@stigmer/protos 3.12.3 → 3.12.5

package/ai/stigmer/iam/platformclient/v1/command_pb.d.ts

@@ -14,11 +14,6 @@ export declare const file_ai_stigmer_iam_platformclient_v1_command: GenFile;
  * is generated server-side and returned only once in the create and
  * rotateSecret responses.
  *
- * @internal
- * PlatformClients hold credential material (client_secret_hash) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientCommandController
  */
 export declare const PlatformClientCommandController: GenService<{
@@ -36,9 +31,6 @@ export declare const PlatformClientCommandController: GenService<{
      * system-managed share client) and is rejected with INVALID_ARGUMENT — including
      * when derived from the resource name.
      *
-     * @internal
-     * Authorization: Requires can_create_platform_client permission in the organization.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.create
      */
     create: {
@@ -54,9 +46,6 @@ export declare const PlatformClientCommandController: GenService<{
      * client_secret_hash, secret_fingerprint) are immutable after creation.
      * Use rotateSecret to change the client secret.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the platform client resource.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.update
      */
     update: {
@@ -67,12 +56,11 @@ export declare const PlatformClientCommandController: GenService<{
     /**
      * Delete a platform client.
      *
-     * Immediately invalidates the client_id and client_secret. Any tokens
-     * previously minted by this platform client remain valid until their
-     * own expiration — deletion does not revoke already-issued tokens.
-     *
-     * @internal
-     * Authorization: Requires can_delete permission on the platform client resource.
+     * Immediately invalidates the client_id and client_secret AND revokes
+     * the client's outstanding user tokens: the platform resolves the
+     * minting client on every user-token request, and a client that no
+     * longer exists is refused UNAUTHENTICATED (fail closed) — so deletion
+     * takes effect on the very next request, not at token expiry.
      *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.delete
      */
@@ -89,9 +77,6 @@ export declare const PlatformClientCommandController: GenService<{
      * unchanged — platform builders do not need to update their client_id
      * configuration after rotation.
      *
-     * @internal
-     * Authorization: Requires can_edit permission on the platform client resource.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.rotateSecret
      */
     rotateSecret: {

package/ai/stigmer/iam/platformclient/v1/command_pb.js

@@ -19,11 +19,6 @@ export const file_ai_stigmer_iam_platformclient_v1_command = /*@__PURE__*/ fileD
  * is generated server-side and returned only once in the create and
  * rotateSecret responses.
  *
- * @internal
- * PlatformClients hold credential material (client_secret_hash) and are always
- * org-private. There is no updateVisibility RPC — public visibility is
- * intentionally unsupported to prevent credential leakage.
- *
  * @generated from service ai.stigmer.iam.platformclient.v1.PlatformClientCommandController
  */
 export const PlatformClientCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_iam_platformclient_v1_command, 0);

package/ai/stigmer/iam/platformclient/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GA8EvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAoEvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/query_connect.d.ts

@@ -9,9 +9,6 @@ export declare const PlatformClientQueryController: {
         /**
          * Get a platform client by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.get
          */
         readonly get: {
@@ -26,10 +23,6 @@ export declare const PlatformClientQueryController: {
          * Resolves a human-readable reference like "acme/acme-dashboard" to the full
          * PlatformClient resource.
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.getByReference
          */
         readonly getByReference: {
@@ -44,9 +37,6 @@ export declare const PlatformClientQueryController: {
          * Returns every PlatformClient whose metadata.org matches the input org.
          * Typically a small set per org, so results are not paginated.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the organization resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.listByOrg
          */
         readonly listByOrg: {

package/ai/stigmer/iam/platformclient/v1/query_connect.js

@@ -17,9 +17,6 @@ export const PlatformClientQueryController = {
         /**
          * Get a platform client by its unique identifier.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the platform client resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.get
          */
         get: {
@@ -34,10 +31,6 @@ export const PlatformClientQueryController = {
          * Resolves a human-readable reference like "acme/acme-dashboard" to the full
          * PlatformClient resource.
          *
-         * @internal
-         * Custom authorization in handler — checks both direct resource access
-         * and organization-level visibility permissions.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.getByReference
          */
         getByReference: {
@@ -52,9 +45,6 @@ export const PlatformClientQueryController = {
          * Returns every PlatformClient whose metadata.org matches the input org.
          * Typically a small set per org, so results are not paginated.
          *
-         * @internal
-         * Authorization: Requires can_view permission on the organization resource.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.listByOrg
          */
         listByOrg: {

package/ai/stigmer/iam/platformclient/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;WAOG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,6BAA6B;YAChC,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,6BAA6B;YAChC,CAAC,EAAE,eAAe;YAClB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/platformclient/v1/query_pb.d.ts

