@stigmer/protos 3.12.4 → 3.12.6

package/ai/stigmer/agentic/skill/v1/command_connect.js

@@ -65,6 +65,10 @@ export const SkillCommandController = {
          * metadata fields untouched. Use this to make a skill publicly accessible
          * or to revoke public access.
          *
+         * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+         * every org boundary, so it is granted by the platform team on request.
+         * Un-publishing and all other levels stay self-service.
+         *
          * @generated from rpc ai.stigmer.agentic.skill.v1.SkillCommandController.updateVisibility
          */
         updateVisibility: {

package/ai/stigmer/agentic/skill/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1J,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,oDAAoD;IAC9D,OAAO,EAAE;QACP;;;;;;WAMG;QACH,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,mCAAmC;YACtC,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,qCAAqC;YACxC,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1J,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,oDAAoD;IAC9D,OAAO,EAAE;QACP;;;;;;WAMG;QACH,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,mCAAmC;YACtC,CAAC,EAAE,sBAAsB;YACzB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,qCAAqC;YACxC,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;WAWG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/skill/v1/command_pb.d.ts

@@ -60,6 +60,10 @@ export declare const SkillCommandController: GenService<{
      * metadata fields untouched. Use this to make a skill publicly accessible
      * or to revoke public access.
      *
+     * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+     * every org boundary, so it is granted by the platform team on request.
+     * Un-publishing and all other levels stay self-service.
+     *
      * @generated from rpc ai.stigmer.agentic.skill.v1.SkillCommandController.updateVisibility
      */
     updateVisibility: {

package/ai/stigmer/agentic/skill/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,qyCAAqyC,EAAE,CAAC,oCAAoC,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE5gD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAkE9B,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/skill/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,qyCAAqyC,EAAE,CAAC,oCAAoC,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE5gD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAsE9B,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/workflow/v1/command_connect.d.ts

@@ -47,6 +47,10 @@ export declare const WorkflowCommandController: {
          * make a workflow publicly accessible or to revoke public access without
          * sending the entire workflow resource (avoiding read-modify-write races).
          *
+         * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+         * every org boundary, so it is granted by the platform team on request.
+         * Un-publishing and all other levels stay self-service.
+         *
          * @generated from rpc ai.stigmer.agentic.workflow.v1.WorkflowCommandController.updateVisibility
          */
         readonly updateVisibility: {

package/ai/stigmer/agentic/workflow/v1/command_connect.js

@@ -57,6 +57,10 @@ export const WorkflowCommandController = {
          * make a workflow publicly accessible or to revoke public access without
          * sending the entire workflow resource (avoiding read-modify-write races).
          *
+         * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+         * every org boundary, so it is granted by the platform team on request.
+         * Un-publishing and all other levels stay self-service.
+         *
          * @generated from rpc ai.stigmer.agentic.workflow.v1.WorkflowCommandController.updateVisibility
          */
         updateVisibility: {

package/ai/stigmer/agentic/workflow/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflow/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4HAA4H;AAC5H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,0DAA0D;IACpE,OAAO,EAAE;QACP;;;;WAIG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,UAAU;YACb,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,YAAY;YAClB,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflow/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4HAA4H;AAC5H,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,0DAA0D;IACpE,OAAO,EAAE;QACP;;;;WAIG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,UAAU;YACb,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,YAAY;YAClB,CAAC,EAAE,uBAAuB;YAC1B,CAAC,EAAE,QAAQ;YACX,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/workflow/v1/command_pb.d.ts

@@ -52,6 +52,10 @@ export declare const WorkflowCommandController: GenService<{
      * make a workflow publicly accessible or to revoke public access without
      * sending the entire workflow resource (avoiding read-modify-write races).
      *
+     * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+     * every org boundary, so it is granted by the platform team on request.
+     * Un-publishing and all other levels stay self-service.
+     *
      * @generated from rpc ai.stigmer.agentic.workflow.v1.WorkflowCommandController.updateVisibility
      */
     updateVisibility: {

package/ai/stigmer/agentic/workflow/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflow/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,uCAAuC,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,sCAAsC,EAAE,MAAM,YAAY,CAAC;AAEpE,OAAO,EAAE,yDAAyD,EAAE,MAAM,+BAA+B,CAAC;AAE1G,OAAO,EAAE,2CAA2C,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,gpDAAgpD,EAAE,CAAC,uCAAuC,EAAE,sCAAsC,EAAE,yDAAyD,EAAE,2CAA2C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEr+D;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAiGjC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflow/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4HAA4H;AAC5H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,uCAAuC,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,sCAAsC,EAAE,MAAM,YAAY,CAAC;AAEpE,OAAO,EAAE,yDAAyD,EAAE,MAAM,+BAA+B,CAAC;AAE1G,OAAO,EAAE,2CAA2C,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,gpDAAgpD,EAAE,CAAC,uCAAuC,EAAE,sCAAsC,EAAE,yDAAyD,EAAE,2CAA2C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEr+D;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAqGjC,aAAa,CAChB,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/workflow/v1/tasks/human_input_pb.d.ts

