@structured-id/ui-core 1.2.0 → 2.0.0

package/src/generated/google/rpc/status.ts

@@ -0,0 +1,127 @@
+// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
+// @generated from protobuf file "google/rpc/status.proto" (package "google.rpc", syntax proto3)
+// tslint:disable
+//
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+import { Any } from "../protobuf/any";
+/**
+ * The `Status` type defines a logical error model that is suitable for
+ * different programming environments, including REST APIs and RPC APIs. It is
+ * used by [gRPC](https://github.com/grpc). Each `Status` message contains
+ * three pieces of data: error code, error message, and error details.
+ *
+ * You can find out more about this error model and how to work with it in the
+ * [API Design Guide](https://cloud.google.com/apis/design/errors).
+ *
+ * @generated from protobuf message google.rpc.Status
+ */
+export interface Status {
+    /**
+     * The status code, which should be an enum value of
+     * [google.rpc.Code][google.rpc.Code].
+     *
+     * @generated from protobuf field: int32 code = 1
+     */
+    code: number;
+    /**
+     * A developer-facing error message, which should be in English. Any
+     * user-facing error message should be localized and sent in the
+     * [google.rpc.Status.details][google.rpc.Status.details] field, or localized
+     * by the client.
+     *
+     * @generated from protobuf field: string message = 2
+     */
+    message: string;
+    /**
+     * A list of messages that carry the error details.  There is a common set of
+     * message types for APIs to use.
+     *
+     * @generated from protobuf field: repeated google.protobuf.Any details = 3
+     */
+    details: Any[];
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class Status$Type extends MessageType<Status> {
+    constructor() {
+        super("google.rpc.Status", [
+            { no: 1, name: "code", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 2, name: "message", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "details", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => Any }
+        ]);
+    }
+    create(value?: PartialMessage<Status>): Status {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.code = 0;
+        message.message = "";
+        message.details = [];
+        if (value !== undefined)
+            reflectionMergePartial<Status>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Status): Status {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* int32 code */ 1:
+                    message.code = reader.int32();
+                    break;
+                case /* string message */ 2:
+                    message.message = reader.string();
+                    break;
+                case /* repeated google.protobuf.Any details */ 3:
+                    message.details.push(Any.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: Status, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* int32 code = 1; */
+        if (message.code !== 0)
+            writer.tag(1, WireType.Varint).int32(message.code);
+        /* string message = 2; */
+        if (message.message !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.message);
+        /* repeated google.protobuf.Any details = 3; */
+        for (let i = 0; i < message.details.length; i++)
+            Any.internalBinaryWrite(message.details[i], writer.tag(3, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.rpc.Status
+ */
+export const Status = new Status$Type();

package/src/generated/sid/v1/account/account.ts

@@ -18,7 +18,7 @@ import { ProfilePhone } from "../identity/identity";
 import { PhoneLabel } from "../identity/identity";
 import { Timestamp } from "../../../google/protobuf/timestamp";
 // ══════════════════════════════════════════════════════════════════════════
-// Consent management — claim-level consent control (SID differentiator)
+// Consent management — claim-level consent control
 // ══════════════════════════════════════════════════════════════════════════
 