@@ -15,9 +15,6 @@ export declare const PlatformClientQueryController: GenService<{
     /**
      * Get a platform client by its unique identifier.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the platform client resource.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.get
      */
     get: {
@@ -31,10 +28,6 @@ export declare const PlatformClientQueryController: GenService<{
      * Resolves a human-readable reference like "acme/acme-dashboard" to the full
      * PlatformClient resource.
      *
-     * @internal
-     * Custom authorization in handler — checks both direct resource access
-     * and organization-level visibility permissions.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.getByReference
      */
     getByReference: {
@@ -48,9 +41,6 @@ export declare const PlatformClientQueryController: GenService<{
      * Returns every PlatformClient whose metadata.org matches the input org.
      * Typically a small set per org, so results are not paginated.
      *
-     * @internal
-     * Authorization: Requires can_view permission on the organization resource.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientQueryController.listByOrg
      */
     listByOrg: {

package/ai/stigmer/iam/platformclient/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,8zBAA8zB,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE/iC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GA+CrC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,8zBAA8zB,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE/iC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAqCrC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/spec_pb.d.ts

@@ -1,4 +1,5 @@
 import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { ApiResourceReference } from "../../../commons/apiresource/io_pb.js";
 import type { IamRole } from "../../v1/enum_pb.js";
 import type { Timestamp } from "@bufbuild/protobuf/wkt";
 import type { Message } from "@bufbuild/protobuf";
@@ -165,6 +166,17 @@ export type PlatformClientSpec = Message<"ai.stigmer.iam.platformclient.v1.Platf
      * @generated from field: repeated string allowed_origins = 9;
      */
     allowedOrigins: string[];
+    /**
+     * Environments whose values are delivered to every agent execution
+     * created by a session this PlatformClient minted. This is how an
+     * embedded assistant reaches secret-gated MCP servers: the client — the
+     * connection resource — carries the credentials (for example a shared
+     * API secret), and minted-user executions receive its values at
+     * runtime. The agent and its default instance stay untouched.
+     *
+     * @generated from field: repeated ai.stigmer.commons.apiresource.ApiResourceReference environment_refs = 10;
+     */
+    environmentRefs: ApiResourceReference[];
 };
 /**
  * Describes the message ai.stigmer.iam.platformclient.v1.PlatformClientSpec.

package/ai/stigmer/iam/platformclient/v1/spec_pb.js

@@ -3,12 +3,14 @@
 /* eslint-disable */
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
 import { file_ai_stigmer_commons_apiresource_field_options } from "../../../commons/apiresource/field_options_pb.js";
+import { file_ai_stigmer_commons_apiresource_io } from "../../../commons/apiresource/io_pb.js";
 import { file_ai_stigmer_iam_v1_enum } from "../../v1/enum_pb.js";
+import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb.js";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/iam/platformclient/v1/spec.proto.
  */
-export const file_ai_stigmer_iam_platformclient_v1_spec = /*@__PURE__*/ fileDesc("CithaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MSLCAgoSUGxhdGZvcm1DbGllbnRTcGVjEhcKCWNsaWVudF9pZBgBIAEoCUIEyIUsARIgChJjbGllbnRfc2VjcmV0X2hhc2gYAiABKAlCBMiFLAESIAoSc2VjcmV0X2ZpbmdlcnByaW50GAMgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBSABKAgSHwoXYXV0b19wcm92aXNpb25fYWNjb3VudHMYBiABKAgSGQoRYXV0b19ncmFudF9vbl9vcmcYByABKAgSMwoPYXV0b19ncmFudF9yb2xlGAggASgOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZRIXCg9hbGxvd2VkX29yaWdpbnMYCSADKAliBnByb3RvMw", [file_ai_stigmer_commons_apiresource_field_options, file_ai_stigmer_iam_v1_enum, file_google_protobuf_timestamp]);
+export const file_ai_stigmer_iam_platformclient_v1_spec = /*@__PURE__*/ fileDesc("CithaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MSKNBAoSUGxhdGZvcm1DbGllbnRTcGVjEhcKCWNsaWVudF9pZBgBIAEoCUIEyIUsARIgChJjbGllbnRfc2VjcmV0X2hhc2gYAiABKAlCBMiFLAESIAoSc2VjcmV0X2ZpbmdlcnByaW50GAMgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBSABKAgSHwoXYXV0b19wcm92aXNpb25fYWNjb3VudHMYBiABKAgSGQoRYXV0b19ncmFudF9vbl9vcmcYByABKAgSMwoPYXV0b19ncmFudF9yb2xlGAggASgOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZRIXCg9hbGxvd2VkX29yaWdpbnMYCSADKAkSyAEKEGVudmlyb25tZW50X3JlZnMYCiADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNWIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_field_options, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_iam_v1_enum, file_buf_validate_validate, file_google_protobuf_timestamp]);
 /**
  * Describes the message ai.stigmer.iam.platformclient.v1.PlatformClientSpec.
  * Use `create(PlatformClientSpecSchema)` to create a new message.

package/ai/stigmer/iam/platformclient/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,wiBAAwiB,EAAE,CAAC,iDAAiD,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AA2KvqB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAE/F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,szBAAszB,EAAE,CAAC,iDAAiD,EAAE,sCAAsC,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAuLz/B;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_connect.d.ts

