@stigmer/protos 3.9.0 → 3.11.0

package/ai/stigmer/activity/v1/io_pb.d.ts

@@ -70,14 +70,18 @@ export type ListRecentActivityRequest = Message<"ai.stigmer.activity.v1.ListRece
     /**
      * Organization slug to scope the query.
      *
-     * When provided, the handler attempts an org-scoped fast path: if the
-     * caller is a member of this organization, it queries MongoDB directly
-     * with `metadata.org = org` instead of enumerating per-resource FGA
-     * tuples. This turns an O(n) FGA reverse-index scan into a single
-     * membership check + indexed MongoDB query.
+     * When provided, results are narrowed to resources in this organization.
+     * The org NEVER widens visibility: per-resource read authority is always
+     * enforced (on the hosted edition, FGA `can_view` enumeration per kind),
+     * and the org filter only intersects that authorized set. Both recents
+     * kinds are private by default — sessions are personal resources and
+     * workflow executions opt in to org observability per instance — so org
+     * membership alone must never substitute for the per-resource check. An
+     * earlier "org member = query by org directly" fast path leaked session
+     * titles to every org member (stigmer-cloud#258).
      *
-     * When empty, falls back to per-resource FGA enumeration (slower but
-     * works regardless of org context).
+     * When empty, results span every organization the caller has resource
+     * access in.
      *
      * @generated from field: string org = 2;
      */

package/ai/stigmer/activity/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uGAAuG;AACvG,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAY,aAAa,CAClE,QAAQ,CAAC,odAAod,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;AAoDngB;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;AAgCjD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;AAiBjD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uGAAuG;AACvG,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAY,aAAa,CAClE,QAAQ,CAAC,odAAod,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;AAoDngB;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;AAoCjD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;AAiBjD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/activity/v1/query_connect.d.ts

@@ -21,11 +21,16 @@ export declare const ActivityQueryController: {
          * List recent activity across sessions and workflow executions.
          *
          * Returns a merged, time-sorted list of the caller's most recent
-         * sessions and workflow executions. Authorization filtering is applied
-         * server-side via FGA (cloud) or returned unfiltered (OSS).
+         * sessions and workflow executions. On the hosted edition, per-resource
+         * authorization filtering is applied server-side (FGA `can_view`
+         * enumeration for both kinds — the same permission the per-kind `get`
+         * RPCs enforce, so every listed entry is openable by construction). The
+         * OSS server does not currently implement this RPC (stigmer#461).
          *
          * @internal
-         * Authorization is handled in-handler via FGA-filtered queries.
+         * Authorization is handled in-handler: the FGA id enumeration is the only
+         * gate (hence is_skip_authorization); the request's org merely narrows
+         * the authorized set.
          *
          * @generated from rpc ai.stigmer.activity.v1.ActivityQueryController.listRecentActivity
          */

package/ai/stigmer/activity/v1/query_connect.js

@@ -27,11 +27,16 @@ export const ActivityQueryController = {
          * List recent activity across sessions and workflow executions.
          *
          * Returns a merged, time-sorted list of the caller's most recent
-         * sessions and workflow executions. Authorization filtering is applied
-         * server-side via FGA (cloud) or returned unfiltered (OSS).
+         * sessions and workflow executions. On the hosted edition, per-resource
+         * authorization filtering is applied server-side (FGA `can_view`
+         * enumeration for both kinds — the same permission the per-kind `get`
+         * RPCs enforce, so every listed entry is openable by construction). The
+         * OSS server does not currently implement this RPC (stigmer#461).
          *
          * @internal
-         * Authorization is handled in-handler via FGA-filtered queries.
+         * Authorization is handled in-handler: the FGA id enumeration is the only
+         * gate (hence is_skip_authorization); the request's org merely narrows
+         * the authorized set.
          *
          * @generated from rpc ai.stigmer.activity.v1.ActivityQueryController.listRecentActivity
          */

package/ai/stigmer/activity/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,0GAA0G;AAC1G,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,gDAAgD;IAC1D,OAAO,EAAE;QACP;;;;;;;;;;;WAWG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,0GAA0G;AAC1G,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,gDAAgD;IAC1D,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;WAgBG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/activity/v1/query_pb.d.ts