 /**

package/src/generated/sid/v1/admin/admin.client.ts

@@ -4,7 +4,6 @@
 import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
 import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
 import { AdminService } from "./admin";
-import type { Empty } from "../../../google/protobuf/empty";
 import type { DeleteProfileMetadataRequest } from "./admin";
 import type { SetProfileMetadataRequest } from "./admin";
 import type { ProfileMetadataEntry } from "./admin";
@@ -16,8 +15,8 @@ import type { RevokeAllSessionsRequest } from "./admin";
 import type { AdminUpdateProfileResponse } from "./admin";
 import type { AdminUpdateProfileRequest } from "./admin";
 import { stackIntercept } from "@protobuf-ts/runtime-rpc";
-import type { BootstrapResponse } from "./admin";
-import type { BootstrapRequest } from "./admin";
+import type { Empty } from "../../../google/protobuf/empty";
+import type { ClaimInstanceRequest } from "./admin";
 import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
 import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
 /**
@@ -27,12 +26,14 @@ import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
  */
 export interface IAdminServiceClient {
     /**
-     * Create the first admin profile. Only works when no admin profiles exist.
-     * No authentication required — returns ALREADY_EXISTS if admin exists.
+     * Make the signed-in caller the first administrator of an unclaimed
+     * installation, with the claim token from the service log. The token is
+     * consumed in the same transaction. FAILED_PRECONDITION once the installation
+     * is claimed; PERMISSION_DENIED for a token that does not match.
      *
-     * @generated from protobuf rpc: Bootstrap
+     * @generated from protobuf rpc: ClaimInstance
      */
-    bootstrap(input: BootstrapRequest, options?: RpcOptions): UnaryCall<BootstrapRequest, BootstrapResponse>;
+    claimInstance(input: ClaimInstanceRequest, options?: RpcOptions): UnaryCall<ClaimInstanceRequest, Empty>;
     /**
      * Update a profile with admin-only fields (status, roles, email verification).
      *
@@ -76,14 +77,16 @@ export class AdminServiceClient implements IAdminServiceClient, ServiceInfo {
     constructor(private readonly _transport: RpcTransport) {
     }
     /**
-     * Create the first admin profile. Only works when no admin profiles exist.
-     * No authentication required — returns ALREADY_EXISTS if admin exists.
+     * Make the signed-in caller the first administrator of an unclaimed
+     * installation, with the claim token from the service log. The token is
+     * consumed in the same transaction. FAILED_PRECONDITION once the installation
+     * is claimed; PERMISSION_DENIED for a token that does not match.
      *
-     * @generated from protobuf rpc: Bootstrap
+     * @generated from protobuf rpc: ClaimInstance
      */
-    bootstrap(input: BootstrapRequest, options?: RpcOptions): UnaryCall<BootstrapRequest, BootstrapResponse> {
+    claimInstance(input: ClaimInstanceRequest, options?: RpcOptions): UnaryCall<ClaimInstanceRequest, Empty> {
         const method = this.methods[0], opt = this._transport.mergeOptions(options);
-        return stackIntercept<BootstrapRequest, BootstrapResponse>("unary", this._transport, method, opt, input);
+        return stackIntercept<ClaimInstanceRequest, Empty>("unary", this._transport, method, opt, input);
     }
     /**
      * Update a profile with admin-only fields (status, roles, email verification).

package/src/generated/sid/v1/admin/admin.ts

@@ -15,29 +15,19 @@ import { MessageType } from "@protobuf-ts/runtime";
 import { Timestamp } from "../../../google/protobuf/timestamp";
 import { Value } from "../../../google/protobuf/struct";
 import { ProfileStatus } from "../identity/identity";
-// ── Bootstrap ──
+// ── Instance claim ──
 
 /**
- * @generated from protobuf message sid.v1.admin.BootstrapRequest
+ * @generated from protobuf message sid.v1.admin.ClaimInstanceRequest
  */
-export interface BootstrapRequest {
+export interface ClaimInstanceRequest {
     /**
-     * @generated from protobuf field: string username = 1
-     */
-    username: string;
-}
-/**
- * @generated from protobuf message sid.v1.admin.BootstrapResponse
- */
-export interface BootstrapResponse {
-    /**
-     * @generated from protobuf field: string profile_id = 1
-     */
-    profileId: string;
-    /**
-     * @generated from protobuf field: string message = 2
+     * Instance claim token (`sidclaim_...`) the operator read from the service log
+     * of an installation that has no administrator. Bearer secret: never logged.
+     *
+     * @generated from protobuf field: string claim_token = 1
      */
-    message: string;
+    claimToken: string;
 }
 // ── Admin Update Profile ──
 