@@ -53,11 +53,6 @@ export declare const PlatformClientTokenController: {
          * is not on the list are refused PERMISSION_DENIED (see the
          * allowed_origins field docs in spec.proto for the exact semantics).
          *
-         * @internal
-         * This RPC is public — no Bearer token is required. The caller authenticates
-         * by providing client_id + client_secret in the request body. The handler
-         * validates these credentials as business logic, not via the auth interceptor.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintUserToken
          */
         readonly mintUserToken: {
@@ -73,13 +68,6 @@ export declare const PlatformClientTokenController: {
          * PlatformClient and guest identity account lazily, and returns a short-lived
          * Stigmer-signed JWT scoped to that org.
          *
-         * @internal
-         * Public — no Bearer token. No PlatformClient credentials. The handler gates
-         * on an enabled public-audience share (NOT_FOUND when disabled or missing)
-         * and stamps the resolved share's id into the guest JWT as the share_id
-         * claim — the create-time gate re-reads the live share by that id on every
-         * session/execution create (decision 011 D6).
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintGuestToken
          */
         readonly mintGuestToken: {

package/ai/stigmer/iam/platformclient/v1/token_connect.js

@@ -59,11 +59,6 @@ export const PlatformClientTokenController = {
          * is not on the list are refused PERMISSION_DENIED (see the
          * allowed_origins field docs in spec.proto for the exact semantics).
          *
-         * @internal
-         * This RPC is public — no Bearer token is required. The caller authenticates
-         * by providing client_id + client_secret in the request body. The handler
-         * validates these credentials as business logic, not via the auth interceptor.
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintUserToken
          */
         mintUserToken: {
@@ -79,13 +74,6 @@ export const PlatformClientTokenController = {
          * PlatformClient and guest identity account lazily, and returns a short-lived
          * Stigmer-signed JWT scoped to that org.
          *
-         * @internal
-         * Public — no Bearer token. No PlatformClient credentials. The handler gates
-         * on an enabled public-audience share (NOT_FOUND when disabled or missing)
-         * and stamps the resolved share's id into the guest JWT as the share_id
-         * claim — the create-time gate re-reads the live share by that id on every
-         * session/execution create (decision 011 D6).
-         *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintGuestToken
          */
         mintGuestToken: {

package/ai/stigmer/iam/platformclient/v1/token_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsCG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;WAeG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"token_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8HAA8H;AAC9H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/platformclient/v1/token_pb.d.ts

@@ -141,29 +141,6 @@ export type MintGuestTokenRequest = Message<"ai.stigmer.iam.platformclient.v1.Mi
      * literal value "null" reports a framed page whose parent origin could not
      * be determined (opaque origin).
      *
-     * @internal
-     * Validated at mint against the share's spec.allowed_origins: empty list
-     * admits any origin; a non-empty list refuses PERMISSION_DENIED for
-     * unlisted origins and for "null". An empty field always passes for
-     * hosted-page and non-browser requests (the anyone-with-link hosted
-     * page). The validated value is stamped into the guest JWT as the
-     * embed_origin claim and re-validated against the live list by the
-     * guest create-time gate.
-     *
-     * The hosted server cross-checks this field against the request's
-     * browser-enforced Origin header (stigmer-cloud#341). When the header
-     * is a third-party origin (a direct SDK embed), the header is
-     * authoritative: a non-empty field that disagrees with it is refused
-     * PERMISSION_DENIED naming both origins, and an empty field resolves
-     * to the header instead of the hosted-page exemption. When the header
-     * is Stigmer's own hosted-page origin, this self-report is the only
-     * embedder signal (the iframe'd page's RPCs carry Stigmer's origin) —
-     * the widget code derives it from browser-authentic sources the
-     * embedder cannot alter. Non-browser callers send no Origin header and
-     * keep the self-report semantics; they gain nothing by omitting it
-     * since the hosted link is anyone-with-link (decision 001) — rate
-     * limits and the billing gate remain the API guards.
-     *
      * @generated from field: string embed_origin = 4;
      */
     embedOrigin: string;
@@ -173,15 +150,6 @@ export type MintGuestTokenRequest = Message<"ai.stigmer.iam.platformclient.v1.Mi
      * Required when the share link has been locked with rotateShareLink;
      * ignored for plain share links.
      *
-     * @internal
-     * Validated at mint against the share's live status.share_link_token
-     * (mismatch or absence answers the same NOT_FOUND as a disabled share,
-     * so a killed link is indistinguishable from a nonexistent one). The
-     * validated value is stamped into the guest JWT as the link_token claim
-     * and re-validated against the live value by the guest create-time gate
-     * on every session/execution create — rotation therefore revokes live
-     * guest tokens on their next message, exactly like disabling the share.
-     *
      * @generated from field: string link_token = 5;
      */
     linkToken: string;
@@ -283,11 +251,6 @@ export declare const PlatformClientTokenController: GenService<{
      * is not on the list are refused PERMISSION_DENIED (see the
      * allowed_origins field docs in spec.proto for the exact semantics).
      *
-     * @internal
-     * This RPC is public — no Bearer token is required. The caller authenticates
-     * by providing client_id + client_secret in the request body. The handler
-     * validates these credentials as business logic, not via the auth interceptor.
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintUserToken
      */
     mintUserToken: {
@@ -302,13 +265,6 @@ export declare const PlatformClientTokenController: GenService<{
      * PlatformClient and guest identity account lazily, and returns a short-lived
      * Stigmer-signed JWT scoped to that org.
      *
-     * @internal
-     * Public — no Bearer token. No PlatformClient credentials. The handler gates
-     * on an enabled public-audience share (NOT_FOUND when disabled or missing)
-     * and stamps the resolved share's id into the guest JWT as the share_id
-     * claim — the create-time gate re-reads the live share by that id on every
-     * session/execution create (decision 011 D6).
-     *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientTokenController.mintGuestToken
      */
     mintGuestToken: {