@@ -217,10 +217,18 @@ export declare enum HumanInputTimeoutPolicy {
      */
     HUMAN_INPUT_TIMEOUT_DENY = 3,
     /**
-     * Escalate: branch to a named escalation task.
-     * Requires a corresponding outcome with then set, or a try_catch handler.
-     * Use when timeout should trigger a different workflow path rather than
-     * a simple approve/deny decision.
+     * Escalate: branch to a designated escalation path.
+     * Requires an outcome NAMED "escalate" with `then` set — on timeout the
+     * task completes as if the reviewer selected that outcome, and its `then`
+     * routes the escalation branch (the same routing a reviewer manually
+     * choosing the escalate outcome takes). Use when timeout should trigger a
+     * different workflow path rather than a simple approve/deny decision.
+     * Task output: {"outcome": "escalate", "auto_resolved": true, "reason": "timeout"}
+     *
+     * Validation fails closed (stigmer/stigmer#781): selecting this policy
+     * without an "escalate" outcome carrying `then` is refused at apply and
+     * at the runner's load — a gate whose escalation has nowhere to go must
+     * never persist.
      *
      * @generated from enum value: HUMAN_INPUT_TIMEOUT_ESCALATE = 4;
      */

package/ai/stigmer/agentic/workflow/v1/tasks/human_input_pb.js

@@ -57,10 +57,18 @@ export var HumanInputTimeoutPolicy;
      */
     HumanInputTimeoutPolicy[HumanInputTimeoutPolicy["HUMAN_INPUT_TIMEOUT_DENY"] = 3] = "HUMAN_INPUT_TIMEOUT_DENY";
     /**
-     * Escalate: branch to a named escalation task.
-     * Requires a corresponding outcome with then set, or a try_catch handler.
-     * Use when timeout should trigger a different workflow path rather than
-     * a simple approve/deny decision.
+     * Escalate: branch to a designated escalation path.
+     * Requires an outcome NAMED "escalate" with `then` set — on timeout the
+     * task completes as if the reviewer selected that outcome, and its `then`
+     * routes the escalation branch (the same routing a reviewer manually
+     * choosing the escalate outcome takes). Use when timeout should trigger a
+     * different workflow path rather than a simple approve/deny decision.
+     * Task output: {"outcome": "escalate", "auto_resolved": true, "reason": "timeout"}
+     *
+     * Validation fails closed (stigmer/stigmer#781): selecting this policy
+     * without an "escalate" outcome carrying `then` is refused at apply and
+     * at the runner's load — a gate whose escalation has nowhere to go must
+     * never persist.
      *
      * @generated from enum value: HUMAN_INPUT_TIMEOUT_ESCALATE = 4;
      */

package/ai/stigmer/agentic/workflow/v1/tasks/human_input_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"human_input_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/agentic/workflow/v1/tasks/human_input_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4IAA4I;AAC5I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,iDAAiD,EAAE,MAAM,qDAAqD,CAAC;AACxH,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAY,aAAa,CACzF,QAAQ,CAAC,ojCAAojC,EAAE,CAAC,iDAAiD,EAAE,0BAA0B,EAAE,2BAA2B,CAAC,CAAC,CAAC;AAqC/qC;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC;AAgJxE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,CAAN,IAAY,uBA2CX;AA3CD,WAAY,uBAAuB;IACjC;;;;OAIG;IACH,yIAA0C,CAAA;IAE1C;;;;;OAKG;IACH,6GAA4B,CAAA;IAE5B;;;;;;OAMG;IACH,mHAA+B,CAAA;IAE/B;;;;;;OAMG;IACH,6GAA4B,CAAA;IAE5B;;;;;;;OAOG;IACH,qHAAgC,CAAA;AAClC,CAAC,EA3CW,uBAAuB,KAAvB,uBAAuB,QA2ClC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAqC,aAAa,CAC1F,QAAQ,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"human_input_pb.js","sourceRoot":"","sources":["../../../../../../../ai/stigmer/agentic/workflow/v1/tasks/human_input_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4IAA4I;AAC5I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,iDAAiD,EAAE,MAAM,qDAAqD,CAAC;AACxH,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAGrE;;GAEG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAY,aAAa,CACzF,QAAQ,CAAC,ojCAAojC,EAAE,CAAC,iDAAiD,EAAE,0BAA0B,EAAE,2BAA2B,CAAC,CAAC,CAAC;AAqC/qC;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC;AAgJxE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,CAAN,IAAY,uBAmDX;AAnDD,WAAY,uBAAuB;IACjC;;;;OAIG;IACH,yIAA0C,CAAA;IAE1C;;;;;OAKG;IACH,6GAA4B,CAAA;IAE5B;;;;;;OAMG;IACH,mHAA+B,CAAA;IAE/B;;;;;;OAMG;IACH,6GAA4B,CAAA;IAE5B;;;;;;;;;;;;;;;OAeG;IACH,qHAAgC,CAAA;AAClC,CAAC,EAnDW,uBAAuB,KAAvB,uBAAuB,QAmDlC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAqC,aAAa,CAC1F,QAAQ,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/workflowinstance/v1/command_connect.d.ts