@@ -185,78 +175,26 @@ export interface DeleteProfileMetadataRequest {
     key: string;
 }
 // @generated message type with reflection information, may provide speed optimized methods
-class BootstrapRequest$Type extends MessageType<BootstrapRequest> {
-    constructor() {
-        super("sid.v1.admin.BootstrapRequest", [
-            { no: 1, name: "username", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<BootstrapRequest>): BootstrapRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.username = "";
-        if (value !== undefined)
-            reflectionMergePartial<BootstrapRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BootstrapRequest): BootstrapRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string username */ 1:
-                    message.username = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: BootstrapRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string username = 1; */
-        if (message.username !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.username);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.admin.BootstrapRequest
- */
-export const BootstrapRequest = new BootstrapRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class BootstrapResponse$Type extends MessageType<BootstrapResponse> {
+class ClaimInstanceRequest$Type extends MessageType<ClaimInstanceRequest> {
     constructor() {
-        super("sid.v1.admin.BootstrapResponse", [
-            { no: 1, name: "profile_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "message", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        super("sid.v1.admin.ClaimInstanceRequest", [
+            { no: 1, name: "claim_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<BootstrapResponse>): BootstrapResponse {
+    create(value?: PartialMessage<ClaimInstanceRequest>): ClaimInstanceRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.profileId = "";
-        message.message = "";
+        message.claimToken = "";
         if (value !== undefined)
-            reflectionMergePartial<BootstrapResponse>(this, message, value);
+            reflectionMergePartial<ClaimInstanceRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BootstrapResponse): BootstrapResponse {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ClaimInstanceRequest): ClaimInstanceRequest {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string profile_id */ 1:
-                    message.profileId = reader.string();
-                    break;
-                case /* string message */ 2:
-                    message.message = reader.string();
+                case /* string claim_token */ 1:
+                    message.claimToken = reader.string();
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -269,13 +207,10 @@ class BootstrapResponse$Type extends MessageType<BootstrapResponse> {
         }
         return message;
     }
-    internalBinaryWrite(message: BootstrapResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string profile_id = 1; */
-        if (message.profileId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.profileId);
-        /* string message = 2; */
-        if (message.message !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.message);
+    internalBinaryWrite(message: ClaimInstanceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string claim_token = 1; */
+        if (message.claimToken !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.claimToken);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -283,9 +218,9 @@ class BootstrapResponse$Type extends MessageType<BootstrapResponse> {
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.admin.BootstrapResponse
+ * @generated MessageType for protobuf message sid.v1.admin.ClaimInstanceRequest
  */
-export const BootstrapResponse = new BootstrapResponse$Type();
+export const ClaimInstanceRequest = new ClaimInstanceRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
 class AdminUpdateProfileRequest$Type extends MessageType<AdminUpdateProfileRequest> {
     constructor() {
@@ -836,7 +771,7 @@ export const DeleteProfileMetadataRequest = new DeleteProfileMetadataRequest$Typ
  * @generated ServiceType for protobuf service sid.v1.admin.AdminService
  */
 export const AdminService = new ServiceType("sid.v1.admin.AdminService", [
-    { name: "Bootstrap", options: { "google.api.http": { post: "/v1/admin/bootstrap", body: "*" } }, I: BootstrapRequest, O: BootstrapResponse },
+    { name: "ClaimInstance", options: { "google.api.http": { post: "/v1/admin/claim", body: "*" } }, I: ClaimInstanceRequest, O: Empty },
     { name: "AdminUpdateProfile", options: { "google.api.http": { patch: "/v1/admin/profiles/{profile_id}", body: "*" } }, I: AdminUpdateProfileRequest, O: AdminUpdateProfileResponse },
     { name: "RevokeAllSessions", idempotency: "IDEMPOTENT", options: { "google.api.http": { delete: "/v1/admin/profiles/{profile_id}/sessions" } }, I: RevokeAllSessionsRequest, O: RevokeAllSessionsResponse },
     { name: "ListProfileMetadata", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/profiles/{profile_id}/metadata" } }, I: ListProfileMetadataRequest, O: ListProfileMetadataResponse },