@@ -25,11 +25,16 @@ export declare const ActivityQueryController: GenService<{
      * List recent activity across sessions and workflow executions.
      *
      * Returns a merged, time-sorted list of the caller's most recent
-     * sessions and workflow executions. Authorization filtering is applied
-     * server-side via FGA (cloud) or returned unfiltered (OSS).
+     * sessions and workflow executions. On the hosted edition, per-resource
+     * authorization filtering is applied server-side (FGA `can_view`
+     * enumeration for both kinds — the same permission the per-kind `get`
+     * RPCs enforce, so every listed entry is openable by construction). The
+     * OSS server does not currently implement this RPC (stigmer#461).
      *
      * @internal
-     * Authorization is handled in-handler via FGA-filtered queries.
+     * Authorization is handled in-handler: the FGA id enumeration is the only
+     * gate (hence is_skip_authorization); the request's org merely narrows
+     * the authorized set.
      *
      * @generated from rpc ai.stigmer.activity.v1.ActivityQueryController.listRecentActivity
      */

package/ai/stigmer/activity/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,0GAA0G;AAC1G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAY,aAAa,CACrE,QAAQ,CAAC,kTAAkT,EAAE,CAAC,8BAA8B,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE7Y;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAkB/B,aAAa,CAChB,WAAW,CAAC,iCAAiC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,0GAA0G;AAC1G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAY,aAAa,CACrE,QAAQ,CAAC,kTAAkT,EAAE,CAAC,8BAA8B,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE7Y;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAuB/B,aAAa,CAChB,WAAW,CAAC,iCAAiC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agent/v1/io_pb.d.ts

@@ -26,6 +26,9 @@ export declare const AgentIdSchema: GenMessage<AgentId>;
  * @internal
  * The handler resolves the default agent globally (by label stigmer.ai/default-agent: "true"
  * with visibility_public), but the org is needed for authorization scoping.
+ * Resolution is deliberately NOT scoped to this org: the default agent is a
+ * platform-level singleton seeded in the system org and served to callers of
+ * every org (see the getDefault rpc docs for the determinism contract).
  *
  * @generated from message ai.stigmer.agentic.agent.v1.GetDefaultAgentRequest
  */

package/ai/stigmer/agentic/agent/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,oNAAoN,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAc/P;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,aAAa,CAC7D,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAoBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,oNAAoN,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAc/P;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,aAAa,CAC7D,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agent/v1/query_connect.d.ts

@@ -46,6 +46,13 @@ export declare const AgentQueryController: {
          * Resolves the agent labeled stigmer.ai/default-agent: "true" with
          * visibility_public. Custom authorization in handler.
          *
+         * Resolution is deterministic (stigmer/stigmer#356): only public labeled
+         * agents are candidates, and with multiple candidates — a reachable state,
+         * since safe label rotation applies the new default before retiring the
+         * old — the one with the lowest metadata.id (the incumbent) wins. The
+         * default changes only when the incumbent's label is explicitly removed,
+         * never as a side effect of another agent gaining the label.
+         *
          * @generated from rpc ai.stigmer.agentic.agent.v1.AgentQueryController.getDefault
          */
         readonly getDefault: {

package/ai/stigmer/agentic/agent/v1/query_connect.js

@@ -54,6 +54,13 @@ export const AgentQueryController = {
          * Resolves the agent labeled stigmer.ai/default-agent: "true" with
          * visibility_public. Custom authorization in handler.
          *
+         * Resolution is deterministic (stigmer/stigmer#356): only public labeled
+         * agents are candidates, and with multiple candidates — a reachable state,
+         * since safe label rotation applies the new default before retiring the
+         * old — the one with the lowest metadata.id (the incumbent) wins. The
+         * default changes only when the incumbent's label is explicitly removed,
+         * never as a side effect of another agent gaining the label.
+         *
          * @generated from rpc ai.stigmer.agentic.agent.v1.AgentQueryController.getDefault
          */
         getDefault: {

package/ai/stigmer/agentic/agent/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ,EAAE,kDAAkD;IAC5D,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,YAAY;YAClB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ,EAAE,kDAAkD;IAC5D,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,YAAY;YAClB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/agent/v1/query_pb.d.ts