@@ -51,6 +51,10 @@ export declare const WorkflowInstanceCommandController: {
          * instance via FGA. An ORG-visible instance means all org members can see
          * all executions — zero per-execution tuples needed.
          *
+         * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+         * every org boundary, so it is granted by the platform team on request.
+         * Un-publishing and all other levels stay self-service.
+         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.updateVisibility
          */
         readonly updateVisibility: {

package/ai/stigmer/agentic/workflowinstance/v1/command_connect.js

@@ -60,6 +60,10 @@ export const WorkflowInstanceCommandController = {
          * instance via FGA. An ORG-visible instance means all org members can see
          * all executions — zero per-execution tuples needed.
          *
+         * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+         * every org boundary, so it is granted by the platform team on request.
+         * Un-publishing and all other levels stay self-service.
+         *
          * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.updateVisibility
          */
         updateVisibility: {

package/ai/stigmer/agentic/workflowinstance/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4IAA4I;AAC5I,oBAAoB;AACpB,cAAc;AAEd,kGAAkG;AAElG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,0EAA0E;IACpF,OAAO,EAAE;QACP;;;;WAIG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4IAA4I;AAC5I,oBAAoB;AACpB,cAAc;AAEd,kGAAkG;AAElG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,0EAA0E;IACpF,OAAO,EAAE;QACP;;;;WAIG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,qBAAqB;YACxB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;WAYG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE,2BAA2B;YACjC,CAAC,EAAE,8BAA8B;YACjC,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/workflowinstance/v1/command_pb.d.ts

@@ -54,6 +54,10 @@ export declare const WorkflowInstanceCommandController: GenService<{
      * instance via FGA. An ORG-visible instance means all org members can see
      * all executions — zero per-execution tuples needed.
      *
+     * In the cloud edition, PUBLIC is operator-gated: public listing crosses
+     * every org boundary, so it is granted by the platform team on request.
+     * Un-publishing and all other levels stay self-service.
+     *
      * @generated from rpc ai.stigmer.agentic.workflowinstance.v1.WorkflowInstanceCommandController.updateVisibility
      */
     updateVisibility: {

package/ai/stigmer/agentic/workflowinstance/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4IAA4I;AAC5I,oBAAoB;AAKpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,8CAA8C,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAY,aAAa,CACvF,QAAQ,CAAC,wnDAAwnD,EAAE,CAAC,+CAA+C,EAAE,8CAA8C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEr3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GA8EzC,aAAa,CAChB,WAAW,CAAC,mDAAmD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowinstance/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4IAA4I;AAC5I,oBAAoB;AAKpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,8CAA8C,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAY,aAAa,CACvF,QAAQ,CAAC,wnDAAwnD,EAAE,CAAC,+CAA+C,EAAE,8CAA8C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEr3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAkFzC,aAAa,CAChB,WAAW,CAAC,mDAAmD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/enum_pb.d.ts

@@ -148,6 +148,14 @@ export declare enum ApiResourceVisibility {
      * Anyone can access (read) this resource.
      * Used for marketplace-published resources (e.g., "stigmer/web-search").
      * Write access still requires org membership.
+     *
+     * In the cloud edition, entering this level is operator-gated
+     * (can_set_public_visibility on platform:stigmer): public listing is a
+     * curation decision, requested by the resource owner and granted by the
+     * platform team — at both doors, updateVisibility escalation and
+     * create-with-public. Leaving this level stays self-service for anyone
+     * with can_edit. The OSS edition is unguarded (the self-hosted operator
+     * owns the store).
      * Named visibility_public to avoid Java reserved keyword conflict.
      *
      * @generated from enum value: visibility_public = 2;

package/ai/stigmer/commons/apiresource/enum_pb.js

@@ -154,6 +154,14 @@ export var ApiResourceVisibility;
      * Anyone can access (read) this resource.
      * Used for marketplace-published resources (e.g., "stigmer/web-search").
      * Write access still requires org membership.
+     *
+     * In the cloud edition, entering this level is operator-gated
+     * (can_set_public_visibility on platform:stigmer): public listing is a
+     * curation decision, requested by the resource owner and granted by the
+     * platform team — at both doors, updateVisibility escalation and
+     * create-with-public. Leaving this level stays self-service for anyone
+     * with can_edit. The OSS edition is unguarded (the self-hosted operator
+     * owns the store).
      * Named visibility_public to avoid Java reserved keyword conflict.
      *
      * @generated from enum value: visibility_public = 2;

package/ai/stigmer/commons/apiresource/enum_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,oqBAAoqB,CAAC,CAAC;AAEjrB;;;;GAIG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,qBAmFX;AAnFD,WAAY,qBAAqB;IAC/B;;;;;;;OAOG;IACH,+HAAuC,CAAA;IAEvC;;;;;;;;;;;OAWG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;OAOG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qFAAkB,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,+FAAuB,CAAA;AACzB,CAAC,EAnFW,qBAAqB,KAArB,qBAAqB,QAmFhC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,oqBAAoqB,CAAC,CAAC;AAEjrB;;;;GAIG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,qBA2FX;AA3FD,WAAY,qBAAqB;IAC/B;;;;;;;OAOG;IACH,+HAAuC,CAAA;IAEvC;;;;;;;;;;;OAWG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;;;;;;;;;OAeG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qFAAkB,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,+FAAuB,CAAA;AACzB,CAAC,EA3FW,qBAAqB,KAArB,qBAAqB,QA2FhC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/identityaccount/v1/spec_pb.d.ts