package/ai/stigmer/iam/platformclient/v1/token_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,omDAAomD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwE3rD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAyF9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAwC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAkErC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"token_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/token_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,8HAA8H;AAC9H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,omDAAomD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwE3rD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA+B9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAyD9D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAwC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAsDrC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/v1/enum_pb.d.ts

@@ -210,12 +210,6 @@ export declare enum IamPermission {
      * conversations: reply to customers as the business, take over and
      * hand back the control token, and clear the attention flag.
      *
-     * @internal
-     * channel-conversations DD-010: computed from the participant role on
-     * agent_channel. Deliberately distinct from can_edit — "may talk to
-     * this channel's customers" and "may configure this channel" are
-     * different powers, and the ISC pilot's trainers hold only the first.
-     *
      * @generated from enum value: can_participate = 36;
      */
     can_participate = 36,
@@ -230,7 +224,33 @@ export declare enum IamPermission {
      *
      * @generated from enum value: can_write_reserved_labels = 37;
      */
-    can_write_reserved_labels = 37
+    can_write_reserved_labels = 37,
+    /**
+     * Platform-level permission to view platform provider standing: the
+     * canary-probe verdicts (health, billing/auth rejections, latency) for
+     * the platform's own LLM provider accounts. Read-only and gated to
+     * platform operators — provider account health is platform-internal,
+     * never org-visible. Deliberately distinct from the manage-class
+     * platform permissions: the standing console only observes (cloud#447).
+     *
+     * @generated from enum value: can_view_provider_standing = 38;
+     */
+    can_view_provider_standing = 38,
+    /**
+     * Platform-level permission to set a resource's visibility to PUBLIC —
+     * the only level that crosses every org boundary (the cross-org
+     * "explore" catalog). Gated to platform operators in the cloud
+     * edition: public listing is a curation decision, requested by the
+     * owner and granted by the platform team. Enforced at BOTH doors a
+     * resource can become public through — updateVisibility escalation and
+     * create-with-public — while org/platform levels and un-publishing
+     * stay self-service (resource can_edit). The OSS edition is
+     * deliberately unguarded: the self-hosted operator owns the store,
+     * the same scoping cloud#320 applied to reserved labels.
+     *
+     * @generated from enum value: can_set_public_visibility = 39;
+     */
+    can_set_public_visibility = 39
 }
 /**
  * Describes the enum ai.stigmer.iam.v1.IamPermission.
@@ -284,13 +304,6 @@ export declare enum IamRole {
      * conversations and speak to its customers as the business (reply, take
      * over, hand back, clear attention). Not a channel configurator.
      *
-     * @internal
-     * channel-conversations DD-010. Grantable only on agent_channel — the
-     * second kind-scoped role after organization's admin/member; the
-     * grantable_roles subsetting is the mechanism, not a new one. Team
-     * usersets ([team#member]) are the named widening the day a team FGA
-     * type lands.
-     *
      * @generated from enum value: participant = 5;
      */
     participant = 5

