting action, consistent with the
-     * per-execution share flow. In Cloud mode the transition reconciles the
-     * instance's `execution_viewer` FGA relation:
-     * - PRIVATE -> ORGANIZATION: creates
-     *   workflow_instance#execution_viewer@organization:<org>#member
-     * - ORGANIZATION -> PRIVATE: deletes that tuple
-     *
      * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.updateExecutionVisibility
      */
     updateExecutionVisibility: {
@@ -142,21 +86,6 @@ export declare const WorkflowInstanceCommandController: GenService<{
     /**
      * Delete a workflow instance.
      *
-     * @internal
-     * Permanently removes a WorkflowInstance resource.
-     * - Does NOT delete the referenced Workflow template (templates are reusable)
-     * - Does NOT delete the referenced Environment resources (environments are reusable)
-     * - DOES cascade delete any dependent WorkflowExecution resources (executions belong to instance)
-     *
-     * Authorization:
-     * Requires "delete" permission on the specific WorkflowInstance resource.
-     * Field path "value" extracts the resource ID from WorkflowInstanceId wrapper.
-     *
-     * Returns the deleted WorkflowInstance (final state before deletion).
-     *
-     * Error: PERMISSION_DENIED if user lacks delete permission
-     * Error: NOT_FOUND if instance ID doesn't exist
-     *
      * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.delete
      */
     delete: {

package/ai/stigmer/agentic/workflowinstance/v1/command_pb.js

@@ -14,17 +14,6 @@ export const file_ai_stigmer_agentic_workflowinstance_v1_command = /*@__PURE__*/
 /**
  * WorkflowInstanceCommandController handles write operations for workflow instances.
  *
- * @internal
- * This service provides the CUD (Create, Update, Delete) operations following the
- * Command-Query Separation pattern. All RPCs that modify state go through this controller.
- *
- * Authorization:
- * - create: Custom authorization logic (validates workflow_id access, environment_refs access)
- * - update: Standard authorization (requires update permission on the instance)
- * - delete: Standard authorization (requires delete permission on the instance)
- *
- * All workflow instances belong to an organization.
- *
  * @generated from service ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController
  */
 export const WorkflowInstanceCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_agentic_workflowinstance_v1_command, 0);

package/ai/stigmer/agentic/workflowinstance/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4IAA4I;AAC5I,oBAAoB;AAKpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,8CAA8C,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAY,aAAa,CACvF,QAAQ,CAAC,wnDAAwnD,EAAE,CAAC,+CAA+C,EAAE,8CAA8C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEr3D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iCAAiC,GA8IzC,aAAa,CAChB,WAAW,CAAC,mDAAmD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4IAA4I;AAC5I,oBAAoB;AAKpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,8CAA8C,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAY,aAAa,CACvF,QAAQ,CAAC,wnDAAwnD,EAAE,CAAC,+CAA+C,EAAE,8CAA8C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEr3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAkFzC,aAAa,CAChB,WAAW,CAAC,mDAAmD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/workflowinstance/v1/io_pb.d.ts

@@ -10,12 +10,6 @@ export declare const file_ai_stigmer_agentic_workflowinstance_v1_io: GenFile;
 /**
  * WorkflowInstanceId wraps a workflow instance identifier.
  *
- * @internal
- * Used as input to RPCs that operate on a single instance:
- * - get: Retrieve a specific instance by ID
- * - delete: Remove a specific instance by ID
- * Format: Resource ID string (e.g., "wfi_abc123")
- *
  * @generated from message ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceId
  */
 export type WorkflowInstanceId = Message<"ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceId"> & {
@@ -34,14 +28,6 @@ export declare const WorkflowInstanceIdSchema: GenMessage<WorkflowInstanceId>;
 /**
  * GetWorkflowInstancesByWorkflowRequest retrieves all instances of a specific workflow template.
  *
- * @internal
- * This allows you to find all configured deployments of a given Workflow.
- * For example, a "deploy-to-cloud" Workflow might have instances:
- * - "prod-deploy" (with production environments)
- * - "staging-deploy" (with staging environments)
- * - "dev-deploy" (with development environments)
- * Supports pagination for efficient retrieval of large result sets.
- *
  * @generated from message ai.stigmer.agentic.workflowinstance.v1.GetWorkflowInstancesByWorkflowRequest
  */
 export type GetWorkflowInstancesByWorkflowRequest = Message<"ai.stigmer.agentic.workflowinstance.v1.GetWorkflowInstancesByWorkflowRequest"> & {
@@ -65,11 +51,6 @@ export type GetWorkflowInstancesByWorkflowRequest = Message<"ai.stigmer.agentic.
      * only by the caller's view permissions, which for a member of several
      * organizations spans all of them.
      *
-     * @internal
-     * Optional by design: pre-existing callers rely on the permission-bounded
-     * behavior. Filtering happens in the query/list step of each edition's
-     * handler, never client-side.
-     *
      * @generated from field: string org = 3;
      */
     org: string;

package/ai/stigmer/agentic/workflowinstance/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uIAAuI;AACvI,oBAAoB;AAQpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,gDAAgD,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAY,aAAa,CAClF,QAAQ,CAAC,gwBAAgwB,EAAE,CAAC,+CAA+C,EAAE,gDAAgD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAsBt7B;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AAgDjE;;;GAGG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAsD,aAAa,CACzH,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AA4BjE;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AAuBjE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uIAAuI;AACvI,oBAAoB;AAQpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,gDAAgD,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAY,aAAa,CAClF,QAAQ,CAAC,gwBAAgwB,EAAE,CAAC,+CAA+C,EAAE,gDAAgD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAgBt7B;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AAmCjE;;;GAGG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAsD,aAAa,CACzH,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AA4BjE;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AAuBjE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/workflowinstance/v1/query_connect.d.ts