@@ -91,9 +91,56 @@ export type IdentityAccountSpec = Message<"ai.stigmer.iam.identityaccount.v1.Ide
      * @generated from field: ai.stigmer.commons.apiresource.ApiResourceReference identity_provider_ref = 8;
      */
     identityProviderRef?: ApiResourceReference;
+    /**
+     * Standing preferences declared by this identity account.
+     *
+     * @generated from field: ai.stigmer.iam.identityaccount.v1.IdentityAccountPreferences preferences = 9;
+     */
+    preferences?: IdentityAccountPreferences;
 };
 /**
  * Describes the message ai.stigmer.iam.identityaccount.v1.IdentityAccountSpec.
  * Use `create(IdentityAccountSpecSchema)` to create a new message.
  */
 export declare const IdentityAccountSpecSchema: GenMessage<IdentityAccountSpec>;
+/**
+ * IdentityAccountPreferences holds user-declared defaults that apply to the
+ * user's own agent executions.
+ *
+ * @generated from message ai.stigmer.iam.identityaccount.v1.IdentityAccountPreferences
+ */
+export type IdentityAccountPreferences = Message<"ai.stigmer.iam.identityaccount.v1.IdentityAccountPreferences"> & {
+    /**
+     * Free-text standing context injected into this user's eligible agent
+     * executions. Example: "Keep answers terse."
+     *
+     * @generated from field: string standing_context = 1;
+     */
+    standingContext: string;
+    /**
+     * Default harness for new sessions: "native" or "cursor".
+     * Empty means no preference — the platform default applies.
+     *
+     * @generated from field: string default_harness = 2;
+     */
+    defaultHarness: string;
+    /**
+     * Default model (registry model ID) for native-harness sessions.
+     * Empty means no preference — the platform default applies.
+     *
+     * @generated from field: string default_native_model = 3;
+     */
+    defaultNativeModel: string;
+    /**
+     * Default model (registry model ID) for cursor-harness sessions.
+     * Empty means no preference — the platform default applies.
+     *
+     * @generated from field: string default_cursor_model = 4;
+     */
+    defaultCursorModel: string;
+};
+/**
+ * Describes the message ai.stigmer.iam.identityaccount.v1.IdentityAccountPreferences.
+ * Use `create(IdentityAccountPreferencesSchema)` to create a new message.
+ */
+export declare const IdentityAccountPreferencesSchema: GenMessage<IdentityAccountPreferences>;

package/ai/stigmer/iam/identityaccount/v1/spec_pb.js

@@ -8,10 +8,15 @@ import { file_buf_validate_validate } from "../../../../../buf/validate/validate
 /**
  * Describes the file ai/stigmer/iam/identityaccount/v1/spec.proto.
  */
-export const file_ai_stigmer_iam_identityaccount_v1_spec = /*@__PURE__*/ fileDesc("CixhaS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvc3BlYy5wcm90bxIhYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxIsgCChNJZGVudGl0eUFjY291bnRTcGVjEhYKBmlkcF9pZBgBIAEoCUIGukgDyAEBEg0KBWVtYWlsGAIgASgJEhIKCmZpcnN0X25hbWUYAyABKAkSEQoJbGFzdF9uYW1lGAQgASgJEhMKC3BpY3R1cmVfdXJsGAUgASgJEhoKEmlzX21hY2hpbmVfYWNjb3VudBgGIAEoCBJdChFwcm92aXNpb25pbmdfbW9kZRgHIAEoDjJCLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnRQcm92aXNpb25pbmdNb2RlElMKFWlkZW50aXR5X3Byb3ZpZGVyX3JlZhgIIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZWIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_iam_identityaccount_v1_enum, file_buf_validate_validate]);
+export const file_ai_stigmer_iam_identityaccount_v1_spec = /*@__PURE__*/ fileDesc("CixhaS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvc3BlYy5wcm90bxIhYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxIpwDChNJZGVudGl0eUFjY291bnRTcGVjEhYKBmlkcF9pZBgBIAEoCUIGukgDyAEBEg0KBWVtYWlsGAIgASgJEhIKCmZpcnN0X25hbWUYAyABKAkSEQoJbGFzdF9uYW1lGAQgASgJEhMKC3BpY3R1cmVfdXJsGAUgASgJEhoKEmlzX21hY2hpbmVfYWNjb3VudBgGIAEoCBJdChFwcm92aXNpb25pbmdfbW9kZRgHIAEoDjJCLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnRQcm92aXNpb25pbmdNb2RlElMKFWlkZW50aXR5X3Byb3ZpZGVyX3JlZhgIIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRJSCgtwcmVmZXJlbmNlcxgJIAEoCzI9LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnRQcmVmZXJlbmNlcyLBAQoaSWRlbnRpdHlBY2NvdW50UHJlZmVyZW5jZXMSIgoQc3RhbmRpbmdfY29udGV4dBgBIAEoCUIIukgFcgMY0A8SMQoPZGVmYXVsdF9oYXJuZXNzGAIgASgJQhi6SBXYAQFyEFIGbmF0aXZlUgZjdXJzb3ISJQoUZGVmYXVsdF9uYXRpdmVfbW9kZWwYAyABKAlCB7pIBHICGGQSJQoUZGVmYXVsdF9jdXJzb3JfbW9kZWwYBCABKAlCB7pIBHICGGRiBnByb3RvMw", [file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_iam_identityaccount_v1_enum, file_buf_validate_validate]);
 /**
  * Describes the message ai.stigmer.iam.identityaccount.v1.IdentityAccountSpec.
  * Use `create(IdentityAccountSpecSchema)` to create a new message.
  */
 export const IdentityAccountSpecSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_identityaccount_v1_spec, 0);
+/**
+ * Describes the message ai.stigmer.iam.identityaccount.v1.IdentityAccountPreferences.
+ * Use `create(IdentityAccountPreferencesSchema)` to create a new message.
+ */
+export const IdentityAccountPreferencesSchema = /*@__PURE__*/ messageDesc(file_ai_stigmer_iam_identityaccount_v1_spec, 1);
 //# sourceMappingURL=spec_pb.js.map

package/ai/stigmer/iam/identityaccount/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAE/F,OAAO,EAAE,2CAA2C,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,kjBAAkjB,EAAE,CAAC,sCAAsC,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAgGlrB;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/identityaccount/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,+HAA+H;AAC/H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAE/F,OAAO,EAAE,2CAA2C,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,w6BAAw6B,EAAE,CAAC,sCAAsC,EAAE,2CAA2C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAuGxiC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA0C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/oauthapp/v1/spec_pb.d.ts