@@ -50,6 +50,13 @@ export declare const AgentQueryController: GenService<{
      * Resolves the agent labeled stigmer.ai/default-agent: "true" with
      * visibility_public. Custom authorization in handler.
      *
+     * Resolution is deterministic (stigmer/stigmer#356): only public labeled
+     * agents are candidates, and with multiple candidates — a reachable state,
+     * since safe label rotation applies the new default before retiring the
+     * old — the one with the lowest metadata.id (the incumbent) wins. The
+     * default changes only when the incumbent's label is explicitly removed,
+     * never as a side effect of another agent gaining the label.
+     *
      * @generated from rpc ai.stigmer.agentic.agent.v1.AgentQueryController.getDefault
      */
     getDefault: {

package/ai/stigmer/agentic/agent/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,omBAAomB,EAAE,CAAC,oCAAoC,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE30B;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GA8C5B,aAAa,CAChB,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,omBAAomB,EAAE,CAAC,oCAAoC,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE30B;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAqD5B,aAAa,CAChB,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agent/v1/spec_pb.d.ts

@@ -165,7 +165,16 @@ export type McpServerUsage = Message<"ai.stigmer.agentic.agent.v1.McpServerUsage
      * Only names from discovered_capabilities.tools are valid here.
      * Do NOT include names from discovered_capabilities.resource_templates —
      * resource templates are read-only data endpoints, not callable tools.
-     * Including a resource template name here causes a fatal runtime error.
+     * A name the server does not expose (including a resource template name)
+     * is warned and ignored at execution: the runner enforces the INTERSECTION
+     * with the server's live toolset, so a stale or mistyped entry narrows the
+     * toolset but never widens it or fails the run.
+     *
+     * Enforcement: the native (deep-agent) harness filters the discovered
+     * toolset before it reaches the model; the Cursor harness cannot hide a
+     * server's tools (its SDK config has no allow-list field), so its HITL
+     * hook permanently denies calls to non-enabled tools instead — the model
+     * may still see the tool listed, but every call is refused.
      *
      * @generated from field: repeated string enabled_tools = 2;
      */
@@ -174,6 +183,9 @@ export type McpServerUsage = Message<"ai.stigmer.agentic.agent.v1.McpServerUsage
      * Override approval requirements for specific tools.
      * Takes precedence over McpServerSpec.pinned_tool_approvals and
      * McpServerStatus.tool_approvals.
+     * Scoped to THIS usage's server: an override applies only to tools of
+     * the McpServer referenced by mcp_server_ref — a same-named tool on
+     * another server is unaffected.
      *
      * @generated from field: repeated ai.stigmer.agentic.agent.v1.ToolApprovalOverride tool_approval_overrides = 3;
      */
@@ -259,6 +271,9 @@ export declare const McpAccessSchema: GenMessage<McpAccess>;
  * McpServerSpec.pinned_tool_approvals and McpServerStatus.tool_approvals,
  * but can be bypassed at execution time by AgentExecution.auto_approve_all.
  *
+ * An override is scoped to the McpServer referenced by its parent usage:
+ * it never affects a same-named tool on another server.
+ *
  * @internal
  * Policy chain (lowest to highest priority):
  * 1. McpServerStatus.tool_approvals — system-generated defaults

package/ai/stigmer/agentic/agent/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mHAAmH;AACnH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAY,aAAa,CACzE,QAAQ,CAAC,43EAA43E,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA0E/iF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA8DxD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAyB,aAAa,CAC/D,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAgDxD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAgCxD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA+BxD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAiDxD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mHAAmH;AACnH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAY,aAAa,CACzE,QAAQ,CAAC,43EAA43E,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA0E/iF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA8DxD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAyB,aAAa,CAC/D,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA4DxD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAgCxD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA+BxD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAoDxD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agentexecution/v1/query_connect.d.ts