package/ai/stigmer/iam/v1/enum_pb.js

@@ -5,7 +5,7 @@ import { enumDesc, fileDesc } from "@bufbuild/protobuf/codegenv1";
 /**
  * Describes the file ai/stigmer/iam/v1/enum.proto.
  */
-export const file_ai_stigmer_iam_v1_enum = /*@__PURE__*/ fileDesc("ChxhaS9zdGlnbWVyL2lhbS92MS9lbnVtLnByb3RvEhFhaS5zdGlnbWVyLmlhbS52MSqTBwoNSWFtUGVybWlzc2lvbhIPCgt1bnNwZWNpZmllZBAAEgwKCGNhbl92aWV3EAESDAoIY2FuX2VkaXQQAhIOCgpjYW5fZGVsZXRlEAMSFAoQY2FuX2dyYW50X2FjY2VzcxAEEhMKD2Nhbl92aWV3X2FjY2VzcxAFEhQKEGNhbl9jcmVhdGVfYWdlbnQQBhIXChNjYW5fY3JlYXRlX3dvcmtmbG93EAcSFgoSY2FuX2NyZWF0ZV9zZXNzaW9uEAgSFAoQY2FuX2NyZWF0ZV9za2lsbBAJEhYKEmNhbl9jcmVhdGVfcHJvamVjdBAKEhIKDmNhbl9jcmVhdGVfaWRwEAsSGgoWY2FuX2NyZWF0ZV9lbnZpcm9ubWVudBAMEh8KG2Nhbl9jcmVhdGVfaWRlbnRpdHlfYWNjb3VudBAVEhgKFGNhbl9jcmVhdGVfb2F1dGhfYXBwEBcSHgoaY2FuX2NyZWF0ZV9wbGF0Zm9ybV9jbGllbnQQGBIbChdjYW5fY3JlYXRlX2V4ZWN1dGlvbl9pbhANEhcKE2Nhbl9jcmVhdGVfaW5zdGFuY2UQDhIPCgtjYW5fZXhlY3V0ZRAPEhQKEGNhbl9yZWFkX3NlY3JldHMQEBIVChFjYW5fYm9vdHN0cmFwX2lhbRAREiAKHGNhbl9tYW5hZ2VfaWRlbnRpdHlfYWNjb3VudHMQEhIYChRsb2dpbl90b19iYWNrX29mZmljZRAUEg8KC2Nhbl9jb25uZWN0EBYSFQoRY2FuX2NyZWF0ZV9ydW5uZXIQGRIaChJjYW5fZGVsZXRlX3Nlc3Npb24QGhoCCAESFAoQY2FuX3ZpZXdfYmlsbGluZxAbEhYKEmNhbl9tYW5hZ2VfYmlsbGluZxAcEhsKF2Nhbl9leGVjdXRlX2JpbGxpbmdfb3BzEB0SGgoWY2FuX2NyZWF0ZV9hZ2VudF9zaGFyZRAeEhoKFmNhbl9jcmVhdGVfY2hhbm5lbF9hcHAQHxIcChhjYW5fbWFuYWdlX21vZGVsX3ByaWNpbmcQIBIeChpjYW5fbWFuYWdlX2N1cnNvcl9hY2NvdW50cxAjEhMKD2Nhbl9wYXJ0aWNpcGF0ZRAkEh0KGWNhbl93cml0ZV9yZXNlcnZlZF9sYWJlbHMQJSIECCEQISIECCIQIioPY2FuX3VzZV9yZWNvcmRzKhRjYW5fY3JlYXRlX2RhdGFzdG9yZSpiCgdJYW1Sb2xlEhgKFGlhbV9yb2xlX3Vuc3BlY2lmaWVkEAASCQoFb3duZXIQARIJCgVhZG1pbhACEgoKBm1lbWJlchADEgoKBnZpZXdlchAEEg8KC3BhcnRpY2lwYW50EAViBnByb3RvMw");
+export const file_ai_stigmer_iam_v1_enum = /*@__PURE__*/ fileDesc("ChxhaS9zdGlnbWVyL2lhbS92MS9lbnVtLnByb3RvEhFhaS5zdGlnbWVyLmlhbS52MSrSBwoNSWFtUGVybWlzc2lvbhIPCgt1bnNwZWNpZmllZBAAEgwKCGNhbl92aWV3EAESDAoIY2FuX2VkaXQQAhIOCgpjYW5fZGVsZXRlEAMSFAoQY2FuX2dyYW50X2FjY2VzcxAEEhMKD2Nhbl92aWV3X2FjY2VzcxAFEhQKEGNhbl9jcmVhdGVfYWdlbnQQBhIXChNjYW5fY3JlYXRlX3dvcmtmbG93EAcSFgoSY2FuX2NyZWF0ZV9zZXNzaW9uEAgSFAoQY2FuX2NyZWF0ZV9za2lsbBAJEhYKEmNhbl9jcmVhdGVfcHJvamVjdBAKEhIKDmNhbl9jcmVhdGVfaWRwEAsSGgoWY2FuX2NyZWF0ZV9lbnZpcm9ubWVudBAMEh8KG2Nhbl9jcmVhdGVfaWRlbnRpdHlfYWNjb3VudBAVEhgKFGNhbl9jcmVhdGVfb2F1dGhfYXBwEBcSHgoaY2FuX2NyZWF0ZV9wbGF0Zm9ybV9jbGllbnQQGBIbChdjYW5fY3JlYXRlX2V4ZWN1dGlvbl9pbhANEhcKE2Nhbl9jcmVhdGVfaW5zdGFuY2UQDhIPCgtjYW5fZXhlY3V0ZRAPEhQKEGNhbl9yZWFkX3NlY3JldHMQEBIVChFjYW5fYm9vdHN0cmFwX2lhbRAREiAKHGNhbl9tYW5hZ2VfaWRlbnRpdHlfYWNjb3VudHMQEhIYChRsb2dpbl90b19iYWNrX29mZmljZRAUEg8KC2Nhbl9jb25uZWN0EBYSFQoRY2FuX2NyZWF0ZV9ydW5uZXIQGRIaChJjYW5fZGVsZXRlX3Nlc3Npb24QGhoCCAESFAoQY2FuX3ZpZXdfYmlsbGluZxAbEhYKEmNhbl9tYW5hZ2VfYmlsbGluZxAcEhsKF2Nhbl9leGVjdXRlX2JpbGxpbmdfb3BzEB0SGgoWY2FuX2NyZWF0ZV9hZ2VudF9zaGFyZRAeEhoKFmNhbl9jcmVhdGVfY2hhbm5lbF9hcHAQHxIcChhjYW5fbWFuYWdlX21vZGVsX3ByaWNpbmcQIBIeChpjYW5fbWFuYWdlX2N1cnNvcl9hY2NvdW50cxAjEhMKD2Nhbl9wYXJ0aWNpcGF0ZRAkEh0KGWNhbl93cml0ZV9yZXNlcnZlZF9sYWJlbHMQJRIeChpjYW5fdmlld19wcm92aWRlcl9zdGFuZGluZxAmEh0KGWNhbl9zZXRfcHVibGljX3Zpc2liaWxpdHkQJyIECCEQISIECCIQIioPY2FuX3VzZV9yZWNvcmRzKhRjYW5fY3JlYXRlX2RhdGFzdG9yZSpiCgdJYW1Sb2xlEhgKFGlhbV9yb2xlX3Vuc3BlY2lmaWVkEAASCQoFb3duZXIQARIJCgVhZG1pbhACEgoKBm1lbWJlchADEgoKBnZpZXdlchAEEg8KC3BhcnRpY2lwYW50EAViBnByb3RvMw");
 /**