@@ -100,6 +100,23 @@ export type OAuthAppSpec = Message<"ai.stigmer.iam.oauthapp.v1.OAuthAppSpec"> &
      * @generated from field: string vendor_approval_docs_url = 10;
      */
     vendorApprovalDocsUrl: string;
+    /**
+     * How the client secret is presented to the vendor's token endpoint
+     * during authorization-code exchange and refresh.
+     *
+     * RFC 6749 §2.3.1 requires authorization servers to support HTTP Basic,
+     * but some vendors' token endpoints accept only client_secret_post
+     * (e.g. HubSpot advertises token_endpoint_auth_methods_supported:
+     * ["client_secret_post"]). Exactly one method is ever used per request —
+     * RFC 6749 §2.3 forbids presenting credentials through more than one
+     * channel at once, and some servers reject requests that do.
+     *
+     * UNSPECIFIED is treated as CLIENT_SECRET_BASIC for backwards
+     * compatibility, preserving the historical behavior byte-for-byte.
+     *
+     * @generated from field: ai.stigmer.iam.oauthapp.v1.TokenEndpointAuthMethod token_endpoint_auth_method = 11;
+     */
+    tokenEndpointAuthMethod: TokenEndpointAuthMethod;
 };
 /**
  * Describes the message ai.stigmer.iam.oauthapp.v1.OAuthAppSpec.
@@ -148,3 +165,42 @@ export declare enum VendorApprovalStatus {
  * Describes the enum ai.stigmer.iam.oauthapp.v1.VendorApprovalStatus.
  */
 export declare const VendorApprovalStatusSchema: GenEnum<VendorApprovalStatus>;
+/**
+ * Client authentication method for the vendor's OAuth token endpoint,
+ * mirroring the RFC 8414 token_endpoint_auth_methods_supported vocabulary.
+ *
+ * Only confidential-client methods appear here: public (DCR) clients
+ * authenticate with PKCE alone and never carry a client secret, so this
+ * enum is meaningful only for OAuthApp-backed vendor OAuth.
+ *
+ * @generated from enum ai.stigmer.iam.oauthapp.v1.TokenEndpointAuthMethod
+ */
+export declare enum TokenEndpointAuthMethod {
+    /**
+     * Default / unset. Treated as CLIENT_SECRET_BASIC for backwards
+     * compatibility — every OAuthApp created before this field existed
+     * authenticated via HTTP Basic.
+     *
+     * @generated from enum value: TOKEN_ENDPOINT_AUTH_METHOD_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * client_secret_basic: the secret rides the Authorization header as
+     * HTTP Basic credentials (RFC 6749 §2.3.1's baseline method).
+     *
+     * @generated from enum value: TOKEN_ENDPOINT_AUTH_METHOD_CLIENT_SECRET_BASIC = 1;
+     */
+    CLIENT_SECRET_BASIC = 1,
+    /**
+     * client_secret_post: the secret rides the request body as the
+     * client_secret form parameter. Required by vendors whose token
+     * endpoints do not accept Basic (e.g. HubSpot).
+     *
+     * @generated from enum value: TOKEN_ENDPOINT_AUTH_METHOD_CLIENT_SECRET_POST = 2;
+     */
+    CLIENT_SECRET_POST = 2
+}
+/**
+ * Describes the enum ai.stigmer.iam.oauthapp.v1.TokenEndpointAuthMethod.
+ */
+export declare const TokenEndpointAuthMethodSchema: GenEnum<TokenEndpointAuthMethod>;

