@stigmer/protos 3.9.0 → 3.11.0

package/ai/stigmer/iam/iampolicy/v1/command_pb.d.ts

@@ -206,6 +206,9 @@ export declare const IamPolicyCommandController: GenService<{
      *
      * Authorization:
      * - Caller must have 'can_grant_access' permission on the organization
+     * - System flows running as the platform machine account cannot satisfy this
+     *   check (the machine account holds no org-scoped grants by design) and must
+     *   use bootstrapRevokeOrgAccess instead
      *
      * Use Cases:
      * - Removing a member from an organization
@@ -221,4 +224,48 @@ export declare const IamPolicyCommandController: GenService<{
         input: typeof RevokeOrgAccessInputSchema;
         output: typeof EmptySchema;
     };
+    /**
+     * Revoke all of a user's access to an organization via the system (bootstrap) path.
+     *
+     * The system-flow twin of revokeOrgAccess: identical revocation behavior, but
+     * authorized by can_bootstrap_iam on platform:stigmer instead of
+     * can_grant_access on the organization.
+     *
+     * @internal
+     * Exists because system flows execute the revoke as the platform machine
+     * account, which by design holds no org-scoped grants. The system channel does
+     * NOT bypass authorization — it authenticates as the machine account, which
+     * can only satisfy platform-scoped permissions. revokeOrgAccess therefore
+     * always fails with PERMISSION_DENIED on the system channel; this RPC is the
+     * sanctioned path, mirroring how bootstrapPolicy is the system-path twin of
+     * create (see https://github.com/stigmer/stigmer/issues/332).
+     *
+     * The operation (identical to revokeOrgAccess after authorization):
+     * 1. Validates can_bootstrap_iam permission on platform:stigmer
+     * 2. Loads all policies where the identity account is principal within the org
+     *    scope, plus policies directly on the organization itself
+     * 3. Deletes all matching policies from MongoDB
+     * 4. Removes all corresponding tuples from OpenFGA (idempotent if none exist)
+     *
+     * Authorization:
+     * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
+     * - This is typically only granted to platform services (machine accounts)
+     *
+     * Use Cases:
+     * - Federated account deprovisioning (deprovisionFederatedAccount's revoke step)
+     * - Any platform-driven offboarding that runs under system credentials
+     *
+     * End-user member removal must use revokeOrgAccess, which checks
+     * can_grant_access on the organization.
+     *
+     * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+     * Output: Empty (google.protobuf.Empty)
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapRevokeOrgAccess
+     */
+    bootstrapRevokeOrgAccess: {
+        methodKind: "unary";
+        input: typeof RevokeOrgAccessInputSchema;
+        output: typeof EmptySchema;
+    };
 }>;

package/ai/stigmer/iam/iampolicy/v1/command_pb.js

@@ -11,7 +11,7 @@ import { file_google_protobuf_empty } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/command.proto.
  */
-export const file_ai_stigmer_iam_iampolicy_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMswGChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKCAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IiTCuBggCAQqHHVuYXV0aG9yaXplZCB0byBncmFudCBhY2Nlc3MSgwEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjGiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSIlwrgYIQgEKh11bmF1dGhvcml6ZWQgdG8gcmV2b2tlIGFjY2VzcxLCAQoPYm9vdHN0cmFwUG9saWN5EiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlvCuBhXCBEQHypIdW5hdXRob3JpemVkIHRvIGJvb3RzdHJhcCBwb2xpY3kgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEsQBChdjbGVhbnVwUmVzb3VyY2VQb2xpY2llcxIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSJkwrgYYAgREB8qUXVuYXV0aG9yaXplZCB0byBjbGVhbnVwIHJlc291cmNlIHBvbGljaWVzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchKQAQoPcmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IjLCuBguCAQqKnVuYXV0aG9yaXplZCB0byByZXZva2Ugb3JnYW5pemF0aW9uIGFjY2VzcxoEoP8rCmIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io, file_ai_stigmer_iam_iampolicy_v1_spec, file_google_protobuf_empty]);
+export const file_ai_stigmer_iam_iampolicy_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMpsIChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKCAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IiTCuBggCAQqHHVuYXV0aG9yaXplZCB0byBncmFudCBhY2Nlc3MSgwEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjGiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSIlwrgYIQgEKh11bmF1dGhvcml6ZWQgdG8gcmV2b2tlIGFjY2VzcxLCAQoPYm9vdHN0cmFwUG9saWN5EiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlvCuBhXCBEQHypIdW5hdXRob3JpemVkIHRvIGJvb3RzdHJhcCBwb2xpY3kgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEsQBChdjbGVhbnVwUmVzb3VyY2VQb2xpY2llcxIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSJkwrgYYAgREB8qUXVuYXV0aG9yaXplZCB0byBjbGVhbnVwIHJlc291cmNlIHBvbGljaWVzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchKQAQoPcmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IjLCuBguCAQqKnVuYXV0aG9yaXplZCB0byByZXZva2Ugb3JnYW5pemF0aW9uIGFjY2VzcxLMAQoYYm9vdHN0cmFwUmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5ImXCuBhhCBEQHypSdW5hdXRob3JpemVkIHRvIHJldm9rZSBvcmdhbml6YXRpb24gYWNjZXNzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchoEoP8rCmIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io, file_ai_stigmer_iam_iampolicy_v1_spec, file_google_protobuf_empty]);
 /**
  * IAM Policy Command Controller
  *