  * IamPermission defines the permissions checked by the authorization
  * interceptor before an RPC handler executes.
@@ -214,12 +214,6 @@ export var IamPermission;
      * conversations: reply to customers as the business, take over and
      * hand back the control token, and clear the attention flag.
      *
-     * @internal
-     * channel-conversations DD-010: computed from the participant role on
-     * agent_channel. Deliberately distinct from can_edit — "may talk to
-     * this channel's customers" and "may configure this channel" are
-     * different powers, and the ISC pilot's trainers hold only the first.
-     *
      * @generated from enum value: can_participate = 36;
      */
     IamPermission[IamPermission["can_participate"] = 36] = "can_participate";
@@ -235,6 +229,32 @@ export var IamPermission;
      * @generated from enum value: can_write_reserved_labels = 37;
      */
     IamPermission[IamPermission["can_write_reserved_labels"] = 37] = "can_write_reserved_labels";
+    /**
+     * Platform-level permission to view platform provider standing: the
+     * canary-probe verdicts (health, billing/auth rejections, latency) for
+     * the platform's own LLM provider accounts. Read-only and gated to
+     * platform operators — provider account health is platform-internal,
+     * never org-visible. Deliberately distinct from the manage-class
+     * platform permissions: the standing console only observes (cloud#447).
+     *
+     * @generated from enum value: can_view_provider_standing = 38;
+     */
+    IamPermission[IamPermission["can_view_provider_standing"] = 38] = "can_view_provider_standing";
+    /**
+     * Platform-level permission to set a resource's visibility to PUBLIC —
+     * the only level that crosses every org boundary (the cross-org
+     * "explore" catalog). Gated to platform operators in the cloud
+     * edition: public listing is a curation decision, requested by the
+     * owner and granted by the platform team. Enforced at BOTH doors a
+     * resource can become public through — updateVisibility escalation and
+     * create-with-public — while org/platform levels and un-publishing
+     * stay self-service (resource can_edit). The OSS edition is
+     * deliberately unguarded: the self-hosted operator owns the store,
+     * the same scoping cloud#320 applied to reserved labels.
+     *
+     * @generated from enum value: can_set_public_visibility = 39;
+     */
+    IamPermission[IamPermission["can_set_public_visibility"] = 39] = "can_set_public_visibility";
 })(IamPermission || (IamPermission = {}));
 /**
  * Describes the enum ai.stigmer.iam.v1.IamPermission.
@@ -289,13 +309,6 @@ export var IamRole;
      * conversations and speak to its customers as the business (reply, take
      * over, hand back, clear attention). Not a channel configurator.
      *
-     * @internal
-     * channel-conversations DD-010. Grantable only on agent_channel — the
-     * second kind-scoped role after organization's admin/member; the
-     * grantable_roles subsetting is the mechanism, not a new one. Team
-     * usersets ([team#member]) are the named widening the day a team FGA
-     * type lands.
-     *
      * @generated from enum value: participant = 5;
      */
     IamRole[IamRole["participant"] = 5] = "participant";