package/ai/stigmer/iam/oauthapp/v1/spec_pb.js

@@ -6,7 +6,7 @@ import { file_buf_validate_validate } from "../../../../../buf/validate/validate
 /**
  * Describes the file ai/stigmer/iam/oauthapp/v1/spec.proto.
  */
-export const file_ai_stigmer_iam_oauthapp_v1_spec = /*@__PURE__*/ fileDesc("CiVhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9zcGVjLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MSLWAgoMT0F1dGhBcHBTcGVjEhAKCHByb3ZpZGVyGAEgASgJEhoKCWNsaWVudF9pZBgCIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAMgASgJQge6SARyAhABEiMKEWF1dGhvcml6YXRpb25fdXJsGAQgASgJQgi6SAVyA4gBARIbCgl0b2tlbl91cmwYBSABKAlCCLpIBXIDiAEBEg4KBnNjb3BlcxgGIAMoCRIUCgx1c2VyaW5mb191cmwYByABKAkSHAoUc2NvcGVfcGFyYW1ldGVyX25hbWUYCCABKAkSUAoWdmVuZG9yX2FwcHJvdmFsX3N0YXR1cxgJIAEoDjIwLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLlZlbmRvckFwcHJvdmFsU3RhdHVzEiAKGHZlbmRvcl9hcHByb3ZhbF9kb2NzX3VybBgKIAEoCSqsAQoUVmVuZG9yQXBwcm92YWxTdGF0dXMSJgoiVkVORE9SX0FQUFJPVkFMX1NUQVRVU19VTlNQRUNJRklFRBAAEiIKHlZFTkRPUl9BUFBST1ZBTF9TVEFUVVNfUEVORElORxABEiMKH1ZFTkRPUl9BUFBST1ZBTF9TVEFUVVNfQVBQUk9WRUQQAhIjCh9WRU5ET1JfQVBQUk9WQUxfU1RBVFVTX1JFSkVDVEVEEANiBnByb3RvMw", [file_buf_validate_validate]);
+export const file_ai_stigmer_iam_oauthapp_v1_spec = /*@__PURE__*/ fileDesc("CiVhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9zcGVjLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MSKvAwoMT0F1dGhBcHBTcGVjEhAKCHByb3ZpZGVyGAEgASgJEhoKCWNsaWVudF9pZBgCIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAMgASgJQge6SARyAhABEiMKEWF1dGhvcml6YXRpb25fdXJsGAQgASgJQgi6SAVyA4gBARIbCgl0b2tlbl91cmwYBSABKAlCCLpIBXIDiAEBEg4KBnNjb3BlcxgGIAMoCRIUCgx1c2VyaW5mb191cmwYByABKAkSHAoUc2NvcGVfcGFyYW1ldGVyX25hbWUYCCABKAkSUAoWdmVuZG9yX2FwcHJvdmFsX3N0YXR1cxgJIAEoDjIwLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLlZlbmRvckFwcHJvdmFsU3RhdHVzEiAKGHZlbmRvcl9hcHByb3ZhbF9kb2NzX3VybBgKIAEoCRJXChp0b2tlbl9lbmRwb2ludF9hdXRoX21ldGhvZBgLIAEoDjIzLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLlRva2VuRW5kcG9pbnRBdXRoTWV0aG9kKqwBChRWZW5kb3JBcHByb3ZhbFN0YXR1cxImCiJWRU5ET1JfQVBQUk9WQUxfU1RBVFVTX1VOU1BFQ0lGSUVEEAASIgoeVkVORE9SX0FQUFJPVkFMX1NUQVRVU19QRU5ESU5HEAESIwofVkVORE9SX0FQUFJPVkFMX1NUQVRVU19BUFBST1ZFRBACEiMKH1ZFTkRPUl9BUFBST1ZBTF9TVEFUVVNfUkVKRUNURUQQAyqsAQoXVG9rZW5FbmRwb2ludEF1dGhNZXRob2QSKgomVE9LRU5fRU5EUE9JTlRfQVVUSF9NRVRIT0RfVU5TUEVDSUZJRUQQABIyCi5UT0tFTl9FTkRQT0lOVF9BVVRIX01FVEhPRF9DTElFTlRfU0VDUkVUX0JBU0lDEAESMQotVE9LRU5fRU5EUE9JTlRfQVVUSF9NRVRIT0RfQ0xJRU5UX1NFQ1JFVF9QT1NUEAJiBnByb3RvMw", [file_buf_validate_validate]);
 /**
  * Describes the message ai.stigmer.iam.oauthapp.v1.OAuthAppSpec.
  * Use `create(OAuthAppSpecSchema)` to create a new message.
@@ -55,4 +55,44 @@ export var VendorApprovalStatus;
  * Describes the enum ai.stigmer.iam.oauthapp.v1.VendorApprovalStatus.
  */
 export const VendorApprovalStatusSchema = /*@__PURE__*/ enumDesc(file_ai_stigmer_iam_oauthapp_v1_spec, 0);
+/**
+ * Client authentication method for the vendor's OAuth token endpoint,
+ * mirroring the RFC 8414 token_endpoint_auth_methods_supported vocabulary.
+ *
+ * Only confidential-client methods appear here: public (DCR) clients
+ * authenticate with PKCE alone and never carry a client secret, so this
+ * enum is meaningful only for OAuthApp-backed vendor OAuth.
+ *
+ * @generated from enum ai.stigmer.iam.oauthapp.v1.TokenEndpointAuthMethod
+ */
+export var TokenEndpointAuthMethod;
+(function (TokenEndpointAuthMethod) {
+    /**
+     * Default / unset. Treated as CLIENT_SECRET_BASIC for backwards
+     * compatibility — every OAuthApp created before this field existed
+     * authenticated via HTTP Basic.
+     *
+     * @generated from enum value: TOKEN_ENDPOINT_AUTH_METHOD_UNSPECIFIED = 0;
+     */
+    TokenEndpointAuthMethod[TokenEndpointAuthMethod["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * client_secret_basic: the secret rides the Authorization header as
+     * HTTP Basic credentials (RFC 6749 §2.3.1's baseline method).
+     *
+     * @generated from enum value: TOKEN_ENDPOINT_AUTH_METHOD_CLIENT_SECRET_BASIC = 1;
+     */
+    TokenEndpointAuthMethod[TokenEndpointAuthMethod["CLIENT_SECRET_BASIC"] = 1] = "CLIENT_SECRET_BASIC";
+    /**
+     * client_secret_post: the secret rides the request body as the
+     * client_secret form parameter. Required by vendors whose token
+     * endpoints do not accept Basic (e.g. HubSpot).
+     *
+     * @generated from enum value: TOKEN_ENDPOINT_AUTH_METHOD_CLIENT_SECRET_POST = 2;
+     */
+    TokenEndpointAuthMethod[TokenEndpointAuthMethod["CLIENT_SECRET_POST"] = 2] = "CLIENT_SECRET_POST";
+})(TokenEndpointAuthMethod || (TokenEndpointAuthMethod = {}));
+/**
+ * Describes the enum ai.stigmer.iam.oauthapp.v1.TokenEndpointAuthMethod.
+ */
+export const TokenEndpointAuthMethodSchema = /*@__PURE__*/ enumDesc(file_ai_stigmer_iam_oauthapp_v1_spec, 1);
 //# sourceMappingURL=spec_pb.js.map