package/src/generated/sid/v1/admin/enrollment.client.ts

@@ -14,6 +14,7 @@ import type { ListInvitesRequest } from "./enrollment";
 import type { Invite } from "./enrollment";
 import type { CreateInviteRequest } from "./enrollment";
 import type { UpdateEnrollmentPolicyRequest } from "./enrollment";
+import type { InstanceStatus } from "./enrollment";
 import { stackIntercept } from "@protobuf-ts/runtime-rpc";
 import type { EnrollmentPolicy } from "./enrollment";
 import type { Empty } from "../../../google/protobuf/empty";
@@ -23,9 +24,6 @@ import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
  * EnrollmentService manages registration gating policies, invite codes,
  * and registration source analytics.
  *
- * CE ships 4 hardcoded enrollment modes (Open, InviteOnly, AdminOnly,
- * DomainRestricted). EE adds per-application overrides and pluggable rules.
- *
  * ── Enrollment Policy ──
  *
  * @generated from protobuf service sid.v1.admin.EnrollmentService
@@ -37,6 +35,13 @@ export interface IEnrollmentServiceClient {
      * @generated from protobuf rpc: GetEnrollmentPolicy
      */
     getEnrollmentPolicy(input: Empty, options?: RpcOptions): UnaryCall<Empty, EnrollmentPolicy>;
+    /**
+     * Whether the installation has been claimed by its first administrator.
+     * Public: while unclaimed, the registration page asks for the claim token.
+     *
+     * @generated from protobuf rpc: GetInstanceStatus
+     */
+    getInstanceStatus(input: Empty, options?: RpcOptions): UnaryCall<Empty, InstanceStatus>;
     /**
      * Update the enrollment policy (mode, domains, tracking).
      *
@@ -82,9 +87,6 @@ export interface IEnrollmentServiceClient {
  * EnrollmentService manages registration gating policies, invite codes,
  * and registration source analytics.
  *
- * CE ships 4 hardcoded enrollment modes (Open, InviteOnly, AdminOnly,
- * DomainRestricted). EE adds per-application overrides and pluggable rules.
- *
  * ── Enrollment Policy ──
  *
  * @generated from protobuf service sid.v1.admin.EnrollmentService
@@ -104,13 +106,23 @@ export class EnrollmentServiceClient implements IEnrollmentServiceClient, Servic
         const method = this.methods[0], opt = this._transport.mergeOptions(options);
         return stackIntercept<Empty, EnrollmentPolicy>("unary", this._transport, method, opt, input);
     }
+    /**
+     * Whether the installation has been claimed by its first administrator.
+     * Public: while unclaimed, the registration page asks for the claim token.
+     *
+     * @generated from protobuf rpc: GetInstanceStatus
+     */
+    getInstanceStatus(input: Empty, options?: RpcOptions): UnaryCall<Empty, InstanceStatus> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<Empty, InstanceStatus>("unary", this._transport, method, opt, input);
+    }
     /**
      * Update the enrollment policy (mode, domains, tracking).
      *
      * @generated from protobuf rpc: UpdateEnrollmentPolicy
      */
     updateEnrollmentPolicy(input: UpdateEnrollmentPolicyRequest, options?: RpcOptions): UnaryCall<UpdateEnrollmentPolicyRequest, EnrollmentPolicy> {
-        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        const method = this.methods[2], opt = this._transport.mergeOptions(options);
         return stackIntercept<UpdateEnrollmentPolicyRequest, EnrollmentPolicy>("unary", this._transport, method, opt, input);
     }
     // ── Invite Management ──
@@ -121,7 +133,7 @@ export class EnrollmentServiceClient implements IEnrollmentServiceClient, Servic
      * @generated from protobuf rpc: CreateInvite
      */
     createInvite(input: CreateInviteRequest, options?: RpcOptions): UnaryCall<CreateInviteRequest, Invite> {
-        const method = this.methods[2], opt = this._transport.mergeOptions(options);
+        const method = this.methods[3], opt = this._transport.mergeOptions(options);
         return stackIntercept<CreateInviteRequest, Invite>("unary", this._transport, method, opt, input);
     }
     /**
@@ -130,7 +142,7 @@ export class EnrollmentServiceClient implements IEnrollmentServiceClient, Servic
      * @generated from protobuf rpc: ListInvites
      */
     listInvites(input: ListInvitesRequest, options?: RpcOptions): UnaryCall<ListInvitesRequest, ListInvitesResponse> {
-        const method = this.methods[3], opt = this._transport.mergeOptions(options);
+        const method = this.methods[4], opt = this._transport.mergeOptions(options);
         return stackIntercept<ListInvitesRequest, ListInvitesResponse>("unary", this._transport, method, opt, input);
     }
     /**
@@ -139,7 +151,7 @@ export class EnrollmentServiceClient implements IEnrollmentServiceClient, Servic
      * @generated from protobuf rpc: RevokeInvite
      */
     revokeInvite(input: RevokeInviteRequest, options?: RpcOptions): UnaryCall<RevokeInviteRequest, Empty> {
-        const method = this.methods[4], opt = this._transport.mergeOptions(options);
+        const method = this.methods[5], opt = this._transport.mergeOptions(options);
         return stackIntercept<RevokeInviteRequest, Empty>("unary", this._transport, method, opt, input);
     }
     /**
@@ -148,7 +160,7 @@ export class EnrollmentServiceClient implements IEnrollmentServiceClient, Servic
      * @generated from protobuf rpc: BulkCreateInvites
      */
     bulkCreateInvites(input: BulkCreateInvitesRequest, options?: RpcOptions): UnaryCall<BulkCreateInvitesRequest, BulkCreateInvitesResponse> {
-        const method = this.methods[5], opt = this._transport.mergeOptions(options);
+        const method = this.methods[6], opt = this._transport.mergeOptions(options);
         return stackIntercept<BulkCreateInvitesRequest, BulkCreateInvitesResponse>("unary", this._transport, method, opt, input);
     }
     // ── Registration Analytics ──
@@ -159,7 +171,7 @@ export class EnrollmentServiceClient implements IEnrollmentServiceClient, Servic
      * @generated from protobuf rpc: GetRegistrationStats
      */
     getRegistrationStats(input: GetRegistrationStatsRequest, options?: RpcOptions): UnaryCall<GetRegistrationStatsRequest, RegistrationStats> {
-        const method = this.methods[6], opt = this._transport.mergeOptions(options);
+        const method = this.methods[7], opt = this._transport.mergeOptions(options);
         return stackIntercept<GetRegistrationStatsRequest, RegistrationStats>("unary", this._transport, method, opt, input);
     }
 }