@@ -58,24 +58,33 @@ export declare const AgentExecutionQueryController: {
             readonly kind: any;
         };
         /**
-         * Get a presigned download URL for an execution artifact.
+         * Get a presigned download URL for an execution artifact or attachment.
          *
          * Returns a time-limited URL for downloading an artifact published by
-         * an agent during execution. The URL can be used with a simple HTTP GET
-         * request without authentication.
+         * an agent during execution, or an attachment submitted with the
+         * execution. The URL can be used with a simple HTTP GET request without
+         * authentication.
          *
          * @internal
          *
          * ## Authorization
          *
          * Requires can_view permission on the execution. This ensures users can
-         * only download artifacts from executions they have access to.
+         * only download files from executions they have access to.
          *
          * ## Security
          *
          * The storage_key is validated to ensure it belongs to the specified
-         * execution. Keys must start with "artifacts/{execution_id}/" to prevent
-         * path traversal attacks.
+         * execution. Two key forms are accepted:
+         *
+         * - "artifacts/{execution_id}/..." — outputs published by the execution;
+         *   the embedded execution id is the ownership proof
+         * - a key listed verbatim in the execution's spec.attachments — inputs
+         *   submitted with the turn ("attachments/{ulid}/{filename}", ULID-unique
+         *   per upload); ownership is the spec reference, since the key carries
+         *   no execution id
+         *
+         * Any other key is rejected to prevent path traversal attacks.
          *
          * ## URL Expiration
          *
@@ -86,12 +95,13 @@ export declare const AgentExecutionQueryController: {
          *
          * - CLI downloading agent-created files
          * - Web UI providing download links for artifacts
+         * - Web UI rendering submitted attachments in the message thread
          * - Refreshing expired download URLs
          *
          * ## Example Flow
          *
          * 1. Get execution via AgentExecutionQueryController.get
-         * 2. Find artifact in status.artifacts[]
+         * 2. Find artifact in status.artifacts[] (or attachment in spec.attachments[])
          * 3. Call getArtifactDownloadUrl with execution_id and storage_key
          * 4. Use returned download_url for HTTP GET
          *

package/ai/stigmer/agentic/agentexecution/v1/query_connect.js

@@ -65,24 +65,33 @@ export const AgentExecutionQueryController = {
             kind: MethodKind.ServerStreaming,
         },
         /**
-         * Get a presigned download URL for an execution artifact.
+         * Get a presigned download URL for an execution artifact or attachment.
          *
          * Returns a time-limited URL for downloading an artifact published by
-         * an agent during execution. The URL can be used with a simple HTTP GET
-         * request without authentication.
+         * an agent during execution, or an attachment submitted with the
+         * execution. The URL can be used with a simple HTTP GET request without
+         * authentication.
          *
          * @internal
          *
          * ## Authorization
          *
          * Requires can_view permission on the execution. This ensures users can
-         * only download artifacts from executions they have access to.
+         * only download files from executions they have access to.
          *
          * ## Security
          *
          * The storage_key is validated to ensure it belongs to the specified
-         * execution. Keys must start with "artifacts/{execution_id}/" to prevent
-         * path traversal attacks.
+         * execution. Two key forms are accepted:
+         *
+         * - "artifacts/{execution_id}/..." — outputs published by the execution;
+         *   the embedded execution id is the ownership proof
+         * - a key listed verbatim in the execution's spec.attachments — inputs
+         *   submitted with the turn ("attachments/{ulid}/{filename}", ULID-unique
+         *   per upload); ownership is the spec reference, since the key carries
+         *   no execution id
+         *
+         * Any other key is rejected to prevent path traversal attacks.
          *
          * ## URL Expiration
          *
@@ -93,12 +102,13 @@ export const AgentExecutionQueryController = {
          *
          * - CLI downloading agent-created files
          * - Web UI providing download links for artifacts
+         * - Web UI rendering submitted attachments in the message thread
          * - Refreshing expired download URLs
          *
          * ## Example Flow
          *
          * 1. Get execution via AgentExecutionQueryController.get
-         * 2. Find artifact in status.artifacts[]
+         * 2. Find artifact in status.artifacts[] (or attachment in spec.attachments[])
          * 3. Call getArtifactDownloadUrl with execution_id and storage_key
          * 4. Use returned download_url for HTTP GET
          *