package/ai/stigmer/iam/oauthapp/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAY,aAAa,CACxE,QAAQ,CAAC,4xBAA4xB,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AA6Gv0B;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA+BX;AA/BD,WAAY,oBAAoB;IAC9B;;;;;;OAMG;IACH,6EAAe,CAAA;IAEf;;;;;OAKG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,uEAAY,CAAA;IAEZ;;;;OAIG;IACH,uEAAY,CAAA;AACd,CAAC,EA/BW,oBAAoB,KAApB,oBAAoB,QA+B/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/oauthapp/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAY,aAAa,CACxE,QAAQ,CAAC,4nCAA4nC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AA+HvqC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA+BX;AA/BD,WAAY,oBAAoB;IAC9B;;;;;;OAMG;IACH,6EAAe,CAAA;IAEf;;;;;OAKG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,uEAAY,CAAA;IAEZ;;;;OAIG;IACH,uEAAY,CAAA;AACd,CAAC,EA/BW,oBAAoB,KAApB,oBAAoB,QA+B/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,uBA0BX;AA1BD,WAAY,uBAAuB;IACjC;;;;;;OAMG;IACH,mFAAe,CAAA;IAEf;;;;;OAKG;IACH,mGAAuB,CAAA;IAEvB;;;;;;OAMG;IACH,iGAAsB,CAAA;AACxB,CAAC,EA1BW,uBAAuB,KAAvB,uBAAuB,QA0BlC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAqC,aAAa,CAC1F,QAAQ,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/command_connect.d.ts

@@ -52,9 +52,11 @@ export declare const PlatformClientCommandController: {
         /**
          * Delete a platform client.
          *
-         * Immediately invalidates the client_id and client_secret. Any tokens
-         * previously minted by this platform client remain valid until their
-         * own expiration — deletion does not revoke already-issued tokens.
+         * Immediately invalidates the client_id and client_secret AND revokes
+         * the client's outstanding user tokens: the platform resolves the
+         * minting client on every user-token request, and a client that no
+         * longer exists is refused UNAUTHENTICATED (fail closed) — so deletion
+         * takes effect on the very next request, not at token expiry.
          *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.delete
          */

package/ai/stigmer/iam/platformclient/v1/command_connect.js

@@ -60,9 +60,11 @@ export const PlatformClientCommandController = {
         /**
          * Delete a platform client.
          *
-         * Immediately invalidates the client_id and client_secret. Any tokens
-         * previously minted by this platform client remain valid until their
-         * own expiration — deletion does not revoke already-issued tokens.
+         * Immediately invalidates the client_id and client_secret AND revokes
+         * the client's outstanding user tokens: the platform resolves the
+         * minting client on every user-token request, and a client that no
+         * longer exists is refused UNAUTHENTICATED (fail closed) — so deletion
+         * takes effect on the very next request, not at token expiry.
          *
          * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.delete
          */

package/ai/stigmer/iam/platformclient/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gIAAgI;AAChI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,kEAAkE;IAC5E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;WAeG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gIAAgI;AAChI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,kEAAkE;IAC5E,OAAO,EAAE;QACP;;;;;;;;;;;;;;;WAeG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,cAAc;YACpB,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,4BAA4B;YAC/B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/platformclient/v1/command_pb.d.ts

@@ -56,9 +56,11 @@ export declare const PlatformClientCommandController: GenService<{
     /**
      * Delete a platform client.
      *
-     * Immediately invalidates the client_id and client_secret. Any tokens
-     * previously minted by this platform client remain valid until their
-     * own expiration — deletion does not revoke already-issued tokens.
+     * Immediately invalidates the client_id and client_secret AND revokes
+     * the client's outstanding user tokens: the platform resolves the
+     * minting client on every user-token request, and a client that no
+     * longer exists is refused UNAUTHENTICATED (fail closed) — so deletion
+     * takes effect on the very next request, not at token expiry.
      *
      * @generated from rpc ai.stigmer.iam.platformclient.v1.PlatformClientCommandController.delete
      */

package/ai/stigmer/iam/platformclient/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAkEvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gIAAgI;AAChI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAY,aAAa,CACjF,QAAQ,CAAC,yqCAAyqC,EAAE,CAAC,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,EAAE,yCAAyC,EAAE,wCAAwC,CAAC,CAAC,CAAC;AAE15C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAoEvC,aAAa,CAChB,WAAW,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/platformclient/v1/spec_pb.d.ts