package/ai/stigmer/iam/iampolicy/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,stCAAstC,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEx9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAmMlC,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,0+CAA0+C,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAE5uD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAkPlC,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/platform/v1/server_info_pb.d.ts

@@ -183,8 +183,10 @@ export declare const GetRunnerScopedTokenInputSchema: GenMessage<GetRunnerScoped
  * @internal
  * Cloud authorizes against the pool claim record, not FGA: the pool_sandboxes
  * row for the caller token's pool_member_id must be CLAIMED for exactly this
- * session_id (the DB is the authorization source), and the minted session
- * token's TTL is the window-covering value recorded on that row at claim time.
+ * session_id (the DB is the authorization source). Identity and org are minted
+ * from the values the claimer recorded on that row — never from the client —
+ * and the TTL is the config-owned standard sandbox TTL, like every session
+ * token (stigmer-cloud#256; renewal, not lifetime, carries long conversations).
  * OSS has no pool and mints nothing (empty output, presence-based contract).
  *
  * @generated from message ai.stigmer.platform.v1.PoolClaim
@@ -228,9 +230,10 @@ export declare const PoolClaimSchema: GenMessage<PoolClaim>;
  * the same of its workflow_sandboxes row. The record IS the revocation
  * lever: when the lifecycle reconciler reaps the sandbox, renewal dies with
  * it, so a credential's renewable lifetime is exactly its sandbox's
- * lifetime. Minted TTL is the standard sandbox TTL (not window-covering) —
- * renewal is what makes short TTLs sufficient. OSS has no signing key and
- * mints nothing (empty output, presence-based contract).
+ * lifetime. Minted TTL is the standard sandbox TTL — every mint path uses it
+ * (stigmer-cloud#256), and renewal is what makes short TTLs sufficient. OSS
+ * has no signing key and mints nothing (empty output, presence-based
+ * contract).
  *
  * @generated from message ai.stigmer.platform.v1.TokenRenewal
  */

package/ai/stigmer/platform/v1/server_info_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"server_info_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,yuDAAyuD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAUh0D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAW1D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA8D1D;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA6B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAoC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA2C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,aAqBX;AArBD,WAAY,aAAa;IACvB;;OAEG;IACH,6FAA8B,CAAA;IAE9B;;;;;OAKG;IACH,+CAAO,CAAA;IAEP;;;;;OAKG;IACH,mDAAS,CAAA;AACX,CAAC,EArBW,aAAa,KAAb,aAAa,QAqBxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GA8F/B,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server_info_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,yuDAAyuD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAUh0D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAW1D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA8D1D;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA+B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAqC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA2C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,aAqBX;AArBD,WAAY,aAAa;IACvB;;OAEG;IACH,6FAA8B,CAAA;IAE9B;;;;;OAKG;IACH,+CAAO,CAAA;IAEP;;;;;OAKG;IACH,mDAAS,CAAA;AACX,CAAC,EArBW,aAAa,KAAb,aAAa,QAqBxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GA8F/B,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/search/v1/io_pb.d.ts

@@ -31,12 +31,12 @@ export type SearchRequest = Message<"ai.stigmer.search.v1.SearchRequest"> & {
      *
      * Behavior:
      * - Empty: Search all searchable kinds (discover mode)
-     *   Searchable kinds: agent, skill, mcp_server, workflow
      * - Single kind: Search only that resource type
      * - Multiple kinds: Search specified types
      *
-     * @internal
-     * Invalid kinds are silently ignored (allows forward compatibility).
+     * The searchable set is edition-defined (the cloud and open-source servers
+     * each publish their own); kinds outside it are silently ignored
+     * (allows forward compatibility).
      *
      * @generated from field: repeated ai.stigmer.commons.apiresource.apiresourcekind.ApiResourceKind kinds = 1;
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/protos",
-  "version": "3.9.0",
+  "version": "3.11.0",
   "description": "Generated TypeScript protobuf stubs for Stigmer APIs",
   "license": "Apache-2.0",
   "type": "module",