package/ai/stigmer/agentic/agentexecution/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentexecution/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sIAAsI;AACtI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,mCAAmC,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAC5gB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,CAAC,EAAE,0BAA0B;YAC7B,CAAC,EAAE,kBAAkB;YACrB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,mCAAmC;YACtC,CAAC,EAAE,kBAAkB;YACrB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,eAAe;SACjC;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAyCG;QACH,sBAAsB,EAAE;YACtB,IAAI,EAAE,wBAAwB;YAC9B,CAAC,EAAE,6BAA6B;YAChC,CAAC,EAAE,8BAA8B;YACjC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAwCG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,4BAA4B;YAC/B,CAAC,EAAE,6BAA6B;YAChC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,qBAAqB,EAAE;YACrB,IAAI,EAAE,uBAAuB;YAC7B,CAAC,EAAE,0BAA0B;YAC7B,CAAC,EAAE,2BAA2B;YAC9B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,uBAAuB;YAC1B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentexecution/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sIAAsI;AACtI,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,mCAAmC,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAC5gB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;WAIG;QACH,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,CAAC,EAAE,0BAA0B;YAC7B,CAAC,EAAE,kBAAkB;YACrB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,CAAC,EAAE,mCAAmC;YACtC,CAAC,EAAE,kBAAkB;YACrB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;WAOG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,WAAW;YACjB,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,cAAc;YACjB,IAAI,EAAE,UAAU,CAAC,eAAe;SACjC;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAmDG;QACH,sBAAsB,EAAE;YACtB,IAAI,EAAE,wBAAwB;YAC9B,CAAC,EAAE,6BAA6B;YAChC,CAAC,EAAE,8BAA8B;YACjC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAwCG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,4BAA4B;YAC/B,CAAC,EAAE,6BAA6B;YAChC,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,qBAAqB,EAAE;YACrB,IAAI,EAAE,uBAAuB;YAC7B,CAAC,EAAE,0BAA0B;YAC7B,CAAC,EAAE,2BAA2B;YAC9B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,wBAAwB;YAC3B,CAAC,EAAE,yBAAyB;YAC5B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;WAMG;QACH,iBAAiB,EAAE;YACjB,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,uBAAuB;YAC1B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,mBAAmB,EAAE;YACnB,IAAI,EAAE,qBAAqB;YAC3B,CAAC,EAAE,+BAA+B;YAClC,CAAC,EAAE,qBAAqB;YACxB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/agentexecution/v1/query_pb.d.ts

@@ -59,24 +59,33 @@ export declare const AgentExecutionQueryController: GenService<{
         output: typeof AgentExecutionSchema;
     };
     /**
-     * Get a presigned download URL for an execution artifact.
+     * Get a presigned download URL for an execution artifact or attachment.
      *
      * Returns a time-limited URL for downloading an artifact published by
-     * an agent during execution. The URL can be used with a simple HTTP GET
-     * request without authentication.
+     * an agent during execution, or an attachment submitted with the
+     * execution. The URL can be used with a simple HTTP GET request without
+     * authentication.
      *
      * @internal
      *
      * ## Authorization
      *
      * Requires can_view permission on the execution. This ensures users can
-     * only download artifacts from executions they have access to.
+     * only download files from executions they have access to.
      *
      * ## Security
      *
      * The storage_key is validated to ensure it belongs to the specified
-     * execution. Keys must start with "artifacts/{execution_id}/" to prevent
-     * path traversal attacks.
+     * execution. Two key forms are accepted:
+     *
+     * - "artifacts/{execution_id}/..." — outputs published by the execution;
+     *   the embedded execution id is the ownership proof
+     * - a key listed verbatim in the execution's spec.attachments — inputs
+     *   submitted with the turn ("attachments/{ulid}/{filename}", ULID-unique
+     *   per upload); ownership is the spec reference, since the key carries
+     *   no execution id
+     *
+     * Any other key is rejected to prevent path traversal attacks.
      *
      * ## URL Expiration
      *
@@ -87,12 +96,13 @@ export declare const AgentExecutionQueryController: GenService<{
      *
      * - CLI downloading agent-created files
      * - Web UI providing download links for artifacts
+     * - Web UI rendering submitted attachments in the message thread
      * - Refreshing expired download URLs
      *
      * ## Example Flow
      *
      * 1. Get execution via AgentExecutionQueryController.get
-     * 2. Find artifact in status.artifacts[]
+     * 2. Find artifact in status.artifacts[] (or attachment in spec.attachments[])
      * 3. Call getArtifactDownloadUrl with execution_id and storage_key
      * 4. Use returned download_url for HTTP GET
      *