@@ -1,17 +1,6 @@
 /**
  * WorkflowInstanceQueryController handles read operations for workflow instances.
  *
- * @internal
- * This service provides all query operations following the Command-Query Separation pattern.
- * All RPCs that read state without modifying it go through this controller.
- *
- * Authorization:
- * - get: Requires get permission on the specific instance
- * - getByWorkflow: Authorization handled in handler via FGA query (returns filtered instances)
- * - getByReference: Custom authorization (supports flexible reference lookup)
- *
- * All operations respect owner scope visibility rules (users see only their org/identity resources).
- *
  * @generated from service ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceQueryController
  */
 export declare const WorkflowInstanceQueryController: {
@@ -20,19 +9,6 @@ export declare const WorkflowInstanceQueryController: {
         /**
          * Get a single workflow instance by ID.
          *
-         * @internal
-         * Retrieves a specific WorkflowInstance using its unique resource identifier.
-         *
-         * Authorization:
-         * Requires "get" permission on the specific WorkflowInstance.
-         * Field path "value" extracts the resource ID from WorkflowInstanceId wrapper.
-         * Verifies user has access based on:
-         * - Instance owner scope (organization or identity_account)
-         * - User's IAM policies
-         *
-         * Error: PERMISSION_DENIED if user lacks get permission
-         * Error: NOT_FOUND if instance ID doesn't exist
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceQueryController.get
          */
         readonly get: {
@@ -46,20 +22,6 @@ export declare const WorkflowInstanceQueryController: {
          *
          * Returns a paginated list of instances that reference the given workflow ID.
          *
-         * @internal
-         * Authorization is handled in handler via FGA query for authorized workflow_instance_ids,
-         * then filtered by workflow_id. This ensures users only see instances they have access to,
-         * even if the parent workflow is shared across organizations.
-         *
-         * Filtering:
-         * Results are filtered by:
-         * - User's organization/identity visibility
-         * - IAM policies
-         * - Owner scope rules
-         *
-         * Error: PERMISSION_DENIED if user lacks access to the workflow
-         * Error: NOT_FOUND if workflow_id doesn't exist
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceQueryController.getByWorkflow
          */
         readonly getByWorkflow: {
@@ -71,18 +33,6 @@ export declare const WorkflowInstanceQueryController: {
         /**
          * Get a workflow instance by reference (ID or slug).
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
-         * Supports lookup by:
-         * - ID: {id: "wfi_abc123"}
-         * - Slug: {slug: "prod-deploy"}
-         * - Name: {name: "Production Deploy"}
-         *
-         * Error: PERMISSION_DENIED if user lacks access
-         * Error: NOT_FOUND if reference doesn't resolve to an instance
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceQueryController.getByReference
          */
         readonly getByReference: {

package/ai/stigmer/agentic/workflowinstance/v1/query_connect.js

@@ -10,17 +10,6 @@ import { ApiResourceReference } from "../../../commons/apiresource/io_pbjs";
 /**
  * WorkflowInstanceQueryController handles read operations for workflow instances.
  *
- * @internal
- * This service provides all query operations following the Command-Query Separation pattern.
- * All RPCs that read state without modifying it go through this controller.
- *
- * Authorization:
- * - get: Requires get permission on the specific instance
- * - getByWorkflow: Authorization handled in handler via FGA query (returns filtered instances)
- * - getByReference: Custom authorization (supports flexible reference lookup)
- *
- * All operations respect owner scope visibility rules (users see only their org/identity resources).
- *
  * @generated from service ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceQueryController
  */
 export const WorkflowInstanceQueryController = {
@@ -29,19 +18,6 @@ export const WorkflowInstanceQueryController = {
         /**
          * Get a single workflow instance by ID.
          *
-         * @internal
-         * Retrieves a specific WorkflowInstance using its unique resource identifier.
-         *
-         * Authorization:
-         * Requires "get" permission on the specific WorkflowInstance.
-         * Field path "value" extracts the resource ID from WorkflowInstanceId wrapper.
-         * Verifies user has access based on:
-         * - Instance owner scope (organization or identity_account)
-         * - User's IAM policies
-         *
-         * Error: PERMISSION_DENIED if user lacks get permission
-         * Error: NOT_FOUND if instance ID doesn't exist
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceQueryController.get
          */
         get: {
@@ -55,20 +31,6 @@ export const WorkflowInstanceQueryController = {
          *
          * Returns a paginated list of instances that reference the given workflow ID.
          *
-         * @internal
-         * Authorization is handled in handler via FGA query for authorized workflow_instance_ids,
-         * then filtered by workflow_id. This ensures users only see instances they have access to,
-         * even if the parent workflow is shared across organizations.
-         *
-         * Filtering:
-         * Results are filtered by:
-         * - User's organization/identity visibility
-         * - IAM policies
-         * - Owner scope rules
-         *
-         * Error: PERMISSION_DENIED if user lacks access to the workflow
-         * Error: NOT_FOUND if workflow_id doesn't exist
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceQueryController.getByWorkflow
          */
         getByWorkflow: {
@@ -80,18 +42,6 @@ export const WorkflowInstanceQueryController = {
         /**
          * Get a workflow instance by reference (ID or slug).
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
-         * Supports lookup by:
-         * - ID: {id: "wfi_abc123"}
-         * - Slug: {slug: "prod-deploy"}
-         * - Name: {name: "Production Deploy"}
-         *
-         * Error: PERMISSION_DENIED if user lacks access
-         * Error: NOT_FOUND if reference doesn't resolve to an instance
-         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceQueryController.getByReference
          */
         getByReference: {