@@ -1,4 +1,5 @@
 import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import type { ApiResourceReference } from "../../../commons/apiresource/io_pb.js";
 import type { IamRole } from "../../v1/enum_pb.js";
 import type { Timestamp } from "@bufbuild/protobuf/wkt";
 import type { Message } from "@bufbuild/protobuf";
@@ -165,6 +166,17 @@ export type PlatformClientSpec = Message<"ai.stigmer.iam.platformclient.v1.Platf
      * @generated from field: repeated string allowed_origins = 9;
      */
     allowedOrigins: string[];
+    /**
+     * Environments whose values are delivered to every agent execution
+     * created by a session this PlatformClient minted. This is how an
+     * embedded assistant reaches secret-gated MCP servers: the client — the
+     * connection resource — carries the credentials (for example a shared
+     * API secret), and minted-user executions receive its values at
+     * runtime. The agent and its default instance stay untouched.
+     *
+     * @generated from field: repeated ai.stigmer.commons.apiresource.ApiResourceReference environment_refs = 10;
+     */
+    environmentRefs: ApiResourceReference[];
 };
 /**
  * Describes the message ai.stigmer.iam.platformclient.v1.PlatformClientSpec.

package/ai/stigmer/iam/platformclient/v1/spec_pb.js

@@ -3,12 +3,14 @@
 /* eslint-disable */
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
 import { file_ai_stigmer_commons_apiresource_field_options } from "../../../commons/apiresource/field_options_pb.js";
+import { file_ai_stigmer_commons_apiresource_io } from "../../../commons/apiresource/io_pb.js";
 import { file_ai_stigmer_iam_v1_enum } from "../../v1/enum_pb.js";
+import { file_buf_validate_validate } from "../../../../../buf/validate/validate_pb.js";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/iam/platformclient/v1/spec.proto.
  */
-export const file_ai_stigmer_iam_platformclient_v1_spec = /*@__PURE__*/ fileDesc("CithaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MSLCAgoSUGxhdGZvcm1DbGllbnRTcGVjEhcKCWNsaWVudF9pZBgBIAEoCUIEyIUsARIgChJjbGllbnRfc2VjcmV0X2hhc2gYAiABKAlCBMiFLAESIAoSc2VjcmV0X2ZpbmdlcnByaW50GAMgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBSABKAgSHwoXYXV0b19wcm92aXNpb25fYWNjb3VudHMYBiABKAgSGQoRYXV0b19ncmFudF9vbl9vcmcYByABKAgSMwoPYXV0b19ncmFudF9yb2xlGAggASgOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZRIXCg9hbGxvd2VkX29yaWdpbnMYCSADKAliBnByb3RvMw", [file_ai_stigmer_commons_apiresource_field_options, file_ai_stigmer_iam_v1_enum, file_google_protobuf_timestamp]);
+export const file_ai_stigmer_iam_platformclient_v1_spec = /*@__PURE__*/ fileDesc("CithaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9zcGVjLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MSKNBAoSUGxhdGZvcm1DbGllbnRTcGVjEhcKCWNsaWVudF9pZBgBIAEoCUIEyIUsARIgChJjbGllbnRfc2VjcmV0X2hhc2gYAiABKAlCBMiFLAESIAoSc2VjcmV0X2ZpbmdlcnByaW50GAMgASgJQgTIhSwBEi4KCmV4cGlyZXNfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDW5ldmVyX2V4cGlyZXMYBSABKAgSHwoXYXV0b19wcm92aXNpb25fYWNjb3VudHMYBiABKAgSGQoRYXV0b19ncmFudF9vbl9vcmcYByABKAgSMwoPYXV0b19ncmFudF9yb2xlGAggASgOMhouYWkuc3RpZ21lci5pYW0udjEuSWFtUm9sZRIXCg9hbGxvd2VkX29yaWdpbnMYCSADKAkSyAEKEGVudmlyb25tZW50X3JlZnMYCiADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNWIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_field_options, file_ai_stigmer_commons_apiresource_io, file_ai_stigmer_iam_v1_enum, file_buf_validate_validate, file_google_protobuf_timestamp]);
 /**
  * Describes the message ai.stigmer.iam.platformclient.v1.PlatformClientSpec.
  * Use `create(PlatformClientSpecSchema)` to create a new message.

package/ai/stigmer/iam/platformclient/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,wiBAAwiB,EAAE,CAAC,iDAAiD,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AA2KvqB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/platformclient/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAE/F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAY,aAAa,CAC9E,QAAQ,CAAC,szBAAszB,EAAE,CAAC,iDAAiD,EAAE,sCAAsC,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAuLz/B;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/v1/enum_pb.d.ts

@@ -235,7 +235,22 @@ export declare enum IamPermission {
      *
      * @generated from enum value: can_view_provider_standing = 38;
      */
-    can_view_provider_standing = 38
+    can_view_provider_standing = 38,
+    /**
+     * Platform-level permission to set a resource's visibility to PUBLIC —
+     * the only level that crosses every org boundary (the cross-org
+     * "explore" catalog). Gated to platform operators in the cloud
+     * edition: public listing is a curation decision, requested by the
+     * owner and granted by the platform team. Enforced at BOTH doors a
+     * resource can become public through — updateVisibility escalation and
+     * create-with-public — while org/platform levels and un-publishing
+     * stay self-service (resource can_edit). The OSS edition is
+     * deliberately unguarded: the self-hosted operator owns the store,
+     * the same scoping cloud#320 applied to reserved labels.
+     *
+     * @generated from enum value: can_set_public_visibility = 39;
+     */
+    can_set_public_visibility = 39
 }
 /**
  * Describes the enum ai.stigmer.iam.v1.IamPermission.