package/ai/stigmer/iam/v1/enum_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/iam/v1/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+FAA+F;AAC/F,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAY,aAAa,CAC/D,QAAQ,CAAC,45CAA45C,CAAC,CAAC;AAEz6C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,aAwPX;AAxPD,WAAY,aAAa;IACvB;;OAEG;IACH,+DAAe,CAAA;IAEf;;;;OAIG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,6DAAc,CAAA;IAEd;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,uEAAmB,CAAA;IAEnB;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,+EAAuB,CAAA;IAEvB;;OAEG;IACH,6EAAsB,CAAA;IAEtB;;OAEG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;OAEG;IACH,sEAAmB,CAAA;IAEnB;;OAEG;IACH,sFAA2B,CAAA;IAE3B;;OAEG;IACH,gGAAgC,CAAA;IAEhC;;OAEG;IACH,kFAAyB,CAAA;IAEzB;;OAEG;IACH,8FAA+B,CAAA;IAE/B;;;;OAIG;IACH,wFAA4B,CAAA;IAE5B;;OAEG;IACH,gFAAwB,CAAA;IAExB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;OAEG;IACH,kGAAiC,CAAA;IAEjC;;;;OAIG;IACH,kFAAyB,CAAA;IAEzB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;;;;;;;OAQG;IACH,8EAAuB,CAAA;IAEvB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;;;;OAKG;IACH,wFAA4B,CAAA;IAE5B;;;;;;;;;;;OAWG;IACH,sFAA2B,CAAA;IAE3B;;;;;;OAMG;IACH,sFAA2B,CAAA;IAE3B;;;;;;;OAOG;IACH,0FAA6B,CAAA;IAE7B;;;;;;;;OAQG;IACH,8FAA+B,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,wEAAoB,CAAA;IAEpB;;;;;;;;;;OAUG;IACH,4FAA8B,CAAA;AAChC,CAAC,EAxPW,aAAa,KAAb,aAAa,QAwPxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;AAE3C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,OAiDX;AAjDD,WAAY,OAAO;IACjB;;OAEG;IACH,qEAAwB,CAAA;IAExB;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;;;;;;;;;;OAaG;IACH,mDAAe,CAAA;AACjB,CAAC,EAjDW,OAAO,KAAP,OAAO,QAiDlB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqB,aAAa,CAC1D,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/iam/v1/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+FAA+F;AAC/F,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAY,aAAa,CAC/D,QAAQ,CAAC,g/CAAg/C,CAAC,CAAC;AAE7/C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,aA8QX;AA9QD,WAAY,aAAa;IACvB;;OAEG;IACH,+DAAe,CAAA;IAEf;;;;OAIG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,yDAAY,CAAA;IAEZ;;OAEG;IACH,6DAAc,CAAA;IAEd;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,uEAAmB,CAAA;IAEnB;;;;OAIG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,+EAAuB,CAAA;IAEvB;;OAEG;IACH,6EAAsB,CAAA;IAEtB;;OAEG;IACH,yEAAoB,CAAA;IAEpB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;OAEG;IACH,sEAAmB,CAAA;IAEnB;;OAEG;IACH,sFAA2B,CAAA;IAE3B;;OAEG;IACH,gGAAgC,CAAA;IAEhC;;OAEG;IACH,kFAAyB,CAAA;IAEzB;;OAEG;IACH,8FAA+B,CAAA;IAE/B;;;;OAIG;IACH,wFAA4B,CAAA;IAE5B;;OAEG;IACH,gFAAwB,CAAA;IAExB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;OAEG;IACH,kGAAiC,CAAA;IAEjC;;;;OAIG;IACH,kFAAyB,CAAA;IAEzB;;;;OAIG;IACH,gEAAgB,CAAA;IAEhB;;;;OAIG;IACH,4EAAsB,CAAA;IAEtB;;;;;;;;OAQG;IACH,8EAAuB,CAAA;IAEvB;;;;OAIG;IACH,0EAAqB,CAAA;IAErB;;OAEG;IACH,8EAAuB,CAAA;IAEvB;;;;;OAKG;IACH,wFAA4B,CAAA;IAE5B;;;;;;;;;;;OAWG;IACH,sFAA2B,CAAA;IAE3B;;;;;;OAMG;IACH,sFAA2B,CAAA;IAE3B;;;;;;;OAOG;IACH,0FAA6B,CAAA;IAE7B;;;;;;;;OAQG;IACH,8FAA+B,CAAA;IAE/B;;;;;;OAMG;IACH,wEAAoB,CAAA;IAEpB;;;;;;;;;;OAUG;IACH,4FAA8B,CAAA;IAE9B;;;;;;;;;OASG;IACH,8FAA+B,CAAA;IAE/B;;;;;;;;;;;;;OAaG;IACH,4FAA8B,CAAA;AAChC,CAAC,EA9QW,aAAa,KAAb,aAAa,QA8QxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;AAE3C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,OA0CX;AA1CD,WAAY,OAAO;IACjB;;OAEG;IACH,qEAAwB,CAAA;IAExB;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,uCAAS,CAAA;IAET;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;OAIG;IACH,yCAAU,CAAA;IAEV;;;;;;OAMG;IACH,mDAAe,CAAA;AACjB,CAAC,EA1CW,OAAO,KAAP,OAAO,QA0ClB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqB,aAAa,CAC1D,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/platform/cursoraccount/v1/command_connect.d.ts