package/src/generated/sid/v1/admin/enrollment.ts

@@ -13,6 +13,21 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
 import { Timestamp } from "../../../google/protobuf/timestamp";
+/**
+ * Whether the installation has its first administrator.
+ *
+ * @generated from protobuf message sid.v1.admin.InstanceStatus
+ */
+export interface InstanceStatus {
+    /**
+     * False while no administrator exists: self-registration then accepts only a
+     * registration carrying the claim token from the service log, whatever the
+     * enrollment mode. The token itself is never returned.
+     *
+     * @generated from protobuf field: bool claimed = 1
+     */
+    claimed: boolean;
+}
 // ══════════════════════════════════════════════════════════════════════════
 // Enrollment Policy
 // ══════════════════════════════════════════════════════════════════════════
@@ -454,8 +469,7 @@ export interface GetRegistrationStatsRequest {
 // ══════════════════════════════════════════════════════════════════════════
 
 /**
- * Registration gating mode. CE: 4 hardcoded options.
- * EE adds POLICY mode for composable rules.
+ * Registration gating mode.
  *
  * @generated from protobuf enum sid.v1.admin.EnrollmentMode
  */
@@ -525,7 +539,7 @@ export enum RegistrationSourceType {
      */
     SCIM_PROVISIONED = 4,
     /**
-     * Federation (person linked to this org).
+     * Federation (a user of another organization linked to this org).
      *
      * @generated from protobuf enum value: REGISTRATION_SOURCE_TYPE_FEDERATION = 5;
      */
@@ -573,6 +587,53 @@ export enum InviteStatus {
     EXPIRED = 4
 }
 // @generated message type with reflection information, may provide speed optimized methods
+class InstanceStatus$Type extends MessageType<InstanceStatus> {
+    constructor() {
+        super("sid.v1.admin.InstanceStatus", [
+            { no: 1, name: "claimed", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+        ]);
+    }
+    create(value?: PartialMessage<InstanceStatus>): InstanceStatus {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.claimed = false;
+        if (value !== undefined)
+            reflectionMergePartial<InstanceStatus>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: InstanceStatus): InstanceStatus {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool claimed */ 1:
+                    message.claimed = reader.bool();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: InstanceStatus, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool claimed = 1; */
+        if (message.claimed !== false)
+            writer.tag(1, WireType.Varint).bool(message.claimed);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.admin.InstanceStatus
+ */
+export const InstanceStatus = new InstanceStatus$Type();
+// @generated message type with reflection information, may provide speed optimized methods
 class EnrollmentPolicy$Type extends MessageType<EnrollmentPolicy> {
     constructor() {
         super("sid.v1.admin.EnrollmentPolicy", [
@@ -1695,6 +1756,7 @@ export const GetRegistrationStatsRequest = new GetRegistrationStatsRequest$Type(
  */
 export const EnrollmentService = new ServiceType("sid.v1.admin.EnrollmentService", [
     { name: "GetEnrollmentPolicy", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/enrollment/policy" } }, I: Empty, O: EnrollmentPolicy },
+    { name: "GetInstanceStatus", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/enrollment/instance-status" } }, I: Empty, O: InstanceStatus },
     { name: "UpdateEnrollmentPolicy", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/admin/enrollment/policy", body: "*" } }, I: UpdateEnrollmentPolicyRequest, O: EnrollmentPolicy },
     { name: "CreateInvite", options: { "google.api.http": { post: "/v1/admin/enrollment/invites", body: "*" } }, I: CreateInviteRequest, O: Invite },
     { name: "ListInvites", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/admin/enrollment/invites" } }, I: ListInvitesRequest, O: ListInvitesResponse },