package/ai/stigmer/agentic/agentexecution/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentexecution/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sIAAsI;AACtI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,6CAA6C,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,4CAA4C,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,o9FAAo9F,EAAE,CAAC,6CAA6C,EAAE,4CAA4C,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAErqG;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GA+NrC,aAAa,CAChB,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agentexecution/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sIAAsI;AACtI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,6CAA6C,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,4CAA4C,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,o9FAAo9F,EAAE,CAAC,6CAA6C,EAAE,4CAA4C,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAErqG;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAyOrC,aAAa,CAChB,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/executioncontext/v1/command_connect.d.ts

@@ -2,13 +2,22 @@
  * ExecutionContextCommandController handles write operations for ExecutionContext resources.
  *
  * @internal
- * Authorization: All RPCs use is_skip_authorization with custom handler-level derived auth.
- * ExecutionContext is ephemeral (1:1 with its parent execution) and has no dedicated
- * FGA model. Authorization is derived from the parent execution:
- *   - create: Caller must have can_edit on parent agent_execution or workflow_execution
- *   - delete: Caller must have can_edit on parent agent_execution or workflow_execution
- *
- * This avoids FGA tuple churn for short-lived resources while maintaining proper access control.
+ * Every write RPC uses is_skip_authorization with a real handler-level check
+ * (the framework's declarative FGA options cannot express any of these):
+ *   - create: the caller-class differs by transport. Internal in-process
+ *     pipeline calls (agent execution, workflow execution, workflow recovery,
+ *     MCP connect) are trusted — the parent operation already authorized the
+ *     run against its session-or-org, and the EC is created before that parent
+ *     is persisted, so it carries no resource to re-check. External callers
+ *     must hold can_create_execution_in on metadata.org (the same bar that
+ *     gates creating an execution in the org; held by members and guests).
+ *     A declarative org option cannot encode the internal/external split.
+ *   - apply: intentionally unannotated router — it delegates to create
+ *     (create-or-fail; ExecutionContext has no update RPC) and the delegated
+ *     pipeline runs under create's handler, authorization included.
+ *   - delete: caller must have can_edit on execution_context:<id> (owner-only,
+ *     per the execution_context FGA model). The FGA target is the loaded
+ *     resource, so it cannot be a declarative method option.
  *
  * @generated from service ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController
  */
@@ -19,8 +28,9 @@ export declare const ExecutionContextCommandController: {
          * Create or update an ExecutionContext.
          *
          * @internal
-         * The authorization and state-operation are determined depending on whether the execution context
-         * is going to be created or updated which is determined as part of the request execution.
+         * Router only: delegates to create when the resource does not exist and
+         * fails with ALREADY_EXISTS when it does (no update RPC). Authorization is
+         * inherited from the delegated create pipeline.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.apply
          */
@@ -34,8 +44,13 @@ export declare const ExecutionContextCommandController: {
          * Create a new ExecutionContext for an execution.
          *
          * @internal
-         * Called by execution pipeline on behalf of the user.
-         * Handler-level derived auth: checks can_edit on parent agent_execution or workflow_execution.
+         * Called by the execution pipelines (agent execution, workflow execution,
+         * workflow recovery, MCP connect) as sub-steps, and reachable directly by
+         * API clients. is_skip_authorization because the caller-class split cannot
+         * be a declarative option: the create handler trusts internal in-process
+         * calls (already authorized upstream) and requires external callers to hold
+         * can_create_execution_in on metadata.org. The pipeline additionally grants
+         * the caller the owner tuple, which gates all subsequent reads and delete.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.create
          */
@@ -49,8 +64,10 @@ export declare const ExecutionContextCommandController: {
          * Delete an ExecutionContext.
          *
          * @internal
-         * Called when execution completes. Handler-level derived auth: checks can_edit
-         * on parent agent_execution or workflow_execution.
+         * Called when execution completes. Handler-level auth (the FGA target is the
+         * loaded resource, so it cannot be a declarative option): caller must have
+         * can_edit on execution_context:<id>, which the FGA model resolves to the
+         * owner written at create time.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.delete
          */