@@ -8,13 +8,6 @@
  * the resource holds provider key material and per-member spend, which
  * are platform-internal and never org-visible.
  *
- * @internal
- * Cloud-only. The OSS Go server does not implement this service — in the
- * OSS edition Cursor credentials are the user's own (BYOK env var), so
- * there is nothing to manage. Handlers refuse writes when secret
- * encryption is not enabled on the deployment (FAILED_PRECONDITION):
- * silently persisting plaintext keys is never acceptable for this store.
- *
  * @generated from service ai.stigmer.platform.cursoraccount.v1.CursorAccountCommandController
  */
 export declare const CursorAccountCommandController: {

package/ai/stigmer/platform/cursoraccount/v1/command_connect.js

@@ -15,13 +15,6 @@ import { MethodKind } from "@bufbuild/protobuf";
  * the resource holds provider key material and per-member spend, which
  * are platform-internal and never org-visible.
  *
- * @internal
- * Cloud-only. The OSS Go server does not implement this service — in the
- * OSS edition Cursor credentials are the user's own (BYOK env var), so
- * there is nothing to manage. Handlers refuse writes when secret
- * encryption is not enabled on the deployment (FAILED_PRECONDITION):
- * silently persisting plaintext keys is never acceptable for this store.
- *
  * @generated from service ai.stigmer.platform.cursoraccount.v1.CursorAccountCommandController
  */
 export const CursorAccountCommandController = {

package/ai/stigmer/platform/cursoraccount/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/platform/cursoraccount/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,wIAAwI;AACxI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAC/M,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,QAAQ,EAAE,qEAAqE;IAC/E,OAAO,EAAE;QACP;;;;;;;;;;WAUG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,qBAAqB,EAAE;YACrB,IAAI,EAAE,uBAAuB;YAC7B,CAAC,EAAE,0BAA0B;YAC7B,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,iBAAiB;YACpB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/platform/cursoraccount/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,wIAAwI;AACxI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAC/M,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,QAAQ,EAAE,qEAAqE;IAC/E,OAAO,EAAE;QACP;;;;;;;;;;WAUG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;WAKG;QACH,qBAAqB,EAAE;YACrB,IAAI,EAAE,uBAAuB;YAC7B,CAAC,EAAE,0BAA0B;YAC7B,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,iBAAiB;YACpB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/platform/cursoraccount/v1/command_pb.d.ts

@@ -15,13 +15,6 @@ export declare const file_ai_stigmer_platform_cursoraccount_v1_command: GenFile;
  * the resource holds provider key material and per-member spend, which
  * are platform-internal and never org-visible.
  *
- * @internal
- * Cloud-only. The OSS Go server does not implement this service — in the
- * OSS edition Cursor credentials are the user's own (BYOK env var), so
- * there is nothing to manage. Handlers refuse writes when secret
- * encryption is not enabled on the deployment (FAILED_PRECONDITION):
- * silently persisting plaintext keys is never acceptable for this store.
- *
  * @generated from service ai.stigmer.platform.cursoraccount.v1.CursorAccountCommandController
  */
 export declare const CursorAccountCommandController: GenService<{

package/ai/stigmer/platform/cursoraccount/v1/command_pb.js

@@ -19,13 +19,6 @@ export const file_ai_stigmer_platform_cursoraccount_v1_command = /*@__PURE__*/ f
  * the resource holds provider key material and per-member spend, which
  * are platform-internal and never org-visible.
  *
- * @internal
- * Cloud-only. The OSS Go server does not implement this service — in the
- * OSS edition Cursor credentials are the user's own (BYOK env var), so
- * there is nothing to manage. Handlers refuse writes when secret
- * encryption is not enabled on the deployment (FAILED_PRECONDITION):
- * silently persisting plaintext keys is never acceptable for this store.
- *
  * @generated from service ai.stigmer.platform.cursoraccount.v1.CursorAccountCommandController
  */
 export const CursorAccountCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_platform_cursoraccount_v1_command, 0);

package/ai/stigmer/platform/cursoraccount/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/platform/cursoraccount/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wIAAwI;AACxI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,wDAAwD,EAAE,MAAM,wBAAwB,CAAC;AAElG,OAAO,EAAE,4CAA4C,EAAE,MAAM,YAAY,CAAC;AAE1E;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,s2DAAs2D,EAAE,CAAC,0CAA0C,EAAE,wDAAwD,EAAE,4CAA4C,CAAC,CAAC,CAAC;AAEzgE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAyEtC,aAAa,CAChB,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/platform/cursoraccount/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wIAAwI;AACxI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,wDAAwD,EAAE,MAAM,wBAAwB,CAAC;AAElG,OAAO,EAAE,4CAA4C,EAAE,MAAM,YAAY,CAAC;AAE1E;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,s2DAAs2D,EAAE,CAAC,0CAA0C,EAAE,wDAAwD,EAAE,4CAA4C,CAAC,CAAC,CAAC;AAEzgE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAyEtC,aAAa,CAChB,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/platform/cursoraccount/v1/query_connect.d.ts

@@ -6,9 +6,6 @@
  * reveals team structure and per-member spend, which are
  * platform-internal.
  *
- * @internal
- * Cloud-only; not implemented by the OSS Go server.
- *
  * @generated from service ai.stigmer.platform.cursoraccount.v1.CursorAccountQueryController
  */
 export declare const CursorAccountQueryController: {

package/ai/stigmer/platform/cursoraccount/v1/query_connect.js

@@ -12,9 +12,6 @@ import { MethodKind } from "@bufbuild/protobuf";
  * reveals team structure and per-member spend, which are
  * platform-internal.
  *
- * @internal
- * Cloud-only; not implemented by the OSS Go server.
- *
  * @generated from service ai.stigmer.platform.cursoraccount.v1.CursorAccountQueryController
  */
 export const CursorAccountQueryController = {