package/src/generated/sid/v1/admin/events.client.ts

@@ -30,7 +30,7 @@ import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
 // ────────────────────────────────────────────────────────────────────────────
 
 /**
- * ── User Events (Page 9.1) ──
+ * ── User Events ──
  *
  * @generated from protobuf service sid.v1.admin.EventService
  */
@@ -47,7 +47,7 @@ export interface IEventServiceClient {
      * @generated from protobuf rpc: GetUserTimeline
      */
     getUserTimeline(input: GetUserTimelineRequest, options?: RpcOptions): UnaryCall<GetUserTimelineRequest, ListEventsResponse>;
-    // ── Admin Events (Page 9.2) ──
+    // ── Admin Events ──
 
     /**
      * @generated from protobuf rpc: ListAdminEvents
@@ -57,7 +57,7 @@ export interface IEventServiceClient {
      * @generated from protobuf rpc: GetAdminEvent
      */
     getAdminEvent(input: GetAdminEventRequest, options?: RpcOptions): UnaryCall<GetAdminEventRequest, AdminEvent>;
-    // ── Event Config (Page 9.3) ──
+    // ── Event Config ──
 
     /**
      * @generated from protobuf rpc: GetEventConfig
@@ -73,7 +73,7 @@ export interface IEventServiceClient {
 // ────────────────────────────────────────────────────────────────────────────
 
 /**
- * ── User Events (Page 9.1) ──
+ * ── User Events ──
  *
  * @generated from protobuf service sid.v1.admin.EventService
  */
@@ -104,7 +104,7 @@ export class EventServiceClient implements IEventServiceClient, ServiceInfo {
         const method = this.methods[2], opt = this._transport.mergeOptions(options);
         return stackIntercept<GetUserTimelineRequest, ListEventsResponse>("unary", this._transport, method, opt, input);
     }
-    // ── Admin Events (Page 9.2) ──
+    // ── Admin Events ──
 
     /**
      * @generated from protobuf rpc: ListAdminEvents
@@ -120,7 +120,7 @@ export class EventServiceClient implements IEventServiceClient, ServiceInfo {
         const method = this.methods[4], opt = this._transport.mergeOptions(options);
         return stackIntercept<GetAdminEventRequest, AdminEvent>("unary", this._transport, method, opt, input);
     }
-    // ── Event Config (Page 9.3) ──
+    // ── Event Config ──
 
     /**
      * @generated from protobuf rpc: GetEventConfig
@@ -138,7 +138,7 @@ export class EventServiceClient implements IEventServiceClient, ServiceInfo {
     }
 }
 // ────────────────────────────────────────────────────────────────────────────
-// AuditService — tamper-evident audit trail (Page 23.2)
+// AuditService — tamper-evident audit trail
 // ────────────────────────────────────────────────────────────────────────────
 
 /**
@@ -159,7 +159,7 @@ export interface IAuditServiceClient {
     exportAuditTrail(input: ExportAuditTrailRequest, options?: RpcOptions): UnaryCall<ExportAuditTrailRequest, ExportAuditTrailResponse>;
 }
 // ────────────────────────────────────────────────────────────────────────────
-// AuditService — tamper-evident audit trail (Page 23.2)
+// AuditService — tamper-evident audit trail
 // ────────────────────────────────────────────────────────────────────────────
 
 /**

package/src/generated/sid/v1/admin/flow.ts

@@ -463,7 +463,7 @@ export enum ActionType {
      */
     UNSPECIFIED = 0,
     /**
-     * HTTP POST to external URL (CE).
+     * HTTP POST to external URL.
      *
      * @generated from protobuf enum value: ACTION_TYPE_WEBHOOK = 1;
      */