package/ai/stigmer/agentic/executioncontext/v1/command_connect.js

@@ -9,13 +9,22 @@ import { ApiResourceDeleteInput } from "../../../commons/apiresource/io_pbjs";
  * ExecutionContextCommandController handles write operations for ExecutionContext resources.
  *
  * @internal
- * Authorization: All RPCs use is_skip_authorization with custom handler-level derived auth.
- * ExecutionContext is ephemeral (1:1 with its parent execution) and has no dedicated
- * FGA model. Authorization is derived from the parent execution:
- *   - create: Caller must have can_edit on parent agent_execution or workflow_execution
- *   - delete: Caller must have can_edit on parent agent_execution or workflow_execution
- *
- * This avoids FGA tuple churn for short-lived resources while maintaining proper access control.
+ * Every write RPC uses is_skip_authorization with a real handler-level check
+ * (the framework's declarative FGA options cannot express any of these):
+ *   - create: the caller-class differs by transport. Internal in-process
+ *     pipeline calls (agent execution, workflow execution, workflow recovery,
+ *     MCP connect) are trusted — the parent operation already authorized the
+ *     run against its session-or-org, and the EC is created before that parent
+ *     is persisted, so it carries no resource to re-check. External callers
+ *     must hold can_create_execution_in on metadata.org (the same bar that
+ *     gates creating an execution in the org; held by members and guests).
+ *     A declarative org option cannot encode the internal/external split.
+ *   - apply: intentionally unannotated router — it delegates to create
+ *     (create-or-fail; ExecutionContext has no update RPC) and the delegated
+ *     pipeline runs under create's handler, authorization included.
+ *   - delete: caller must have can_edit on execution_context:<id> (owner-only,
+ *     per the execution_context FGA model). The FGA target is the loaded
+ *     resource, so it cannot be a declarative method option.
  *
  * @generated from service ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController
  */
@@ -26,8 +35,9 @@ export const ExecutionContextCommandController = {
          * Create or update an ExecutionContext.
          *
          * @internal
-         * The authorization and state-operation are determined depending on whether the execution context
-         * is going to be created or updated which is determined as part of the request execution.
+         * Router only: delegates to create when the resource does not exist and
+         * fails with ALREADY_EXISTS when it does (no update RPC). Authorization is
+         * inherited from the delegated create pipeline.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.apply
          */
@@ -41,8 +51,13 @@ export const ExecutionContextCommandController = {
          * Create a new ExecutionContext for an execution.
          *
          * @internal
-         * Called by execution pipeline on behalf of the user.
-         * Handler-level derived auth: checks can_edit on parent agent_execution or workflow_execution.
+         * Called by the execution pipelines (agent execution, workflow execution,
+         * workflow recovery, MCP connect) as sub-steps, and reachable directly by
+         * API clients. is_skip_authorization because the caller-class split cannot
+         * be a declarative option: the create handler trusts internal in-process
+         * calls (already authorized upstream) and requires external callers to hold
+         * can_create_execution_in on metadata.org. The pipeline additionally grants
+         * the caller the owner tuple, which gates all subsequent reads and delete.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.create
          */
@@ -56,8 +71,10 @@ export const ExecutionContextCommandController = {
          * Delete an ExecutionContext.
          *
          * @internal
-         * Called when execution completes. Handler-level derived auth: checks can_edit
-         * on parent agent_execution or workflow_execution.
+         * Called when execution completes. Handler-level auth (the FGA target is the
+         * loaded resource, so it cannot be a declarative option): caller must have
+         * can_edit on execution_context:<id>, which the FGA model resolves to the
+         * owner written at create time.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.delete
          */

package/ai/stigmer/agentic/executioncontext/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4IAA4I;AAC5I,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,0EAA0E;IACpF,OAAO,EAAE;QACP;;;;;;;;WAQG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4IAA4I;AAC5I,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,0EAA0E;IACpF,OAAO,EAAE;QACP;;;;;;;;;WASG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}